From 833e1c20c63ea3da7f1323429828e94eaa9b52c7 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Tue, 30 Jan 2024 10:58:58 +0100 Subject: [PATCH] XU4: remove deprecated patches --- ...N2-net-stmmac-enable-disable-WOL-irq.patch | 32 - .../odroidxu4-current/patch-6.1.67-68.patch | 9166 ---------- .../odroidxu4-current/patch-6.1.68-69.patch | 4110 ----- .../odroidxu4-current/patch-6.1.69-70.patch | 5394 ------ .../odroidxu4-current/patch-6.1.70-71.patch | 7517 -------- .../odroidxu4-current/patch-6.1.71-72.patch | 9332 ---------- .../odroidxu4-current/patch-6.1.72-73.patch | 294 - .../odroidxu4-current/patch-6.1.73-74.patch | 3175 ---- .../odroidxu4-current/patch-6.1.74-75.patch | 15017 ---------------- 9 files changed, 54037 deletions(-) delete mode 100644 patch/kernel/odroidxu4-current/0001-Revert-ODROID-N2-net-stmmac-enable-disable-WOL-irq.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.67-68.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.68-69.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.69-70.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.70-71.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.71-72.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.72-73.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.73-74.patch delete mode 100644 patch/kernel/odroidxu4-current/patch-6.1.74-75.patch diff --git a/patch/kernel/odroidxu4-current/0001-Revert-ODROID-N2-net-stmmac-enable-disable-WOL-irq.patch b/patch/kernel/odroidxu4-current/0001-Revert-ODROID-N2-net-stmmac-enable-disable-WOL-irq.patch deleted file mode 100644 index f23d3d0a71..0000000000 --- a/patch/kernel/odroidxu4-current/0001-Revert-ODROID-N2-net-stmmac-enable-disable-WOL-irq.patch +++ /dev/null @@ -1,32 +0,0 @@ -From ebceefcc56614d3a079c5b905bcba5a1797b60c4 Mon Sep 17 00:00:00 2001 -From: Julian Sikorski -Date: Sat, 27 Jan 2024 13:27:31 +0000 -Subject: [PATCH] Revert "ODROID-N2: net: stmmac: enable/disable WOL irq" - -This reverts commit fa6baada11bc2aaa35ce26b97380f37aab14c1dd. ---- - drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 6 ++---- - 1 file changed, 2 insertions(+), 4 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index 77fb5598b..a4b5636c9 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -761,12 +761,10 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - if (wol->wolopts) { - pr_info("stmmac: wakeup enable\n"); - device_set_wakeup_enable(priv->device, 1); -- if (priv->wol_irq != dev->irq) -- enable_irq_wake(priv->wol_irq); -+ enable_irq_wake(priv->wol_irq); - } else { - device_set_wakeup_enable(priv->device, 0); -- if (priv->wol_irq != dev->irq) -- disable_irq_wake(priv->wol_irq); -+ disable_irq_wake(priv->wol_irq); - } - - mutex_lock(&priv->lock); --- -2.34.1 - diff --git a/patch/kernel/odroidxu4-current/patch-6.1.67-68.patch b/patch/kernel/odroidxu4-current/patch-6.1.67-68.patch deleted file mode 100644 index 78edec2836..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.67-68.patch +++ /dev/null @@ -1,9166 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-bus-optee-devices b/Documentation/ABI/testing/sysfs-bus-optee-devices -index 0f58701367b66..af31e5a22d89f 100644 ---- a/Documentation/ABI/testing/sysfs-bus-optee-devices -+++ b/Documentation/ABI/testing/sysfs-bus-optee-devices -@@ -6,3 +6,12 @@ Description: - OP-TEE bus provides reference to registered drivers under this directory. The - matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers - are free to create needed API under optee-ta- directory. -+ -+What: /sys/bus/tee/devices/optee-ta-/need_supplicant -+Date: November 2023 -+KernelVersion: 6.7 -+Contact: op-tee@lists.trustedfirmware.org -+Description: -+ Allows to distinguish whether an OP-TEE based TA/device requires user-space -+ tee-supplicant to function properly or not. This attribute will be present for -+ devices which depend on tee-supplicant to be running. -diff --git a/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml b/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml -index 509d20c091af8..6a206111d4e0f 100644 ---- a/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml -+++ b/Documentation/devicetree/bindings/interrupt-controller/qcom,mpm.yaml -@@ -62,6 +62,9 @@ properties: - - description: MPM pin number - - description: GIC SPI number for the MPM pin - -+ '#power-domain-cells': -+ const: 0 -+ - required: - - compatible - - reg -@@ -93,4 +96,5 @@ examples: - <86 183>, - <90 260>, - <91 260>; -+ #power-domain-cells = <0>; - }; -diff --git a/Makefile b/Makefile -index c27600b90cad2..2a8ad0cec2f1c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 67 -+SUBLEVEL = 68 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/arm/boot/dts/imx28-xea.dts b/arch/arm/boot/dts/imx28-xea.dts -index a400c108f66a2..6c5e6856648af 100644 ---- a/arch/arm/boot/dts/imx28-xea.dts -+++ b/arch/arm/boot/dts/imx28-xea.dts -@@ -8,6 +8,7 @@ - #include "imx28-lwe.dtsi" - - / { -+ model = "Liebherr XEA board"; - compatible = "lwn,imx28-xea", "fsl,imx28"; - }; - -diff --git a/arch/arm/boot/dts/imx6ul-pico.dtsi b/arch/arm/boot/dts/imx6ul-pico.dtsi -index 357ffb2f5ad61..dd6790852b0d6 100644 ---- a/arch/arm/boot/dts/imx6ul-pico.dtsi -+++ b/arch/arm/boot/dts/imx6ul-pico.dtsi -@@ -121,6 +121,8 @@ - max-speed = <100>; - interrupt-parent = <&gpio5>; - interrupts = <6 IRQ_TYPE_LEVEL_LOW>; -+ clocks = <&clks IMX6UL_CLK_ENET_REF>; -+ clock-names = "rmii-ref"; - }; - }; - }; -diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi -index 667568aa4326a..45947707134b8 100644 ---- a/arch/arm/boot/dts/imx7s.dtsi -+++ b/arch/arm/boot/dts/imx7s.dtsi -@@ -454,7 +454,7 @@ - }; - - gpt1: timer@302d0000 { -- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; -+ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; - reg = <0x302d0000 0x10000>; - interrupts = ; - clocks = <&clks IMX7D_GPT1_ROOT_CLK>, -@@ -463,7 +463,7 @@ - }; - - gpt2: timer@302e0000 { -- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; -+ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; - reg = <0x302e0000 0x10000>; - interrupts = ; - clocks = <&clks IMX7D_GPT2_ROOT_CLK>, -@@ -473,7 +473,7 @@ - }; - - gpt3: timer@302f0000 { -- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; -+ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; - reg = <0x302f0000 0x10000>; - interrupts = ; - clocks = <&clks IMX7D_GPT3_ROOT_CLK>, -@@ -483,7 +483,7 @@ - }; - - gpt4: timer@30300000 { -- compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; -+ compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt"; - reg = <0x30300000 0x10000>; - interrupts = ; - clocks = <&clks IMX7D_GPT4_ROOT_CLK>, -diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c -index b9efe9da06e0b..3d76e8c28c51d 100644 ---- a/arch/arm/mach-imx/mmdc.c -+++ b/arch/arm/mach-imx/mmdc.c -@@ -502,6 +502,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b - - name = devm_kasprintf(&pdev->dev, - GFP_KERNEL, "mmdc%d", ret); -+ if (!name) { -+ ret = -ENOMEM; -+ goto pmu_release_id; -+ } - - pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; - pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; -@@ -524,9 +528,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b - - pmu_register_err: - pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); -- ida_simple_remove(&mmdc_ida, pmu_mmdc->id); - cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); - hrtimer_cancel(&pmu_mmdc->hrtimer); -+pmu_release_id: -+ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); - pmu_free: - kfree(pmu_mmdc); - return ret; -diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi -index 25630a395db56..8c34b3e12a66a 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi -@@ -1301,6 +1301,7 @@ - phys = <&usb3_phy0>, <&usb3_phy0>; - phy-names = "usb2-phy", "usb3-phy"; - snps,gfladj-refclk-lpm-sel-quirk; -+ snps,parkmode-disable-ss-quirk; - }; - - }; -@@ -1343,6 +1344,7 @@ - phys = <&usb3_phy1>, <&usb3_phy1>; - phy-names = "usb2-phy", "usb3-phy"; - snps,gfladj-refclk-lpm-sel-quirk; -+ snps,parkmode-disable-ss-quirk; - }; - }; - -diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi -index bf8f02c1535c1..e642cb7d54d77 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi -@@ -1431,7 +1431,7 @@ - phys = <&usb3_phy0>, <&usb3_phy0>; - phy-names = "usb2-phy", "usb3-phy"; - power-domains = <&pgc_otg1>; -- usb3-resume-missing-cas; -+ snps,parkmode-disable-ss-quirk; - status = "disabled"; - }; - -@@ -1463,7 +1463,7 @@ - phys = <&usb3_phy1>, <&usb3_phy1>; - phy-names = "usb2-phy", "usb3-phy"; - power-domains = <&pgc_otg2>; -- usb3-resume-missing-cas; -+ snps,parkmode-disable-ss-quirk; - status = "disabled"; - }; - -diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts -index d3f9eab2b7844..2c35ed0734a47 100644 ---- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts -+++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts -@@ -72,7 +72,7 @@ - }; - }; - -- memory { -+ memory@40000000 { - reg = <0 0x40000000 0 0x40000000>; - }; - -diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts -index 36722cabe626e..f9313b697ac12 100644 ---- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts -+++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts -@@ -54,7 +54,7 @@ - }; - }; - -- memory { -+ memory@40000000 { - reg = <0 0x40000000 0 0x20000000>; - }; - -diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts -index 0b5f154007be8..49c7185243cc1 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts -@@ -43,7 +43,7 @@ - id-gpio = <&pio 16 GPIO_ACTIVE_HIGH>; - }; - -- usb_p1_vbus: regulator@0 { -+ usb_p1_vbus: regulator-usb-p1 { - compatible = "regulator-fixed"; - regulator-name = "usb_vbus"; - regulator-min-microvolt = <5000000>; -@@ -52,7 +52,7 @@ - enable-active-high; - }; - -- usb_p0_vbus: regulator@1 { -+ usb_p0_vbus: regulator-usb-p0 { - compatible = "regulator-fixed"; - regulator-name = "vbus"; - regulator-min-microvolt = <5000000>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-evb.dts b/arch/arm64/boot/dts/mediatek/mt8183-evb.dts -index 52dc4a50e34d3..2ca0da51efaa0 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-evb.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8183-evb.dts -@@ -30,14 +30,14 @@ - #address-cells = <2>; - #size-cells = <2>; - ranges; -- scp_mem_reserved: scp_mem_region { -+ scp_mem_reserved: memory@50000000 { - compatible = "shared-dma-pool"; - reg = <0 0x50000000 0 0x2900000>; - no-map; - }; - }; - -- ntc@0 { -+ thermal-sensor { - compatible = "murata,ncp03wf104"; - pullup-uv = <1800000>; - pullup-ohm = <390000>; -@@ -139,8 +139,8 @@ - }; - - &pio { -- i2c_pins_0: i2c0{ -- pins_i2c{ -+ i2c_pins_0: i2c0 { -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -148,8 +148,8 @@ - }; - }; - -- i2c_pins_1: i2c1{ -- pins_i2c{ -+ i2c_pins_1: i2c1 { -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -157,8 +157,8 @@ - }; - }; - -- i2c_pins_2: i2c2{ -- pins_i2c{ -+ i2c_pins_2: i2c2 { -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -166,8 +166,8 @@ - }; - }; - -- i2c_pins_3: i2c3{ -- pins_i2c{ -+ i2c_pins_3: i2c3 { -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -175,8 +175,8 @@ - }; - }; - -- i2c_pins_4: i2c4{ -- pins_i2c{ -+ i2c_pins_4: i2c4 { -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -184,8 +184,8 @@ - }; - }; - -- i2c_pins_5: i2c5{ -- pins_i2c{ -+ i2c_pins_5: i2c5 { -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -193,8 +193,8 @@ - }; - }; - -- spi_pins_0: spi0{ -- pins_spi{ -+ spi_pins_0: spi0 { -+ pins_spi { - pinmux = , - , - , -@@ -308,8 +308,8 @@ - }; - }; - -- spi_pins_1: spi1{ -- pins_spi{ -+ spi_pins_1: spi1 { -+ pins_spi { - pinmux = , - , - , -@@ -318,8 +318,8 @@ - }; - }; - -- spi_pins_2: spi2{ -- pins_spi{ -+ spi_pins_2: spi2 { -+ pins_spi { - pinmux = , - , - , -@@ -328,8 +328,8 @@ - }; - }; - -- spi_pins_3: spi3{ -- pins_spi{ -+ spi_pins_3: spi3 { -+ pins_spi { - pinmux = , - , - , -@@ -338,8 +338,8 @@ - }; - }; - -- spi_pins_4: spi4{ -- pins_spi{ -+ spi_pins_4: spi4 { -+ pins_spi { - pinmux = , - , - , -@@ -348,8 +348,8 @@ - }; - }; - -- spi_pins_5: spi5{ -- pins_spi{ -+ spi_pins_5: spi5 { -+ pins_spi { - pinmux = , - , - , -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi -index 3ac83be536274..dccf367c7ec6c 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi -@@ -101,6 +101,8 @@ - - &dsi0 { - status = "okay"; -+ /delete-property/#size-cells; -+ /delete-property/#address-cells; - /delete-node/panel@0; - ports { - port { -@@ -437,20 +439,20 @@ - }; - - touchscreen_pins: touchscreen-pins { -- touch_int_odl { -+ touch-int-odl { - pinmux = ; - input-enable; - bias-pull-up; - }; - -- touch_rst_l { -+ touch-rst-l { - pinmux = ; - output-high; - }; - }; - - trackpad_pins: trackpad-pins { -- trackpad_int { -+ trackpad-int { - pinmux = ; - input-enable; - bias-disable; /* pulled externally */ -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi -index 632fd89e75969..a428a581c93a8 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi -@@ -108,7 +108,7 @@ - #size-cells = <2>; - ranges; - -- scp_mem_reserved: scp_mem_region { -+ scp_mem_reserved: memory@50000000 { - compatible = "shared-dma-pool"; - reg = <0 0x50000000 0 0x2900000>; - no-map; -@@ -423,7 +423,7 @@ - - &pio { - aud_pins_default: audiopins { -- pins_bus { -+ pins-bus { - pinmux = , - , - , -@@ -445,7 +445,7 @@ - }; - - aud_pins_tdm_out_on: audiotdmouton { -- pins_bus { -+ pins-bus { - pinmux = , - , - , -@@ -457,7 +457,7 @@ - }; - - aud_pins_tdm_out_off: audiotdmoutoff { -- pins_bus { -+ pins-bus { - pinmux = , - , - , -@@ -471,13 +471,13 @@ - }; - - bt_pins: bt-pins { -- pins_bt_en { -+ pins-bt-en { - pinmux = ; - output-low; - }; - }; - -- ec_ap_int_odl: ec_ap_int_odl { -+ ec_ap_int_odl: ec-ap-int-odl { - pins1 { - pinmux = ; - input-enable; -@@ -485,7 +485,7 @@ - }; - }; - -- h1_int_od_l: h1_int_od_l { -+ h1_int_od_l: h1-int-od-l { - pins1 { - pinmux = ; - input-enable; -@@ -493,7 +493,7 @@ - }; - - i2c0_pins: i2c0 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -502,7 +502,7 @@ - }; - - i2c1_pins: i2c1 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -511,7 +511,7 @@ - }; - - i2c2_pins: i2c2 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - bias-disable; -@@ -520,7 +520,7 @@ - }; - - i2c3_pins: i2c3 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -529,7 +529,7 @@ - }; - - i2c4_pins: i2c4 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - bias-disable; -@@ -538,7 +538,7 @@ - }; - - i2c5_pins: i2c5 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -547,7 +547,7 @@ - }; - - i2c6_pins: i2c6 { -- pins_bus { -+ pins-bus { - pinmux = , - ; - bias-disable; -@@ -555,7 +555,7 @@ - }; - - mmc0_pins_default: mmc0-pins-default { -- pins_cmd_dat { -+ pins-cmd-dat { - pinmux = , - , - , -@@ -570,13 +570,13 @@ - mediatek,pull-up-adv = <01>; - }; - -- pins_clk { -+ pins-clk { - pinmux = ; - drive-strength = ; - mediatek,pull-down-adv = <10>; - }; - -- pins_rst { -+ pins-rst { - pinmux = ; - drive-strength = ; - mediatek,pull-down-adv = <01>; -@@ -584,7 +584,7 @@ - }; - - mmc0_pins_uhs: mmc0-pins-uhs { -- pins_cmd_dat { -+ pins-cmd-dat { - pinmux = , - , - , -@@ -599,19 +599,19 @@ - mediatek,pull-up-adv = <01>; - }; - -- pins_clk { -+ pins-clk { - pinmux = ; - drive-strength = ; - mediatek,pull-down-adv = <10>; - }; - -- pins_ds { -+ pins-ds { - pinmux = ; - drive-strength = ; - mediatek,pull-down-adv = <10>; - }; - -- pins_rst { -+ pins-rst { - pinmux = ; - drive-strength = ; - mediatek,pull-up-adv = <01>; -@@ -619,7 +619,7 @@ - }; - - mmc1_pins_default: mmc1-pins-default { -- pins_cmd_dat { -+ pins-cmd-dat { - pinmux = , - , - , -@@ -629,7 +629,7 @@ - mediatek,pull-up-adv = <10>; - }; - -- pins_clk { -+ pins-clk { - pinmux = ; - input-enable; - mediatek,pull-down-adv = <10>; -@@ -637,7 +637,7 @@ - }; - - mmc1_pins_uhs: mmc1-pins-uhs { -- pins_cmd_dat { -+ pins-cmd-dat { - pinmux = , - , - , -@@ -648,7 +648,7 @@ - mediatek,pull-up-adv = <10>; - }; - -- pins_clk { -+ pins-clk { - pinmux = ; - drive-strength = ; - mediatek,pull-down-adv = <10>; -@@ -656,15 +656,15 @@ - }; - }; - -- panel_pins_default: panel_pins_default { -- panel_reset { -+ panel_pins_default: panel-pins-default { -+ panel-reset { - pinmux = ; - output-low; - bias-pull-up; - }; - }; - -- pwm0_pin_default: pwm0_pin_default { -+ pwm0_pin_default: pwm0-pin-default { - pins1 { - pinmux = ; - output-high; -@@ -676,14 +676,14 @@ - }; - - scp_pins: scp { -- pins_scp_uart { -+ pins-scp-uart { - pinmux = , - ; - }; - }; - - spi0_pins: spi0 { -- pins_spi{ -+ pins-spi { - pinmux = , - , - , -@@ -693,7 +693,7 @@ - }; - - spi1_pins: spi1 { -- pins_spi{ -+ pins-spi { - pinmux = , - , - , -@@ -703,20 +703,20 @@ - }; - - spi2_pins: spi2 { -- pins_spi{ -+ pins-spi { - pinmux = , - , - ; - bias-disable; - }; -- pins_spi_mi { -+ pins-spi-mi { - pinmux = ; - mediatek,pull-down-adv = <00>; - }; - }; - - spi3_pins: spi3 { -- pins_spi{ -+ pins-spi { - pinmux = , - , - , -@@ -726,7 +726,7 @@ - }; - - spi4_pins: spi4 { -- pins_spi{ -+ pins-spi { - pinmux = , - , - , -@@ -736,7 +736,7 @@ - }; - - spi5_pins: spi5 { -- pins_spi{ -+ pins-spi { - pinmux = , - , - , -@@ -746,63 +746,63 @@ - }; - - uart0_pins_default: uart0-pins-default { -- pins_rx { -+ pins-rx { - pinmux = ; - input-enable; - bias-pull-up; - }; -- pins_tx { -+ pins-tx { - pinmux = ; - }; - }; - - uart1_pins_default: uart1-pins-default { -- pins_rx { -+ pins-rx { - pinmux = ; - input-enable; - bias-pull-up; - }; -- pins_tx { -+ pins-tx { - pinmux = ; - }; -- pins_rts { -+ pins-rts { - pinmux = ; - output-enable; - }; -- pins_cts { -+ pins-cts { - pinmux = ; - input-enable; - }; - }; - - uart1_pins_sleep: uart1-pins-sleep { -- pins_rx { -+ pins-rx { - pinmux = ; - input-enable; - bias-pull-up; - }; -- pins_tx { -+ pins-tx { - pinmux = ; - }; -- pins_rts { -+ pins-rts { - pinmux = ; - output-enable; - }; -- pins_cts { -+ pins-cts { - pinmux = ; - input-enable; - }; - }; - - wifi_pins_pwrseq: wifi-pins-pwrseq { -- pins_wifi_enable { -+ pins-wifi-enable { - pinmux = ; - output-low; - }; - }; - - wifi_pins_wakeup: wifi-pins-wakeup { -- pins_wifi_wakeup { -+ pins-wifi-wakeup { - pinmux = ; - input-enable; - }; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts -index a1d01639df30a..dd8d39861d9ca 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts -+++ b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts -@@ -178,7 +178,7 @@ - - &pio { - i2c_pins_0: i2c0 { -- pins_i2c{ -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -187,7 +187,7 @@ - }; - - i2c_pins_1: i2c1 { -- pins_i2c{ -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -196,7 +196,7 @@ - }; - - i2c_pins_2: i2c2 { -- pins_i2c{ -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -205,7 +205,7 @@ - }; - - i2c_pins_3: i2c3 { -- pins_i2c{ -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -214,7 +214,7 @@ - }; - - i2c_pins_4: i2c4 { -- pins_i2c{ -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -@@ -223,7 +223,7 @@ - }; - - i2c_pins_5: i2c5 { -- pins_i2c{ -+ pins_i2c { - pinmux = , - ; - mediatek,pull-up-adv = <3>; -diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -index 268a1f28af8ce..10779a9947fe2 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -@@ -1136,127 +1136,6 @@ - nvmem-cell-names = "calibration-data"; - }; - -- thermal_zones: thermal-zones { -- cpu_thermal: cpu-thermal { -- polling-delay-passive = <100>; -- polling-delay = <500>; -- thermal-sensors = <&thermal 0>; -- sustainable-power = <5000>; -- -- trips { -- threshold: trip-point0 { -- temperature = <68000>; -- hysteresis = <2000>; -- type = "passive"; -- }; -- -- target: trip-point1 { -- temperature = <80000>; -- hysteresis = <2000>; -- type = "passive"; -- }; -- -- cpu_crit: cpu-crit { -- temperature = <115000>; -- hysteresis = <2000>; -- type = "critical"; -- }; -- }; -- -- cooling-maps { -- map0 { -- trip = <&target>; -- cooling-device = <&cpu0 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu1 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu2 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu3 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>; -- contribution = <3072>; -- }; -- map1 { -- trip = <&target>; -- cooling-device = <&cpu4 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu5 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu6 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu7 -- THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>; -- contribution = <1024>; -- }; -- }; -- }; -- -- /* The tzts1 ~ tzts6 don't need to polling */ -- /* The tzts1 ~ tzts6 don't need to thermal throttle */ -- -- tzts1: tzts1 { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- thermal-sensors = <&thermal 1>; -- sustainable-power = <5000>; -- trips {}; -- cooling-maps {}; -- }; -- -- tzts2: tzts2 { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- thermal-sensors = <&thermal 2>; -- sustainable-power = <5000>; -- trips {}; -- cooling-maps {}; -- }; -- -- tzts3: tzts3 { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- thermal-sensors = <&thermal 3>; -- sustainable-power = <5000>; -- trips {}; -- cooling-maps {}; -- }; -- -- tzts4: tzts4 { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- thermal-sensors = <&thermal 4>; -- sustainable-power = <5000>; -- trips {}; -- cooling-maps {}; -- }; -- -- tzts5: tzts5 { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- thermal-sensors = <&thermal 5>; -- sustainable-power = <5000>; -- trips {}; -- cooling-maps {}; -- }; -- -- tztsABB: tztsABB { -- polling-delay-passive = <0>; -- polling-delay = <0>; -- thermal-sensors = <&thermal 6>; -- sustainable-power = <5000>; -- trips {}; -- cooling-maps {}; -- }; -- }; -- - pwm0: pwm@1100e000 { - compatible = "mediatek,mt8183-disp-pwm"; - reg = <0 0x1100e000 0 0x1000>; -@@ -2031,4 +1910,125 @@ - power-domains = <&spm MT8183_POWER_DOMAIN_CAM>; - }; - }; -+ -+ thermal_zones: thermal-zones { -+ cpu_thermal: cpu-thermal { -+ polling-delay-passive = <100>; -+ polling-delay = <500>; -+ thermal-sensors = <&thermal 0>; -+ sustainable-power = <5000>; -+ -+ trips { -+ threshold: trip-point0 { -+ temperature = <68000>; -+ hysteresis = <2000>; -+ type = "passive"; -+ }; -+ -+ target: trip-point1 { -+ temperature = <80000>; -+ hysteresis = <2000>; -+ type = "passive"; -+ }; -+ -+ cpu_crit: cpu-crit { -+ temperature = <115000>; -+ hysteresis = <2000>; -+ type = "critical"; -+ }; -+ }; -+ -+ cooling-maps { -+ map0 { -+ trip = <&target>; -+ cooling-device = <&cpu0 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu1 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu2 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu3 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>; -+ contribution = <3072>; -+ }; -+ map1 { -+ trip = <&target>; -+ cooling-device = <&cpu4 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu5 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu6 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu7 -+ THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>; -+ contribution = <1024>; -+ }; -+ }; -+ }; -+ -+ /* The tzts1 ~ tzts6 don't need to polling */ -+ /* The tzts1 ~ tzts6 don't need to thermal throttle */ -+ -+ tzts1: tzts1 { -+ polling-delay-passive = <0>; -+ polling-delay = <0>; -+ thermal-sensors = <&thermal 1>; -+ sustainable-power = <5000>; -+ trips {}; -+ cooling-maps {}; -+ }; -+ -+ tzts2: tzts2 { -+ polling-delay-passive = <0>; -+ polling-delay = <0>; -+ thermal-sensors = <&thermal 2>; -+ sustainable-power = <5000>; -+ trips {}; -+ cooling-maps {}; -+ }; -+ -+ tzts3: tzts3 { -+ polling-delay-passive = <0>; -+ polling-delay = <0>; -+ thermal-sensors = <&thermal 3>; -+ sustainable-power = <5000>; -+ trips {}; -+ cooling-maps {}; -+ }; -+ -+ tzts4: tzts4 { -+ polling-delay-passive = <0>; -+ polling-delay = <0>; -+ thermal-sensors = <&thermal 4>; -+ sustainable-power = <5000>; -+ trips {}; -+ cooling-maps {}; -+ }; -+ -+ tzts5: tzts5 { -+ polling-delay-passive = <0>; -+ polling-delay = <0>; -+ thermal-sensors = <&thermal 5>; -+ sustainable-power = <5000>; -+ trips {}; -+ cooling-maps {}; -+ }; -+ -+ tztsABB: tztsABB { -+ polling-delay-passive = <0>; -+ polling-delay = <0>; -+ thermal-sensors = <&thermal 6>; -+ sustainable-power = <5000>; -+ trips {}; -+ cooling-maps {}; -+ }; -+ }; - }; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi -index 9b62e161db261..4b8a1c462906e 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi -@@ -207,7 +207,7 @@ - pinctrl-0 = <&i2c7_pins>; - - pmic@34 { -- #interrupt-cells = <1>; -+ #interrupt-cells = <2>; - compatible = "mediatek,mt6360"; - reg = <0x34>; - interrupt-controller; -diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -index ef2764a595eda..414cbe3451270 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi -@@ -471,6 +471,8 @@ - - power-domain@MT8195_POWER_DOMAIN_VENC_CORE1 { - reg = ; -+ clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>; -+ clock-names = "venc1-larb"; - mediatek,infracfg = <&infracfg_ao>; - #power-domain-cells = <0>; - }; -@@ -533,6 +535,8 @@ - - power-domain@MT8195_POWER_DOMAIN_VENC { - reg = ; -+ clocks = <&vencsys CLK_VENC_LARB>; -+ clock-names = "venc0-larb"; - mediatek,infracfg = <&infracfg_ao>; - #power-domain-cells = <0>; - }; -@@ -1985,7 +1989,7 @@ - reg = <0 0x1b010000 0 0x1000>; - mediatek,larb-id = <20>; - mediatek,smi = <&smi_common_vpp>; -- clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>, -+ clocks = <&vencsys_core1 CLK_VENC_CORE1_VENC>, - <&vencsys_core1 CLK_VENC_CORE1_GALS>, - <&vppsys0 CLK_VPP0_GALS_VDO0_VDO1_VENCSYS_CORE1>; - clock-names = "apb", "smi", "gals"; -diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi -index 49ae15708a0b6..905a50aa5dc38 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi -@@ -666,7 +666,7 @@ - - vdec: video-codec@ff360000 { - compatible = "rockchip,rk3328-vdec", "rockchip,rk3399-vdec"; -- reg = <0x0 0xff360000 0x0 0x400>; -+ reg = <0x0 0xff360000 0x0 0x480>; - interrupts = ; - clocks = <&cru ACLK_RKVDEC>, <&cru HCLK_RKVDEC>, - <&cru SCLK_VDEC_CABAC>, <&cru SCLK_VDEC_CORE>; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi -index 5f3caf01badeb..a7e6eccb14cc6 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi -@@ -1062,7 +1062,9 @@ - power-domain@RK3399_PD_VDU { - reg = ; - clocks = <&cru ACLK_VDU>, -- <&cru HCLK_VDU>; -+ <&cru HCLK_VDU>, -+ <&cru SCLK_VDU_CA>, -+ <&cru SCLK_VDU_CORE>; - pm_qos = <&qos_video_m1_r>, - <&qos_video_m1_w>; - #power-domain-cells = <0>; -@@ -1338,7 +1340,7 @@ - - vdec: video-codec@ff660000 { - compatible = "rockchip,rk3399-vdec"; -- reg = <0x0 0xff660000 0x0 0x400>; -+ reg = <0x0 0xff660000 0x0 0x480>; - interrupts = ; - clocks = <&cru ACLK_VDU>, <&cru HCLK_VDU>, - <&cru SCLK_VDU_CA>, <&cru SCLK_VDU_CORE>; -diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c -index 82b4402810da0..40ed49d9adff5 100644 ---- a/arch/loongarch/net/bpf_jit.c -+++ b/arch/loongarch/net/bpf_jit.c -@@ -796,8 +796,6 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - - /* function return */ - case BPF_JMP | BPF_EXIT: -- emit_sext_32(ctx, regmap[BPF_REG_0], true); -- - if (i == ctx->prog->len - 1) - break; - -@@ -844,14 +842,8 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - } - break; - case BPF_DW: -- if (is_signed_imm12(off)) { -- emit_insn(ctx, ldd, dst, src, off); -- } else if (is_signed_imm14(off)) { -- emit_insn(ctx, ldptrd, dst, src, off); -- } else { -- move_imm(ctx, t1, off, is32); -- emit_insn(ctx, ldxd, dst, src, t1); -- } -+ move_imm(ctx, t1, off, is32); -+ emit_insn(ctx, ldxd, dst, src, t1); - break; - } - break; -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 0e62f5edaee2e..585783c9907ef 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -483,6 +483,7 @@ config MACH_LOONGSON2EF - - config MACH_LOONGSON64 - bool "Loongson 64-bit family of machines" -+ select ARCH_DMA_DEFAULT_COHERENT - select ARCH_SPARSEMEM_ENABLE - select ARCH_MIGHT_HAVE_PC_PARPORT - select ARCH_MIGHT_HAVE_PC_SERIO -@@ -1304,6 +1305,7 @@ config CPU_LOONGSON64 - select CPU_SUPPORTS_MSA - select CPU_DIEI_BROKEN if !LOONGSON3_ENHANCEMENT - select CPU_MIPSR2_IRQ_VI -+ select DMA_NONCOHERENT - select WEAK_ORDERING - select WEAK_REORDERING_BEYOND_LLSC - select MIPS_ASID_BITS_VARIABLE -diff --git a/arch/mips/include/asm/mach-loongson64/boot_param.h b/arch/mips/include/asm/mach-loongson64/boot_param.h -index 035b1a69e2d00..e007edd6b60a7 100644 ---- a/arch/mips/include/asm/mach-loongson64/boot_param.h -+++ b/arch/mips/include/asm/mach-loongson64/boot_param.h -@@ -14,7 +14,11 @@ - #define ADAPTER_ROM 8 - #define ACPI_TABLE 9 - #define SMBIOS_TABLE 10 --#define MAX_MEMORY_TYPE 11 -+#define UMA_VIDEO_RAM 11 -+#define VUMA_VIDEO_RAM 12 -+#define MAX_MEMORY_TYPE 13 -+ -+#define MEM_SIZE_IS_IN_BYTES (1 << 31) - - #define LOONGSON3_BOOT_MEM_MAP_MAX 128 - struct efi_memory_map_loongson { -@@ -117,7 +121,8 @@ struct irq_source_routing_table { - u64 pci_io_start_addr; - u64 pci_io_end_addr; - u64 pci_config_addr; -- u32 dma_mask_bits; -+ u16 dma_mask_bits; -+ u16 dma_noncoherent; - } __packed; - - struct interface_info { -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index bbe9ce471791e..17d80e2f2e4cb 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -121,6 +121,19 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) - /* Put the stack after the struct pt_regs. */ - childksp = (unsigned long) childregs; - p->thread.cp0_status = (read_c0_status() & ~(ST0_CU2|ST0_CU1)) | ST0_KERNEL_CUMASK; -+ -+ /* -+ * New tasks lose permission to use the fpu. This accelerates context -+ * switching for most programs since they don't use the fpu. -+ */ -+ clear_tsk_thread_flag(p, TIF_USEDFPU); -+ clear_tsk_thread_flag(p, TIF_USEDMSA); -+ clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE); -+ -+#ifdef CONFIG_MIPS_MT_FPAFF -+ clear_tsk_thread_flag(p, TIF_FPUBOUND); -+#endif /* CONFIG_MIPS_MT_FPAFF */ -+ - if (unlikely(args->fn)) { - /* kernel thread */ - unsigned long status = p->thread.cp0_status; -@@ -149,20 +162,8 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) - p->thread.reg29 = (unsigned long) childregs; - p->thread.reg31 = (unsigned long) ret_from_fork; - -- /* -- * New tasks lose permission to use the fpu. This accelerates context -- * switching for most programs since they don't use the fpu. -- */ - childregs->cp0_status &= ~(ST0_CU2|ST0_CU1); - -- clear_tsk_thread_flag(p, TIF_USEDFPU); -- clear_tsk_thread_flag(p, TIF_USEDMSA); -- clear_tsk_thread_flag(p, TIF_MSA_CTX_LIVE); -- --#ifdef CONFIG_MIPS_MT_FPAFF -- clear_tsk_thread_flag(p, TIF_FPUBOUND); --#endif /* CONFIG_MIPS_MT_FPAFF */ -- - #ifdef CONFIG_MIPS_FP_SUPPORT - atomic_set(&p->thread.bd_emu_frame, BD_EMUFRAME_NONE); - #endif -diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c -index c961e2999f15a..ef3750a6ffacf 100644 ---- a/arch/mips/loongson64/env.c -+++ b/arch/mips/loongson64/env.c -@@ -13,6 +13,8 @@ - * Copyright (C) 2009 Lemote Inc. - * Author: Wu Zhangjin, wuzhangjin@gmail.com - */ -+ -+#include - #include - #include - #include -@@ -147,8 +149,14 @@ void __init prom_lefi_init_env(void) - - loongson_sysconf.dma_mask_bits = eirq_source->dma_mask_bits; - if (loongson_sysconf.dma_mask_bits < 32 || -- loongson_sysconf.dma_mask_bits > 64) -+ loongson_sysconf.dma_mask_bits > 64) { - loongson_sysconf.dma_mask_bits = 32; -+ dma_default_coherent = true; -+ } else { -+ dma_default_coherent = !eirq_source->dma_noncoherent; -+ } -+ -+ pr_info("Firmware: Coherent DMA: %s\n", dma_default_coherent ? "on" : "off"); - - loongson_sysconf.restart_addr = boot_p->reset_system.ResetWarm; - loongson_sysconf.poweroff_addr = boot_p->reset_system.Shutdown; -diff --git a/arch/mips/loongson64/init.c b/arch/mips/loongson64/init.c -index ee8de1735b7c0..f25caa6aa9d30 100644 ---- a/arch/mips/loongson64/init.c -+++ b/arch/mips/loongson64/init.c -@@ -49,8 +49,7 @@ void virtual_early_config(void) - void __init szmem(unsigned int node) - { - u32 i, mem_type; -- static unsigned long num_physpages; -- u64 node_id, node_psize, start_pfn, end_pfn, mem_start, mem_size; -+ phys_addr_t node_id, mem_start, mem_size; - - /* Otherwise come from DTB */ - if (loongson_sysconf.fw_interface != LOONGSON_LEFI) -@@ -64,30 +63,46 @@ void __init szmem(unsigned int node) - - mem_type = loongson_memmap->map[i].mem_type; - mem_size = loongson_memmap->map[i].mem_size; -- mem_start = loongson_memmap->map[i].mem_start; -+ -+ /* Memory size comes in MB if MEM_SIZE_IS_IN_BYTES not set */ -+ if (mem_size & MEM_SIZE_IS_IN_BYTES) -+ mem_size &= ~MEM_SIZE_IS_IN_BYTES; -+ else -+ mem_size = mem_size << 20; -+ -+ mem_start = (node_id << 44) | loongson_memmap->map[i].mem_start; - - switch (mem_type) { - case SYSTEM_RAM_LOW: - case SYSTEM_RAM_HIGH: -- start_pfn = ((node_id << 44) + mem_start) >> PAGE_SHIFT; -- node_psize = (mem_size << 20) >> PAGE_SHIFT; -- end_pfn = start_pfn + node_psize; -- num_physpages += node_psize; -- pr_info("Node%d: mem_type:%d, mem_start:0x%llx, mem_size:0x%llx MB\n", -- (u32)node_id, mem_type, mem_start, mem_size); -- pr_info(" start_pfn:0x%llx, end_pfn:0x%llx, num_physpages:0x%lx\n", -- start_pfn, end_pfn, num_physpages); -- memblock_add_node(PFN_PHYS(start_pfn), -- PFN_PHYS(node_psize), node, -+ case UMA_VIDEO_RAM: -+ pr_info("Node %d, mem_type:%d\t[%pa], %pa bytes usable\n", -+ (u32)node_id, mem_type, &mem_start, &mem_size); -+ memblock_add_node(mem_start, mem_size, node, - MEMBLOCK_NONE); - break; - case SYSTEM_RAM_RESERVED: -- pr_info("Node%d: mem_type:%d, mem_start:0x%llx, mem_size:0x%llx MB\n", -- (u32)node_id, mem_type, mem_start, mem_size); -- memblock_reserve(((node_id << 44) + mem_start), mem_size << 20); -+ case VIDEO_ROM: -+ case ADAPTER_ROM: -+ case ACPI_TABLE: -+ case SMBIOS_TABLE: -+ pr_info("Node %d, mem_type:%d\t[%pa], %pa bytes reserved\n", -+ (u32)node_id, mem_type, &mem_start, &mem_size); -+ memblock_reserve(mem_start, mem_size); -+ break; -+ /* We should not reserve VUMA_VIDEO_RAM as it overlaps with MMIO */ -+ case VUMA_VIDEO_RAM: -+ default: -+ pr_info("Node %d, mem_type:%d\t[%pa], %pa bytes unhandled\n", -+ (u32)node_id, mem_type, &mem_start, &mem_size); - break; - } - } -+ -+ /* Reserve vgabios if it comes from firmware */ -+ if (loongson_sysconf.vgabios_addr) -+ memblock_reserve(virt_to_phys((void *)loongson_sysconf.vgabios_addr), -+ SZ_256K); - } - - #ifndef CONFIG_NUMA -diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig -index 67c26e81e2150..345d5e021484c 100644 ---- a/arch/parisc/Kconfig -+++ b/arch/parisc/Kconfig -@@ -105,9 +105,12 @@ config ARCH_HAS_ILOG2_U64 - default n - - config GENERIC_BUG -- bool -- default y -+ def_bool y - depends on BUG -+ select GENERIC_BUG_RELATIVE_POINTERS if 64BIT -+ -+config GENERIC_BUG_RELATIVE_POINTERS -+ bool - - config GENERIC_HWEIGHT - bool -diff --git a/arch/parisc/include/asm/bug.h b/arch/parisc/include/asm/bug.h -index b9cad0bb4461b..833555f74ffa7 100644 ---- a/arch/parisc/include/asm/bug.h -+++ b/arch/parisc/include/asm/bug.h -@@ -17,26 +17,27 @@ - #define PARISC_BUG_BREAK_ASM "break 0x1f, 0x1fff" - #define PARISC_BUG_BREAK_INSN 0x03ffe01f /* PARISC_BUG_BREAK_ASM */ - --#if defined(CONFIG_64BIT) --#define ASM_WORD_INSN ".dword\t" -+#ifdef CONFIG_GENERIC_BUG_RELATIVE_POINTERS -+# define __BUG_REL(val) ".word " __stringify(val) " - ." - #else --#define ASM_WORD_INSN ".word\t" -+# define __BUG_REL(val) ".word " __stringify(val) - #endif - -+ - #ifdef CONFIG_DEBUG_BUGVERBOSE - #define BUG() \ - do { \ - asm volatile("\n" \ - "1:\t" PARISC_BUG_BREAK_ASM "\n" \ - "\t.pushsection __bug_table,\"a\"\n" \ -- "\t.align %4\n" \ -- "2:\t" ASM_WORD_INSN "1b, %c0\n" \ -+ "\t.align 4\n" \ -+ "2:\t" __BUG_REL(1b) "\n" \ -+ "\t" __BUG_REL(%c0) "\n" \ - "\t.short %1, %2\n" \ -- "\t.blockz %3-2*%4-2*2\n" \ -+ "\t.blockz %3-2*4-2*2\n" \ - "\t.popsection" \ - : : "i" (__FILE__), "i" (__LINE__), \ -- "i" (0), "i" (sizeof(struct bug_entry)), \ -- "i" (sizeof(long)) ); \ -+ "i" (0), "i" (sizeof(struct bug_entry)) ); \ - unreachable(); \ - } while(0) - -@@ -54,15 +55,15 @@ - asm volatile("\n" \ - "1:\t" PARISC_BUG_BREAK_ASM "\n" \ - "\t.pushsection __bug_table,\"a\"\n" \ -- "\t.align %4\n" \ -- "2:\t" ASM_WORD_INSN "1b, %c0\n" \ -+ "\t.align 4\n" \ -+ "2:\t" __BUG_REL(1b) "\n" \ -+ "\t" __BUG_REL(%c0) "\n" \ - "\t.short %1, %2\n" \ -- "\t.blockz %3-2*%4-2*2\n" \ -+ "\t.blockz %3-2*4-2*2\n" \ - "\t.popsection" \ - : : "i" (__FILE__), "i" (__LINE__), \ - "i" (BUGFLAG_WARNING|(flags)), \ -- "i" (sizeof(struct bug_entry)), \ -- "i" (sizeof(long)) ); \ -+ "i" (sizeof(struct bug_entry)) ); \ - } while(0) - #else - #define __WARN_FLAGS(flags) \ -@@ -70,14 +71,13 @@ - asm volatile("\n" \ - "1:\t" PARISC_BUG_BREAK_ASM "\n" \ - "\t.pushsection __bug_table,\"a\"\n" \ -- "\t.align %2\n" \ -- "2:\t" ASM_WORD_INSN "1b\n" \ -+ "\t.align 4\n" \ -+ "2:\t" __BUG_REL(1b) "\n" \ - "\t.short %0\n" \ -- "\t.blockz %1-%2-2\n" \ -+ "\t.blockz %1-4-2\n" \ - "\t.popsection" \ - : : "i" (BUGFLAG_WARNING|(flags)), \ -- "i" (sizeof(struct bug_entry)), \ -- "i" (sizeof(long)) ); \ -+ "i" (sizeof(struct bug_entry)) ); \ - } while(0) - #endif - -diff --git a/arch/riscv/Kconfig.socs b/arch/riscv/Kconfig.socs -index 69774bb362d6a..29d78eefc8894 100644 ---- a/arch/riscv/Kconfig.socs -+++ b/arch/riscv/Kconfig.socs -@@ -23,6 +23,7 @@ config SOC_STARFIVE - select PINCTRL - select RESET_CONTROLLER - select SIFIVE_PLIC -+ select ARM_AMBA - help - This enables support for StarFive SoC platform hardware. - -diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c -index 378f5b1514435..5348d842c7453 100644 ---- a/arch/riscv/kernel/traps_misaligned.c -+++ b/arch/riscv/kernel/traps_misaligned.c -@@ -342,16 +342,14 @@ int handle_misaligned_store(struct pt_regs *regs) - } else if ((insn & INSN_MASK_C_SD) == INSN_MATCH_C_SD) { - len = 8; - val.data_ulong = GET_RS2S(insn, regs); -- } else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP && -- ((insn >> SH_RD) & 0x1f)) { -+ } else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP) { - len = 8; - val.data_ulong = GET_RS2C(insn, regs); - #endif - } else if ((insn & INSN_MASK_C_SW) == INSN_MATCH_C_SW) { - len = 4; - val.data_ulong = GET_RS2S(insn, regs); -- } else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP && -- ((insn >> SH_RD) & 0x1f)) { -+ } else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP) { - len = 4; - val.data_ulong = GET_RS2C(insn, regs); - } else { -diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c -index 4909dcd762e8c..9977d637f836d 100644 ---- a/arch/s390/mm/pgtable.c -+++ b/arch/s390/mm/pgtable.c -@@ -731,7 +731,7 @@ void ptep_zap_unused(struct mm_struct *mm, unsigned long addr, - pte_clear(mm, addr, ptep); - } - if (reset) -- pgste_val(pgste) &= ~_PGSTE_GPS_USAGE_MASK; -+ pgste_val(pgste) &= ~(_PGSTE_GPS_USAGE_MASK | _PGSTE_GPS_NODAT); - pgste_set_unlock(ptep, pgste); - preempt_enable(); - } -diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c -index 8a1d48b8c2a3e..d0565a9e7d8c9 100644 ---- a/arch/x86/coco/tdx/tdx.c -+++ b/arch/x86/coco/tdx/tdx.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c -index 93c60c0c9d4a7..9c0b26ae51069 100644 ---- a/arch/x86/entry/common.c -+++ b/arch/x86/entry/common.c -@@ -25,6 +25,7 @@ - #include - #endif - -+#include - #include - #include - #include -@@ -96,6 +97,10 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs) - return (int)regs->orig_ax; - } - -+#ifdef CONFIG_IA32_EMULATION -+bool __ia32_enabled __ro_after_init = true; -+#endif -+ - /* - * Invoke a 32-bit syscall. Called with IRQs on in CONTEXT_KERNEL. - */ -@@ -115,7 +120,96 @@ static __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs, int nr) - } - } - --/* Handles int $0x80 */ -+#ifdef CONFIG_IA32_EMULATION -+static __always_inline bool int80_is_external(void) -+{ -+ const unsigned int offs = (0x80 / 32) * 0x10; -+ const u32 bit = BIT(0x80 % 32); -+ -+ /* The local APIC on XENPV guests is fake */ -+ if (cpu_feature_enabled(X86_FEATURE_XENPV)) -+ return false; -+ -+ /* -+ * If vector 0x80 is set in the APIC ISR then this is an external -+ * interrupt. Either from broken hardware or injected by a VMM. -+ * -+ * Note: In guest mode this is only valid for secure guests where -+ * the secure module fully controls the vAPIC exposed to the guest. -+ */ -+ return apic_read(APIC_ISR + offs) & bit; -+} -+ -+/** -+ * int80_emulation - 32-bit legacy syscall entry -+ * -+ * This entry point can be used by 32-bit and 64-bit programs to perform -+ * 32-bit system calls. Instances of INT $0x80 can be found inline in -+ * various programs and libraries. It is also used by the vDSO's -+ * __kernel_vsyscall fallback for hardware that doesn't support a faster -+ * entry method. Restarted 32-bit system calls also fall back to INT -+ * $0x80 regardless of what instruction was originally used to do the -+ * system call. -+ * -+ * This is considered a slow path. It is not used by most libc -+ * implementations on modern hardware except during process startup. -+ * -+ * The arguments for the INT $0x80 based syscall are on stack in the -+ * pt_regs structure: -+ * eax: system call number -+ * ebx, ecx, edx, esi, edi, ebp: arg1 - arg 6 -+ */ -+DEFINE_IDTENTRY_RAW(int80_emulation) -+{ -+ int nr; -+ -+ /* Kernel does not use INT $0x80! */ -+ if (unlikely(!user_mode(regs))) { -+ irqentry_enter(regs); -+ instrumentation_begin(); -+ panic("Unexpected external interrupt 0x80\n"); -+ } -+ -+ /* -+ * Establish kernel context for instrumentation, including for -+ * int80_is_external() below which calls into the APIC driver. -+ * Identical for soft and external interrupts. -+ */ -+ enter_from_user_mode(regs); -+ -+ instrumentation_begin(); -+ add_random_kstack_offset(); -+ -+ /* Validate that this is a soft interrupt to the extent possible */ -+ if (unlikely(int80_is_external())) -+ panic("Unexpected external interrupt 0x80\n"); -+ -+ /* -+ * The low level idtentry code pushed -1 into regs::orig_ax -+ * and regs::ax contains the syscall number. -+ * -+ * User tracing code (ptrace or signal handlers) might assume -+ * that the regs::orig_ax contains a 32-bit number on invoking -+ * a 32-bit syscall. -+ * -+ * Establish the syscall convention by saving the 32bit truncated -+ * syscall number in regs::orig_ax and by invalidating regs::ax. -+ */ -+ regs->orig_ax = regs->ax & GENMASK(31, 0); -+ regs->ax = -ENOSYS; -+ -+ nr = syscall_32_enter(regs); -+ -+ local_irq_enable(); -+ nr = syscall_enter_from_user_mode_work(regs, nr); -+ do_syscall_32_irqs_on(regs, nr); -+ -+ instrumentation_end(); -+ syscall_exit_to_user_mode(regs); -+} -+#else /* CONFIG_IA32_EMULATION */ -+ -+/* Handles int $0x80 on a 32bit kernel */ - __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) - { - int nr = syscall_32_enter(regs); -@@ -134,6 +228,7 @@ __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) - instrumentation_end(); - syscall_exit_to_user_mode(regs); - } -+#endif /* !CONFIG_IA32_EMULATION */ - - static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) - { -diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S -index 4dd19819053a5..d6c08d8986b17 100644 ---- a/arch/x86/entry/entry_64_compat.S -+++ b/arch/x86/entry/entry_64_compat.S -@@ -277,80 +277,3 @@ SYM_INNER_LABEL(entry_SYSRETL_compat_end, SYM_L_GLOBAL) - ANNOTATE_NOENDBR - int3 - SYM_CODE_END(entry_SYSCALL_compat) -- --/* -- * 32-bit legacy system call entry. -- * -- * 32-bit x86 Linux system calls traditionally used the INT $0x80 -- * instruction. INT $0x80 lands here. -- * -- * This entry point can be used by 32-bit and 64-bit programs to perform -- * 32-bit system calls. Instances of INT $0x80 can be found inline in -- * various programs and libraries. It is also used by the vDSO's -- * __kernel_vsyscall fallback for hardware that doesn't support a faster -- * entry method. Restarted 32-bit system calls also fall back to INT -- * $0x80 regardless of what instruction was originally used to do the -- * system call. -- * -- * This is considered a slow path. It is not used by most libc -- * implementations on modern hardware except during process startup. -- * -- * Arguments: -- * eax system call number -- * ebx arg1 -- * ecx arg2 -- * edx arg3 -- * esi arg4 -- * edi arg5 -- * ebp arg6 -- */ --SYM_CODE_START(entry_INT80_compat) -- UNWIND_HINT_ENTRY -- ENDBR -- /* -- * Interrupts are off on entry. -- */ -- ASM_CLAC /* Do this early to minimize exposure */ -- ALTERNATIVE "swapgs", "", X86_FEATURE_XENPV -- -- /* -- * User tracing code (ptrace or signal handlers) might assume that -- * the saved RAX contains a 32-bit number when we're invoking a 32-bit -- * syscall. Just in case the high bits are nonzero, zero-extend -- * the syscall number. (This could almost certainly be deleted -- * with no ill effects.) -- */ -- movl %eax, %eax -- -- /* switch to thread stack expects orig_ax and rdi to be pushed */ -- pushq %rax /* pt_regs->orig_ax */ -- -- /* Need to switch before accessing the thread stack. */ -- SWITCH_TO_KERNEL_CR3 scratch_reg=%rax -- -- /* In the Xen PV case we already run on the thread stack. */ -- ALTERNATIVE "", "jmp .Lint80_keep_stack", X86_FEATURE_XENPV -- -- movq %rsp, %rax -- movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp -- -- pushq 5*8(%rax) /* regs->ss */ -- pushq 4*8(%rax) /* regs->rsp */ -- pushq 3*8(%rax) /* regs->eflags */ -- pushq 2*8(%rax) /* regs->cs */ -- pushq 1*8(%rax) /* regs->ip */ -- pushq 0*8(%rax) /* regs->orig_ax */ --.Lint80_keep_stack: -- -- PUSH_AND_CLEAR_REGS rax=$-ENOSYS -- UNWIND_HINT_REGS -- -- cld -- -- IBRS_ENTER -- UNTRAIN_RET -- -- movq %rsp, %rdi -- call do_int80_syscall_32 -- jmp swapgs_restore_regs_and_return_to_usermode --SYM_CODE_END(entry_INT80_compat) -diff --git a/arch/x86/include/asm/ia32.h b/arch/x86/include/asm/ia32.h -index fada857f0a1ed..9805629479d96 100644 ---- a/arch/x86/include/asm/ia32.h -+++ b/arch/x86/include/asm/ia32.h -@@ -68,6 +68,27 @@ extern void ia32_pick_mmap_layout(struct mm_struct *mm); - - #endif - --#endif /* CONFIG_IA32_EMULATION */ -+extern bool __ia32_enabled; -+ -+static inline bool ia32_enabled(void) -+{ -+ return __ia32_enabled; -+} -+ -+static inline void ia32_disable(void) -+{ -+ __ia32_enabled = false; -+} -+ -+#else /* !CONFIG_IA32_EMULATION */ -+ -+static inline bool ia32_enabled(void) -+{ -+ return IS_ENABLED(CONFIG_X86_32); -+} -+ -+static inline void ia32_disable(void) {} -+ -+#endif - - #endif /* _ASM_X86_IA32_H */ -diff --git a/arch/x86/include/asm/idtentry.h b/arch/x86/include/asm/idtentry.h -index 72184b0b2219e..fca710a93eb9c 100644 ---- a/arch/x86/include/asm/idtentry.h -+++ b/arch/x86/include/asm/idtentry.h -@@ -569,6 +569,10 @@ DECLARE_IDTENTRY_RAW(X86_TRAP_UD, exc_invalid_op); - DECLARE_IDTENTRY_RAW(X86_TRAP_BP, exc_int3); - DECLARE_IDTENTRY_RAW_ERRORCODE(X86_TRAP_PF, exc_page_fault); - -+#if defined(CONFIG_IA32_EMULATION) -+DECLARE_IDTENTRY_RAW(IA32_SYSCALL_VECTOR, int80_emulation); -+#endif -+ - #ifdef CONFIG_X86_MCE - #ifdef CONFIG_X86_64 - DECLARE_IDTENTRY_MCE(X86_TRAP_MC, exc_machine_check); -diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h -index 12ef86b19910d..84294b66b9162 100644 ---- a/arch/x86/include/asm/proto.h -+++ b/arch/x86/include/asm/proto.h -@@ -32,10 +32,6 @@ void entry_SYSCALL_compat(void); - void entry_SYSCALL_compat_safe_stack(void); - void entry_SYSRETL_compat_unsafe_stack(void); - void entry_SYSRETL_compat_end(void); --void entry_INT80_compat(void); --#ifdef CONFIG_XEN_PV --void xen_entry_INT80_compat(void); --#endif - #endif - - void x86_configure_nx(void); -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index b66960358381b..c1d09c8844d67 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -1291,6 +1291,9 @@ static void zenbleed_check_cpu(void *unused) - - void amd_check_microcode(void) - { -+ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) -+ return; -+ - on_each_cpu(zenbleed_check_cpu, NULL, 1); - } - -diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c -index a58c6bc1cd68c..f5a3374e62cb1 100644 ---- a/arch/x86/kernel/idt.c -+++ b/arch/x86/kernel/idt.c -@@ -117,7 +117,7 @@ static const __initconst struct idt_data def_idts[] = { - - SYSG(X86_TRAP_OF, asm_exc_overflow), - #if defined(CONFIG_IA32_EMULATION) -- SYSG(IA32_SYSCALL_VECTOR, entry_INT80_compat), -+ SYSG(IA32_SYSCALL_VECTOR, asm_int80_emulation), - #elif defined(CONFIG_X86_32) - SYSG(IA32_SYSCALL_VECTOR, entry_INT80_32), - #endif -diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c -index 68b2a9d3dbc6b..c8dfb0fdde7f9 100644 ---- a/arch/x86/kernel/sev.c -+++ b/arch/x86/kernel/sev.c -@@ -1279,10 +1279,6 @@ void setup_ghcb(void) - if (!cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT)) - return; - -- /* First make sure the hypervisor talks a supported protocol. */ -- if (!sev_es_negotiate_protocol()) -- sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SEV_ES_GEN_REQ); -- - /* - * Check whether the runtime #VC exception handler is active. It uses - * the per-CPU GHCB page which is set up by sev_es_init_vc_handling(). -@@ -1297,6 +1293,13 @@ void setup_ghcb(void) - return; - } - -+ /* -+ * Make sure the hypervisor talks a supported protocol. -+ * This gets called only in the BSP boot phase. -+ */ -+ if (!sev_es_negotiate_protocol()) -+ sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SEV_ES_GEN_REQ); -+ - /* - * Clear the boot_ghcb. The first exception comes in before the bss - * section is cleared. -diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c -index 4194aa4c5f0e0..4a663812562db 100644 ---- a/arch/x86/kvm/svm/svm.c -+++ b/arch/x86/kvm/svm/svm.c -@@ -1786,15 +1786,17 @@ void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) - bool old_paging = is_paging(vcpu); - - #ifdef CONFIG_X86_64 -- if (vcpu->arch.efer & EFER_LME && !vcpu->arch.guest_state_protected) { -+ if (vcpu->arch.efer & EFER_LME) { - if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) { - vcpu->arch.efer |= EFER_LMA; -- svm->vmcb->save.efer |= EFER_LMA | EFER_LME; -+ if (!vcpu->arch.guest_state_protected) -+ svm->vmcb->save.efer |= EFER_LMA | EFER_LME; - } - - if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) { - vcpu->arch.efer &= ~EFER_LMA; -- svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME); -+ if (!vcpu->arch.guest_state_protected) -+ svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME); - } - } - #endif -diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c -index 3ea0f763540a4..3e93af083e037 100644 ---- a/arch/x86/mm/mem_encrypt_amd.c -+++ b/arch/x86/mm/mem_encrypt_amd.c -@@ -34,6 +34,7 @@ - #include - #include - #include -+#include - - #include "mm_internal.h" - -@@ -502,6 +503,16 @@ void __init sme_early_init(void) - x86_platform.guest.enc_status_change_finish = amd_enc_status_change_finish; - x86_platform.guest.enc_tlb_flush_required = amd_enc_tlb_flush_required; - x86_platform.guest.enc_cache_flush_required = amd_enc_cache_flush_required; -+ -+ /* -+ * The VMM is capable of injecting interrupt 0x80 and triggering the -+ * compatibility syscall path. -+ * -+ * By default, the 32-bit emulation is disabled in order to ensure -+ * the safety of the VM. -+ */ -+ if (sev_status & MSR_AMD64_SEV_ENABLED) -+ ia32_disable(); - } - - void __init mem_encrypt_free_decrypted_mem(void) -diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c -index 333539bdbdaae..9280e15de3af5 100644 ---- a/arch/x86/xen/enlighten_pv.c -+++ b/arch/x86/xen/enlighten_pv.c -@@ -623,7 +623,7 @@ static struct trap_array_entry trap_array[] = { - TRAP_ENTRY(exc_int3, false ), - TRAP_ENTRY(exc_overflow, false ), - #ifdef CONFIG_IA32_EMULATION -- { entry_INT80_compat, xen_entry_INT80_compat, false }, -+ TRAP_ENTRY(int80_emulation, false ), - #endif - TRAP_ENTRY(exc_page_fault, false ), - TRAP_ENTRY(exc_divide_error, false ), -diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S -index 6b4fdf6b95422..dec5e03e7a2cf 100644 ---- a/arch/x86/xen/xen-asm.S -+++ b/arch/x86/xen/xen-asm.S -@@ -156,7 +156,7 @@ xen_pv_trap asm_xenpv_exc_machine_check - #endif /* CONFIG_X86_MCE */ - xen_pv_trap asm_exc_simd_coprocessor_error - #ifdef CONFIG_IA32_EMULATION --xen_pv_trap entry_INT80_compat -+xen_pv_trap asm_int80_emulation - #endif - xen_pv_trap asm_exc_xen_unknown_trap - xen_pv_trap asm_exc_xen_hypervisor_callback -diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c -index a0e347f6f97eb..94154a849a3ea 100644 ---- a/drivers/acpi/scan.c -+++ b/drivers/acpi/scan.c -@@ -1563,17 +1563,22 @@ static const struct iommu_ops *acpi_iommu_configure_id(struct device *dev, - int err; - const struct iommu_ops *ops; - -+ /* Serialise to make dev->iommu stable under our potential fwspec */ -+ mutex_lock(&iommu_probe_device_lock); - /* - * If we already translated the fwspec there is nothing left to do, - * return the iommu_ops. - */ - ops = acpi_iommu_fwspec_ops(dev); -- if (ops) -+ if (ops) { -+ mutex_unlock(&iommu_probe_device_lock); - return ops; -+ } - - err = iort_iommu_configure_id(dev, id_in); - if (err && err != -EPROBE_DEFER) - err = viot_iommu_configure(dev); -+ mutex_unlock(&iommu_probe_device_lock); - - /* - * If we have reason to believe the IOMMU driver missed the initial -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index e4a6da81cd4b3..9cc3a2b1b4fc1 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -4788,6 +4788,7 @@ static void binder_release_work(struct binder_proc *proc, - "undelivered TRANSACTION_ERROR: %u\n", - e->cmd); - } break; -+ case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT: - case BINDER_WORK_TRANSACTION_COMPLETE: { - binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, - "undelivered TRANSACTION_COMPLETE\n"); -diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c -index 1c06781f71148..f3bd9f104bd12 100644 ---- a/drivers/base/devcoredump.c -+++ b/drivers/base/devcoredump.c -@@ -363,6 +363,7 @@ void dev_coredumpm(struct device *dev, struct module *owner, - devcd->devcd_dev.class = &devcd_class; - - mutex_lock(&devcd->mutex); -+ dev_set_uevent_suppress(&devcd->devcd_dev, true); - if (device_add(&devcd->devcd_dev)) - goto put_device; - -@@ -377,6 +378,8 @@ void dev_coredumpm(struct device *dev, struct module *owner, - "devcoredump")) - dev_warn(dev, "devcoredump create_link failed\n"); - -+ dev_set_uevent_suppress(&devcd->devcd_dev, false); -+ kobject_uevent(&devcd->devcd_dev.kobj, KOBJ_ADD); - INIT_DELAYED_WORK(&devcd->del_wk, devcd_del); - schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT); - mutex_unlock(&devcd->mutex); -diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c -index cf3fa998093de..4f3dd9316fb2f 100644 ---- a/drivers/base/regmap/regcache.c -+++ b/drivers/base/regmap/regcache.c -@@ -410,8 +410,7 @@ out: - rb_entry(node, struct regmap_range_node, node); - - /* If there's nothing in the cache there's nothing to sync */ -- ret = regcache_read(map, this->selector_reg, &i); -- if (ret != 0) -+ if (regcache_read(map, this->selector_reg, &i) != 0) - continue; - - ret = _regmap_write(map, this->selector_reg, i); -diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c -index cd27bf173dec8..a64648682c72c 100644 ---- a/drivers/gpio/gpiolib-sysfs.c -+++ b/drivers/gpio/gpiolib-sysfs.c -@@ -463,14 +463,17 @@ static ssize_t export_store(struct class *class, - goto done; - - status = gpiod_set_transitory(desc, false); -- if (!status) { -- status = gpiod_export(desc, true); -- if (status < 0) -- gpiod_free(desc); -- else -- set_bit(FLAG_SYSFS, &desc->flags); -+ if (status) { -+ gpiod_free(desc); -+ goto done; - } - -+ status = gpiod_export(desc, true); -+ if (status < 0) -+ gpiod_free(desc); -+ else -+ set_bit(FLAG_SYSFS, &desc->flags); -+ - done: - if (status) - pr_debug("%s: status %d\n", __func__, status); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -index ced4e7e8f98b5..133e4e03c143c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -@@ -201,7 +201,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, - } - - for (i = 0; i < p->nchunks; i++) { -- struct drm_amdgpu_cs_chunk __user **chunk_ptr = NULL; -+ struct drm_amdgpu_cs_chunk __user *chunk_ptr = NULL; - struct drm_amdgpu_cs_chunk user_chunk; - uint32_t __user *cdata; - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -index 2fced451f0aea..aabde6ebb190e 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -@@ -90,7 +90,7 @@ static void amdgpu_display_flip_work_func(struct work_struct *__work) - - struct drm_crtc *crtc = &amdgpu_crtc->base; - unsigned long flags; -- unsigned i; -+ unsigned int i; - int vpos, hpos; - - for (i = 0; i < work->shared_count; ++i) -@@ -167,7 +167,7 @@ int amdgpu_display_crtc_page_flip_target(struct drm_crtc *crtc, - u64 tiling_flags; - int i, r; - -- work = kzalloc(sizeof *work, GFP_KERNEL); -+ work = kzalloc(sizeof(*work), GFP_KERNEL); - if (work == NULL) - return -ENOMEM; - -@@ -298,18 +298,17 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set, - - adev = drm_to_adev(dev); - /* if we have active crtcs and we don't have a power ref, -- take the current one */ -+ * take the current one -+ */ - if (active && !adev->have_disp_power_ref) { - adev->have_disp_power_ref = true; - return ret; - } -- /* if we have no active crtcs, then drop the power ref -- we got before */ -- if (!active && adev->have_disp_power_ref) { -- pm_runtime_put_autosuspend(dev->dev); -+ /* if we have no active crtcs, then go to -+ * drop the power ref we got before -+ */ -+ if (!active && adev->have_disp_power_ref) - adev->have_disp_power_ref = false; -- } -- - out: - /* drop the power reference we got coming in here */ - pm_runtime_put_autosuspend(dev->dev); -@@ -473,11 +472,10 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector, - if (amdgpu_connector->router.ddc_valid) - amdgpu_i2c_router_select_ddc_port(amdgpu_connector); - -- if (use_aux) { -+ if (use_aux) - ret = i2c_transfer(&amdgpu_connector->ddc_bus->aux.ddc, msgs, 2); -- } else { -+ else - ret = i2c_transfer(&amdgpu_connector->ddc_bus->adapter, msgs, 2); -- } - - if (ret != 2) - /* Couldn't find an accessible DDC on this connector */ -@@ -486,10 +484,12 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector, - * EDID header starts with: - * 0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0x00. - * Only the first 6 bytes must be valid as -- * drm_edid_block_valid() can fix the last 2 bytes */ -+ * drm_edid_block_valid() can fix the last 2 bytes -+ */ - if (drm_edid_header_is_valid(buf) < 6) { - /* Couldn't find an accessible EDID on this -- * connector */ -+ * connector -+ */ - return false; - } - return true; -@@ -1204,8 +1204,10 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev, - - obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]); - if (obj == NULL) { -- drm_dbg_kms(dev, "No GEM object associated to handle 0x%08X, " -- "can't create framebuffer\n", mode_cmd->handles[0]); -+ drm_dbg_kms(dev, -+ "No GEM object associated to handle 0x%08X, can't create framebuffer\n", -+ mode_cmd->handles[0]); -+ - return ERR_PTR(-ENOENT); - } - -@@ -1398,6 +1400,7 @@ bool amdgpu_display_crtc_scaling_mode_fixup(struct drm_crtc *crtc, - } - if (amdgpu_crtc->rmx_type != RMX_OFF) { - fixed20_12 a, b; -+ - a.full = dfixed_const(src_v); - b.full = dfixed_const(dst_v); - amdgpu_crtc->vsc.full = dfixed_div(a, b); -@@ -1417,7 +1420,7 @@ bool amdgpu_display_crtc_scaling_mode_fixup(struct drm_crtc *crtc, - * - * \param dev Device to query. - * \param pipe Crtc to query. -- * \param flags Flags from caller (DRM_CALLED_FROM_VBLIRQ or 0). -+ * \param flags from caller (DRM_CALLED_FROM_VBLIRQ or 0). - * For driver internal use only also supports these flags: - * - * USE_REAL_VBLANKSTART to use the real start of vblank instead -@@ -1493,8 +1496,8 @@ int amdgpu_display_get_crtc_scanoutpos(struct drm_device *dev, - - /* Called from driver internal vblank counter query code? */ - if (flags & GET_DISTANCE_TO_VBLANKSTART) { -- /* Caller wants distance from real vbl_start in *hpos */ -- *hpos = *vpos - vbl_start; -+ /* Caller wants distance from real vbl_start in *hpos */ -+ *hpos = *vpos - vbl_start; - } - - /* Fudge vblank to start a few scanlines earlier to handle the -@@ -1516,7 +1519,7 @@ int amdgpu_display_get_crtc_scanoutpos(struct drm_device *dev, - - /* In vblank? */ - if (in_vbl) -- ret |= DRM_SCANOUTPOS_IN_VBLANK; -+ ret |= DRM_SCANOUTPOS_IN_VBLANK; - - /* Called from driver internal vblank counter query code? */ - if (flags & GET_DISTANCE_TO_VBLANKSTART) { -@@ -1622,6 +1625,7 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev) - - if (amdgpu_crtc->cursor_bo && !adev->enable_virtual_display) { - struct amdgpu_bo *aobj = gem_to_amdgpu_bo(amdgpu_crtc->cursor_bo); -+ - r = amdgpu_bo_reserve(aobj, true); - if (r == 0) { - amdgpu_bo_unpin(aobj); -@@ -1629,9 +1633,9 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev) - } - } - -- if (fb == NULL || fb->obj[0] == NULL) { -+ if (!fb || !fb->obj[0]) - continue; -- } -+ - robj = gem_to_amdgpu_bo(fb->obj[0]); - if (!amdgpu_display_robj_is_fb(adev, robj)) { - r = amdgpu_bo_reserve(robj, true); -@@ -1658,6 +1662,7 @@ int amdgpu_display_resume_helper(struct amdgpu_device *adev) - - if (amdgpu_crtc->cursor_bo && !adev->enable_virtual_display) { - struct amdgpu_bo *aobj = gem_to_amdgpu_bo(amdgpu_crtc->cursor_bo); -+ - r = amdgpu_bo_reserve(aobj, true); - if (r == 0) { - r = amdgpu_bo_pin(aobj, AMDGPU_GEM_DOMAIN_VRAM); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c -index 4d9eb0137f8c4..d6c4293829aab 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c -@@ -79,6 +79,8 @@ - * That is, for an I2C EEPROM driver everything is controlled by - * the "eeprom_addr". - * -+ * See also top of amdgpu_ras_eeprom.c. -+ * - * P.S. If you need to write, lock and read the Identification Page, - * (M24M02-DR device only, which we do not use), change the "7" to - * "0xF" in the macro below, and let the client set bit 20 to 1 in -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c -index 84c241b9a2a13..f5f747cfe90a1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c -@@ -33,12 +33,29 @@ - - #include "amdgpu_reset.h" - --#define EEPROM_I2C_MADDR_VEGA20 0x0 --#define EEPROM_I2C_MADDR_ARCTURUS 0x40000 --#define EEPROM_I2C_MADDR_ARCTURUS_D342 0x0 --#define EEPROM_I2C_MADDR_SIENNA_CICHLID 0x0 --#define EEPROM_I2C_MADDR_ALDEBARAN 0x0 --#define EEPROM_I2C_MADDR_SMU_13_0_0 (0x54UL << 16) -+/* These are memory addresses as would be seen by one or more EEPROM -+ * chips strung on the I2C bus, usually by manipulating pins 1-3 of a -+ * set of EEPROM devices. They form a continuous memory space. -+ * -+ * The I2C device address includes the device type identifier, 1010b, -+ * which is a reserved value and indicates that this is an I2C EEPROM -+ * device. It also includes the top 3 bits of the 19 bit EEPROM memory -+ * address, namely bits 18, 17, and 16. This makes up the 7 bit -+ * address sent on the I2C bus with bit 0 being the direction bit, -+ * which is not represented here, and sent by the hardware directly. -+ * -+ * For instance, -+ * 50h = 1010000b => device type identifier 1010b, bits 18:16 = 000b, address 0. -+ * 54h = 1010100b => --"--, bits 18:16 = 100b, address 40000h. -+ * 56h = 1010110b => --"--, bits 18:16 = 110b, address 60000h. -+ * Depending on the size of the I2C EEPROM device(s), bits 18:16 may -+ * address memory in a device or a device on the I2C bus, depending on -+ * the status of pins 1-3. See top of amdgpu_eeprom.c. -+ * -+ * The RAS table lives either at address 0 or address 40000h of EEPROM. -+ */ -+#define EEPROM_I2C_MADDR_0 0x0 -+#define EEPROM_I2C_MADDR_4 0x40000 - - /* - * The 2 macros bellow represent the actual size in bytes that -@@ -90,33 +107,23 @@ - - static bool __is_ras_eeprom_supported(struct amdgpu_device *adev) - { -- return adev->asic_type == CHIP_VEGA20 || -- adev->asic_type == CHIP_ARCTURUS || -- adev->asic_type == CHIP_SIENNA_CICHLID || -- adev->asic_type == CHIP_ALDEBARAN; --} -- --static bool __get_eeprom_i2c_addr_arct(struct amdgpu_device *adev, -- struct amdgpu_ras_eeprom_control *control) --{ -- struct atom_context *atom_ctx = adev->mode_info.atom_context; -- -- if (!control || !atom_ctx) -+ switch (adev->ip_versions[MP1_HWIP][0]) { -+ case IP_VERSION(11, 0, 2): /* VEGA20 and ARCTURUS */ -+ case IP_VERSION(11, 0, 7): /* Sienna cichlid */ -+ case IP_VERSION(13, 0, 0): -+ case IP_VERSION(13, 0, 2): /* Aldebaran */ -+ case IP_VERSION(13, 0, 6): -+ case IP_VERSION(13, 0, 10): -+ return true; -+ default: - return false; -- -- if (strnstr(atom_ctx->vbios_version, -- "D342", -- sizeof(atom_ctx->vbios_version))) -- control->i2c_address = EEPROM_I2C_MADDR_ARCTURUS_D342; -- else -- control->i2c_address = EEPROM_I2C_MADDR_ARCTURUS; -- -- return true; -+ } - } - - static bool __get_eeprom_i2c_addr(struct amdgpu_device *adev, - struct amdgpu_ras_eeprom_control *control) - { -+ struct atom_context *atom_ctx = adev->mode_info.atom_context; - u8 i2c_addr; - - if (!control) -@@ -137,36 +144,42 @@ static bool __get_eeprom_i2c_addr(struct amdgpu_device *adev, - return true; - } - -- switch (adev->asic_type) { -- case CHIP_VEGA20: -- control->i2c_address = EEPROM_I2C_MADDR_VEGA20; -- break; -- -- case CHIP_ARCTURUS: -- return __get_eeprom_i2c_addr_arct(adev, control); -- -- case CHIP_SIENNA_CICHLID: -- control->i2c_address = EEPROM_I2C_MADDR_SIENNA_CICHLID; -- break; -- -- case CHIP_ALDEBARAN: -- control->i2c_address = EEPROM_I2C_MADDR_ALDEBARAN; -- break; -- -- default: -- return false; -- } -- - switch (adev->ip_versions[MP1_HWIP][0]) { -+ case IP_VERSION(11, 0, 2): -+ /* VEGA20 and ARCTURUS */ -+ if (adev->asic_type == CHIP_VEGA20) -+ control->i2c_address = EEPROM_I2C_MADDR_0; -+ else if (strnstr(atom_ctx->vbios_version, -+ "D342", -+ sizeof(atom_ctx->vbios_version))) -+ control->i2c_address = EEPROM_I2C_MADDR_0; -+ else -+ control->i2c_address = EEPROM_I2C_MADDR_4; -+ return true; -+ case IP_VERSION(11, 0, 7): -+ control->i2c_address = EEPROM_I2C_MADDR_0; -+ return true; -+ case IP_VERSION(13, 0, 2): -+ if (strnstr(atom_ctx->vbios_version, "D673", -+ sizeof(atom_ctx->vbios_version))) -+ control->i2c_address = EEPROM_I2C_MADDR_4; -+ else -+ control->i2c_address = EEPROM_I2C_MADDR_0; -+ return true; - case IP_VERSION(13, 0, 0): -- control->i2c_address = EEPROM_I2C_MADDR_SMU_13_0_0; -- break; -- -+ if (strnstr(atom_ctx->vbios_pn, "D707", -+ sizeof(atom_ctx->vbios_pn))) -+ control->i2c_address = EEPROM_I2C_MADDR_0; -+ else -+ control->i2c_address = EEPROM_I2C_MADDR_4; -+ return true; -+ case IP_VERSION(13, 0, 6): -+ case IP_VERSION(13, 0, 10): -+ control->i2c_address = EEPROM_I2C_MADDR_4; -+ return true; - default: -- break; -+ return false; - } -- -- return true; - } - - static void -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -index 23e7e5126eae6..66a6f7a37ebcf 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c -@@ -397,7 +397,7 @@ static int gfx_v11_0_ring_test_ib(struct amdgpu_ring *ring, long timeout) - adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD); - cpu_ptr = &adev->wb.wb[index]; - -- r = amdgpu_ib_get(adev, NULL, 16, AMDGPU_IB_POOL_DIRECT, &ib); -+ r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib); - if (r) { - DRM_ERROR("amdgpu: failed to get ib (%ld).\n", r); - goto err1; -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c -index 7f0b18b0d4c48..71ef25425c7f6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c -@@ -883,8 +883,8 @@ static int gfx_v8_0_ring_test_ib(struct amdgpu_ring *ring, long timeout) - gpu_addr = adev->wb.gpu_addr + (index * 4); - adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD); - memset(&ib, 0, sizeof(ib)); -- r = amdgpu_ib_get(adev, NULL, 16, -- AMDGPU_IB_POOL_DIRECT, &ib); -+ -+ r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib); - if (r) - goto err1; - -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c -index fe371022e5104..84ca601f7d5f3 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c -@@ -1034,8 +1034,8 @@ static int gfx_v9_0_ring_test_ib(struct amdgpu_ring *ring, long timeout) - gpu_addr = adev->wb.gpu_addr + (index * 4); - adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD); - memset(&ib, 0, sizeof(ib)); -- r = amdgpu_ib_get(adev, NULL, 16, -- AMDGPU_IB_POOL_DIRECT, &ib); -+ -+ r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib); - if (r) - goto err1; - -diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig -index 57946d80b02db..12baf9ba03c96 100644 ---- a/drivers/gpu/drm/bridge/Kconfig -+++ b/drivers/gpu/drm/bridge/Kconfig -@@ -309,6 +309,7 @@ config DRM_TOSHIBA_TC358768 - select REGMAP_I2C - select DRM_PANEL - select DRM_MIPI_DSI -+ select VIDEOMODE_HELPERS - help - Toshiba TC358768AXBG/TC358778XBG DSI bridge chip driver. - -diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c -index 8219310025de5..f7422f0cf579d 100644 ---- a/drivers/gpu/drm/i915/display/icl_dsi.c -+++ b/drivers/gpu/drm/i915/display/icl_dsi.c -@@ -1500,6 +1500,13 @@ static void gen11_dsi_post_disable(struct intel_atomic_state *state, - static enum drm_mode_status gen11_dsi_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) - { -+ struct drm_i915_private *i915 = to_i915(connector->dev); -+ enum drm_mode_status status; -+ -+ status = intel_cpu_transcoder_mode_valid(i915, mode); -+ if (status != MODE_OK) -+ return status; -+ - /* FIXME: DSC? */ - return intel_dsi_mode_valid(connector, mode); - } -diff --git a/drivers/gpu/drm/i915/display/intel_crt.c b/drivers/gpu/drm/i915/display/intel_crt.c -index 4a8ff2f976085..e60b2cf84b851 100644 ---- a/drivers/gpu/drm/i915/display/intel_crt.c -+++ b/drivers/gpu/drm/i915/display/intel_crt.c -@@ -343,8 +343,13 @@ intel_crt_mode_valid(struct drm_connector *connector, - struct drm_device *dev = connector->dev; - struct drm_i915_private *dev_priv = to_i915(dev); - int max_dotclk = dev_priv->max_dotclk_freq; -+ enum drm_mode_status status; - int max_clock; - -+ status = intel_cpu_transcoder_mode_valid(dev_priv, mode); -+ if (status != MODE_OK) -+ return status; -+ - if (mode->flags & DRM_MODE_FLAG_DBLSCAN) - return MODE_NO_DBLESCAN; - -diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c -index 96e679a176e94..1777a12f2f421 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.c -+++ b/drivers/gpu/drm/i915/display/intel_display.c -@@ -8229,6 +8229,16 @@ intel_mode_valid(struct drm_device *dev, - mode->vtotal > vtotal_max) - return MODE_V_ILLEGAL; - -+ return MODE_OK; -+} -+ -+enum drm_mode_status intel_cpu_transcoder_mode_valid(struct drm_i915_private *dev_priv, -+ const struct drm_display_mode *mode) -+{ -+ /* -+ * Additional transcoder timing limits, -+ * excluding BXT/GLK DSI transcoders. -+ */ - if (DISPLAY_VER(dev_priv) >= 5) { - if (mode->hdisplay < 64 || - mode->htotal - mode->hdisplay < 32) -diff --git a/drivers/gpu/drm/i915/display/intel_display.h b/drivers/gpu/drm/i915/display/intel_display.h -index 884e8e67b17c7..b4f941674357b 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.h -+++ b/drivers/gpu/drm/i915/display/intel_display.h -@@ -554,6 +554,9 @@ enum drm_mode_status - intel_mode_valid_max_plane_size(struct drm_i915_private *dev_priv, - const struct drm_display_mode *mode, - bool bigjoiner); -+enum drm_mode_status -+intel_cpu_transcoder_mode_valid(struct drm_i915_private *i915, -+ const struct drm_display_mode *mode); - enum phy intel_port_to_phy(struct drm_i915_private *i915, enum port port); - bool is_trans_port_sync_mode(const struct intel_crtc_state *state); - bool intel_crtc_is_bigjoiner_slave(const struct intel_crtc_state *crtc_state); -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 594ea037050a9..5970f4149090f 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -973,8 +973,9 @@ intel_dp_mode_valid(struct drm_connector *_connector, - enum drm_mode_status status; - bool dsc = false, bigjoiner = false; - -- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -- return MODE_NO_DBLESCAN; -+ status = intel_cpu_transcoder_mode_valid(dev_priv, mode); -+ if (status != MODE_OK) -+ return status; - - if (mode->flags & DRM_MODE_FLAG_DBLCLK) - return MODE_H_ILLEGAL; -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index 9a6822256ddf6..eec32f682012c 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -703,6 +703,10 @@ intel_dp_mst_mode_valid_ctx(struct drm_connector *connector, - return 0; - } - -+ *status = intel_cpu_transcoder_mode_valid(dev_priv, mode); -+ if (*status != MODE_OK) -+ return 0; -+ - if (mode->flags & DRM_MODE_FLAG_DBLSCAN) { - *status = MODE_NO_DBLESCAN; - return 0; -diff --git a/drivers/gpu/drm/i915/display/intel_dvo.c b/drivers/gpu/drm/i915/display/intel_dvo.c -index 5572e43026e4d..511c589070087 100644 ---- a/drivers/gpu/drm/i915/display/intel_dvo.c -+++ b/drivers/gpu/drm/i915/display/intel_dvo.c -@@ -225,10 +225,16 @@ intel_dvo_mode_valid(struct drm_connector *connector, - { - struct intel_connector *intel_connector = to_intel_connector(connector); - struct intel_dvo *intel_dvo = intel_attached_dvo(intel_connector); -+ struct drm_i915_private *i915 = to_i915(intel_connector->base.dev); - const struct drm_display_mode *fixed_mode = - intel_panel_fixed_mode(intel_connector, mode); - int max_dotclk = to_i915(connector->dev)->max_dotclk_freq; - int target_clock = mode->clock; -+ enum drm_mode_status status; -+ -+ status = intel_cpu_transcoder_mode_valid(i915, mode); -+ if (status != MODE_OK) -+ return status; - - if (mode->flags & DRM_MODE_FLAG_DBLSCAN) - return MODE_NO_DBLESCAN; -diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c -index 7816b2a33feeb..2600019fc8b96 100644 ---- a/drivers/gpu/drm/i915/display/intel_hdmi.c -+++ b/drivers/gpu/drm/i915/display/intel_hdmi.c -@@ -1987,8 +1987,9 @@ intel_hdmi_mode_valid(struct drm_connector *connector, - bool has_hdmi_sink = intel_has_hdmi_sink(hdmi, connector->state); - bool ycbcr_420_only; - -- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -- return MODE_NO_DBLESCAN; -+ status = intel_cpu_transcoder_mode_valid(dev_priv, mode); -+ if (status != MODE_OK) -+ return status; - - if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING) - clock *= 2; -diff --git a/drivers/gpu/drm/i915/display/intel_lvds.c b/drivers/gpu/drm/i915/display/intel_lvds.c -index a749a5a66d624..40b5d3d3c7e14 100644 ---- a/drivers/gpu/drm/i915/display/intel_lvds.c -+++ b/drivers/gpu/drm/i915/display/intel_lvds.c -@@ -92,9 +92,9 @@ bool intel_lvds_port_enabled(struct drm_i915_private *dev_priv, - - /* asserts want to know the pipe even if the port is disabled */ - if (HAS_PCH_CPT(dev_priv)) -- *pipe = (val & LVDS_PIPE_SEL_MASK_CPT) >> LVDS_PIPE_SEL_SHIFT_CPT; -+ *pipe = REG_FIELD_GET(LVDS_PIPE_SEL_MASK_CPT, val); - else -- *pipe = (val & LVDS_PIPE_SEL_MASK) >> LVDS_PIPE_SEL_SHIFT; -+ *pipe = REG_FIELD_GET(LVDS_PIPE_SEL_MASK, val); - - return val & LVDS_PORT_EN; - } -@@ -389,11 +389,16 @@ intel_lvds_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) - { - struct intel_connector *intel_connector = to_intel_connector(connector); -+ struct drm_i915_private *i915 = to_i915(intel_connector->base.dev); - const struct drm_display_mode *fixed_mode = - intel_panel_fixed_mode(intel_connector, mode); - int max_pixclk = to_i915(connector->dev)->max_dotclk_freq; - enum drm_mode_status status; - -+ status = intel_cpu_transcoder_mode_valid(i915, mode); -+ if (status != MODE_OK) -+ return status; -+ - if (mode->flags & DRM_MODE_FLAG_DBLSCAN) - return MODE_NO_DBLESCAN; - -diff --git a/drivers/gpu/drm/i915/display/intel_sdvo.c b/drivers/gpu/drm/i915/display/intel_sdvo.c -index 2c2e0f041f869..8294dddfd9de8 100644 ---- a/drivers/gpu/drm/i915/display/intel_sdvo.c -+++ b/drivers/gpu/drm/i915/display/intel_sdvo.c -@@ -115,7 +115,6 @@ struct intel_sdvo { - - enum port port; - -- bool has_hdmi_monitor; - bool has_hdmi_audio; - - /* DDC bus used by this SDVO encoder */ -@@ -1278,10 +1277,13 @@ static void i9xx_adjust_sdvo_tv_clock(struct intel_crtc_state *pipe_config) - pipe_config->clock_set = true; - } - --static bool intel_has_hdmi_sink(struct intel_sdvo *sdvo, -+static bool intel_has_hdmi_sink(struct intel_sdvo_connector *intel_sdvo_connector, - const struct drm_connector_state *conn_state) - { -- return sdvo->has_hdmi_monitor && -+ struct drm_connector *connector = conn_state->connector; -+ -+ return intel_sdvo_connector->is_hdmi && -+ connector->display_info.is_hdmi && - READ_ONCE(to_intel_digital_connector_state(conn_state)->force_audio) != HDMI_AUDIO_OFF_DVI; - } - -@@ -1360,7 +1362,7 @@ static int intel_sdvo_compute_config(struct intel_encoder *encoder, - pipe_config->pixel_multiplier = - intel_sdvo_get_pixel_multiplier(adjusted_mode); - -- pipe_config->has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo, conn_state); -+ pipe_config->has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo_connector, conn_state); - - if (pipe_config->has_hdmi_sink) { - if (intel_sdvo_state->base.force_audio == HDMI_AUDIO_AUTO) -@@ -1871,13 +1873,19 @@ static enum drm_mode_status - intel_sdvo_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) - { -+ struct drm_i915_private *i915 = to_i915(connector->dev); - struct intel_sdvo *intel_sdvo = intel_attached_sdvo(to_intel_connector(connector)); - struct intel_sdvo_connector *intel_sdvo_connector = - to_intel_sdvo_connector(connector); -- int max_dotclk = to_i915(connector->dev)->max_dotclk_freq; -- bool has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo, connector->state); -+ bool has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo_connector, connector->state); -+ int max_dotclk = i915->max_dotclk_freq; -+ enum drm_mode_status status; - int clock = mode->clock; - -+ status = intel_cpu_transcoder_mode_valid(i915, mode); -+ if (status != MODE_OK) -+ return status; -+ - if (mode->flags & DRM_MODE_FLAG_DBLSCAN) - return MODE_NO_DBLESCAN; - -@@ -2064,7 +2072,6 @@ intel_sdvo_tmds_sink_detect(struct drm_connector *connector) - if (edid->input & DRM_EDID_INPUT_DIGITAL) { - status = connector_status_connected; - if (intel_sdvo_connector->is_hdmi) { -- intel_sdvo->has_hdmi_monitor = drm_detect_hdmi_monitor(edid); - intel_sdvo->has_hdmi_audio = drm_detect_monitor_audio(edid); - } - } else -@@ -2116,7 +2123,6 @@ intel_sdvo_detect(struct drm_connector *connector, bool force) - - intel_sdvo->attached_output = response; - -- intel_sdvo->has_hdmi_monitor = false; - intel_sdvo->has_hdmi_audio = false; - - if ((intel_sdvo_connector->output_flag & response) == 0) -diff --git a/drivers/gpu/drm/i915/display/intel_tv.c b/drivers/gpu/drm/i915/display/intel_tv.c -index dcf89d701f0f6..fb25be800e753 100644 ---- a/drivers/gpu/drm/i915/display/intel_tv.c -+++ b/drivers/gpu/drm/i915/display/intel_tv.c -@@ -956,8 +956,14 @@ static enum drm_mode_status - intel_tv_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) - { -+ struct drm_i915_private *i915 = to_i915(connector->dev); - const struct tv_mode *tv_mode = intel_tv_mode_find(connector->state); -- int max_dotclk = to_i915(connector->dev)->max_dotclk_freq; -+ int max_dotclk = i915->max_dotclk_freq; -+ enum drm_mode_status status; -+ -+ status = intel_cpu_transcoder_mode_valid(i915, mode); -+ if (status != MODE_OK) -+ return status; - - if (mode->flags & DRM_MODE_FLAG_DBLSCAN) - return MODE_NO_DBLESCAN; -diff --git a/drivers/gpu/drm/i915/display/vlv_dsi.c b/drivers/gpu/drm/i915/display/vlv_dsi.c -index 00c80f29ad999..114088ca59ed4 100644 ---- a/drivers/gpu/drm/i915/display/vlv_dsi.c -+++ b/drivers/gpu/drm/i915/display/vlv_dsi.c -@@ -1627,9 +1627,25 @@ static const struct drm_encoder_funcs intel_dsi_funcs = { - .destroy = intel_dsi_encoder_destroy, - }; - -+static enum drm_mode_status vlv_dsi_mode_valid(struct drm_connector *connector, -+ struct drm_display_mode *mode) -+{ -+ struct drm_i915_private *i915 = to_i915(connector->dev); -+ -+ if (IS_VALLEYVIEW(i915) || IS_CHERRYVIEW(i915)) { -+ enum drm_mode_status status; -+ -+ status = intel_cpu_transcoder_mode_valid(i915, mode); -+ if (status != MODE_OK) -+ return status; -+ } -+ -+ return intel_dsi_mode_valid(connector, mode); -+} -+ - static const struct drm_connector_helper_funcs intel_dsi_connector_helper_funcs = { - .get_modes = intel_dsi_get_modes, -- .mode_valid = intel_dsi_mode_valid, -+ .mode_valid = vlv_dsi_mode_valid, - .atomic_check = intel_digital_connector_atomic_check, - }; - -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index 25015996f627a..c6766704340eb 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -2681,52 +2681,50 @@ - * Enables the LVDS port. This bit must be set before DPLLs are enabled, as - * the DPLL semantics change when the LVDS is assigned to that pipe. - */ --#define LVDS_PORT_EN (1 << 31) -+#define LVDS_PORT_EN REG_BIT(31) - /* Selects pipe B for LVDS data. Must be set on pre-965. */ --#define LVDS_PIPE_SEL_SHIFT 30 --#define LVDS_PIPE_SEL_MASK (1 << 30) --#define LVDS_PIPE_SEL(pipe) ((pipe) << 30) --#define LVDS_PIPE_SEL_SHIFT_CPT 29 --#define LVDS_PIPE_SEL_MASK_CPT (3 << 29) --#define LVDS_PIPE_SEL_CPT(pipe) ((pipe) << 29) -+#define LVDS_PIPE_SEL_MASK REG_BIT(30) -+#define LVDS_PIPE_SEL(pipe) REG_FIELD_PREP(LVDS_PIPE_SEL_MASK, (pipe)) -+#define LVDS_PIPE_SEL_MASK_CPT REG_GENMASK(30, 29) -+#define LVDS_PIPE_SEL_CPT(pipe) REG_FIELD_PREP(LVDS_PIPE_SEL_MASK_CPT, (pipe)) - /* LVDS dithering flag on 965/g4x platform */ --#define LVDS_ENABLE_DITHER (1 << 25) -+#define LVDS_ENABLE_DITHER REG_BIT(25) - /* LVDS sync polarity flags. Set to invert (i.e. negative) */ --#define LVDS_VSYNC_POLARITY (1 << 21) --#define LVDS_HSYNC_POLARITY (1 << 20) -+#define LVDS_VSYNC_POLARITY REG_BIT(21) -+#define LVDS_HSYNC_POLARITY REG_BIT(20) - - /* Enable border for unscaled (or aspect-scaled) display */ --#define LVDS_BORDER_ENABLE (1 << 15) -+#define LVDS_BORDER_ENABLE REG_BIT(15) - /* - * Enables the A0-A2 data pairs and CLKA, containing 18 bits of color data per - * pixel. - */ --#define LVDS_A0A2_CLKA_POWER_MASK (3 << 8) --#define LVDS_A0A2_CLKA_POWER_DOWN (0 << 8) --#define LVDS_A0A2_CLKA_POWER_UP (3 << 8) -+#define LVDS_A0A2_CLKA_POWER_MASK REG_GENMASK(9, 8) -+#define LVDS_A0A2_CLKA_POWER_DOWN REG_FIELD_PREP(LVDS_A0A2_CLKA_POWER_MASK, 0) -+#define LVDS_A0A2_CLKA_POWER_UP REG_FIELD_PREP(LVDS_A0A2_CLKA_POWER_MASK, 3) - /* - * Controls the A3 data pair, which contains the additional LSBs for 24 bit - * mode. Only enabled if LVDS_A0A2_CLKA_POWER_UP also indicates it should be - * on. - */ --#define LVDS_A3_POWER_MASK (3 << 6) --#define LVDS_A3_POWER_DOWN (0 << 6) --#define LVDS_A3_POWER_UP (3 << 6) -+#define LVDS_A3_POWER_MASK REG_GENMASK(7, 6) -+#define LVDS_A3_POWER_DOWN REG_FIELD_PREP(LVDS_A3_POWER_MASK, 0) -+#define LVDS_A3_POWER_UP REG_FIELD_PREP(LVDS_A3_POWER_MASK, 3) - /* - * Controls the CLKB pair. This should only be set when LVDS_B0B3_POWER_UP - * is set. - */ --#define LVDS_CLKB_POWER_MASK (3 << 4) --#define LVDS_CLKB_POWER_DOWN (0 << 4) --#define LVDS_CLKB_POWER_UP (3 << 4) -+#define LVDS_CLKB_POWER_MASK REG_GENMASK(5, 4) -+#define LVDS_CLKB_POWER_DOWN REG_FIELD_PREP(LVDS_CLKB_POWER_MASK, 0) -+#define LVDS_CLKB_POWER_UP REG_FIELD_PREP(LVDS_CLKB_POWER_MASK, 3) - /* - * Controls the B0-B3 data pairs. This must be set to match the DPLL p2 - * setting for whether we are in dual-channel mode. The B3 pair will - * additionally only be powered up when LVDS_A3_POWER_UP is set. - */ --#define LVDS_B0B3_POWER_MASK (3 << 2) --#define LVDS_B0B3_POWER_DOWN (0 << 2) --#define LVDS_B0B3_POWER_UP (3 << 2) -+#define LVDS_B0B3_POWER_MASK REG_GENMASK(3, 2) -+#define LVDS_B0B3_POWER_DOWN REG_FIELD_PREP(LVDS_B0B3_POWER_MASK, 0) -+#define LVDS_B0B3_POWER_UP REG_FIELD_PREP(LVDS_B0B3_POWER_MASK, 3) - - /* Video Data Island Packet control */ - #define VIDEO_DIP_DATA _MMIO(0x61178) -@@ -6461,7 +6459,7 @@ - #define FDI_PLL_CTL_2 _MMIO(0xfe004) - - #define PCH_LVDS _MMIO(0xe1180) --#define LVDS_DETECTED (1 << 1) -+#define LVDS_DETECTED REG_BIT(1) - - #define _PCH_DP_B 0xe4100 - #define PCH_DP_B _MMIO(_PCH_DP_B) -diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c -index 0962c12eba5a0..2147afb725581 100644 ---- a/drivers/hwmon/acpi_power_meter.c -+++ b/drivers/hwmon/acpi_power_meter.c -@@ -31,6 +31,7 @@ - #define POWER_METER_CAN_NOTIFY (1 << 3) - #define POWER_METER_IS_BATTERY (1 << 8) - #define UNKNOWN_HYSTERESIS 0xFFFFFFFF -+#define UNKNOWN_POWER 0xFFFFFFFF - - #define METER_NOTIFY_CONFIG 0x80 - #define METER_NOTIFY_TRIP 0x81 -@@ -348,6 +349,9 @@ static ssize_t show_power(struct device *dev, - update_meter(resource); - mutex_unlock(&resource->lock); - -+ if (resource->power == UNKNOWN_POWER) -+ return -ENODATA; -+ - return sprintf(buf, "%llu\n", resource->power * 1000); - } - -diff --git a/drivers/hwmon/nzxt-kraken2.c b/drivers/hwmon/nzxt-kraken2.c -index 89f7ea4f42d47..badbcaf01f90b 100644 ---- a/drivers/hwmon/nzxt-kraken2.c -+++ b/drivers/hwmon/nzxt-kraken2.c -@@ -161,13 +161,13 @@ static int kraken2_probe(struct hid_device *hdev, - ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW); - if (ret) { - hid_err(hdev, "hid hw start failed with %d\n", ret); -- goto fail_and_stop; -+ return ret; - } - - ret = hid_hw_open(hdev); - if (ret) { - hid_err(hdev, "hid hw open failed with %d\n", ret); -- goto fail_and_close; -+ goto fail_and_stop; - } - - priv->hwmon_dev = hwmon_device_register_with_info(&hdev->dev, "kraken2", -diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c -index 1cf7478da6ee8..fda48a0afc1a5 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c -+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c -@@ -2072,7 +2072,7 @@ static void clear_etmdrvdata(void *info) - etmdrvdata[cpu] = NULL; - } - --static int __exit etm4_remove_dev(struct etmv4_drvdata *drvdata) -+static void etm4_remove_dev(struct etmv4_drvdata *drvdata) - { - etm_perf_symlink(drvdata->csdev, false); - /* -@@ -2094,10 +2094,9 @@ static int __exit etm4_remove_dev(struct etmv4_drvdata *drvdata) - cscfg_unregister_csdev(drvdata->csdev); - coresight_unregister(drvdata->csdev); - -- return 0; - } - --static void __exit etm4_remove_amba(struct amba_device *adev) -+static void etm4_remove_amba(struct amba_device *adev) - { - struct etmv4_drvdata *drvdata = dev_get_drvdata(&adev->dev); - -@@ -2105,15 +2104,14 @@ static void __exit etm4_remove_amba(struct amba_device *adev) - etm4_remove_dev(drvdata); - } - --static int __exit etm4_remove_platform_dev(struct platform_device *pdev) -+static int etm4_remove_platform_dev(struct platform_device *pdev) - { -- int ret = 0; - struct etmv4_drvdata *drvdata = dev_get_drvdata(&pdev->dev); - - if (drvdata) -- ret = etm4_remove_dev(drvdata); -+ etm4_remove_dev(drvdata); - pm_runtime_disable(&pdev->dev); -- return ret; -+ return 0; - } - - static const struct amba_id etm4_ids[] = { -diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c -index 4140efd664097..016220ba0addd 100644 ---- a/drivers/hwtracing/ptt/hisi_ptt.c -+++ b/drivers/hwtracing/ptt/hisi_ptt.c -@@ -837,6 +837,10 @@ static void hisi_ptt_pmu_del(struct perf_event *event, int flags) - hisi_ptt_pmu_stop(event, PERF_EF_UPDATE); - } - -+static void hisi_ptt_pmu_read(struct perf_event *event) -+{ -+} -+ - static void hisi_ptt_remove_cpuhp_instance(void *hotplug_node) - { - cpuhp_state_remove_instance_nocalls(hisi_ptt_pmu_online, hotplug_node); -@@ -880,6 +884,7 @@ static int hisi_ptt_register_pmu(struct hisi_ptt *hisi_ptt) - .stop = hisi_ptt_pmu_stop, - .add = hisi_ptt_pmu_add, - .del = hisi_ptt_pmu_del, -+ .read = hisi_ptt_pmu_read, - }; - - reg = readl(hisi_ptt->iobase + HISI_PTT_LOCATION); -diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c -index 6fdb25a5f8016..ad98c85ec2e7a 100644 ---- a/drivers/i2c/busses/i2c-designware-common.c -+++ b/drivers/i2c/busses/i2c-designware-common.c -@@ -63,7 +63,7 @@ static int dw_reg_read(void *context, unsigned int reg, unsigned int *val) - { - struct dw_i2c_dev *dev = context; - -- *val = readl_relaxed(dev->base + reg); -+ *val = readl(dev->base + reg); - - return 0; - } -@@ -72,7 +72,7 @@ static int dw_reg_write(void *context, unsigned int reg, unsigned int val) - { - struct dw_i2c_dev *dev = context; - -- writel_relaxed(val, dev->base + reg); -+ writel(val, dev->base + reg); - - return 0; - } -@@ -81,7 +81,7 @@ static int dw_reg_read_swab(void *context, unsigned int reg, unsigned int *val) - { - struct dw_i2c_dev *dev = context; - -- *val = swab32(readl_relaxed(dev->base + reg)); -+ *val = swab32(readl(dev->base + reg)); - - return 0; - } -@@ -90,7 +90,7 @@ static int dw_reg_write_swab(void *context, unsigned int reg, unsigned int val) - { - struct dw_i2c_dev *dev = context; - -- writel_relaxed(swab32(val), dev->base + reg); -+ writel(swab32(val), dev->base + reg); - - return 0; - } -@@ -99,8 +99,8 @@ static int dw_reg_read_word(void *context, unsigned int reg, unsigned int *val) - { - struct dw_i2c_dev *dev = context; - -- *val = readw_relaxed(dev->base + reg) | -- (readw_relaxed(dev->base + reg + 2) << 16); -+ *val = readw(dev->base + reg) | -+ (readw(dev->base + reg + 2) << 16); - - return 0; - } -@@ -109,8 +109,8 @@ static int dw_reg_write_word(void *context, unsigned int reg, unsigned int val) - { - struct dw_i2c_dev *dev = context; - -- writew_relaxed(val, dev->base + reg); -- writew_relaxed(val >> 16, dev->base + reg + 2); -+ writew(val, dev->base + reg); -+ writew(val >> 16, dev->base + reg + 2); - - return 0; - } -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index 957634eceba8f..8ce569bf7525e 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -96,12 +96,6 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, - return page_size; - } - -- /* rdma_for_each_block() has a bug if the page size is smaller than the -- * page size used to build the umem. For now prevent smaller page sizes -- * from being returned. -- */ -- pgsz_bitmap &= GENMASK(BITS_PER_LONG - 1, PAGE_SHIFT); -- - /* The best result is the smallest page size that results in the minimum - * number of required pages. Compute the largest page size that could - * work based on VA address bits that don't change. -diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c -index e58893387bb4d..43d396a7d8e16 100644 ---- a/drivers/infiniband/hw/bnxt_re/main.c -+++ b/drivers/infiniband/hw/bnxt_re/main.c -@@ -70,7 +70,7 @@ static char version[] = - BNXT_RE_DESC "\n"; - - MODULE_AUTHOR("Eddie Wai "); --MODULE_DESCRIPTION(BNXT_RE_DESC " Driver"); -+MODULE_DESCRIPTION(BNXT_RE_DESC); - MODULE_LICENSE("Dual BSD/GPL"); - - /* globals */ -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index 8a9d28f81149a..c2ee80546d120 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -4913,10 +4913,15 @@ static int check_cong_type(struct ib_qp *ibqp, - cong_alg->wnd_mode_sel = WND_LIMIT; - break; - default: -- ibdev_err(&hr_dev->ib_dev, -- "error type(%u) for congestion selection.\n", -- hr_dev->caps.cong_type); -- return -EINVAL; -+ ibdev_warn(&hr_dev->ib_dev, -+ "invalid type(%u) for congestion selection.\n", -+ hr_dev->caps.cong_type); -+ hr_dev->caps.cong_type = CONG_TYPE_DCQCN; -+ cong_alg->alg_sel = CONG_DCQCN; -+ cong_alg->alg_sub_sel = UNSUPPORT_CONG_LEVEL; -+ cong_alg->dip_vld = DIP_INVALID; -+ cong_alg->wnd_mode_sel = WND_LIMIT; -+ break; - } - - return 0; -diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c -index c07ce85d243f1..311a1138e838d 100644 ---- a/drivers/infiniband/hw/irdma/hw.c -+++ b/drivers/infiniband/hw/irdma/hw.c -@@ -322,7 +322,11 @@ static void irdma_process_aeq(struct irdma_pci_f *rf) - break; - case IRDMA_AE_QP_SUSPEND_COMPLETE: - if (iwqp->iwdev->vsi.tc_change_pending) { -- atomic_dec(&iwqp->sc_qp.vsi->qp_suspend_reqs); -+ if (!atomic_dec_return(&qp->vsi->qp_suspend_reqs)) -+ wake_up(&iwqp->iwdev->suspend_wq); -+ } -+ if (iwqp->suspend_pending) { -+ iwqp->suspend_pending = false; - wake_up(&iwqp->iwdev->suspend_wq); - } - break; -@@ -568,16 +572,13 @@ static void irdma_destroy_irq(struct irdma_pci_f *rf, - * Issue destroy cqp request and - * free the resources associated with the cqp - */ --static void irdma_destroy_cqp(struct irdma_pci_f *rf, bool free_hwcqp) -+static void irdma_destroy_cqp(struct irdma_pci_f *rf) - { - struct irdma_sc_dev *dev = &rf->sc_dev; - struct irdma_cqp *cqp = &rf->cqp; - int status = 0; - -- if (rf->cqp_cmpl_wq) -- destroy_workqueue(rf->cqp_cmpl_wq); -- if (free_hwcqp) -- status = irdma_sc_cqp_destroy(dev->cqp); -+ status = irdma_sc_cqp_destroy(dev->cqp); - if (status) - ibdev_dbg(to_ibdev(dev), "ERR: Destroy CQP failed %d\n", status); - -@@ -741,6 +742,9 @@ static void irdma_destroy_ccq(struct irdma_pci_f *rf) - struct irdma_ccq *ccq = &rf->ccq; - int status = 0; - -+ if (rf->cqp_cmpl_wq) -+ destroy_workqueue(rf->cqp_cmpl_wq); -+ - if (!rf->reset) - status = irdma_sc_ccq_destroy(dev->ccq, 0, true); - if (status) -@@ -921,8 +925,8 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) - - cqp->scratch_array = kcalloc(sqsize, sizeof(*cqp->scratch_array), GFP_KERNEL); - if (!cqp->scratch_array) { -- kfree(cqp->cqp_requests); -- return -ENOMEM; -+ status = -ENOMEM; -+ goto err_scratch; - } - - dev->cqp = &cqp->sc_cqp; -@@ -932,15 +936,14 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) - cqp->sq.va = dma_alloc_coherent(dev->hw->device, cqp->sq.size, - &cqp->sq.pa, GFP_KERNEL); - if (!cqp->sq.va) { -- kfree(cqp->scratch_array); -- kfree(cqp->cqp_requests); -- return -ENOMEM; -+ status = -ENOMEM; -+ goto err_sq; - } - - status = irdma_obj_aligned_mem(rf, &mem, sizeof(struct irdma_cqp_ctx), - IRDMA_HOST_CTX_ALIGNMENT_M); - if (status) -- goto exit; -+ goto err_ctx; - - dev->cqp->host_ctx_pa = mem.pa; - dev->cqp->host_ctx = mem.va; -@@ -966,7 +969,7 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) - status = irdma_sc_cqp_init(dev->cqp, &cqp_init_info); - if (status) { - ibdev_dbg(to_ibdev(dev), "ERR: cqp init status %d\n", status); -- goto exit; -+ goto err_ctx; - } - - spin_lock_init(&cqp->req_lock); -@@ -977,7 +980,7 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) - ibdev_dbg(to_ibdev(dev), - "ERR: cqp create failed - status %d maj_err %d min_err %d\n", - status, maj_err, min_err); -- goto exit; -+ goto err_ctx; - } - - INIT_LIST_HEAD(&cqp->cqp_avail_reqs); -@@ -991,8 +994,16 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) - init_waitqueue_head(&cqp->remove_wq); - return 0; - --exit: -- irdma_destroy_cqp(rf, false); -+err_ctx: -+ dma_free_coherent(dev->hw->device, cqp->sq.size, -+ cqp->sq.va, cqp->sq.pa); -+ cqp->sq.va = NULL; -+err_sq: -+ kfree(cqp->scratch_array); -+ cqp->scratch_array = NULL; -+err_scratch: -+ kfree(cqp->cqp_requests); -+ cqp->cqp_requests = NULL; - - return status; - } -@@ -1159,7 +1170,6 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq, - int status; - struct irdma_ceq_init_info info = {}; - struct irdma_sc_dev *dev = &rf->sc_dev; -- u64 scratch; - u32 ceq_size; - - info.ceq_id = ceq_id; -@@ -1180,14 +1190,13 @@ static int irdma_create_ceq(struct irdma_pci_f *rf, struct irdma_ceq *iwceq, - iwceq->sc_ceq.ceq_id = ceq_id; - info.dev = dev; - info.vsi = vsi; -- scratch = (uintptr_t)&rf->cqp.sc_cqp; - status = irdma_sc_ceq_init(&iwceq->sc_ceq, &info); - if (!status) { - if (dev->ceq_valid) - status = irdma_cqp_ceq_cmd(&rf->sc_dev, &iwceq->sc_ceq, - IRDMA_OP_CEQ_CREATE); - else -- status = irdma_sc_cceq_create(&iwceq->sc_ceq, scratch); -+ status = irdma_sc_cceq_create(&iwceq->sc_ceq, 0); - } - - if (status) { -@@ -1740,7 +1749,7 @@ void irdma_ctrl_deinit_hw(struct irdma_pci_f *rf) - rf->reset, rf->rdma_ver); - fallthrough; - case CQP_CREATED: -- irdma_destroy_cqp(rf, true); -+ irdma_destroy_cqp(rf); - fallthrough; - case INITIAL_STATE: - irdma_del_init_mem(rf); -diff --git a/drivers/infiniband/hw/irdma/main.c b/drivers/infiniband/hw/irdma/main.c -index 514453777e07d..be1030d1adfaf 100644 ---- a/drivers/infiniband/hw/irdma/main.c -+++ b/drivers/infiniband/hw/irdma/main.c -@@ -48,7 +48,7 @@ static void irdma_prep_tc_change(struct irdma_device *iwdev) - /* Wait for all qp's to suspend */ - wait_event_timeout(iwdev->suspend_wq, - !atomic_read(&iwdev->vsi.qp_suspend_reqs), -- IRDMA_EVENT_TIMEOUT); -+ msecs_to_jiffies(IRDMA_EVENT_TIMEOUT_MS)); - irdma_ws_reset(&iwdev->vsi); - } - -diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h -index 9cbe64311f985..6a6b14d8fca45 100644 ---- a/drivers/infiniband/hw/irdma/main.h -+++ b/drivers/infiniband/hw/irdma/main.h -@@ -78,7 +78,7 @@ extern struct auxiliary_driver i40iw_auxiliary_drv; - - #define MAX_DPC_ITERATIONS 128 - --#define IRDMA_EVENT_TIMEOUT 50000 -+#define IRDMA_EVENT_TIMEOUT_MS 5000 - #define IRDMA_VCHNL_EVENT_TIMEOUT 100000 - #define IRDMA_RST_TIMEOUT_HZ 4 - -diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c -index 3b8b2341981ea..447e1bcc82a32 100644 ---- a/drivers/infiniband/hw/irdma/verbs.c -+++ b/drivers/infiniband/hw/irdma/verbs.c -@@ -1098,6 +1098,21 @@ static int irdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index, - return 0; - } - -+static int irdma_wait_for_suspend(struct irdma_qp *iwqp) -+{ -+ if (!wait_event_timeout(iwqp->iwdev->suspend_wq, -+ !iwqp->suspend_pending, -+ msecs_to_jiffies(IRDMA_EVENT_TIMEOUT_MS))) { -+ iwqp->suspend_pending = false; -+ ibdev_warn(&iwqp->iwdev->ibdev, -+ "modify_qp timed out waiting for suspend. qp_id = %d, last_ae = 0x%x\n", -+ iwqp->ibqp.qp_num, iwqp->last_aeq); -+ return -EBUSY; -+ } -+ -+ return 0; -+} -+ - /** - * irdma_modify_qp_roce - modify qp request - * @ibqp: qp's pointer for modify -@@ -1359,17 +1374,11 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, - - info.next_iwarp_state = IRDMA_QP_STATE_SQD; - issue_modify_qp = 1; -+ iwqp->suspend_pending = true; - break; - case IB_QPS_SQE: - case IB_QPS_ERR: - case IB_QPS_RESET: -- if (iwqp->iwarp_state == IRDMA_QP_STATE_RTS) { -- spin_unlock_irqrestore(&iwqp->lock, flags); -- info.next_iwarp_state = IRDMA_QP_STATE_SQD; -- irdma_hw_modify_qp(iwdev, iwqp, &info, true); -- spin_lock_irqsave(&iwqp->lock, flags); -- } -- - if (iwqp->iwarp_state == IRDMA_QP_STATE_ERROR) { - spin_unlock_irqrestore(&iwqp->lock, flags); - if (udata && udata->inlen) { -@@ -1406,6 +1415,11 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, - ctx_info->rem_endpoint_idx = udp_info->arp_idx; - if (irdma_hw_modify_qp(iwdev, iwqp, &info, true)) - return -EINVAL; -+ if (info.next_iwarp_state == IRDMA_QP_STATE_SQD) { -+ ret = irdma_wait_for_suspend(iwqp); -+ if (ret) -+ return ret; -+ } - spin_lock_irqsave(&iwqp->lock, flags); - if (iwqp->iwarp_state == info.curr_iwarp_state) { - iwqp->iwarp_state = info.next_iwarp_state; -diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h -index a536e9fa85ebf..9f9e273bbff3e 100644 ---- a/drivers/infiniband/hw/irdma/verbs.h -+++ b/drivers/infiniband/hw/irdma/verbs.h -@@ -193,6 +193,7 @@ struct irdma_qp { - u8 flush_issued : 1; - u8 sig_all : 1; - u8 pau_mode : 1; -+ u8 suspend_pending : 1; - u8 rsvd : 1; - u8 iwarp_state; - u16 term_sq_flush_code; -diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c -index a67f58359de9e..cc07c91f9c549 100644 ---- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c -+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c -@@ -382,7 +382,7 @@ static void complete_rdma_req(struct rtrs_clt_io_req *req, int errno, - struct rtrs_clt_path *clt_path; - int err; - -- if (WARN_ON(!req->in_use)) -+ if (!req->in_use) - return; - if (WARN_ON(!req->con)) - return; -@@ -1694,7 +1694,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con) - clt_path->s.dev_ref++; - max_send_wr = min_t(int, wr_limit, - /* QD * (REQ + RSP + FR REGS or INVS) + drain */ -- clt_path->queue_depth * 3 + 1); -+ clt_path->queue_depth * 4 + 1); - max_recv_wr = min_t(int, wr_limit, - clt_path->queue_depth * 3 + 1); - max_send_sge = 2; -@@ -2346,8 +2346,6 @@ static int init_conns(struct rtrs_clt_path *clt_path) - if (err) - goto destroy; - -- rtrs_start_hb(&clt_path->s); -- - return 0; - - destroy: -@@ -2621,6 +2619,7 @@ static int init_path(struct rtrs_clt_path *clt_path) - goto out; - } - rtrs_clt_path_up(clt_path); -+ rtrs_start_hb(&clt_path->s); - out: - mutex_unlock(&clt_path->init_mutex); - -diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c -index 22d7ba05e9fe8..e978ee4bb73ae 100644 ---- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c -+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c -@@ -63,8 +63,9 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, - { - enum rtrs_srv_state old_state; - bool changed = false; -+ unsigned long flags; - -- spin_lock_irq(&srv_path->state_lock); -+ spin_lock_irqsave(&srv_path->state_lock, flags); - old_state = srv_path->state; - switch (new_state) { - case RTRS_SRV_CONNECTED: -@@ -85,7 +86,7 @@ static bool rtrs_srv_change_state(struct rtrs_srv_path *srv_path, - } - if (changed) - srv_path->state = new_state; -- spin_unlock_irq(&srv_path->state_lock); -+ spin_unlock_irqrestore(&srv_path->state_lock, flags); - - return changed; - } -@@ -548,7 +549,10 @@ static void unmap_cont_bufs(struct rtrs_srv_path *srv_path) - struct rtrs_srv_mr *srv_mr; - - srv_mr = &srv_path->mrs[i]; -- rtrs_iu_free(srv_mr->iu, srv_path->s.dev->ib_dev, 1); -+ -+ if (always_invalidate) -+ rtrs_iu_free(srv_mr->iu, srv_path->s.dev->ib_dev, 1); -+ - ib_dereg_mr(srv_mr->mr); - ib_dma_unmap_sg(srv_path->s.dev->ib_dev, srv_mr->sgt.sgl, - srv_mr->sgt.nents, DMA_BIDIRECTIONAL); -@@ -714,20 +718,23 @@ static void rtrs_srv_info_rsp_done(struct ib_cq *cq, struct ib_wc *wc) - WARN_ON(wc->opcode != IB_WC_SEND); - } - --static void rtrs_srv_path_up(struct rtrs_srv_path *srv_path) -+static int rtrs_srv_path_up(struct rtrs_srv_path *srv_path) - { - struct rtrs_srv_sess *srv = srv_path->srv; - struct rtrs_srv_ctx *ctx = srv->ctx; -- int up; -+ int up, ret = 0; - - mutex_lock(&srv->paths_ev_mutex); - up = ++srv->paths_up; - if (up == 1) -- ctx->ops.link_ev(srv, RTRS_SRV_LINK_EV_CONNECTED, NULL); -+ ret = ctx->ops.link_ev(srv, RTRS_SRV_LINK_EV_CONNECTED, NULL); - mutex_unlock(&srv->paths_ev_mutex); - - /* Mark session as established */ -- srv_path->established = true; -+ if (!ret) -+ srv_path->established = true; -+ -+ return ret; - } - - static void rtrs_srv_path_down(struct rtrs_srv_path *srv_path) -@@ -856,7 +863,12 @@ static int process_info_req(struct rtrs_srv_con *con, - goto iu_free; - kobject_get(&srv_path->kobj); - get_device(&srv_path->srv->dev); -- rtrs_srv_change_state(srv_path, RTRS_SRV_CONNECTED); -+ err = rtrs_srv_change_state(srv_path, RTRS_SRV_CONNECTED); -+ if (!err) { -+ rtrs_err(s, "rtrs_srv_change_state(), err: %d\n", err); -+ goto iu_free; -+ } -+ - rtrs_srv_start_hb(srv_path); - - /* -@@ -865,7 +877,11 @@ static int process_info_req(struct rtrs_srv_con *con, - * all connections are successfully established. Thus, simply notify - * listener with a proper event if we are the first path. - */ -- rtrs_srv_path_up(srv_path); -+ err = rtrs_srv_path_up(srv_path); -+ if (err) { -+ rtrs_err(s, "rtrs_srv_path_up(), err: %d\n", err); -+ goto iu_free; -+ } - - ib_dma_sync_single_for_device(srv_path->s.dev->ib_dev, - tx_iu->dma_addr, -@@ -1521,7 +1537,6 @@ static void rtrs_srv_close_work(struct work_struct *work) - - srv_path = container_of(work, typeof(*srv_path), close_work); - -- rtrs_srv_destroy_path_files(srv_path); - rtrs_srv_stop_hb(srv_path); - - for (i = 0; i < srv_path->s.con_num; i++) { -@@ -1541,6 +1556,8 @@ static void rtrs_srv_close_work(struct work_struct *work) - /* Wait for all completion */ - wait_for_completion(&srv_path->complete_done); - -+ rtrs_srv_destroy_path_files(srv_path); -+ - /* Notify upper layer if we are the last path */ - rtrs_srv_path_down(srv_path); - -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 2bcd1f23d07d2..8b38972394776 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -278,12 +278,13 @@ static void dev_iommu_free(struct device *dev) - kfree(param); - } - -+DEFINE_MUTEX(iommu_probe_device_lock); -+ - static int __iommu_probe_device(struct device *dev, struct list_head *group_list) - { - const struct iommu_ops *ops = dev->bus->iommu_ops; - struct iommu_device *iommu_dev; - struct iommu_group *group; -- static DEFINE_MUTEX(iommu_probe_device_lock); - int ret; - - if (!ops) -@@ -295,11 +296,9 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list - * probably be able to use device_lock() here to minimise the scope, - * but for now enforcing a simple global ordering is fine. - */ -- mutex_lock(&iommu_probe_device_lock); -- if (!dev_iommu_get(dev)) { -- ret = -ENOMEM; -- goto err_unlock; -- } -+ lockdep_assert_held(&iommu_probe_device_lock); -+ if (!dev_iommu_get(dev)) -+ return -ENOMEM; - - if (!try_module_get(ops->owner)) { - ret = -EINVAL; -@@ -326,7 +325,6 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_list - mutex_unlock(&group->mutex); - iommu_group_put(group); - -- mutex_unlock(&iommu_probe_device_lock); - iommu_device_link(iommu_dev, dev); - - return 0; -@@ -341,9 +339,6 @@ out_module_put: - err_free: - dev_iommu_free(dev); - --err_unlock: -- mutex_unlock(&iommu_probe_device_lock); -- - return ret; - } - -@@ -353,7 +348,9 @@ int iommu_probe_device(struct device *dev) - struct iommu_group *group; - int ret; - -+ mutex_lock(&iommu_probe_device_lock); - ret = __iommu_probe_device(dev, NULL); -+ mutex_unlock(&iommu_probe_device_lock); - if (ret) - goto err_out; - -@@ -1684,7 +1681,9 @@ static int probe_iommu_group(struct device *dev, void *data) - return 0; - } - -+ mutex_lock(&iommu_probe_device_lock); - ret = __iommu_probe_device(dev, group_list); -+ mutex_unlock(&iommu_probe_device_lock); - if (ret == -ENODEV) - ret = 0; - -diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c -index 5696314ae69e7..1fa1db3be8529 100644 ---- a/drivers/iommu/of_iommu.c -+++ b/drivers/iommu/of_iommu.c -@@ -112,16 +112,20 @@ const struct iommu_ops *of_iommu_configure(struct device *dev, - const u32 *id) - { - const struct iommu_ops *ops = NULL; -- struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); -+ struct iommu_fwspec *fwspec; - int err = NO_IOMMU; - - if (!master_np) - return NULL; - -+ /* Serialise to make dev->iommu stable under our potential fwspec */ -+ mutex_lock(&iommu_probe_device_lock); -+ fwspec = dev_iommu_fwspec_get(dev); - if (fwspec) { -- if (fwspec->ops) -+ if (fwspec->ops) { -+ mutex_unlock(&iommu_probe_device_lock); - return fwspec->ops; -- -+ } - /* In the deferred case, start again from scratch */ - iommu_fwspec_free(dev); - } -@@ -155,6 +159,8 @@ const struct iommu_ops *of_iommu_configure(struct device *dev, - fwspec = dev_iommu_fwspec_get(dev); - ops = fwspec->ops; - } -+ mutex_unlock(&iommu_probe_device_lock); -+ - /* - * If we have reason to believe the IOMMU driver missed the initial - * probe for dev, replay it to get things in order. -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 20f67edae95d0..0c2801d770901 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -93,6 +93,18 @@ static int remove_and_add_spares(struct mddev *mddev, - struct md_rdev *this); - static void mddev_detach(struct mddev *mddev); - -+enum md_ro_state { -+ MD_RDWR, -+ MD_RDONLY, -+ MD_AUTO_READ, -+ MD_MAX_STATE -+}; -+ -+static bool md_is_rdwr(struct mddev *mddev) -+{ -+ return (mddev->ro == MD_RDWR); -+} -+ - /* - * Default number of read corrections we'll attempt on an rdev - * before ejecting it from the array. We divide the read error -@@ -444,7 +456,7 @@ static void md_submit_bio(struct bio *bio) - if (!bio) - return; - -- if (mddev->ro == 1 && unlikely(rw == WRITE)) { -+ if (mddev->ro == MD_RDONLY && unlikely(rw == WRITE)) { - if (bio_sectors(bio) != 0) - bio->bi_status = BLK_STS_IOERR; - bio_endio(bio); -@@ -2643,7 +2655,7 @@ void md_update_sb(struct mddev *mddev, int force_change) - int any_badblocks_changed = 0; - int ret = -1; - -- if (mddev->ro) { -+ if (!md_is_rdwr(mddev)) { - if (force_change) - set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags); - return; -@@ -3909,7 +3921,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len) - goto out_unlock; - } - rv = -EROFS; -- if (mddev->ro) -+ if (!md_is_rdwr(mddev)) - goto out_unlock; - - /* request to change the personality. Need to ensure: -@@ -4115,7 +4127,7 @@ layout_store(struct mddev *mddev, const char *buf, size_t len) - if (mddev->pers) { - if (mddev->pers->check_reshape == NULL) - err = -EBUSY; -- else if (mddev->ro) -+ else if (!md_is_rdwr(mddev)) - err = -EROFS; - else { - mddev->new_layout = n; -@@ -4224,7 +4236,7 @@ chunk_size_store(struct mddev *mddev, const char *buf, size_t len) - if (mddev->pers) { - if (mddev->pers->check_reshape == NULL) - err = -EBUSY; -- else if (mddev->ro) -+ else if (!md_is_rdwr(mddev)) - err = -EROFS; - else { - mddev->new_chunk_sectors = n >> 9; -@@ -4347,13 +4359,13 @@ array_state_show(struct mddev *mddev, char *page) - - if (mddev->pers && !test_bit(MD_NOT_READY, &mddev->flags)) { - switch(mddev->ro) { -- case 1: -+ case MD_RDONLY: - st = readonly; - break; -- case 2: -+ case MD_AUTO_READ: - st = read_auto; - break; -- case 0: -+ case MD_RDWR: - spin_lock(&mddev->lock); - if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) - st = write_pending; -@@ -4389,7 +4401,8 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) - int err = 0; - enum array_state st = match_word(buf, array_states); - -- if (mddev->pers && (st == active || st == clean) && mddev->ro != 1) { -+ if (mddev->pers && (st == active || st == clean) && -+ mddev->ro != MD_RDONLY) { - /* don't take reconfig_mutex when toggling between - * clean and active - */ -@@ -4433,23 +4446,23 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) - if (mddev->pers) - err = md_set_readonly(mddev, NULL); - else { -- mddev->ro = 1; -+ mddev->ro = MD_RDONLY; - set_disk_ro(mddev->gendisk, 1); - err = do_md_run(mddev); - } - break; - case read_auto: - if (mddev->pers) { -- if (mddev->ro == 0) -+ if (md_is_rdwr(mddev)) - err = md_set_readonly(mddev, NULL); -- else if (mddev->ro == 1) -+ else if (mddev->ro == MD_RDONLY) - err = restart_array(mddev); - if (err == 0) { -- mddev->ro = 2; -+ mddev->ro = MD_AUTO_READ; - set_disk_ro(mddev->gendisk, 0); - } - } else { -- mddev->ro = 2; -+ mddev->ro = MD_AUTO_READ; - err = do_md_run(mddev); - } - break; -@@ -4474,7 +4487,7 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) - wake_up(&mddev->sb_wait); - err = 0; - } else { -- mddev->ro = 0; -+ mddev->ro = MD_RDWR; - set_disk_ro(mddev->gendisk, 0); - err = do_md_run(mddev); - } -@@ -4775,7 +4788,7 @@ action_show(struct mddev *mddev, char *page) - if (test_bit(MD_RECOVERY_FROZEN, &recovery)) - type = "frozen"; - else if (test_bit(MD_RECOVERY_RUNNING, &recovery) || -- (!mddev->ro && test_bit(MD_RECOVERY_NEEDED, &recovery))) { -+ (md_is_rdwr(mddev) && test_bit(MD_RECOVERY_NEEDED, &recovery))) { - if (test_bit(MD_RECOVERY_RESHAPE, &recovery)) - type = "reshape"; - else if (test_bit(MD_RECOVERY_SYNC, &recovery)) { -@@ -4861,11 +4874,11 @@ action_store(struct mddev *mddev, const char *page, size_t len) - set_bit(MD_RECOVERY_REQUESTED, &mddev->recovery); - set_bit(MD_RECOVERY_SYNC, &mddev->recovery); - } -- if (mddev->ro == 2) { -+ if (mddev->ro == MD_AUTO_READ) { - /* A write to sync_action is enough to justify - * canceling read-auto mode - */ -- mddev->ro = 0; -+ mddev->ro = MD_RDWR; - md_wakeup_thread(mddev->sync_thread); - } - set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); -@@ -5093,8 +5106,7 @@ max_sync_store(struct mddev *mddev, const char *buf, size_t len) - goto out_unlock; - - err = -EBUSY; -- if (max < mddev->resync_max && -- mddev->ro == 0 && -+ if (max < mddev->resync_max && md_is_rdwr(mddev) && - test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) - goto out_unlock; - -@@ -5829,8 +5841,8 @@ int md_run(struct mddev *mddev) - continue; - sync_blockdev(rdev->bdev); - invalidate_bdev(rdev->bdev); -- if (mddev->ro != 1 && rdev_read_only(rdev)) { -- mddev->ro = 1; -+ if (mddev->ro != MD_RDONLY && rdev_read_only(rdev)) { -+ mddev->ro = MD_RDONLY; - if (mddev->gendisk) - set_disk_ro(mddev->gendisk, 1); - } -@@ -5938,8 +5950,8 @@ int md_run(struct mddev *mddev) - - mddev->ok_start_degraded = start_dirty_degraded; - -- if (start_readonly && mddev->ro == 0) -- mddev->ro = 2; /* read-only, but switch on first write */ -+ if (start_readonly && md_is_rdwr(mddev)) -+ mddev->ro = MD_AUTO_READ; /* read-only, but switch on first write */ - - err = pers->run(mddev); - if (err) -@@ -6017,8 +6029,8 @@ int md_run(struct mddev *mddev) - mddev->sysfs_action = sysfs_get_dirent_safe(mddev->kobj.sd, "sync_action"); - mddev->sysfs_completed = sysfs_get_dirent_safe(mddev->kobj.sd, "sync_completed"); - mddev->sysfs_degraded = sysfs_get_dirent_safe(mddev->kobj.sd, "degraded"); -- } else if (mddev->ro == 2) /* auto-readonly not meaningful */ -- mddev->ro = 0; -+ } else if (mddev->ro == MD_AUTO_READ) -+ mddev->ro = MD_RDWR; - - atomic_set(&mddev->max_corr_read_errors, - MD_DEFAULT_MAX_CORRECTED_READ_ERRORS); -@@ -6036,7 +6048,7 @@ int md_run(struct mddev *mddev) - if (rdev->raid_disk >= 0) - sysfs_link_rdev(mddev, rdev); /* failure here is OK */ - -- if (mddev->degraded && !mddev->ro) -+ if (mddev->degraded && md_is_rdwr(mddev)) - /* This ensures that recovering status is reported immediately - * via sysfs - until a lack of spares is confirmed. - */ -@@ -6128,7 +6140,7 @@ static int restart_array(struct mddev *mddev) - return -ENXIO; - if (!mddev->pers) - return -EINVAL; -- if (!mddev->ro) -+ if (md_is_rdwr(mddev)) - return -EBUSY; - - rcu_read_lock(); -@@ -6147,7 +6159,7 @@ static int restart_array(struct mddev *mddev) - return -EROFS; - - mddev->safemode = 0; -- mddev->ro = 0; -+ mddev->ro = MD_RDWR; - set_disk_ro(disk, 0); - pr_debug("md: %s switched to read-write mode.\n", mdname(mddev)); - /* Kick recovery or resync if necessary */ -@@ -6174,7 +6186,7 @@ static void md_clean(struct mddev *mddev) - mddev->clevel[0] = 0; - mddev->flags = 0; - mddev->sb_flags = 0; -- mddev->ro = 0; -+ mddev->ro = MD_RDWR; - mddev->metadata_type[0] = 0; - mddev->chunk_sectors = 0; - mddev->ctime = mddev->utime = 0; -@@ -6226,7 +6238,7 @@ static void __md_stop_writes(struct mddev *mddev) - } - md_bitmap_flush(mddev); - -- if (mddev->ro == 0 && -+ if (md_is_rdwr(mddev) && - ((!mddev->in_sync && !mddev_is_clustered(mddev)) || - mddev->sb_flags)) { - /* mark array as shutdown cleanly */ -@@ -6302,6 +6314,9 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) - int err = 0; - int did_freeze = 0; - -+ if (mddev->external && test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) -+ return -EBUSY; -+ - if (!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)) { - did_freeze = 1; - set_bit(MD_RECOVERY_FROZEN, &mddev->recovery); -@@ -6314,8 +6329,6 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) - * which will now never happen */ - wake_up_process(mddev->sync_thread->tsk); - -- if (mddev->external && test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) -- return -EBUSY; - mddev_unlock(mddev); - wait_event(resync_wait, !test_bit(MD_RECOVERY_RUNNING, - &mddev->recovery)); -@@ -6328,29 +6341,30 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) - mddev->sync_thread || - test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) { - pr_warn("md: %s still in use.\n",mdname(mddev)); -- if (did_freeze) { -- clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); -- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); -- md_wakeup_thread(mddev->thread); -- } - err = -EBUSY; - goto out; - } -+ - if (mddev->pers) { - __md_stop_writes(mddev); - -- err = -ENXIO; -- if (mddev->ro==1) -+ if (mddev->ro == MD_RDONLY) { -+ err = -ENXIO; - goto out; -- mddev->ro = 1; -+ } -+ -+ mddev->ro = MD_RDONLY; - set_disk_ro(mddev->gendisk, 1); -+ } -+ -+out: -+ if ((mddev->pers && !err) || did_freeze) { - clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); - set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); - md_wakeup_thread(mddev->thread); - sysfs_notify_dirent_safe(mddev->sysfs_state); -- err = 0; - } --out: -+ - mutex_unlock(&mddev->open_mutex); - return err; - } -@@ -6399,7 +6413,7 @@ static int do_md_stop(struct mddev *mddev, int mode, - return -EBUSY; - } - if (mddev->pers) { -- if (mddev->ro) -+ if (!md_is_rdwr(mddev)) - set_disk_ro(disk, 0); - - __md_stop_writes(mddev); -@@ -6416,8 +6430,8 @@ static int do_md_stop(struct mddev *mddev, int mode, - mutex_unlock(&mddev->open_mutex); - mddev->changed = 1; - -- if (mddev->ro) -- mddev->ro = 0; -+ if (!md_is_rdwr(mddev)) -+ mddev->ro = MD_RDWR; - } else - mutex_unlock(&mddev->open_mutex); - /* -@@ -7232,7 +7246,7 @@ static int update_size(struct mddev *mddev, sector_t num_sectors) - if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) || - mddev->sync_thread) - return -EBUSY; -- if (mddev->ro) -+ if (!md_is_rdwr(mddev)) - return -EROFS; - - rdev_for_each(rdev, mddev) { -@@ -7262,7 +7276,7 @@ static int update_raid_disks(struct mddev *mddev, int raid_disks) - /* change the number of raid disks */ - if (mddev->pers->check_reshape == NULL) - return -EINVAL; -- if (mddev->ro) -+ if (!md_is_rdwr(mddev)) - return -EROFS; - if (raid_disks <= 0 || - (mddev->max_disks && raid_disks >= mddev->max_disks)) -@@ -7686,26 +7700,25 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode, - * The remaining ioctls are changing the state of the - * superblock, so we do not allow them on read-only arrays. - */ -- if (mddev->ro && mddev->pers) { -- if (mddev->ro == 2) { -- mddev->ro = 0; -- sysfs_notify_dirent_safe(mddev->sysfs_state); -- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); -- /* mddev_unlock will wake thread */ -- /* If a device failed while we were read-only, we -- * need to make sure the metadata is updated now. -- */ -- if (test_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags)) { -- mddev_unlock(mddev); -- wait_event(mddev->sb_wait, -- !test_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags) && -- !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)); -- mddev_lock_nointr(mddev); -- } -- } else { -+ if (!md_is_rdwr(mddev) && mddev->pers) { -+ if (mddev->ro != MD_AUTO_READ) { - err = -EROFS; - goto unlock; - } -+ mddev->ro = MD_RDWR; -+ sysfs_notify_dirent_safe(mddev->sysfs_state); -+ set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); -+ /* mddev_unlock will wake thread */ -+ /* If a device failed while we were read-only, we -+ * need to make sure the metadata is updated now. -+ */ -+ if (test_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags)) { -+ mddev_unlock(mddev); -+ wait_event(mddev->sb_wait, -+ !test_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags) && -+ !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)); -+ mddev_lock_nointr(mddev); -+ } - } - - switch (cmd) { -@@ -7791,11 +7804,11 @@ static int md_set_read_only(struct block_device *bdev, bool ro) - * Transitioning to read-auto need only happen for arrays that call - * md_write_start and which are not ready for writes yet. - */ -- if (!ro && mddev->ro == 1 && mddev->pers) { -+ if (!ro && mddev->ro == MD_RDONLY && mddev->pers) { - err = restart_array(mddev); - if (err) - goto out_unlock; -- mddev->ro = 2; -+ mddev->ro = MD_AUTO_READ; - } - - out_unlock: -@@ -8269,9 +8282,9 @@ static int md_seq_show(struct seq_file *seq, void *v) - seq_printf(seq, "%s : %sactive", mdname(mddev), - mddev->pers ? "" : "in"); - if (mddev->pers) { -- if (mddev->ro==1) -+ if (mddev->ro == MD_RDONLY) - seq_printf(seq, " (read-only)"); -- if (mddev->ro==2) -+ if (mddev->ro == MD_AUTO_READ) - seq_printf(seq, " (auto-read-only)"); - seq_printf(seq, " %s", mddev->pers->name); - } -@@ -8530,10 +8543,10 @@ bool md_write_start(struct mddev *mddev, struct bio *bi) - if (bio_data_dir(bi) != WRITE) - return true; - -- BUG_ON(mddev->ro == 1); -- if (mddev->ro == 2) { -+ BUG_ON(mddev->ro == MD_RDONLY); -+ if (mddev->ro == MD_AUTO_READ) { - /* need to switch to read/write */ -- mddev->ro = 0; -+ mddev->ro = MD_RDWR; - set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); - md_wakeup_thread(mddev->thread); - md_wakeup_thread(mddev->sync_thread); -@@ -8584,7 +8597,7 @@ void md_write_inc(struct mddev *mddev, struct bio *bi) - { - if (bio_data_dir(bi) != WRITE) - return; -- WARN_ON_ONCE(mddev->in_sync || mddev->ro); -+ WARN_ON_ONCE(mddev->in_sync || !md_is_rdwr(mddev)); - percpu_ref_get(&mddev->writes_pending); - } - EXPORT_SYMBOL(md_write_inc); -@@ -8690,7 +8703,7 @@ void md_allow_write(struct mddev *mddev) - { - if (!mddev->pers) - return; -- if (mddev->ro) -+ if (!md_is_rdwr(mddev)) - return; - if (!mddev->pers->sync_request) - return; -@@ -8738,7 +8751,7 @@ void md_do_sync(struct md_thread *thread) - if (test_bit(MD_RECOVERY_DONE, &mddev->recovery) || - test_bit(MD_RECOVERY_WAIT, &mddev->recovery)) - return; -- if (mddev->ro) {/* never try to sync a read-only array */ -+ if (!md_is_rdwr(mddev)) {/* never try to sync a read-only array */ - set_bit(MD_RECOVERY_INTR, &mddev->recovery); - return; - } -@@ -9207,9 +9220,9 @@ static int remove_and_add_spares(struct mddev *mddev, - if (test_bit(Faulty, &rdev->flags)) - continue; - if (!test_bit(Journal, &rdev->flags)) { -- if (mddev->ro && -- ! (rdev->saved_raid_disk >= 0 && -- !test_bit(Bitmap_sync, &rdev->flags))) -+ if (!md_is_rdwr(mddev) && -+ !(rdev->saved_raid_disk >= 0 && -+ !test_bit(Bitmap_sync, &rdev->flags))) - continue; - - rdev->recovery_offset = 0; -@@ -9307,7 +9320,8 @@ void md_check_recovery(struct mddev *mddev) - flush_signals(current); - } - -- if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery)) -+ if (!md_is_rdwr(mddev) && -+ !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery)) - return; - if ( ! ( - (mddev->sb_flags & ~ (1<external && mddev->safemode == 1) - mddev->safemode = 0; - -- if (mddev->ro) { -+ if (!md_is_rdwr(mddev)) { - struct md_rdev *rdev; - if (!mddev->external && mddev->in_sync) - /* 'Blocked' flag not needed as failed devices -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 98d4e93efa31c..e4564ca1f2434 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -5905,11 +5905,11 @@ static bool stripe_ahead_of_reshape(struct mddev *mddev, struct r5conf *conf, - int dd_idx; - - for (dd_idx = 0; dd_idx < sh->disks; dd_idx++) { -- if (dd_idx == sh->pd_idx) -+ if (dd_idx == sh->pd_idx || dd_idx == sh->qd_idx) - continue; - - min_sector = min(min_sector, sh->dev[dd_idx].sector); -- max_sector = min(max_sector, sh->dev[dd_idx].sector); -+ max_sector = max(max_sector, sh->dev[dd_idx].sector); - } - - spin_lock_irq(&conf->device_lock); -diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c -index 0b2fbe1335a77..c70c89209fe55 100644 ---- a/drivers/misc/mei/client.c -+++ b/drivers/misc/mei/client.c -@@ -1978,7 +1978,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb) - - mei_hdr = mei_msg_hdr_init(cb); - if (IS_ERR(mei_hdr)) { -- rets = -PTR_ERR(mei_hdr); -+ rets = PTR_ERR(mei_hdr); - mei_hdr = NULL; - goto err; - } -@@ -2002,7 +2002,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb) - - hbuf_slots = mei_hbuf_empty_slots(dev); - if (hbuf_slots < 0) { -- rets = -EOVERFLOW; -+ buf_len = -EOVERFLOW; - goto out; - } - -diff --git a/drivers/net/arcnet/arcdevice.h b/drivers/net/arcnet/arcdevice.h -index 19e996a829c9d..b54275389f8ac 100644 ---- a/drivers/net/arcnet/arcdevice.h -+++ b/drivers/net/arcnet/arcdevice.h -@@ -186,6 +186,8 @@ do { \ - #define ARC_IS_5MBIT 1 /* card default speed is 5MBit */ - #define ARC_CAN_10MBIT 2 /* card uses COM20022, supporting 10MBit, - but default is 2.5MBit. */ -+#define ARC_HAS_LED 4 /* card has software controlled LEDs */ -+#define ARC_HAS_ROTARY 8 /* card has rotary encoder */ - - /* information needed to define an encapsulation driver */ - struct ArcProto { -diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c -index c580acb8b1d34..7b5c8bb02f119 100644 ---- a/drivers/net/arcnet/com20020-pci.c -+++ b/drivers/net/arcnet/com20020-pci.c -@@ -213,12 +213,13 @@ static int com20020pci_probe(struct pci_dev *pdev, - if (!strncmp(ci->name, "EAE PLX-PCI FB2", 15)) - lp->backplane = 1; - -- /* Get the dev_id from the PLX rotary coder */ -- if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15)) -- dev_id_mask = 0x3; -- dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask; -- -- snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); -+ if (ci->flags & ARC_HAS_ROTARY) { -+ /* Get the dev_id from the PLX rotary coder */ -+ if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15)) -+ dev_id_mask = 0x3; -+ dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask; -+ snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i); -+ } - - if (arcnet_inb(ioaddr, COM20020_REG_R_STATUS) == 0xFF) { - pr_err("IO address %Xh is empty!\n", ioaddr); -@@ -230,6 +231,10 @@ static int com20020pci_probe(struct pci_dev *pdev, - goto err_free_arcdev; - } - -+ ret = com20020_found(dev, IRQF_SHARED); -+ if (ret) -+ goto err_free_arcdev; -+ - card = devm_kzalloc(&pdev->dev, sizeof(struct com20020_dev), - GFP_KERNEL); - if (!card) { -@@ -239,41 +244,39 @@ static int com20020pci_probe(struct pci_dev *pdev, - - card->index = i; - card->pci_priv = priv; -- card->tx_led.brightness_set = led_tx_set; -- card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, -- GFP_KERNEL, "arc%d-%d-tx", -- dev->dev_id, i); -- card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, -- "pci:green:tx:%d-%d", -- dev->dev_id, i); -- -- card->tx_led.dev = &dev->dev; -- card->recon_led.brightness_set = led_recon_set; -- card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, -- GFP_KERNEL, "arc%d-%d-recon", -- dev->dev_id, i); -- card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, -- "pci:red:recon:%d-%d", -- dev->dev_id, i); -- card->recon_led.dev = &dev->dev; -- card->dev = dev; -- -- ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); -- if (ret) -- goto err_free_arcdev; - -- ret = devm_led_classdev_register(&pdev->dev, &card->recon_led); -- if (ret) -- goto err_free_arcdev; -- -- dev_set_drvdata(&dev->dev, card); -- -- ret = com20020_found(dev, IRQF_SHARED); -- if (ret) -- goto err_free_arcdev; -- -- devm_arcnet_led_init(dev, dev->dev_id, i); -+ if (ci->flags & ARC_HAS_LED) { -+ card->tx_led.brightness_set = led_tx_set; -+ card->tx_led.default_trigger = devm_kasprintf(&pdev->dev, -+ GFP_KERNEL, "arc%d-%d-tx", -+ dev->dev_id, i); -+ card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, -+ "pci:green:tx:%d-%d", -+ dev->dev_id, i); -+ -+ card->tx_led.dev = &dev->dev; -+ card->recon_led.brightness_set = led_recon_set; -+ card->recon_led.default_trigger = devm_kasprintf(&pdev->dev, -+ GFP_KERNEL, "arc%d-%d-recon", -+ dev->dev_id, i); -+ card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, -+ "pci:red:recon:%d-%d", -+ dev->dev_id, i); -+ card->recon_led.dev = &dev->dev; -+ -+ ret = devm_led_classdev_register(&pdev->dev, &card->tx_led); -+ if (ret) -+ goto err_free_arcdev; -+ -+ ret = devm_led_classdev_register(&pdev->dev, &card->recon_led); -+ if (ret) -+ goto err_free_arcdev; -+ -+ dev_set_drvdata(&dev->dev, card); -+ devm_arcnet_led_init(dev, dev->dev_id, i); -+ } - -+ card->dev = dev; - list_add(&card->list, &priv->list_dev); - continue; - -@@ -329,7 +332,7 @@ static struct com20020_pci_card_info card_info_5mbit = { - }; - - static struct com20020_pci_card_info card_info_sohard = { -- .name = "PLX-PCI", -+ .name = "SOHARD SH ARC-PCI", - .devcount = 1, - /* SOHARD needs PCI base addr 4 */ - .chan_map_tbl = { -@@ -364,7 +367,7 @@ static struct com20020_pci_card_info card_info_eae_arc1 = { - }, - }, - .rotary = 0x0, -- .flags = ARC_CAN_10MBIT, -+ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, - }; - - static struct com20020_pci_card_info card_info_eae_ma1 = { -@@ -396,7 +399,7 @@ static struct com20020_pci_card_info card_info_eae_ma1 = { - }, - }, - .rotary = 0x0, -- .flags = ARC_CAN_10MBIT, -+ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, - }; - - static struct com20020_pci_card_info card_info_eae_fb2 = { -@@ -421,7 +424,7 @@ static struct com20020_pci_card_info card_info_eae_fb2 = { - }, - }, - .rotary = 0x0, -- .flags = ARC_CAN_10MBIT, -+ .flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT, - }; - - static const struct pci_device_id com20020pci_id_table[] = { -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -index 80b44043e6c53..28c9b6f1a54f1 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c -@@ -553,17 +553,17 @@ void aq_ptp_tx_hwtstamp(struct aq_nic_s *aq_nic, u64 timestamp) - - /* aq_ptp_rx_hwtstamp - utility function which checks for RX time stamp - * @adapter: pointer to adapter struct -- * @skb: particular skb to send timestamp with -+ * @shhwtstamps: particular skb_shared_hwtstamps to save timestamp - * - * if the timestamp is valid, we convert it into the timecounter ns - * value, then store that result into the hwtstamps structure which - * is passed up the network stack - */ --static void aq_ptp_rx_hwtstamp(struct aq_ptp_s *aq_ptp, struct sk_buff *skb, -+static void aq_ptp_rx_hwtstamp(struct aq_ptp_s *aq_ptp, struct skb_shared_hwtstamps *shhwtstamps, - u64 timestamp) - { - timestamp -= atomic_read(&aq_ptp->offset_ingress); -- aq_ptp_convert_to_hwtstamp(aq_ptp, skb_hwtstamps(skb), timestamp); -+ aq_ptp_convert_to_hwtstamp(aq_ptp, shhwtstamps, timestamp); - } - - void aq_ptp_hwtstamp_config_get(struct aq_ptp_s *aq_ptp, -@@ -639,7 +639,7 @@ bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) - &aq_ptp->ptp_rx == ring || &aq_ptp->hwts_rx == ring; - } - --u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, -+u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct skb_shared_hwtstamps *shhwtstamps, u8 *p, - unsigned int len) - { - struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp; -@@ -648,7 +648,7 @@ u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, - p, len, ×tamp); - - if (ret > 0) -- aq_ptp_rx_hwtstamp(aq_ptp, skb, timestamp); -+ aq_ptp_rx_hwtstamp(aq_ptp, shhwtstamps, timestamp); - - return ret; - } -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h -index 28ccb7ca2df9e..210b723f22072 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.h -@@ -67,7 +67,7 @@ int aq_ptp_hwtstamp_config_set(struct aq_ptp_s *aq_ptp, - /* Return either ring is belong to PTP or not*/ - bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring); - --u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct sk_buff *skb, u8 *p, -+u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, struct skb_shared_hwtstamps *shhwtstamps, u8 *p, - unsigned int len); - - struct ptp_clock *aq_ptp_get_ptp_clock(struct aq_ptp_s *aq_ptp); -@@ -143,7 +143,7 @@ static inline bool aq_ptp_ring(struct aq_nic_s *aq_nic, struct aq_ring_s *ring) - } - - static inline u16 aq_ptp_extract_ts(struct aq_nic_s *aq_nic, -- struct sk_buff *skb, u8 *p, -+ struct skb_shared_hwtstamps *shhwtstamps, u8 *p, - unsigned int len) - { - return 0; -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -index 2dc8d215a5918..b5a49166fa972 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -@@ -647,7 +647,7 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi, - } - if (is_ptp_ring) - buff->len -= -- aq_ptp_extract_ts(self->aq_nic, skb, -+ aq_ptp_extract_ts(self->aq_nic, skb_hwtstamps(skb), - aq_buf_vaddr(&buff->rxdata), - buff->len); - -@@ -742,6 +742,8 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, - struct aq_ring_buff_s *buff = &rx_ring->buff_ring[rx_ring->sw_head]; - bool is_ptp_ring = aq_ptp_ring(rx_ring->aq_nic, rx_ring); - struct aq_ring_buff_s *buff_ = NULL; -+ u16 ptp_hwtstamp_len = 0; -+ struct skb_shared_hwtstamps shhwtstamps; - struct sk_buff *skb = NULL; - unsigned int next_ = 0U; - struct xdp_buff xdp; -@@ -810,11 +812,12 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, - hard_start = page_address(buff->rxdata.page) + - buff->rxdata.pg_off - rx_ring->page_offset; - -- if (is_ptp_ring) -- buff->len -= -- aq_ptp_extract_ts(rx_ring->aq_nic, skb, -- aq_buf_vaddr(&buff->rxdata), -- buff->len); -+ if (is_ptp_ring) { -+ ptp_hwtstamp_len = aq_ptp_extract_ts(rx_ring->aq_nic, &shhwtstamps, -+ aq_buf_vaddr(&buff->rxdata), -+ buff->len); -+ buff->len -= ptp_hwtstamp_len; -+ } - - xdp_init_buff(&xdp, frame_sz, &rx_ring->xdp_rxq); - xdp_prepare_buff(&xdp, hard_start, rx_ring->page_offset, -@@ -834,6 +837,9 @@ static int __aq_ring_xdp_clean(struct aq_ring_s *rx_ring, - if (IS_ERR(skb) || !skb) - continue; - -+ if (ptp_hwtstamp_len > 0) -+ *skb_hwtstamps(skb) = shhwtstamps; -+ - if (buff->is_vlan) - __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), - buff->vlan_rx_tag); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c -index d8afcf8d6b30e..4d6663ff84722 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c -@@ -2075,6 +2075,7 @@ destroy_flow_table: - rhashtable_destroy(&tc_info->flow_table); - free_tc_info: - kfree(tc_info); -+ bp->tc_info = NULL; - return rc; - } - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 85570e40c8e9b..f60a16de565ed 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -6853,7 +6853,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget) - desc_idx, *post_ptr); - drop_it_no_recycle: - /* Other statistics kept track of by card. */ -- tp->rx_dropped++; -+ tnapi->rx_dropped++; - goto next_pkt; - } - -@@ -7879,8 +7879,10 @@ static int tg3_tso_bug(struct tg3 *tp, struct tg3_napi *tnapi, - - segs = skb_gso_segment(skb, tp->dev->features & - ~(NETIF_F_TSO | NETIF_F_TSO6)); -- if (IS_ERR(segs) || !segs) -+ if (IS_ERR(segs) || !segs) { -+ tnapi->tx_dropped++; - goto tg3_tso_bug_end; -+ } - - skb_list_walk_safe(segs, seg, next) { - skb_mark_not_on_list(seg); -@@ -8151,7 +8153,7 @@ dma_error: - drop: - dev_kfree_skb_any(skb); - drop_nofree: -- tp->tx_dropped++; -+ tnapi->tx_dropped++; - return NETDEV_TX_OK; - } - -@@ -9330,7 +9332,7 @@ static void __tg3_set_rx_mode(struct net_device *); - /* tp->lock is held. */ - static int tg3_halt(struct tg3 *tp, int kind, bool silent) - { -- int err; -+ int err, i; - - tg3_stop_fw(tp); - -@@ -9351,6 +9353,13 @@ static int tg3_halt(struct tg3 *tp, int kind, bool silent) - - /* And make sure the next sample is new data */ - memset(tp->hw_stats, 0, sizeof(struct tg3_hw_stats)); -+ -+ for (i = 0; i < TG3_IRQ_MAX_VECS; ++i) { -+ struct tg3_napi *tnapi = &tp->napi[i]; -+ -+ tnapi->rx_dropped = 0; -+ tnapi->tx_dropped = 0; -+ } - } - - return err; -@@ -11900,6 +11909,9 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats) - { - struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev; - struct tg3_hw_stats *hw_stats = tp->hw_stats; -+ unsigned long rx_dropped; -+ unsigned long tx_dropped; -+ int i; - - stats->rx_packets = old_stats->rx_packets + - get_stat64(&hw_stats->rx_ucast_packets) + -@@ -11946,8 +11958,26 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats) - stats->rx_missed_errors = old_stats->rx_missed_errors + - get_stat64(&hw_stats->rx_discards); - -- stats->rx_dropped = tp->rx_dropped; -- stats->tx_dropped = tp->tx_dropped; -+ /* Aggregate per-queue counters. The per-queue counters are updated -+ * by a single writer, race-free. The result computed by this loop -+ * might not be 100% accurate (counters can be updated in the middle of -+ * the loop) but the next tg3_get_nstats() will recompute the current -+ * value so it is acceptable. -+ * -+ * Note that these counters wrap around at 4G on 32bit machines. -+ */ -+ rx_dropped = (unsigned long)(old_stats->rx_dropped); -+ tx_dropped = (unsigned long)(old_stats->tx_dropped); -+ -+ for (i = 0; i < tp->irq_cnt; i++) { -+ struct tg3_napi *tnapi = &tp->napi[i]; -+ -+ rx_dropped += tnapi->rx_dropped; -+ tx_dropped += tnapi->tx_dropped; -+ } -+ -+ stats->rx_dropped = rx_dropped; -+ stats->tx_dropped = tx_dropped; - } - - static int tg3_get_regs_len(struct net_device *dev) -diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h -index 1000c894064f0..8d753f8c5b065 100644 ---- a/drivers/net/ethernet/broadcom/tg3.h -+++ b/drivers/net/ethernet/broadcom/tg3.h -@@ -3018,6 +3018,7 @@ struct tg3_napi { - u16 *rx_rcb_prod_idx; - struct tg3_rx_prodring_set prodring; - struct tg3_rx_buffer_desc *rx_rcb; -+ unsigned long rx_dropped; - - u32 tx_prod ____cacheline_aligned; - u32 tx_cons; -@@ -3026,6 +3027,7 @@ struct tg3_napi { - u32 prodmbox; - struct tg3_tx_buffer_desc *tx_ring; - struct tg3_tx_ring_info *tx_buffers; -+ unsigned long tx_dropped; - - dma_addr_t status_mapping; - dma_addr_t rx_rcb_mapping; -@@ -3219,8 +3221,6 @@ struct tg3 { - - - /* begin "everything else" cacheline(s) section */ -- unsigned long rx_dropped; -- unsigned long tx_dropped; - struct rtnl_link_stats64 net_stats_prev; - struct tg3_ethtool_stats estats_prev; - -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c -index 928d934cb21a5..f75668c479351 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c -@@ -66,6 +66,27 @@ static enum mac_mode hns_get_enet_interface(const struct hns_mac_cb *mac_cb) - } - } - -+static u32 hns_mac_link_anti_shake(struct mac_driver *mac_ctrl_drv) -+{ -+#define HNS_MAC_LINK_WAIT_TIME 5 -+#define HNS_MAC_LINK_WAIT_CNT 40 -+ -+ u32 link_status = 0; -+ int i; -+ -+ if (!mac_ctrl_drv->get_link_status) -+ return link_status; -+ -+ for (i = 0; i < HNS_MAC_LINK_WAIT_CNT; i++) { -+ msleep(HNS_MAC_LINK_WAIT_TIME); -+ mac_ctrl_drv->get_link_status(mac_ctrl_drv, &link_status); -+ if (!link_status) -+ break; -+ } -+ -+ return link_status; -+} -+ - void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) - { - struct mac_driver *mac_ctrl_drv; -@@ -83,6 +104,14 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status) - &sfp_prsnt); - if (!ret) - *link_status = *link_status && sfp_prsnt; -+ -+ /* for FIBER port, it may have a fake link up. -+ * when the link status changes from down to up, we need to do -+ * anti-shake. the anti-shake time is base on tests. -+ * only FIBER port need to do this. -+ */ -+ if (*link_status && !mac_cb->link) -+ *link_status = hns_mac_link_anti_shake(mac_ctrl_drv); - } - - mac_cb->link = *link_status; -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -index 7cf10d1e2b311..85722afe21770 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -@@ -142,7 +142,8 @@ MODULE_DEVICE_TABLE(acpi, hns_enet_acpi_match); - - static void fill_desc(struct hnae_ring *ring, void *priv, - int size, dma_addr_t dma, int frag_end, -- int buf_num, enum hns_desc_type type, int mtu) -+ int buf_num, enum hns_desc_type type, int mtu, -+ bool is_gso) - { - struct hnae_desc *desc = &ring->desc[ring->next_to_use]; - struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use]; -@@ -275,6 +276,15 @@ static int hns_nic_maybe_stop_tso( - return 0; - } - -+static int hns_nic_maybe_stop_tx_v2(struct sk_buff **out_skb, int *bnum, -+ struct hnae_ring *ring) -+{ -+ if (skb_is_gso(*out_skb)) -+ return hns_nic_maybe_stop_tso(out_skb, bnum, ring); -+ else -+ return hns_nic_maybe_stop_tx(out_skb, bnum, ring); -+} -+ - static void fill_tso_desc(struct hnae_ring *ring, void *priv, - int size, dma_addr_t dma, int frag_end, - int buf_num, enum hns_desc_type type, int mtu) -@@ -300,6 +310,19 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv, - mtu); - } - -+static void fill_desc_v2(struct hnae_ring *ring, void *priv, -+ int size, dma_addr_t dma, int frag_end, -+ int buf_num, enum hns_desc_type type, int mtu, -+ bool is_gso) -+{ -+ if (is_gso) -+ fill_tso_desc(ring, priv, size, dma, frag_end, buf_num, type, -+ mtu); -+ else -+ fill_v2_desc(ring, priv, size, dma, frag_end, buf_num, type, -+ mtu); -+} -+ - netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, - struct sk_buff *skb, - struct hns_nic_ring_data *ring_data) -@@ -313,6 +336,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, - int seg_num; - dma_addr_t dma; - int size, next_to_use; -+ bool is_gso; - int i; - - switch (priv->ops.maybe_stop_tx(&skb, &buf_num, ring)) { -@@ -339,8 +363,9 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, - ring->stats.sw_err_cnt++; - goto out_err_tx_ok; - } -+ is_gso = skb_is_gso(skb); - priv->ops.fill_desc(ring, skb, size, dma, seg_num == 1 ? 1 : 0, -- buf_num, DESC_TYPE_SKB, ndev->mtu); -+ buf_num, DESC_TYPE_SKB, ndev->mtu, is_gso); - - /* fill the fragments */ - for (i = 1; i < seg_num; i++) { -@@ -354,7 +379,7 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, - } - priv->ops.fill_desc(ring, skb_frag_page(frag), size, dma, - seg_num - 1 == i ? 1 : 0, buf_num, -- DESC_TYPE_PAGE, ndev->mtu); -+ DESC_TYPE_PAGE, ndev->mtu, is_gso); - } - - /*complete translate all packets*/ -@@ -1776,15 +1801,6 @@ static int hns_nic_set_features(struct net_device *netdev, - netdev_info(netdev, "enet v1 do not support tso!\n"); - break; - default: -- if (features & (NETIF_F_TSO | NETIF_F_TSO6)) { -- priv->ops.fill_desc = fill_tso_desc; -- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; -- /* The chip only support 7*4096 */ -- netif_set_tso_max_size(netdev, 7 * 4096); -- } else { -- priv->ops.fill_desc = fill_v2_desc; -- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; -- } - break; - } - netdev->features = features; -@@ -2159,16 +2175,9 @@ static void hns_nic_set_priv_ops(struct net_device *netdev) - priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; - } else { - priv->ops.get_rxd_bnum = get_v2rx_desc_bnum; -- if ((netdev->features & NETIF_F_TSO) || -- (netdev->features & NETIF_F_TSO6)) { -- priv->ops.fill_desc = fill_tso_desc; -- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tso; -- /* This chip only support 7*4096 */ -- netif_set_tso_max_size(netdev, 7 * 4096); -- } else { -- priv->ops.fill_desc = fill_v2_desc; -- priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx; -- } -+ priv->ops.fill_desc = fill_desc_v2; -+ priv->ops.maybe_stop_tx = hns_nic_maybe_stop_tx_v2; -+ netif_set_tso_max_size(netdev, 7 * 4096); - /* enable tso when init - * control tso on/off through TSE bit in bd - */ -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.h b/drivers/net/ethernet/hisilicon/hns/hns_enet.h -index ffa9d6573f54b..3f3ee032f631c 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_enet.h -+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.h -@@ -44,7 +44,8 @@ struct hns_nic_ring_data { - struct hns_nic_ops { - void (*fill_desc)(struct hnae_ring *ring, void *priv, - int size, dma_addr_t dma, int frag_end, -- int buf_num, enum hns_desc_type type, int mtu); -+ int buf_num, enum hns_desc_type type, int mtu, -+ bool is_gso); - int (*maybe_stop_tx)(struct sk_buff **out_skb, - int *bnum, struct hnae_ring *ring); - void (*get_rxd_bnum)(u32 bnum_flag, int *out_bnum); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 9f5824eb8808a..b4157ff370a31 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -16158,7 +16158,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT; - if (val < MAX_FRAME_SIZE_DEFAULT) - dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n", -- i, val); -+ pf->hw.port, val); - - /* Add a filter to drop all Flow control frames from any VSI from being - * transmitted. By doing so we stop a malicious VF from sending out -diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -index c13b4fa659ee9..31e02624aca48 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -@@ -829,18 +829,10 @@ static int __iavf_set_coalesce(struct net_device *netdev, - struct iavf_adapter *adapter = netdev_priv(netdev); - int i; - -- if (ec->rx_coalesce_usecs == 0) { -- if (ec->use_adaptive_rx_coalesce) -- netif_info(adapter, drv, netdev, "rx-usecs=0, need to disable adaptive-rx for a complete disable\n"); -- } else if ((ec->rx_coalesce_usecs < IAVF_MIN_ITR) || -- (ec->rx_coalesce_usecs > IAVF_MAX_ITR)) { -+ if (ec->rx_coalesce_usecs > IAVF_MAX_ITR) { - netif_info(adapter, drv, netdev, "Invalid value, rx-usecs range is 0-8160\n"); - return -EINVAL; -- } else if (ec->tx_coalesce_usecs == 0) { -- if (ec->use_adaptive_tx_coalesce) -- netif_info(adapter, drv, netdev, "tx-usecs=0, need to disable adaptive-tx for a complete disable\n"); -- } else if ((ec->tx_coalesce_usecs < IAVF_MIN_ITR) || -- (ec->tx_coalesce_usecs > IAVF_MAX_ITR)) { -+ } else if (ec->tx_coalesce_usecs > IAVF_MAX_ITR) { - netif_info(adapter, drv, netdev, "Invalid value, tx-usecs range is 0-8160\n"); - return -EINVAL; - } -diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.h b/drivers/net/ethernet/intel/iavf/iavf_txrx.h -index 7e6ee32d19b69..10ba36602c0c1 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_txrx.h -+++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.h -@@ -15,7 +15,6 @@ - */ - #define IAVF_ITR_DYNAMIC 0x8000 /* use top bit as a flag */ - #define IAVF_ITR_MASK 0x1FFE /* mask for ITR register value */ --#define IAVF_MIN_ITR 2 /* reg uses 2 usec resolution */ - #define IAVF_ITR_100K 10 /* all values below must be even */ - #define IAVF_ITR_50K 20 - #define IAVF_ITR_20K 50 -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h -index a0c31f5b2ce05..03ebabd616353 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h -@@ -1877,7 +1877,7 @@ struct mcs_hw_info { - u8 tcam_entries; /* RX/TX Tcam entries per mcs block */ - u8 secy_entries; /* RX/TX SECY entries per mcs block */ - u8 sc_entries; /* RX/TX SC CAM entries per mcs block */ -- u8 sa_entries; /* PN table entries = SA entries */ -+ u16 sa_entries; /* PN table entries = SA entries */ - u64 rsvd[16]; - }; - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c -index c43f19dfbd744..c1775bd01c2b4 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c -@@ -117,7 +117,7 @@ void mcs_get_rx_secy_stats(struct mcs *mcs, struct mcs_secy_stats *stats, int id - reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYTAGGEDCTLX(id); - stats->pkt_tagged_ctl_cnt = mcs_reg_read(mcs, reg); - -- reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX(id); -+ reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(id); - stats->pkt_untaged_cnt = mcs_reg_read(mcs, reg); - - reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(id); -@@ -215,7 +215,7 @@ void mcs_get_sc_stats(struct mcs *mcs, struct mcs_sc_stats *stats, - reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSCNOTVALIDX(id); - stats->pkt_notvalid_cnt = mcs_reg_read(mcs, reg); - -- reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX(id); -+ reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX(id); - stats->pkt_unchecked_cnt = mcs_reg_read(mcs, reg); - - if (mcs->hw->mcs_blks > 1) { -@@ -1219,6 +1219,17 @@ struct mcs *mcs_get_pdata(int mcs_id) - return NULL; - } - -+bool is_mcs_bypass(int mcs_id) -+{ -+ struct mcs *mcs_dev; -+ -+ list_for_each_entry(mcs_dev, &mcs_list, mcs_list) { -+ if (mcs_dev->mcs_id == mcs_id) -+ return mcs_dev->bypass; -+ } -+ return true; -+} -+ - void mcs_set_port_cfg(struct mcs *mcs, struct mcs_port_cfg_set_req *req) - { - u64 val = 0; -@@ -1436,7 +1447,7 @@ static int mcs_x2p_calibration(struct mcs *mcs) - return err; - } - --static void mcs_set_external_bypass(struct mcs *mcs, u8 bypass) -+static void mcs_set_external_bypass(struct mcs *mcs, bool bypass) - { - u64 val; - -@@ -1447,6 +1458,7 @@ static void mcs_set_external_bypass(struct mcs *mcs, u8 bypass) - else - val &= ~BIT_ULL(6); - mcs_reg_write(mcs, MCSX_MIL_GLOBAL, val); -+ mcs->bypass = bypass; - } - - static void mcs_global_cfg(struct mcs *mcs) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs.h -index 0f89dcb764654..f927cc61dfd21 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.h -@@ -149,6 +149,7 @@ struct mcs { - u16 num_vec; - void *rvu; - u16 *tx_sa_active; -+ bool bypass; - }; - - struct mcs_ops { -@@ -206,6 +207,7 @@ void mcs_get_custom_tag_cfg(struct mcs *mcs, struct mcs_custom_tag_cfg_get_req * - int mcs_alloc_ctrlpktrule(struct rsrc_bmap *rsrc, u16 *pf_map, u16 offset, u16 pcifunc); - int mcs_free_ctrlpktrule(struct mcs *mcs, struct mcs_free_ctrl_pkt_rule_req *req); - int mcs_ctrlpktrule_write(struct mcs *mcs, struct mcs_ctrl_pkt_rule_write_req *req); -+bool is_mcs_bypass(int mcs_id); - - /* CN10K-B APIs */ - void cn10kb_mcs_set_hw_capabilities(struct mcs *mcs); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h -index f3ab01fc363c8..f4c6de89002c1 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h -@@ -810,14 +810,37 @@ - offset = 0x9d8ull; \ - offset; }) - -+#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDX(a) ({ \ -+ u64 offset; \ -+ \ -+ offset = 0xee80ull; \ -+ if (mcs->hw->mcs_blks > 1) \ -+ offset = 0xe818ull; \ -+ offset += (a) * 0x8ull; \ -+ offset; }) -+ -+#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(a) ({ \ -+ u64 offset; \ -+ \ -+ offset = 0xa680ull; \ -+ if (mcs->hw->mcs_blks > 1) \ -+ offset = 0xd018ull; \ -+ offset += (a) * 0x8ull; \ -+ offset; }) -+ -+#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX(a) ({ \ -+ u64 offset; \ -+ \ -+ offset = 0xf680ull; \ -+ if (mcs->hw->mcs_blks > 1) \ -+ offset = 0xe018ull; \ -+ offset += (a) * 0x8ull; \ -+ offset; }) -+ - #define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCDECRYPTEDX(a) (0xe680ull + (a) * 0x8ull) - #define MCSX_CSE_RX_MEM_SLAVE_INOCTETSSCVALIDATEX(a) (0xde80ull + (a) * 0x8ull) --#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDORNOTAGX(a) (0xa680ull + (a) * 0x8ull) - #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYNOTAGX(a) (0xd218 + (a) * 0x8ull) --#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(a) (0xd018ull + (a) * 0x8ull) --#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCUNCHECKEDOROKX(a) (0xee80ull + (a) * 0x8ull) - #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(a) (0xb680ull + (a) * 0x8ull) --#define MCSX_CSE_RX_MEM_SLAVE_INPKTSSCLATEORDELAYEDX(a) (0xf680ull + (a) * 0x8ull) - #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSAINVALIDX(a) (0x12680ull + (a) * 0x8ull) - #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTUSINGSAERRORX(a) (0x15680ull + (a) * 0x8ull) - #define MCSX_CSE_RX_MEM_SLAVE_INPKTSSANOTVALIDX(a) (0x13680ull + (a) * 0x8ull) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -index 733add3a9dc6b..d88d86bf07b03 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c -@@ -2622,6 +2622,9 @@ static void __rvu_flr_handler(struct rvu *rvu, u16 pcifunc) - */ - rvu_npc_free_mcam_entries(rvu, pcifunc, -1); - -+ if (rvu->mcs_blk_cnt) -+ rvu_mcs_flr_handler(rvu, pcifunc); -+ - mutex_unlock(&rvu->flr_lock); - } - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -index a3346ea7876c5..95a7bc396e8ea 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -@@ -325,6 +325,7 @@ struct nix_hw { - struct nix_txvlan txvlan; - struct nix_ipolicer *ipolicer; - u64 *tx_credits; -+ u8 cc_mcs_cnt; - }; - - /* RVU block's capabilities or functionality, -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -index dc7bd2ce78f7d..d609512998992 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -@@ -1285,7 +1285,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) - - rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq"); - if (!rvu_dl->devlink_wq) -- goto err; -+ return -ENOMEM; - - INIT_WORK(&rvu_reporters->intr_work, rvu_npa_intr_work); - INIT_WORK(&rvu_reporters->err_work, rvu_npa_err_work); -@@ -1293,9 +1293,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) - INIT_WORK(&rvu_reporters->ras_work, rvu_npa_ras_work); - - return 0; --err: -- rvu_npa_health_reporters_destroy(rvu_dl); -- return -ENOMEM; - } - - static int rvu_npa_health_reporters_create(struct rvu_devlink *rvu_dl) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c -index 7310047136986..959f36efdc4a6 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c -@@ -12,6 +12,7 @@ - #include "rvu_reg.h" - #include "rvu.h" - #include "npc.h" -+#include "mcs.h" - #include "cgx.h" - #include "lmac_common.h" - #include "rvu_npc_hash.h" -@@ -4164,6 +4165,12 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, - SDP_HW_MAX_FRS << 16 | NIC_HW_MIN_FRS); - } - -+ /* Get MCS external bypass status for CN10K-B */ -+ if (mcs_get_blkcnt() == 1) { -+ /* Adjust for 2 credits when external bypass is disabled */ -+ nix_hw->cc_mcs_cnt = is_mcs_bypass(0) ? 0 : 2; -+ } -+ - /* Set credits for Tx links assuming max packet length allowed. - * This will be reconfigured based on MTU set for PF/VF. - */ -@@ -4187,6 +4194,7 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, - tx_credits = (lmac_fifo_len - lmac_max_frs) / 16; - /* Enable credits and set credit pkt count to max allowed */ - cfg = (tx_credits << 12) | (0x1FF << 2) | BIT_ULL(1); -+ cfg |= FIELD_PREP(NIX_AF_LINKX_MCS_CNT_MASK, nix_hw->cc_mcs_cnt); - - link = iter + slink; - nix_hw->tx_credits[link] = tx_credits; -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -index 16cfc802e348d..f65805860c8d4 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -@@ -389,7 +389,13 @@ static u64 npc_get_default_entry_action(struct rvu *rvu, struct npc_mcam *mcam, - int bank, nixlf, index; - - /* get ucast entry rule entry index */ -- nix_get_nixlf(rvu, pf_func, &nixlf, NULL); -+ if (nix_get_nixlf(rvu, pf_func, &nixlf, NULL)) { -+ dev_err(rvu->dev, "%s: nixlf not attached to pcifunc:0x%x\n", -+ __func__, pf_func); -+ /* Action 0 is drop */ -+ return 0; -+ } -+ - index = npc_get_nixlf_mcam_index(mcam, pf_func, nixlf, - NIXLF_UCAST_ENTRY); - bank = npc_get_bank(mcam, index); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c -index b3150f0532919..d46ac29adb966 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.c -@@ -31,8 +31,8 @@ static struct hw_reg_map txsch_reg_map[NIX_TXSCH_LVL_CNT] = { - {NIX_TXSCH_LVL_TL4, 3, 0xFFFF, {{0x0B00, 0x0B08}, {0x0B10, 0x0B18}, - {0x1200, 0x12E0} } }, - {NIX_TXSCH_LVL_TL3, 4, 0xFFFF, {{0x1000, 0x10E0}, {0x1600, 0x1608}, -- {0x1610, 0x1618}, {0x1700, 0x17B0} } }, -- {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17B0} } }, -+ {0x1610, 0x1618}, {0x1700, 0x17C8} } }, -+ {NIX_TXSCH_LVL_TL2, 2, 0xFFFF, {{0x0E00, 0x0EE0}, {0x1700, 0x17C8} } }, - {NIX_TXSCH_LVL_TL1, 1, 0xFFFF, {{0x0C00, 0x0D98} } }, - }; - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h -index 39f7a7cb27558..b690e5566f12a 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h -@@ -434,6 +434,7 @@ - - #define NIX_AF_LINKX_BASE_MASK GENMASK_ULL(11, 0) - #define NIX_AF_LINKX_RANGE_MASK GENMASK_ULL(19, 16) -+#define NIX_AF_LINKX_MCS_CNT_MASK GENMASK_ULL(33, 32) - - /* SSO */ - #define SSO_AF_CONST (0x1000) -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c -index aaf1af2a402ec..af779ae40d3c2 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c -@@ -323,9 +323,12 @@ static void otx2_get_pauseparam(struct net_device *netdev, - if (is_otx2_lbkvf(pfvf->pdev)) - return; - -+ mutex_lock(&pfvf->mbox.lock); - req = otx2_mbox_alloc_msg_cgx_cfg_pause_frm(&pfvf->mbox); -- if (!req) -+ if (!req) { -+ mutex_unlock(&pfvf->mbox.lock); - return; -+ } - - if (!otx2_sync_mbox_msg(&pfvf->mbox)) { - rsp = (struct cgx_pause_frm_cfg *) -@@ -333,6 +336,7 @@ static void otx2_get_pauseparam(struct net_device *netdev, - pause->rx_pause = rsp->rx_pause; - pause->tx_pause = rsp->tx_pause; - } -+ mutex_unlock(&pfvf->mbox.lock); - } - - static int otx2_set_pauseparam(struct net_device *netdev, -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -index 18c5d2b3f7f95..55807e2043edf 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -@@ -1676,6 +1676,14 @@ static void otx2_do_set_rx_mode(struct otx2_nic *pf) - mutex_unlock(&pf->mbox.lock); - } - -+static void otx2_set_irq_coalesce(struct otx2_nic *pfvf) -+{ -+ int cint; -+ -+ for (cint = 0; cint < pfvf->hw.cint_cnt; cint++) -+ otx2_config_irq_coalescing(pfvf, cint); -+} -+ - static void otx2_dim_work(struct work_struct *w) - { - struct dim_cq_moder cur_moder; -@@ -1691,6 +1699,7 @@ static void otx2_dim_work(struct work_struct *w) - CQ_TIMER_THRESH_MAX : cur_moder.usec; - pfvf->hw.cq_ecount_wait = (cur_moder.pkts > NAPI_POLL_WEIGHT) ? - NAPI_POLL_WEIGHT : cur_moder.pkts; -+ otx2_set_irq_coalesce(pfvf); - dim->state = DIM_START_MEASURE; - } - -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c -index 20d801d30c732..aee392a15b23c 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c -@@ -510,11 +510,18 @@ static void otx2_adjust_adaptive_coalese(struct otx2_nic *pfvf, struct otx2_cq_p - { - struct dim_sample dim_sample; - u64 rx_frames, rx_bytes; -+ u64 tx_frames, tx_bytes; - - rx_frames = OTX2_GET_RX_STATS(RX_BCAST) + OTX2_GET_RX_STATS(RX_MCAST) + - OTX2_GET_RX_STATS(RX_UCAST); - rx_bytes = OTX2_GET_RX_STATS(RX_OCTS); -- dim_update_sample(pfvf->napi_events, rx_frames, rx_bytes, &dim_sample); -+ tx_bytes = OTX2_GET_TX_STATS(TX_OCTS); -+ tx_frames = OTX2_GET_TX_STATS(TX_UCAST); -+ -+ dim_update_sample(pfvf->napi_events, -+ rx_frames + tx_frames, -+ rx_bytes + tx_bytes, -+ &dim_sample); - net_dim(&cq_poll->dim, dim_sample); - } - -@@ -555,16 +562,9 @@ int otx2_napi_handler(struct napi_struct *napi, int budget) - if (pfvf->flags & OTX2_FLAG_INTF_DOWN) - return workdone; - -- /* Check for adaptive interrupt coalesce */ -- if (workdone != 0 && -- ((pfvf->flags & OTX2_FLAG_ADPTV_INT_COAL_ENABLED) == -- OTX2_FLAG_ADPTV_INT_COAL_ENABLED)) { -- /* Adjust irq coalese using net_dim */ -+ /* Adjust irq coalese using net_dim */ -+ if (pfvf->flags & OTX2_FLAG_ADPTV_INT_COAL_ENABLED) - otx2_adjust_adaptive_coalese(pfvf, cq_poll); -- /* Update irq coalescing */ -- for (i = 0; i < pfvf->hw.cint_cnt; i++) -- otx2_config_irq_coalescing(pfvf, i); -- } - - /* Re-enable interrupts */ - otx2_write64(pfvf, NIX_LF_CINTX_ENA_W1S(cq_poll->cint_idx), -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h -index 93a4258421667..13dfcf9f75dad 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h -+++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h -@@ -214,7 +214,7 @@ struct ionic_desc_info { - void *cb_arg; - }; - --#define IONIC_QUEUE_NAME_MAX_SZ 32 -+#define IONIC_QUEUE_NAME_MAX_SZ 16 - - struct ionic_queue { - struct device *dev; -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index a89ab455af67d..f7634884c7508 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -46,24 +46,24 @@ static void ionic_lif_queue_identify(struct ionic_lif *lif); - static void ionic_dim_work(struct work_struct *work) - { - struct dim *dim = container_of(work, struct dim, work); -+ struct ionic_intr_info *intr; - struct dim_cq_moder cur_moder; - struct ionic_qcq *qcq; -+ struct ionic_lif *lif; - u32 new_coal; - - cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix); - qcq = container_of(dim, struct ionic_qcq, dim); -- new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec); -+ lif = qcq->q.lif; -+ new_coal = ionic_coal_usec_to_hw(lif->ionic, cur_moder.usec); - new_coal = new_coal ? new_coal : 1; - -- if (qcq->intr.dim_coal_hw != new_coal) { -- unsigned int qi = qcq->cq.bound_q->index; -- struct ionic_lif *lif = qcq->q.lif; -- -- qcq->intr.dim_coal_hw = new_coal; -+ intr = &qcq->intr; -+ if (intr->dim_coal_hw != new_coal) { -+ intr->dim_coal_hw = new_coal; - - ionic_intr_coal_init(lif->ionic->idev.intr_ctrl, -- lif->rxqcqs[qi]->intr.index, -- qcq->intr.dim_coal_hw); -+ intr->index, intr->dim_coal_hw); - } - - dim->state = DIM_START_MEASURE; -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index abfa375b08878..d22457f2cf9cf 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -193,6 +193,7 @@ enum rtl_registers { - /* No threshold before first PCI xfer */ - #define RX_FIFO_THRESH (7 << RXCFG_FIFO_SHIFT) - #define RX_EARLY_OFF (1 << 11) -+#define RX_PAUSE_SLOT_ON (1 << 11) /* 8125b and later */ - #define RXCFG_DMA_SHIFT 8 - /* Unlimited maximum PCI burst. */ - #define RX_DMA_BURST (7 << RXCFG_DMA_SHIFT) -@@ -2237,9 +2238,13 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp) - case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_53: - RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); - break; -- case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63: -+ case RTL_GIGA_MAC_VER_61: - RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST); - break; -+ case RTL_GIGA_MAC_VER_63: -+ RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST | -+ RX_PAUSE_SLOT_ON); -+ break; - default: - RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST); - break; -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c -index e95d35f1e5a0c..8fd167501fa0e 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c -@@ -710,28 +710,22 @@ void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, - } - } - --void dwmac5_fpe_configure(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, -+void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, -+ u32 num_txq, u32 num_rxq, - bool enable) - { - u32 value; - -- if (!enable) { -- value = readl(ioaddr + MAC_FPE_CTRL_STS); -- -- value &= ~EFPE; -- -- writel(value, ioaddr + MAC_FPE_CTRL_STS); -- return; -+ if (enable) { -+ cfg->fpe_csr = EFPE; -+ value = readl(ioaddr + GMAC_RXQ_CTRL1); -+ value &= ~GMAC_RXQCTRL_FPRQ; -+ value |= (num_rxq - 1) << GMAC_RXQCTRL_FPRQ_SHIFT; -+ writel(value, ioaddr + GMAC_RXQ_CTRL1); -+ } else { -+ cfg->fpe_csr = 0; - } -- -- value = readl(ioaddr + GMAC_RXQ_CTRL1); -- value &= ~GMAC_RXQCTRL_FPRQ; -- value |= (num_rxq - 1) << GMAC_RXQCTRL_FPRQ_SHIFT; -- writel(value, ioaddr + GMAC_RXQ_CTRL1); -- -- value = readl(ioaddr + MAC_FPE_CTRL_STS); -- value |= EFPE; -- writel(value, ioaddr + MAC_FPE_CTRL_STS); -+ writel(cfg->fpe_csr, ioaddr + MAC_FPE_CTRL_STS); - } - - int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) -@@ -741,6 +735,9 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) - - status = FPE_EVENT_UNKNOWN; - -+ /* Reads from the MAC_FPE_CTRL_STS register should only be performed -+ * here, since the status flags of MAC_FPE_CTRL_STS are "clear on read" -+ */ - value = readl(ioaddr + MAC_FPE_CTRL_STS); - - if (value & TRSP) { -@@ -766,19 +763,15 @@ int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev) - return status; - } - --void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, enum stmmac_mpacket_type type) -+void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, -+ enum stmmac_mpacket_type type) - { -- u32 value; -+ u32 value = cfg->fpe_csr; - -- value = readl(ioaddr + MAC_FPE_CTRL_STS); -- -- if (type == MPACKET_VERIFY) { -- value &= ~SRSP; -+ if (type == MPACKET_VERIFY) - value |= SVER; -- } else { -- value &= ~SVER; -+ else if (type == MPACKET_RESPONSE) - value |= SRSP; -- } - - writel(value, ioaddr + MAC_FPE_CTRL_STS); - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.h b/drivers/net/ethernet/stmicro/stmmac/dwmac5.h -index 53c138d0ff480..34e620790eb37 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.h -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.h -@@ -153,9 +153,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, - unsigned int ptp_rate); - void dwmac5_est_irq_status(void __iomem *ioaddr, struct net_device *dev, - struct stmmac_extra_stats *x, u32 txqcnt); --void dwmac5_fpe_configure(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, -+void dwmac5_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, -+ u32 num_txq, u32 num_rxq, - bool enable); - void dwmac5_fpe_send_mpacket(void __iomem *ioaddr, -+ struct stmmac_fpe_cfg *cfg, - enum stmmac_mpacket_type type); - int dwmac5_fpe_irq_status(void __iomem *ioaddr, struct net_device *dev); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -index f30e08a106cbe..c2181c277291b 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c -@@ -1441,7 +1441,8 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, - return 0; - } - --static void dwxgmac3_fpe_configure(void __iomem *ioaddr, u32 num_txq, -+static void dwxgmac3_fpe_configure(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, -+ u32 num_txq, - u32 num_rxq, bool enable) - { - u32 value; -diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h -index 592b4067f9b8f..b2b9cf04bc726 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/hwif.h -+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h -@@ -392,9 +392,11 @@ struct stmmac_ops { - unsigned int ptp_rate); - void (*est_irq_status)(void __iomem *ioaddr, struct net_device *dev, - struct stmmac_extra_stats *x, u32 txqcnt); -- void (*fpe_configure)(void __iomem *ioaddr, u32 num_txq, u32 num_rxq, -+ void (*fpe_configure)(void __iomem *ioaddr, struct stmmac_fpe_cfg *cfg, -+ u32 num_txq, u32 num_rxq, - bool enable); - void (*fpe_send_mpacket)(void __iomem *ioaddr, -+ struct stmmac_fpe_cfg *cfg, - enum stmmac_mpacket_type type); - int (*fpe_irq_status)(void __iomem *ioaddr, struct net_device *dev); - }; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 9f76c2f7d513b..69aac8ed84f67 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -957,7 +957,8 @@ static void stmmac_fpe_link_state_handle(struct stmmac_priv *priv, bool is_up) - bool *hs_enable = &fpe_cfg->hs_enable; - - if (is_up && *hs_enable) { -- stmmac_fpe_send_mpacket(priv, priv->ioaddr, MPACKET_VERIFY); -+ stmmac_fpe_send_mpacket(priv, priv->ioaddr, fpe_cfg, -+ MPACKET_VERIFY); - } else { - *lo_state = FPE_STATE_OFF; - *lp_state = FPE_STATE_OFF; -@@ -5704,6 +5705,7 @@ static void stmmac_fpe_event_status(struct stmmac_priv *priv, int status) - /* If user has requested FPE enable, quickly response */ - if (*hs_enable) - stmmac_fpe_send_mpacket(priv, priv->ioaddr, -+ fpe_cfg, - MPACKET_RESPONSE); - } - -@@ -7028,6 +7030,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work) - if (*lo_state == FPE_STATE_ENTERING_ON && - *lp_state == FPE_STATE_ENTERING_ON) { - stmmac_fpe_configure(priv, priv->ioaddr, -+ fpe_cfg, - priv->plat->tx_queues_to_use, - priv->plat->rx_queues_to_use, - *enable); -@@ -7046,6 +7049,7 @@ static void stmmac_fpe_lp_task(struct work_struct *work) - netdev_info(priv->dev, SEND_VERIFY_MPAKCET_FMT, - *lo_state, *lp_state); - stmmac_fpe_send_mpacket(priv, priv->ioaddr, -+ fpe_cfg, - MPACKET_VERIFY); - } - /* Sleep then retry */ -@@ -7060,6 +7064,7 @@ void stmmac_fpe_handshake(struct stmmac_priv *priv, bool enable) - if (priv->plat->fpe_cfg->hs_enable != enable) { - if (enable) { - stmmac_fpe_send_mpacket(priv, priv->ioaddr, -+ priv->plat->fpe_cfg, - MPACKET_VERIFY); - } else { - priv->plat->fpe_cfg->lo_fpe_state = FPE_STATE_OFF; -@@ -7472,6 +7477,7 @@ int stmmac_suspend(struct device *dev) - if (priv->dma_cap.fpesel) { - /* Disable FPE */ - stmmac_fpe_configure(priv, priv->ioaddr, -+ priv->plat->fpe_cfg, - priv->plat->tx_queues_to_use, - priv->plat->rx_queues_to_use, false); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c -index 773e415cc2de6..390c900832cd2 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c -@@ -1073,6 +1073,7 @@ disable: - - priv->plat->fpe_cfg->enable = false; - stmmac_fpe_configure(priv, priv->ioaddr, -+ priv->plat->fpe_cfg, - priv->plat->tx_queues_to_use, - priv->plat->rx_queues_to_use, - false); -diff --git a/drivers/net/hyperv/Kconfig b/drivers/net/hyperv/Kconfig -index ca7bf7f897d36..c8cbd85adcf99 100644 ---- a/drivers/net/hyperv/Kconfig -+++ b/drivers/net/hyperv/Kconfig -@@ -3,5 +3,6 @@ config HYPERV_NET - tristate "Microsoft Hyper-V virtual network driver" - depends on HYPERV - select UCS2_STRING -+ select NLS - help - Select this option to enable the Hyper-V virtual network driver. -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 345e341d22338..4d833781294a4 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -763,7 +763,7 @@ enum rtl_register_content { - - /* rtl8152 flags */ - enum rtl8152_flags { -- RTL8152_UNPLUG = 0, -+ RTL8152_INACCESSIBLE = 0, - RTL8152_SET_RX_MODE, - WORK_ENABLE, - RTL8152_LINK_CHG, -@@ -1244,7 +1244,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) - static void rtl_set_unplug(struct r8152 *tp) - { - if (tp->udev->state == USB_STATE_NOTATTACHED) { -- set_bit(RTL8152_UNPLUG, &tp->flags); -+ set_bit(RTL8152_INACCESSIBLE, &tp->flags); - smp_mb__after_atomic(); - } - } -@@ -1255,7 +1255,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, - u16 limit = 64; - int ret = 0; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - /* both size and indix must be 4 bytes align */ -@@ -1299,7 +1299,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen, - u16 byteen_start, byteen_end, byen; - u16 limit = 512; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - /* both size and indix must be 4 bytes align */ -@@ -1529,7 +1529,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg) - struct r8152 *tp = netdev_priv(netdev); - int ret; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - if (phy_id != R8152_PHY_ID) -@@ -1545,7 +1545,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val) - { - struct r8152 *tp = netdev_priv(netdev); - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - if (phy_id != R8152_PHY_ID) -@@ -1750,7 +1750,7 @@ static void read_bulk_callback(struct urb *urb) - if (!tp) - return; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - if (!test_bit(WORK_ENABLE, &tp->flags)) -@@ -1842,7 +1842,7 @@ static void write_bulk_callback(struct urb *urb) - if (!test_bit(WORK_ENABLE, &tp->flags)) - return; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - if (!skb_queue_empty(&tp->tx_queue)) -@@ -1863,7 +1863,7 @@ static void intr_callback(struct urb *urb) - if (!test_bit(WORK_ENABLE, &tp->flags)) - return; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - switch (status) { -@@ -2607,7 +2607,7 @@ static void bottom_half(struct tasklet_struct *t) - { - struct r8152 *tp = from_tasklet(tp, t, tx_tl); - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - if (!test_bit(WORK_ENABLE, &tp->flags)) -@@ -2650,7 +2650,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags) - int ret; - - /* The rx would be stopped, so skip submitting */ -- if (test_bit(RTL8152_UNPLUG, &tp->flags) || -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || - !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev)) - return 0; - -@@ -2857,6 +2857,8 @@ static void rtl8152_nic_reset(struct r8152 *tp) - ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CR, CR_RST); - - for (i = 0; i < 1000; i++) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ break; - if (!(ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CR) & CR_RST)) - break; - usleep_range(100, 400); -@@ -3050,7 +3052,7 @@ static int rtl_enable(struct r8152 *tp) - - static int rtl8152_enable(struct r8152 *tp) - { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - set_tx_qlen(tp); -@@ -3137,7 +3139,7 @@ static int rtl8153_enable(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - set_tx_qlen(tp); -@@ -3169,7 +3171,7 @@ static void rtl_disable(struct r8152 *tp) - u32 ocp_data; - int i; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { - rtl_drop_queued_tx(tp); - return; - } -@@ -3186,6 +3188,8 @@ static void rtl_disable(struct r8152 *tp) - rxdy_gated_en(tp, true); - - for (i = 0; i < 1000; i++) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ break; - ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); - if ((ocp_data & FIFO_EMPTY) == FIFO_EMPTY) - break; -@@ -3193,6 +3197,8 @@ static void rtl_disable(struct r8152 *tp) - } - - for (i = 0; i < 1000; i++) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ break; - if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0) & TCR0_TX_EMPTY) - break; - usleep_range(1000, 2000); -@@ -3623,7 +3629,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) - } - - msleep(20); -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - break; - } - -@@ -3655,7 +3661,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) - int i; - - for (i = 0; i < 500; i++) { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & - AUTOLOAD_DONE) -@@ -3697,7 +3703,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) - int i; - - for (i = 0; i < 500; i++) { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & - AUTOLOAD_DONE) -@@ -4062,8 +4068,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) - for (i = 0; wait && i < 5000; i++) { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -- break; -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ return -ENODEV; - - usleep_range(1000, 2000); - ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); -@@ -5381,6 +5387,8 @@ static void wait_oob_link_list_ready(struct r8152 *tp) - int i; - - for (i = 0; i < 1000; i++) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ break; - ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); - if (ocp_data & LINK_LIST_READY) - break; -@@ -5395,6 +5403,8 @@ static void r8156b_wait_loading_flash(struct r8152 *tp) - int i; - - for (i = 0; i < 100; i++) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ break; - if (ocp_read_word(tp, MCU_TYPE_USB, USB_GPHY_CTRL) & GPHY_PATCH_DONE) - break; - usleep_range(1000, 2000); -@@ -5517,6 +5527,8 @@ static int r8153_pre_firmware_1(struct r8152 *tp) - for (i = 0; i < 104; i++) { - u32 ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_WDT1_CTRL); - -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ return -ENODEV; - if (!(ocp_data & WTD1_EN)) - break; - usleep_range(1000, 2000); -@@ -5673,6 +5685,8 @@ static void r8153_aldps_en(struct r8152 *tp, bool enable) - data &= ~EN_ALDPS; - ocp_reg_write(tp, OCP_POWER_CFG, data); - for (i = 0; i < 20; i++) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) -+ return; - usleep_range(1000, 2000); - if (ocp_read_word(tp, MCU_TYPE_PLA, 0xe000) & 0x0100) - break; -@@ -6026,7 +6040,7 @@ static int rtl8156_enable(struct r8152 *tp) - u32 ocp_data; - u16 speed; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - r8156_fc_parameter(tp); -@@ -6084,7 +6098,7 @@ static int rtl8156b_enable(struct r8152 *tp) - u32 ocp_data; - u16 speed; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - set_tx_qlen(tp); -@@ -6270,7 +6284,7 @@ out: - - static void rtl8152_up(struct r8152 *tp) - { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8152_aldps_en(tp, false); -@@ -6280,7 +6294,7 @@ static void rtl8152_up(struct r8152 *tp) - - static void rtl8152_down(struct r8152 *tp) - { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { - rtl_drop_queued_tx(tp); - return; - } -@@ -6295,7 +6309,7 @@ static void rtl8153_up(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153_u1u2en(tp, false); -@@ -6335,7 +6349,7 @@ static void rtl8153_down(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { - rtl_drop_queued_tx(tp); - return; - } -@@ -6356,7 +6370,7 @@ static void rtl8153b_up(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153b_u1u2en(tp, false); -@@ -6380,7 +6394,7 @@ static void rtl8153b_down(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { - rtl_drop_queued_tx(tp); - return; - } -@@ -6417,7 +6431,7 @@ static void rtl8153c_up(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153b_u1u2en(tp, false); -@@ -6498,7 +6512,7 @@ static void rtl8156_up(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153b_u1u2en(tp, false); -@@ -6571,7 +6585,7 @@ static void rtl8156_down(struct r8152 *tp) - { - u32 ocp_data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { - rtl_drop_queued_tx(tp); - return; - } -@@ -6709,7 +6723,7 @@ static void rtl_work_func_t(struct work_struct *work) - /* If the device is unplugged or !netif_running(), the workqueue - * doesn't need to wake the device, and could return directly. - */ -- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev)) - return; - - if (usb_autopm_get_interface(tp->intf) < 0) -@@ -6748,7 +6762,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work) - { - struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work); - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - if (usb_autopm_get_interface(tp->intf) < 0) -@@ -6875,7 +6889,7 @@ static int rtl8152_close(struct net_device *netdev) - netif_stop_queue(netdev); - - res = usb_autopm_get_interface(tp->intf); -- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) { -+ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { - rtl_drop_queued_tx(tp); - rtl_stop_rx(tp); - } else { -@@ -6908,7 +6922,7 @@ static void r8152b_init(struct r8152 *tp) - u32 ocp_data; - u16 data; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - data = r8152_mdio_read(tp, MII_BMCR); -@@ -6952,7 +6966,7 @@ static void r8153_init(struct r8152 *tp) - u16 data; - int i; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153_u1u2en(tp, false); -@@ -6963,7 +6977,7 @@ static void r8153_init(struct r8152 *tp) - break; - - msleep(20); -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - break; - } - -@@ -7092,7 +7106,7 @@ static void r8153b_init(struct r8152 *tp) - u16 data; - int i; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153b_u1u2en(tp, false); -@@ -7103,7 +7117,7 @@ static void r8153b_init(struct r8152 *tp) - break; - - msleep(20); -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - break; - } - -@@ -7174,7 +7188,7 @@ static void r8153c_init(struct r8152 *tp) - u16 data; - int i; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153b_u1u2en(tp, false); -@@ -7194,7 +7208,7 @@ static void r8153c_init(struct r8152 *tp) - break; - - msleep(20); -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - } - -@@ -8023,7 +8037,7 @@ static void r8156_init(struct r8152 *tp) - u16 data; - int i; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); -@@ -8044,7 +8058,7 @@ static void r8156_init(struct r8152 *tp) - break; - - msleep(20); -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - } - -@@ -8119,7 +8133,7 @@ static void r8156b_init(struct r8152 *tp) - u16 data; - int i; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); -@@ -8153,7 +8167,7 @@ static void r8156b_init(struct r8152 *tp) - break; - - msleep(20); -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - } - -@@ -9219,7 +9233,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) - struct mii_ioctl_data *data = if_mii(rq); - int res; - -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return -ENODEV; - - res = usb_autopm_get_interface(tp->intf); -@@ -9321,7 +9335,7 @@ static const struct net_device_ops rtl8152_netdev_ops = { - - static void rtl8152_unload(struct r8152 *tp) - { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - if (tp->version != RTL_VER_01) -@@ -9330,7 +9344,7 @@ static void rtl8152_unload(struct r8152 *tp) - - static void rtl8153_unload(struct r8152 *tp) - { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153_power_cut_en(tp, false); -@@ -9338,7 +9352,7 @@ static void rtl8153_unload(struct r8152 *tp) - - static void rtl8153b_unload(struct r8152 *tp) - { -- if (test_bit(RTL8152_UNPLUG, &tp->flags)) -+ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) - return; - - r8153b_power_cut_en(tp, false); -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index 69f9e69208f68..118bf08a708b9 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -154,6 +154,11 @@ enum nvme_quirks { - * No temperature thresholds for channels other than 0 (Composite). - */ - NVME_QUIRK_NO_SECONDARY_TEMP_THRESH = (1 << 19), -+ -+ /* -+ * Disables simple suspend/resume path. -+ */ -+ NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND = (1 << 20), - }; - - /* -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 886c3fc9578e4..3d01290994d89 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -3093,6 +3093,18 @@ static unsigned long check_vendor_combination_bug(struct pci_dev *pdev) - if ((dmi_match(DMI_BOARD_VENDOR, "LENOVO")) && - dmi_match(DMI_BOARD_NAME, "LNVNB161216")) - return NVME_QUIRK_SIMPLE_SUSPEND; -+ } else if (pdev->vendor == 0x2646 && (pdev->device == 0x2263 || -+ pdev->device == 0x500f)) { -+ /* -+ * Exclude some Kingston NV1 and A2000 devices from -+ * NVME_QUIRK_SIMPLE_SUSPEND. Do a full suspend to save a -+ * lot fo energy with s2idle sleep on some TUXEDO platforms. -+ */ -+ if (dmi_match(DMI_BOARD_NAME, "NS5X_NS7XAU") || -+ dmi_match(DMI_BOARD_NAME, "NS5x_7xAU") || -+ dmi_match(DMI_BOARD_NAME, "NS5x_7xPU") || -+ dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1")) -+ return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND; - } - - return 0; -@@ -3133,7 +3145,9 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev, - dev->dev = get_device(&pdev->dev); - - quirks |= check_vendor_combination_bug(pdev); -- if (!noacpi && acpi_storage_d3(&pdev->dev)) { -+ if (!noacpi && -+ !(quirks & NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND) && -+ acpi_storage_d3(&pdev->dev)) { - /* - * Some systems use a bios work around to ask for D3 on - * platforms that support kernel managed suspend. -diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c -index 0fbf331a748fd..9bb9fe0fad07c 100644 ---- a/drivers/of/dynamic.c -+++ b/drivers/of/dynamic.c -@@ -104,8 +104,9 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p) - * - * Returns the new state of a device based on the notifier used. - * -- * Return: 0 on device going from enabled to disabled, 1 on device -- * going from disabled to enabled and -1 on no change. -+ * Return: OF_RECONFIG_CHANGE_REMOVE on device going from enabled to -+ * disabled, OF_RECONFIG_CHANGE_ADD on device going from disabled to -+ * enabled and OF_RECONFIG_NO_CHANGE on no change. - */ - int of_reconfig_get_state_change(unsigned long action, struct of_reconfig_data *pr) - { -diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c -index 5784dc20fb382..4605758d32146 100644 ---- a/drivers/parport/parport_pc.c -+++ b/drivers/parport/parport_pc.c -@@ -2614,6 +2614,8 @@ enum parport_pc_pci_cards { - netmos_9865, - quatech_sppxp100, - wch_ch382l, -+ brainboxes_uc146, -+ brainboxes_px203, - }; - - -@@ -2678,6 +2680,8 @@ static struct parport_pc_pci { - /* netmos_9865 */ { 1, { { 0, -1 }, } }, - /* quatech_sppxp100 */ { 1, { { 0, 1 }, } }, - /* wch_ch382l */ { 1, { { 2, -1 }, } }, -+ /* brainboxes_uc146 */ { 1, { { 3, -1 }, } }, -+ /* brainboxes_px203 */ { 1, { { 0, -1 }, } }, - }; - - static const struct pci_device_id parport_pc_pci_tbl[] = { -@@ -2771,6 +2775,23 @@ static const struct pci_device_id parport_pc_pci_tbl[] = { - PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 }, - /* WCH CH382L PCI-E single parallel port card */ - { 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l }, -+ /* Brainboxes IX-500/550 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x402a, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, oxsemi_pcie_pport }, -+ /* Brainboxes UC-146/UC-157 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0be1, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc146 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0be2, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc146 }, -+ /* Brainboxes PX-146/PX-257 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x401c, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, oxsemi_pcie_pport }, -+ /* Brainboxes PX-203 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x4007, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px203 }, -+ /* Brainboxes PX-475 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x401f, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, oxsemi_pcie_pport }, - { 0, } /* terminate list */ - }; - MODULE_DEVICE_TABLE(pci, parport_pc_pci_tbl); -diff --git a/drivers/platform/mellanox/mlxbf-bootctl.c b/drivers/platform/mellanox/mlxbf-bootctl.c -index 1c7a288b59a5c..6a171a4f9dc68 100644 ---- a/drivers/platform/mellanox/mlxbf-bootctl.c -+++ b/drivers/platform/mellanox/mlxbf-bootctl.c -@@ -17,6 +17,7 @@ - - #define MLXBF_BOOTCTL_SB_SECURE_MASK 0x03 - #define MLXBF_BOOTCTL_SB_TEST_MASK 0x0c -+#define MLXBF_BOOTCTL_SB_DEV_MASK BIT(4) - - #define MLXBF_SB_KEY_NUM 4 - -@@ -37,11 +38,18 @@ static struct mlxbf_bootctl_name boot_names[] = { - { MLXBF_BOOTCTL_NONE, "none" }, - }; - -+enum { -+ MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION = 0, -+ MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE = 1, -+ MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE = 2, -+ MLXBF_BOOTCTL_SB_LIFECYCLE_RMA = 3 -+}; -+ - static const char * const mlxbf_bootctl_lifecycle_states[] = { -- [0] = "Production", -- [1] = "GA Secured", -- [2] = "GA Non-Secured", -- [3] = "RMA", -+ [MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION] = "Production", -+ [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE] = "GA Secured", -+ [MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE] = "GA Non-Secured", -+ [MLXBF_BOOTCTL_SB_LIFECYCLE_RMA] = "RMA", - }; - - /* ARM SMC call which is atomic and no need for lock. */ -@@ -165,25 +173,30 @@ static ssize_t second_reset_action_store(struct device *dev, - static ssize_t lifecycle_state_show(struct device *dev, - struct device_attribute *attr, char *buf) - { -+ int status_bits; -+ int use_dev_key; -+ int test_state; - int lc_state; - -- lc_state = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS, -- MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE); -- if (lc_state < 0) -- return lc_state; -+ status_bits = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS, -+ MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE); -+ if (status_bits < 0) -+ return status_bits; - -- lc_state &= -- MLXBF_BOOTCTL_SB_TEST_MASK | MLXBF_BOOTCTL_SB_SECURE_MASK; -+ use_dev_key = status_bits & MLXBF_BOOTCTL_SB_DEV_MASK; -+ test_state = status_bits & MLXBF_BOOTCTL_SB_TEST_MASK; -+ lc_state = status_bits & MLXBF_BOOTCTL_SB_SECURE_MASK; - - /* - * If the test bits are set, we specify that the current state may be - * due to using the test bits. - */ -- if (lc_state & MLXBF_BOOTCTL_SB_TEST_MASK) { -- lc_state &= MLXBF_BOOTCTL_SB_SECURE_MASK; -- -+ if (test_state) { - return sprintf(buf, "%s(test)\n", - mlxbf_bootctl_lifecycle_states[lc_state]); -+ } else if (use_dev_key && -+ (lc_state == MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE)) { -+ return sprintf(buf, "Secured (development)\n"); - } - - return sprintf(buf, "%s\n", mlxbf_bootctl_lifecycle_states[lc_state]); -diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c -index 2d4bbe99959ef..db7a1d360cd2c 100644 ---- a/drivers/platform/mellanox/mlxbf-pmc.c -+++ b/drivers/platform/mellanox/mlxbf-pmc.c -@@ -1202,6 +1202,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) - attr->dev_attr.show = mlxbf_pmc_event_list_show; - attr->nr = blk_num; - attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, "event_list"); -+ if (!attr->dev_attr.attr.name) -+ return -ENOMEM; - pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; - attr = NULL; - -@@ -1214,6 +1216,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) - attr->nr = blk_num; - attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, - "enable"); -+ if (!attr->dev_attr.attr.name) -+ return -ENOMEM; - pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; - attr = NULL; - } -@@ -1240,6 +1244,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) - attr->nr = blk_num; - attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, - "counter%d", j); -+ if (!attr->dev_attr.attr.name) -+ return -ENOMEM; - pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; - attr = NULL; - -@@ -1251,6 +1257,8 @@ static int mlxbf_pmc_init_perftype_counter(struct device *dev, int blk_num) - attr->nr = blk_num; - attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, - "event%d", j); -+ if (!attr->dev_attr.attr.name) -+ return -ENOMEM; - pmc->block[blk_num].block_attr[++i] = &attr->dev_attr.attr; - attr = NULL; - } -@@ -1283,6 +1291,8 @@ static int mlxbf_pmc_init_perftype_reg(struct device *dev, int blk_num) - attr->nr = blk_num; - attr->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL, - events[j].evt_name); -+ if (!attr->dev_attr.attr.name) -+ return -ENOMEM; - pmc->block[blk_num].block_attr[i] = &attr->dev_attr.attr; - attr = NULL; - i++; -@@ -1311,6 +1321,8 @@ static int mlxbf_pmc_create_groups(struct device *dev, int blk_num) - pmc->block[blk_num].block_attr_grp.attrs = pmc->block[blk_num].block_attr; - pmc->block[blk_num].block_attr_grp.name = devm_kasprintf( - dev, GFP_KERNEL, pmc->block_name[blk_num]); -+ if (!pmc->block[blk_num].block_attr_grp.name) -+ return -ENOMEM; - pmc->groups[blk_num] = &pmc->block[blk_num].block_attr_grp; - - return 0; -@@ -1442,6 +1454,8 @@ static int mlxbf_pmc_probe(struct platform_device *pdev) - - pmc->hwmon_dev = devm_hwmon_device_register_with_groups( - dev, "bfperf", pmc, pmc->groups); -+ if (IS_ERR(pmc->hwmon_dev)) -+ return PTR_ERR(pmc->hwmon_dev); - platform_set_drvdata(pdev, pmc); - - return 0; -diff --git a/drivers/platform/surface/aggregator/core.c b/drivers/platform/surface/aggregator/core.c -index 1a6373dea109c..6152be38398c4 100644 ---- a/drivers/platform/surface/aggregator/core.c -+++ b/drivers/platform/surface/aggregator/core.c -@@ -231,9 +231,12 @@ static int ssam_receive_buf(struct serdev_device *dev, const unsigned char *buf, - size_t n) - { - struct ssam_controller *ctrl; -+ int ret; - - ctrl = serdev_device_get_drvdata(dev); -- return ssam_controller_receive_buf(ctrl, buf, n); -+ ret = ssam_controller_receive_buf(ctrl, buf, n); -+ -+ return ret < 0 ? 0 : ret; - } - - static void ssam_write_wakeup(struct serdev_device *dev) -diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig -index 1396a839dd8a4..d5acef3202dad 100644 ---- a/drivers/platform/x86/Kconfig -+++ b/drivers/platform/x86/Kconfig -@@ -271,6 +271,7 @@ config ASUS_WMI - depends on RFKILL || RFKILL = n - depends on HOTPLUG_PCI - depends on ACPI_VIDEO || ACPI_VIDEO = n -+ depends on SERIO_I8042 || SERIO_I8042 = n - select INPUT_SPARSEKMAP - select LEDS_CLASS - select NEW_LEDS -@@ -287,7 +288,6 @@ config ASUS_WMI - config ASUS_NB_WMI - tristate "Asus Notebook WMI Driver" - depends on ASUS_WMI -- depends on SERIO_I8042 || SERIO_I8042 = n - help - This is a driver for newer Asus notebooks. It adds extra features - like wireless radio and bluetooth control, leds, hotkeys, backlight... -diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c -index df1db54d4e183..af3da303e2b15 100644 ---- a/drivers/platform/x86/asus-nb-wmi.c -+++ b/drivers/platform/x86/asus-nb-wmi.c -@@ -501,8 +501,6 @@ static const struct dmi_system_id asus_quirks[] = { - - static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) - { -- int ret; -- - quirks = &quirk_asus_unknown; - dmi_check_system(asus_quirks); - -@@ -517,15 +515,6 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) - - if (tablet_mode_sw != -1) - quirks->tablet_switch_mode = tablet_mode_sw; -- -- if (quirks->i8042_filter) { -- ret = i8042_install_filter(quirks->i8042_filter); -- if (ret) { -- pr_warn("Unable to install key filter\n"); -- return; -- } -- pr_info("Using i8042 filter function for receiving events\n"); -- } - } - - static const struct key_entry asus_nb_wmi_keymap[] = { -diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c -index 49dd55b8e8faf..296150eaef929 100644 ---- a/drivers/platform/x86/asus-wmi.c -+++ b/drivers/platform/x86/asus-wmi.c -@@ -3839,6 +3839,12 @@ static int asus_wmi_add(struct platform_device *pdev) - goto fail_wmi_handler; - } - -+ if (asus->driver->quirks->i8042_filter) { -+ err = i8042_install_filter(asus->driver->quirks->i8042_filter); -+ if (err) -+ pr_warn("Unable to install key filter - %d\n", err); -+ } -+ - asus_wmi_battery_init(asus); - - asus_wmi_debugfs_init(asus); -@@ -3873,6 +3879,8 @@ static int asus_wmi_remove(struct platform_device *device) - struct asus_wmi *asus; - - asus = platform_get_drvdata(device); -+ if (asus->driver->quirks->i8042_filter) -+ i8042_remove_filter(asus->driver->quirks->i8042_filter); - wmi_remove_notify_handler(asus->driver->event_guid); - asus_wmi_backlight_exit(asus); - asus_wmi_input_exit(asus); -diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c -index 2b79377cc21e2..b3f3e23a64eee 100644 ---- a/drivers/platform/x86/wmi.c -+++ b/drivers/platform/x86/wmi.c -@@ -1227,6 +1227,11 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device) - if (debug_dump_wdg) - wmi_dump_wdg(&gblock[i]); - -+ if (!gblock[i].instance_count) { -+ dev_info(wmi_bus_dev, FW_INFO "%pUL has zero instances\n", &gblock[i].guid); -+ continue; -+ } -+ - if (guid_already_parsed_for_legacy(device, &gblock[i].guid)) - continue; - -diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c -index 8a2f18fa3faf5..9193c3b8edebe 100644 ---- a/drivers/powercap/dtpm_cpu.c -+++ b/drivers/powercap/dtpm_cpu.c -@@ -140,6 +140,8 @@ static void pd_release(struct dtpm *dtpm) - if (policy) { - for_each_cpu(dtpm_cpu->cpu, policy->related_cpus) - per_cpu(dtpm_per_cpu, dtpm_cpu->cpu) = NULL; -+ -+ cpufreq_cpu_put(policy); - } - - kfree(dtpm_cpu); -@@ -191,12 +193,16 @@ static int __dtpm_cpu_setup(int cpu, struct dtpm *parent) - return 0; - - pd = em_cpu_get(cpu); -- if (!pd || em_is_artificial(pd)) -- return -EINVAL; -+ if (!pd || em_is_artificial(pd)) { -+ ret = -EINVAL; -+ goto release_policy; -+ } - - dtpm_cpu = kzalloc(sizeof(*dtpm_cpu), GFP_KERNEL); -- if (!dtpm_cpu) -- return -ENOMEM; -+ if (!dtpm_cpu) { -+ ret = -ENOMEM; -+ goto release_policy; -+ } - - dtpm_init(&dtpm_cpu->dtpm, &dtpm_ops); - dtpm_cpu->cpu = cpu; -@@ -216,6 +222,7 @@ static int __dtpm_cpu_setup(int cpu, struct dtpm *parent) - if (ret) - goto out_dtpm_unregister; - -+ cpufreq_cpu_put(policy); - return 0; - - out_dtpm_unregister: -@@ -227,6 +234,8 @@ out_kfree_dtpm_cpu: - per_cpu(dtpm_per_cpu, cpu) = NULL; - kfree(dtpm_cpu); - -+release_policy: -+ cpufreq_cpu_put(policy); - return ret; - } - -diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c -index 50a577ac3bb42..b6df0d4319072 100644 ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -2710,6 +2710,7 @@ init_wrb_hndl_failed: - kfree(pwrb_context->pwrb_handle_base); - kfree(pwrb_context->pwrb_handle_basestd); - } -+ kfree(phwi_ctxt->be_wrbq); - return -ENOMEM; - } - -diff --git a/drivers/tee/optee/device.c b/drivers/tee/optee/device.c -index 64f0e047c23d2..4b10921276942 100644 ---- a/drivers/tee/optee/device.c -+++ b/drivers/tee/optee/device.c -@@ -60,7 +60,16 @@ static void optee_release_device(struct device *dev) - kfree(optee_device); - } - --static int optee_register_device(const uuid_t *device_uuid) -+static ssize_t need_supplicant_show(struct device *dev, -+ struct device_attribute *attr, -+ char *buf) -+{ -+ return 0; -+} -+ -+static DEVICE_ATTR_RO(need_supplicant); -+ -+static int optee_register_device(const uuid_t *device_uuid, u32 func) - { - struct tee_client_device *optee_device = NULL; - int rc; -@@ -83,6 +92,10 @@ static int optee_register_device(const uuid_t *device_uuid) - put_device(&optee_device->dev); - } - -+ if (func == PTA_CMD_GET_DEVICES_SUPP) -+ device_create_file(&optee_device->dev, -+ &dev_attr_need_supplicant); -+ - return rc; - } - -@@ -142,7 +155,7 @@ static int __optee_enumerate_devices(u32 func) - num_devices = shm_size / sizeof(uuid_t); - - for (idx = 0; idx < num_devices; idx++) { -- rc = optee_register_device(&device_uuid[idx]); -+ rc = optee_register_device(&device_uuid[idx], func); - if (rc) - goto out_shm; - } -diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c -index 7db51781289ed..88035100b86c6 100644 ---- a/drivers/tty/serial/8250/8250_dw.c -+++ b/drivers/tty/serial/8250/8250_dw.c -@@ -795,6 +795,7 @@ static const struct acpi_device_id dw8250_acpi_match[] = { - { "INT33C5", (kernel_ulong_t)&dw8250_dw_apb }, - { "INT3434", (kernel_ulong_t)&dw8250_dw_apb }, - { "INT3435", (kernel_ulong_t)&dw8250_dw_apb }, -+ { "INTC10EE", (kernel_ulong_t)&dw8250_dw_apb }, - { }, - }; - MODULE_DEVICE_TABLE(acpi, dw8250_acpi_match); -diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c -index f271becfc46c1..02c9b98a6bbf1 100644 ---- a/drivers/tty/serial/8250/8250_early.c -+++ b/drivers/tty/serial/8250/8250_early.c -@@ -197,6 +197,7 @@ static int __init early_omap8250_setup(struct earlycon_device *device, - OF_EARLYCON_DECLARE(omap8250, "ti,omap2-uart", early_omap8250_setup); - OF_EARLYCON_DECLARE(omap8250, "ti,omap3-uart", early_omap8250_setup); - OF_EARLYCON_DECLARE(omap8250, "ti,omap4-uart", early_omap8250_setup); -+OF_EARLYCON_DECLARE(omap8250, "ti,am654-uart", early_omap8250_setup); - - #endif - -diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c -index 2e21f74a24705..0b04d810b3e61 100644 ---- a/drivers/tty/serial/8250/8250_omap.c -+++ b/drivers/tty/serial/8250/8250_omap.c -@@ -825,7 +825,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) - if (priv->habit & UART_HAS_RHR_IT_DIS) { - reg = serial_in(p, UART_OMAP_IER2); - reg &= ~UART_OMAP_IER2_RHR_IT_DIS; -- serial_out(p, UART_OMAP_IER2, UART_OMAP_IER2_RHR_IT_DIS); -+ serial_out(p, UART_OMAP_IER2, reg); - } - - dmaengine_tx_status(rxchan, cookie, &state); -@@ -967,7 +967,7 @@ static int omap_8250_rx_dma(struct uart_8250_port *p) - if (priv->habit & UART_HAS_RHR_IT_DIS) { - reg = serial_in(p, UART_OMAP_IER2); - reg |= UART_OMAP_IER2_RHR_IT_DIS; -- serial_out(p, UART_OMAP_IER2, UART_OMAP_IER2_RHR_IT_DIS); -+ serial_out(p, UART_OMAP_IER2, reg); - } - - dma_async_issue_pending(dma->rxchan); -@@ -1186,10 +1186,12 @@ static int omap_8250_dma_handle_irq(struct uart_port *port) - - status = serial_port_in(port, UART_LSR); - -- if (priv->habit & UART_HAS_EFR2) -- am654_8250_handle_rx_dma(up, iir, status); -- else -- status = omap_8250_handle_rx_dma(up, iir, status); -+ if ((iir & 0x3f) != UART_IIR_THRI) { -+ if (priv->habit & UART_HAS_EFR2) -+ am654_8250_handle_rx_dma(up, iir, status); -+ else -+ status = omap_8250_handle_rx_dma(up, iir, status); -+ } - - serial8250_modem_status(up); - if (status & UART_LSR_THRE && up->dma->tx_err) { -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index 0a1cc36f93aa7..c74eaf2552c32 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -218,17 +218,18 @@ static struct vendor_data vendor_st = { - - /* Deals with DMA transactions */ - --struct pl011_sgbuf { -- struct scatterlist sg; -- char *buf; -+struct pl011_dmabuf { -+ dma_addr_t dma; -+ size_t len; -+ char *buf; - }; - - struct pl011_dmarx_data { - struct dma_chan *chan; - struct completion complete; - bool use_buf_b; -- struct pl011_sgbuf sgbuf_a; -- struct pl011_sgbuf sgbuf_b; -+ struct pl011_dmabuf dbuf_a; -+ struct pl011_dmabuf dbuf_b; - dma_cookie_t cookie; - bool running; - struct timer_list timer; -@@ -241,7 +242,8 @@ struct pl011_dmarx_data { - - struct pl011_dmatx_data { - struct dma_chan *chan; -- struct scatterlist sg; -+ dma_addr_t dma; -+ size_t len; - char *buf; - bool queued; - }; -@@ -365,32 +367,24 @@ static int pl011_fifo_to_tty(struct uart_amba_port *uap) - - #define PL011_DMA_BUFFER_SIZE PAGE_SIZE - --static int pl011_sgbuf_init(struct dma_chan *chan, struct pl011_sgbuf *sg, -+static int pl011_dmabuf_init(struct dma_chan *chan, struct pl011_dmabuf *db, - enum dma_data_direction dir) - { -- dma_addr_t dma_addr; -- -- sg->buf = dma_alloc_coherent(chan->device->dev, -- PL011_DMA_BUFFER_SIZE, &dma_addr, GFP_KERNEL); -- if (!sg->buf) -+ db->buf = dma_alloc_coherent(chan->device->dev, PL011_DMA_BUFFER_SIZE, -+ &db->dma, GFP_KERNEL); -+ if (!db->buf) - return -ENOMEM; -- -- sg_init_table(&sg->sg, 1); -- sg_set_page(&sg->sg, phys_to_page(dma_addr), -- PL011_DMA_BUFFER_SIZE, offset_in_page(dma_addr)); -- sg_dma_address(&sg->sg) = dma_addr; -- sg_dma_len(&sg->sg) = PL011_DMA_BUFFER_SIZE; -+ db->len = PL011_DMA_BUFFER_SIZE; - - return 0; - } - --static void pl011_sgbuf_free(struct dma_chan *chan, struct pl011_sgbuf *sg, -+static void pl011_dmabuf_free(struct dma_chan *chan, struct pl011_dmabuf *db, - enum dma_data_direction dir) - { -- if (sg->buf) { -+ if (db->buf) { - dma_free_coherent(chan->device->dev, -- PL011_DMA_BUFFER_SIZE, sg->buf, -- sg_dma_address(&sg->sg)); -+ PL011_DMA_BUFFER_SIZE, db->buf, db->dma); - } - } - -@@ -551,8 +545,8 @@ static void pl011_dma_tx_callback(void *data) - - spin_lock_irqsave(&uap->port.lock, flags); - if (uap->dmatx.queued) -- dma_unmap_sg(dmatx->chan->device->dev, &dmatx->sg, 1, -- DMA_TO_DEVICE); -+ dma_unmap_single(dmatx->chan->device->dev, dmatx->dma, -+ dmatx->len, DMA_TO_DEVICE); - - dmacr = uap->dmacr; - uap->dmacr = dmacr & ~UART011_TXDMAE; -@@ -638,18 +632,19 @@ static int pl011_dma_tx_refill(struct uart_amba_port *uap) - memcpy(&dmatx->buf[first], &xmit->buf[0], second); - } - -- dmatx->sg.length = count; -- -- if (dma_map_sg(dma_dev->dev, &dmatx->sg, 1, DMA_TO_DEVICE) != 1) { -+ dmatx->len = count; -+ dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count, -+ DMA_TO_DEVICE); -+ if (dmatx->dma == DMA_MAPPING_ERROR) { - uap->dmatx.queued = false; - dev_dbg(uap->port.dev, "unable to map TX DMA\n"); - return -EBUSY; - } - -- desc = dmaengine_prep_slave_sg(chan, &dmatx->sg, 1, DMA_MEM_TO_DEV, -+ desc = dmaengine_prep_slave_single(chan, dmatx->dma, dmatx->len, DMA_MEM_TO_DEV, - DMA_PREP_INTERRUPT | DMA_CTRL_ACK); - if (!desc) { -- dma_unmap_sg(dma_dev->dev, &dmatx->sg, 1, DMA_TO_DEVICE); -+ dma_unmap_single(dma_dev->dev, dmatx->dma, dmatx->len, DMA_TO_DEVICE); - uap->dmatx.queued = false; - /* - * If DMA cannot be used right now, we complete this -@@ -813,8 +808,8 @@ __acquires(&uap->port.lock) - dmaengine_terminate_async(uap->dmatx.chan); - - if (uap->dmatx.queued) { -- dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, -- DMA_TO_DEVICE); -+ dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, -+ uap->dmatx.len, DMA_TO_DEVICE); - uap->dmatx.queued = false; - uap->dmacr &= ~UART011_TXDMAE; - pl011_write(uap->dmacr, uap, REG_DMACR); -@@ -828,15 +823,15 @@ static int pl011_dma_rx_trigger_dma(struct uart_amba_port *uap) - struct dma_chan *rxchan = uap->dmarx.chan; - struct pl011_dmarx_data *dmarx = &uap->dmarx; - struct dma_async_tx_descriptor *desc; -- struct pl011_sgbuf *sgbuf; -+ struct pl011_dmabuf *dbuf; - - if (!rxchan) - return -EIO; - - /* Start the RX DMA job */ -- sgbuf = uap->dmarx.use_buf_b ? -- &uap->dmarx.sgbuf_b : &uap->dmarx.sgbuf_a; -- desc = dmaengine_prep_slave_sg(rxchan, &sgbuf->sg, 1, -+ dbuf = uap->dmarx.use_buf_b ? -+ &uap->dmarx.dbuf_b : &uap->dmarx.dbuf_a; -+ desc = dmaengine_prep_slave_single(rxchan, dbuf->dma, dbuf->len, - DMA_DEV_TO_MEM, - DMA_PREP_INTERRUPT | DMA_CTRL_ACK); - /* -@@ -876,8 +871,8 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap, - bool readfifo) - { - struct tty_port *port = &uap->port.state->port; -- struct pl011_sgbuf *sgbuf = use_buf_b ? -- &uap->dmarx.sgbuf_b : &uap->dmarx.sgbuf_a; -+ struct pl011_dmabuf *dbuf = use_buf_b ? -+ &uap->dmarx.dbuf_b : &uap->dmarx.dbuf_a; - int dma_count = 0; - u32 fifotaken = 0; /* only used for vdbg() */ - -@@ -886,7 +881,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap, - - if (uap->dmarx.poll_rate) { - /* The data can be taken by polling */ -- dmataken = sgbuf->sg.length - dmarx->last_residue; -+ dmataken = dbuf->len - dmarx->last_residue; - /* Recalculate the pending size */ - if (pending >= dmataken) - pending -= dmataken; -@@ -900,7 +895,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap, - * Note that tty_insert_flip_buf() tries to take as many chars - * as it can. - */ -- dma_count = tty_insert_flip_string(port, sgbuf->buf + dmataken, -+ dma_count = tty_insert_flip_string(port, dbuf->buf + dmataken, - pending); - - uap->port.icount.rx += dma_count; -@@ -911,7 +906,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap, - - /* Reset the last_residue for Rx DMA poll */ - if (uap->dmarx.poll_rate) -- dmarx->last_residue = sgbuf->sg.length; -+ dmarx->last_residue = dbuf->len; - - /* - * Only continue with trying to read the FIFO if all DMA chars have -@@ -946,8 +941,8 @@ static void pl011_dma_rx_irq(struct uart_amba_port *uap) - { - struct pl011_dmarx_data *dmarx = &uap->dmarx; - struct dma_chan *rxchan = dmarx->chan; -- struct pl011_sgbuf *sgbuf = dmarx->use_buf_b ? -- &dmarx->sgbuf_b : &dmarx->sgbuf_a; -+ struct pl011_dmabuf *dbuf = dmarx->use_buf_b ? -+ &dmarx->dbuf_b : &dmarx->dbuf_a; - size_t pending; - struct dma_tx_state state; - enum dma_status dmastat; -@@ -969,7 +964,7 @@ static void pl011_dma_rx_irq(struct uart_amba_port *uap) - pl011_write(uap->dmacr, uap, REG_DMACR); - uap->dmarx.running = false; - -- pending = sgbuf->sg.length - state.residue; -+ pending = dbuf->len - state.residue; - BUG_ON(pending > PL011_DMA_BUFFER_SIZE); - /* Then we terminate the transfer - we now know our residue */ - dmaengine_terminate_all(rxchan); -@@ -996,8 +991,8 @@ static void pl011_dma_rx_callback(void *data) - struct pl011_dmarx_data *dmarx = &uap->dmarx; - struct dma_chan *rxchan = dmarx->chan; - bool lastbuf = dmarx->use_buf_b; -- struct pl011_sgbuf *sgbuf = dmarx->use_buf_b ? -- &dmarx->sgbuf_b : &dmarx->sgbuf_a; -+ struct pl011_dmabuf *dbuf = dmarx->use_buf_b ? -+ &dmarx->dbuf_b : &dmarx->dbuf_a; - size_t pending; - struct dma_tx_state state; - int ret; -@@ -1015,7 +1010,7 @@ static void pl011_dma_rx_callback(void *data) - * the DMA irq handler. So we check the residue here. - */ - rxchan->device->device_tx_status(rxchan, dmarx->cookie, &state); -- pending = sgbuf->sg.length - state.residue; -+ pending = dbuf->len - state.residue; - BUG_ON(pending > PL011_DMA_BUFFER_SIZE); - /* Then we terminate the transfer - we now know our residue */ - dmaengine_terminate_all(rxchan); -@@ -1067,16 +1062,16 @@ static void pl011_dma_rx_poll(struct timer_list *t) - unsigned long flags; - unsigned int dmataken = 0; - unsigned int size = 0; -- struct pl011_sgbuf *sgbuf; -+ struct pl011_dmabuf *dbuf; - int dma_count; - struct dma_tx_state state; - -- sgbuf = dmarx->use_buf_b ? &uap->dmarx.sgbuf_b : &uap->dmarx.sgbuf_a; -+ dbuf = dmarx->use_buf_b ? &uap->dmarx.dbuf_b : &uap->dmarx.dbuf_a; - rxchan->device->device_tx_status(rxchan, dmarx->cookie, &state); - if (likely(state.residue < dmarx->last_residue)) { -- dmataken = sgbuf->sg.length - dmarx->last_residue; -+ dmataken = dbuf->len - dmarx->last_residue; - size = dmarx->last_residue - state.residue; -- dma_count = tty_insert_flip_string(port, sgbuf->buf + dmataken, -+ dma_count = tty_insert_flip_string(port, dbuf->buf + dmataken, - size); - if (dma_count == size) - dmarx->last_residue = state.residue; -@@ -1123,7 +1118,7 @@ static void pl011_dma_startup(struct uart_amba_port *uap) - return; - } - -- sg_init_one(&uap->dmatx.sg, uap->dmatx.buf, PL011_DMA_BUFFER_SIZE); -+ uap->dmatx.len = PL011_DMA_BUFFER_SIZE; - - /* The DMA buffer is now the FIFO the TTY subsystem can use */ - uap->port.fifosize = PL011_DMA_BUFFER_SIZE; -@@ -1133,7 +1128,7 @@ static void pl011_dma_startup(struct uart_amba_port *uap) - goto skip_rx; - - /* Allocate and map DMA RX buffers */ -- ret = pl011_sgbuf_init(uap->dmarx.chan, &uap->dmarx.sgbuf_a, -+ ret = pl011_dmabuf_init(uap->dmarx.chan, &uap->dmarx.dbuf_a, - DMA_FROM_DEVICE); - if (ret) { - dev_err(uap->port.dev, "failed to init DMA %s: %d\n", -@@ -1141,12 +1136,12 @@ static void pl011_dma_startup(struct uart_amba_port *uap) - goto skip_rx; - } - -- ret = pl011_sgbuf_init(uap->dmarx.chan, &uap->dmarx.sgbuf_b, -+ ret = pl011_dmabuf_init(uap->dmarx.chan, &uap->dmarx.dbuf_b, - DMA_FROM_DEVICE); - if (ret) { - dev_err(uap->port.dev, "failed to init DMA %s: %d\n", - "RX buffer B", ret); -- pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, -+ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, - DMA_FROM_DEVICE); - goto skip_rx; - } -@@ -1200,8 +1195,9 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) - /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); - if (uap->dmatx.queued) { -- dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, -- DMA_TO_DEVICE); -+ dma_unmap_single(uap->dmatx.chan->device->dev, -+ uap->dmatx.dma, uap->dmatx.len, -+ DMA_TO_DEVICE); - uap->dmatx.queued = false; - } - -@@ -1212,8 +1208,8 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) - if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); - /* Clean up the RX DMA */ -- pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE); -- pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE); -+ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); -+ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); - uap->using_rx_dma = false; -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index b398fba942964..b4b849415c503 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -769,6 +769,18 @@ static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - case SC16IS7XX_IIR_RTOI_SRC: - case SC16IS7XX_IIR_XOFFI_SRC: - rxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG); -+ -+ /* -+ * There is a silicon bug that makes the chip report a -+ * time-out interrupt but no data in the FIFO. This is -+ * described in errata section 18.1.4. -+ * -+ * When this happens, read one byte from the FIFO to -+ * clear the interrupt. -+ */ -+ if (iir == SC16IS7XX_IIR_RTOI_SRC && !rxlen) -+ rxlen = 1; -+ - if (rxlen) - sc16is7xx_handle_rx(port, rxlen, iir); - break; -diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c -index 6be6009f911e1..f1ca9250cad96 100644 ---- a/drivers/usb/gadget/function/f_hid.c -+++ b/drivers/usb/gadget/function/f_hid.c -@@ -88,6 +88,7 @@ static void hidg_release(struct device *dev) - { - struct f_hidg *hidg = container_of(dev, struct f_hidg, dev); - -+ kfree(hidg->report_desc); - kfree(hidg->set_report_buf); - kfree(hidg); - } -@@ -1287,9 +1288,9 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) - hidg->report_length = opts->report_length; - hidg->report_desc_length = opts->report_desc_length; - if (opts->report_desc) { -- hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc, -- opts->report_desc_length, -- GFP_KERNEL); -+ hidg->report_desc = kmemdup(opts->report_desc, -+ opts->report_desc_length, -+ GFP_KERNEL); - if (!hidg->report_desc) { - put_device(&hidg->dev); - --opts->refcnt; -diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c -index 1c0c61e8ba696..c40f2ecbe1b8c 100644 ---- a/drivers/usb/gadget/udc/core.c -+++ b/drivers/usb/gadget/udc/core.c -@@ -1608,8 +1608,6 @@ static void gadget_unbind_driver(struct device *dev) - - dev_dbg(&udc->dev, "unbinding gadget driver [%s]\n", driver->function); - -- kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); -- - udc->allow_connect = false; - cancel_work_sync(&udc->vbus_work); - mutex_lock(&udc->connect_lock); -@@ -1629,6 +1627,8 @@ static void gadget_unbind_driver(struct device *dev) - driver->is_bound = false; - udc->driver = NULL; - mutex_unlock(&udc_lock); -+ -+ kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); - } - - /* ------------------------------------------------------------------------- */ -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 24bcf6ab12d8a..e02ef31da68e4 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -348,8 +348,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - /* xHC spec requires PCI devices to support D3hot and D3cold */ - if (xhci->hci_version >= 0x120) - xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; -- else if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version >= 0x110) -- xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; - - if (xhci->quirks & XHCI_RESET_ON_RESUME) - xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, -diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c -index 3c3bab33e03a5..49d6b2388b874 100644 ---- a/drivers/usb/typec/class.c -+++ b/drivers/usb/typec/class.c -@@ -267,7 +267,7 @@ static void typec_altmode_put_partner(struct altmode *altmode) - if (!partner) - return; - -- adev = &partner->adev; -+ adev = &altmode->adev; - - if (is_typec_plug(adev->dev.parent)) { - struct typec_plug *plug = to_typec_plug(adev->dev.parent); -@@ -497,7 +497,8 @@ static void typec_altmode_release(struct device *dev) - { - struct altmode *alt = to_altmode(to_typec_altmode(dev)); - -- typec_altmode_put_partner(alt); -+ if (!is_typec_port(dev->parent)) -+ typec_altmode_put_partner(alt); - - altmode_id_remove(alt->adev.dev.parent, alt->id); - kfree(alt); -diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c -index bf99654371b35..2b7e796c48897 100644 ---- a/drivers/vdpa/mlx5/net/mlx5_vnet.c -+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c -@@ -2508,13 +2508,18 @@ static int setup_cvq_vring(struct mlx5_vdpa_dev *mvdev) - struct mlx5_control_vq *cvq = &mvdev->cvq; - int err = 0; - -- if (mvdev->actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ)) -+ if (mvdev->actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ)) { -+ u16 idx = cvq->vring.last_avail_idx; -+ - err = vringh_init_iotlb(&cvq->vring, mvdev->actual_features, - MLX5_CVQ_MAX_ENT, false, - (struct vring_desc *)(uintptr_t)cvq->desc_addr, - (struct vring_avail *)(uintptr_t)cvq->driver_addr, - (struct vring_used *)(uintptr_t)cvq->device_addr); - -+ if (!err) -+ cvq->vring.last_avail_idx = cvq->vring.last_used_idx = idx; -+ } - return err; - } - -diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c -index 2c6078a6b8ecb..58ca7c936393c 100644 ---- a/fs/nilfs2/sufile.c -+++ b/fs/nilfs2/sufile.c -@@ -501,15 +501,38 @@ int nilfs_sufile_mark_dirty(struct inode *sufile, __u64 segnum) - - down_write(&NILFS_MDT(sufile)->mi_sem); - ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh); -- if (!ret) { -- mark_buffer_dirty(bh); -- nilfs_mdt_mark_dirty(sufile); -- kaddr = kmap_atomic(bh->b_page); -- su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr); -+ if (ret) -+ goto out_sem; -+ -+ kaddr = kmap_atomic(bh->b_page); -+ su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr); -+ if (unlikely(nilfs_segment_usage_error(su))) { -+ struct the_nilfs *nilfs = sufile->i_sb->s_fs_info; -+ -+ kunmap_atomic(kaddr); -+ brelse(bh); -+ if (nilfs_segment_is_active(nilfs, segnum)) { -+ nilfs_error(sufile->i_sb, -+ "active segment %llu is erroneous", -+ (unsigned long long)segnum); -+ } else { -+ /* -+ * Segments marked erroneous are never allocated by -+ * nilfs_sufile_alloc(); only active segments, ie, -+ * the segments indexed by ns_segnum or ns_nextnum, -+ * can be erroneous here. -+ */ -+ WARN_ON_ONCE(1); -+ } -+ ret = -EIO; -+ } else { - nilfs_segment_usage_set_dirty(su); - kunmap_atomic(kaddr); -+ mark_buffer_dirty(bh); -+ nilfs_mdt_mark_dirty(sufile); - brelse(bh); - } -+out_sem: - up_write(&NILFS_MDT(sufile)->mi_sem); - return ret; - } -@@ -536,9 +559,14 @@ int nilfs_sufile_set_segment_usage(struct inode *sufile, __u64 segnum, - - kaddr = kmap_atomic(bh->b_page); - su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr); -- WARN_ON(nilfs_segment_usage_error(su)); -- if (modtime) -+ if (modtime) { -+ /* -+ * Check segusage error and set su_lastmod only when updating -+ * this entry with a valid timestamp, not for cancellation. -+ */ -+ WARN_ON_ONCE(nilfs_segment_usage_error(su)); - su->su_lastmod = cpu_to_le64(modtime); -+ } - su->su_nblocks = cpu_to_le32(nblocks); - kunmap_atomic(kaddr); - -diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c -index 0f0667957c810..71400496ed365 100644 ---- a/fs/nilfs2/the_nilfs.c -+++ b/fs/nilfs2/the_nilfs.c -@@ -716,7 +716,11 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data) - goto failed_sbh; - } - nilfs_release_super_block(nilfs); -- sb_set_blocksize(sb, blocksize); -+ if (!sb_set_blocksize(sb, blocksize)) { -+ nilfs_err(sb, "bad blocksize %d", blocksize); -+ err = -EINVAL; -+ goto out; -+ } - - err = nilfs_load_super_block(nilfs, sb, blocksize, &sbp); - if (err) -diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c -index 33ea1440f4b06..2e15b182e59fc 100644 ---- a/fs/smb/client/cifsfs.c -+++ b/fs/smb/client/cifsfs.c -@@ -1191,32 +1191,103 @@ const struct inode_operations cifs_symlink_inode_ops = { - .listxattr = cifs_listxattr, - }; - -+/* -+ * Advance the EOF marker to after the source range. -+ */ -+static int cifs_precopy_set_eof(struct inode *src_inode, struct cifsInodeInfo *src_cifsi, -+ struct cifs_tcon *src_tcon, -+ unsigned int xid, loff_t src_end) -+{ -+ struct cifsFileInfo *writeable_srcfile; -+ int rc = -EINVAL; -+ -+ writeable_srcfile = find_writable_file(src_cifsi, FIND_WR_FSUID_ONLY); -+ if (writeable_srcfile) { -+ if (src_tcon->ses->server->ops->set_file_size) -+ rc = src_tcon->ses->server->ops->set_file_size( -+ xid, src_tcon, writeable_srcfile, -+ src_inode->i_size, true /* no need to set sparse */); -+ else -+ rc = -ENOSYS; -+ cifsFileInfo_put(writeable_srcfile); -+ cifs_dbg(FYI, "SetFSize for copychunk rc = %d\n", rc); -+ } -+ -+ if (rc < 0) -+ goto set_failed; -+ -+ netfs_resize_file(&src_cifsi->netfs, src_end); -+ fscache_resize_cookie(cifs_inode_cookie(src_inode), src_end); -+ return 0; -+ -+set_failed: -+ return filemap_write_and_wait(src_inode->i_mapping); -+} -+ -+/* -+ * Flush out either the folio that overlaps the beginning of a range in which -+ * pos resides or the folio that overlaps the end of a range unless that folio -+ * is entirely within the range we're going to invalidate. We extend the flush -+ * bounds to encompass the folio. -+ */ -+static int cifs_flush_folio(struct inode *inode, loff_t pos, loff_t *_fstart, loff_t *_fend, -+ bool first) -+{ -+ struct folio *folio; -+ unsigned long long fpos, fend; -+ pgoff_t index = pos / PAGE_SIZE; -+ size_t size; -+ int rc = 0; -+ -+ folio = filemap_get_folio(inode->i_mapping, index); -+ if (IS_ERR(folio)) -+ return 0; -+ -+ size = folio_size(folio); -+ fpos = folio_pos(folio); -+ fend = fpos + size - 1; -+ *_fstart = min_t(unsigned long long, *_fstart, fpos); -+ *_fend = max_t(unsigned long long, *_fend, fend); -+ if ((first && pos == fpos) || (!first && pos == fend)) -+ goto out; -+ -+ rc = filemap_write_and_wait_range(inode->i_mapping, fpos, fend); -+out: -+ folio_put(folio); -+ return rc; -+} -+ - static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, - struct file *dst_file, loff_t destoff, loff_t len, - unsigned int remap_flags) - { - struct inode *src_inode = file_inode(src_file); - struct inode *target_inode = file_inode(dst_file); -+ struct cifsInodeInfo *src_cifsi = CIFS_I(src_inode); -+ struct cifsInodeInfo *target_cifsi = CIFS_I(target_inode); - struct cifsFileInfo *smb_file_src = src_file->private_data; -- struct cifsFileInfo *smb_file_target; -- struct cifs_tcon *target_tcon; -+ struct cifsFileInfo *smb_file_target = dst_file->private_data; -+ struct cifs_tcon *target_tcon, *src_tcon; -+ unsigned long long destend, fstart, fend, new_size; - unsigned int xid; - int rc; - -- if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY)) -+ if (remap_flags & REMAP_FILE_DEDUP) -+ return -EOPNOTSUPP; -+ if (remap_flags & ~REMAP_FILE_ADVISORY) - return -EINVAL; - - cifs_dbg(FYI, "clone range\n"); - - xid = get_xid(); - -- if (!src_file->private_data || !dst_file->private_data) { -+ if (!smb_file_src || !smb_file_target) { - rc = -EBADF; - cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n"); - goto out; - } - -- smb_file_target = dst_file->private_data; -+ src_tcon = tlink_tcon(smb_file_src->tlink); - target_tcon = tlink_tcon(smb_file_target->tlink); - - /* -@@ -1229,20 +1300,63 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, - if (len == 0) - len = src_inode->i_size - off; - -- cifs_dbg(FYI, "about to flush pages\n"); -- /* should we flush first and last page first */ -- truncate_inode_pages_range(&target_inode->i_data, destoff, -- PAGE_ALIGN(destoff + len)-1); -+ cifs_dbg(FYI, "clone range\n"); - -- if (target_tcon->ses->server->ops->duplicate_extents) -+ /* Flush the source buffer */ -+ rc = filemap_write_and_wait_range(src_inode->i_mapping, off, -+ off + len - 1); -+ if (rc) -+ goto unlock; -+ -+ /* The server-side copy will fail if the source crosses the EOF marker. -+ * Advance the EOF marker after the flush above to the end of the range -+ * if it's short of that. -+ */ -+ if (src_cifsi->netfs.remote_i_size < off + len) { -+ rc = cifs_precopy_set_eof(src_inode, src_cifsi, src_tcon, xid, off + len); -+ if (rc < 0) -+ goto unlock; -+ } -+ -+ new_size = destoff + len; -+ destend = destoff + len - 1; -+ -+ /* Flush the folios at either end of the destination range to prevent -+ * accidental loss of dirty data outside of the range. -+ */ -+ fstart = destoff; -+ fend = destend; -+ -+ rc = cifs_flush_folio(target_inode, destoff, &fstart, &fend, true); -+ if (rc) -+ goto unlock; -+ rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false); -+ if (rc) -+ goto unlock; -+ -+ /* Discard all the folios that overlap the destination region. */ -+ cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend); -+ truncate_inode_pages_range(&target_inode->i_data, fstart, fend); -+ -+ fscache_invalidate(cifs_inode_cookie(target_inode), NULL, -+ i_size_read(target_inode), 0); -+ -+ rc = -EOPNOTSUPP; -+ if (target_tcon->ses->server->ops->duplicate_extents) { - rc = target_tcon->ses->server->ops->duplicate_extents(xid, - smb_file_src, smb_file_target, off, len, destoff); -- else -- rc = -EOPNOTSUPP; -+ if (rc == 0 && new_size > i_size_read(target_inode)) { -+ truncate_setsize(target_inode, new_size); -+ netfs_resize_file(&target_cifsi->netfs, new_size); -+ fscache_resize_cookie(cifs_inode_cookie(target_inode), -+ new_size); -+ } -+ } - - /* force revalidate of size and timestamps of target file now - that target is updated on the server */ - CIFS_I(target_inode)->time = 0; -+unlock: - /* although unlocking in the reverse order from locking is not - strictly necessary here it is a little cleaner to be consistent */ - unlock_two_nondirectories(src_inode, target_inode); -@@ -1258,10 +1372,12 @@ ssize_t cifs_file_copychunk_range(unsigned int xid, - { - struct inode *src_inode = file_inode(src_file); - struct inode *target_inode = file_inode(dst_file); -+ struct cifsInodeInfo *src_cifsi = CIFS_I(src_inode); - struct cifsFileInfo *smb_file_src; - struct cifsFileInfo *smb_file_target; - struct cifs_tcon *src_tcon; - struct cifs_tcon *target_tcon; -+ unsigned long long destend, fstart, fend; - ssize_t rc; - - cifs_dbg(FYI, "copychunk range\n"); -@@ -1301,13 +1417,41 @@ ssize_t cifs_file_copychunk_range(unsigned int xid, - if (rc) - goto unlock; - -- /* should we flush first and last page first */ -- truncate_inode_pages(&target_inode->i_data, 0); -+ /* The server-side copy will fail if the source crosses the EOF marker. -+ * Advance the EOF marker after the flush above to the end of the range -+ * if it's short of that. -+ */ -+ if (src_cifsi->server_eof < off + len) { -+ rc = cifs_precopy_set_eof(src_inode, src_cifsi, src_tcon, xid, off + len); -+ if (rc < 0) -+ goto unlock; -+ } -+ -+ destend = destoff + len - 1; -+ -+ /* Flush the folios at either end of the destination range to prevent -+ * accidental loss of dirty data outside of the range. -+ */ -+ fstart = destoff; -+ fend = destend; -+ -+ rc = cifs_flush_folio(target_inode, destoff, &fstart, &fend, true); -+ if (rc) -+ goto unlock; -+ rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false); -+ if (rc) -+ goto unlock; -+ -+ /* Discard all the folios that overlap the destination region. */ -+ truncate_inode_pages_range(&target_inode->i_data, fstart, fend); - - rc = file_modified(dst_file); -- if (!rc) -+ if (!rc) { - rc = target_tcon->ses->server->ops->copychunk_range(xid, - smb_file_src, smb_file_target, off, len, destoff); -+ if (rc > 0 && destoff + rc > i_size_read(target_inode)) -+ truncate_setsize(target_inode, destoff + rc); -+ } - - file_accessed(src_file); - -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index e628848a1df93..6ef3c00de5ca1 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -2834,6 +2834,8 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, - usleep_range(512, 2048); - } while (++retry_count < 5); - -+ if (!rc && !dfs_rsp) -+ rc = -EIO; - if (rc) { - if (!is_retryable_error(rc) && rc != -ENOENT && rc != -EOPNOTSUPP) - cifs_tcon_dbg(VFS, "%s: ioctl error: rc=%d\n", __func__, rc); -diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h -index c7e0d80dbf6a5..67575bc8a7e29 100644 ---- a/include/linux/cpuhotplug.h -+++ b/include/linux/cpuhotplug.h -@@ -196,6 +196,7 @@ enum cpuhp_state { - CPUHP_AP_ARM_CORESIGHT_CTI_STARTING, - CPUHP_AP_ARM64_ISNDEP_STARTING, - CPUHP_AP_SMPCFD_DYING, -+ CPUHP_AP_HRTIMERS_DYING, - CPUHP_AP_X86_TBOOT_DYING, - CPUHP_AP_ARM_CACHE_B15_RAC_DYING, - CPUHP_AP_ONLINE, -diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h -index 0ee140176f102..f2044d5a652b5 100644 ---- a/include/linux/hrtimer.h -+++ b/include/linux/hrtimer.h -@@ -531,9 +531,9 @@ extern void sysrq_timer_list_show(void); - - int hrtimers_prepare_cpu(unsigned int cpu); - #ifdef CONFIG_HOTPLUG_CPU --int hrtimers_dead_cpu(unsigned int cpu); -+int hrtimers_cpu_dying(unsigned int cpu); - #else --#define hrtimers_dead_cpu NULL -+#define hrtimers_cpu_dying NULL - #endif - - #endif -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index e46f6b49eb389..1c6f35ba1604f 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -880,10 +880,7 @@ static inline bool hugepage_migration_supported(struct hstate *h) - return arch_hugetlb_migration_supported(h); - } - --static inline bool __vma_private_lock(struct vm_area_struct *vma) --{ -- return (!(vma->vm_flags & VM_MAYSHARE)) && vma->vm_private_data; --} -+bool __vma_private_lock(struct vm_area_struct *vma); - - /* - * Movability check is different as compared to migration check. -diff --git a/include/linux/iommu.h b/include/linux/iommu.h -index 3c9da1f8979e3..9d87090953bcc 100644 ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -657,6 +657,7 @@ static inline void dev_iommu_priv_set(struct device *dev, void *priv) - dev->iommu->priv = priv; - } - -+extern struct mutex iommu_probe_device_lock; - int iommu_probe_device(struct device *dev); - void iommu_release_device(struct device *dev); - -diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h -index 85a64cb95d755..8de5d51a0b5e7 100644 ---- a/include/linux/kprobes.h -+++ b/include/linux/kprobes.h -@@ -140,7 +140,7 @@ static inline bool kprobe_ftrace(struct kprobe *p) - * - */ - struct kretprobe_holder { -- struct kretprobe *rp; -+ struct kretprobe __rcu *rp; - refcount_t ref; - }; - -@@ -202,10 +202,8 @@ extern int arch_trampoline_kprobe(struct kprobe *p); - #ifdef CONFIG_KRETPROBE_ON_RETHOOK - static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri) - { -- RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(), -- "Kretprobe is accessed from instance under preemptive context"); -- -- return (struct kretprobe *)READ_ONCE(ri->node.rethook->data); -+ /* rethook::data is non-changed field, so that you can access it freely. */ -+ return (struct kretprobe *)ri->node.rethook->data; - } - static nokprobe_inline unsigned long get_kretprobe_retaddr(struct kretprobe_instance *ri) - { -@@ -250,10 +248,7 @@ unsigned long kretprobe_trampoline_handler(struct pt_regs *regs, - - static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri) - { -- RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(), -- "Kretprobe is accessed from instance under preemptive context"); -- -- return READ_ONCE(ri->rph->rp); -+ return rcu_dereference_check(ri->rph->rp, rcu_read_lock_any_held()); - } - - static nokprobe_inline unsigned long get_kretprobe_retaddr(struct kretprobe_instance *ri) -diff --git a/include/linux/rethook.h b/include/linux/rethook.h -index bdbe6717f45a2..a00963f33bc14 100644 ---- a/include/linux/rethook.h -+++ b/include/linux/rethook.h -@@ -29,7 +29,12 @@ typedef void (*rethook_handler_t) (struct rethook_node *, void *, struct pt_regs - */ - struct rethook { - void *data; -- rethook_handler_t handler; -+ /* -+ * To avoid sparse warnings, this uses a raw function pointer with -+ * __rcu, instead of rethook_handler_t. But this must be same as -+ * rethook_handler_t. -+ */ -+ void (__rcu *handler) (struct rethook_node *, void *, struct pt_regs *); - struct freelist_head pool; - refcount_t ref; - struct rcu_head rcu; -diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h -index d82ff9fa1a6e8..9f4a4f70270df 100644 ---- a/include/linux/stmmac.h -+++ b/include/linux/stmmac.h -@@ -172,6 +172,7 @@ struct stmmac_fpe_cfg { - bool hs_enable; /* FPE handshake enable */ - enum stmmac_fpe_state lp_fpe_state; /* Link Partner FPE state */ - enum stmmac_fpe_state lo_fpe_state; /* Local station FPE state */ -+ u32 fpe_csr; /* MAC_FPE_CTRL_STS reg cache */ - }; - - struct stmmac_safety_feature_cfg { -diff --git a/include/net/genetlink.h b/include/net/genetlink.h -index 9f97f73615b69..b9e5a22ae3ff9 100644 ---- a/include/net/genetlink.h -+++ b/include/net/genetlink.h -@@ -12,10 +12,12 @@ - * struct genl_multicast_group - generic netlink multicast group - * @name: name of the multicast group, names are per-family - * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) -+ * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding - */ - struct genl_multicast_group { - char name[GENL_NAMSIZ]; - u8 flags; -+ u8 cap_sys_admin:1; - }; - - struct genl_ops; -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 19646fdec23dc..c3d56b337f358 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1460,17 +1460,22 @@ static inline int tcp_full_space(const struct sock *sk) - return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf)); - } - --static inline void tcp_adjust_rcv_ssthresh(struct sock *sk) -+static inline void __tcp_adjust_rcv_ssthresh(struct sock *sk, u32 new_ssthresh) - { - int unused_mem = sk_unused_reserved_mem(sk); - struct tcp_sock *tp = tcp_sk(sk); - -- tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss); -+ tp->rcv_ssthresh = min(tp->rcv_ssthresh, new_ssthresh); - if (unused_mem) - tp->rcv_ssthresh = max_t(u32, tp->rcv_ssthresh, - tcp_win_from_space(sk, unused_mem)); - } - -+static inline void tcp_adjust_rcv_ssthresh(struct sock *sk) -+{ -+ __tcp_adjust_rcv_ssthresh(sk, 4U * tcp_sk(sk)->advmss); -+} -+ - void tcp_cleanup_rbuf(struct sock *sk, int copied); - void __tcp_cleanup_rbuf(struct sock *sk, int copied); - -diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h -index 92a673cd9b4fd..77b83ea62dd69 100644 ---- a/include/rdma/ib_umem.h -+++ b/include/rdma/ib_umem.h -@@ -78,6 +78,13 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, - { - __rdma_block_iter_start(biter, umem->sgt_append.sgt.sgl, - umem->sgt_append.sgt.nents, pgsz); -+ biter->__sg_advance = ib_umem_offset(umem) & ~(pgsz - 1); -+ biter->__sg_numblocks = ib_umem_num_dma_blocks(umem, pgsz); -+} -+ -+static inline bool __rdma_umem_block_iter_next(struct ib_block_iter *biter) -+{ -+ return __rdma_block_iter_next(biter) && biter->__sg_numblocks--; - } - - /** -@@ -93,7 +100,7 @@ static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, - */ - #define rdma_umem_for_each_dma_block(umem, biter, pgsz) \ - for (__rdma_umem_block_iter_start(biter, umem, pgsz); \ -- __rdma_block_iter_next(biter);) -+ __rdma_umem_block_iter_next(biter);) - - #ifdef CONFIG_INFINIBAND_USER_MEM - -diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h -index 975d6e9efbcb4..5582509003264 100644 ---- a/include/rdma/ib_verbs.h -+++ b/include/rdma/ib_verbs.h -@@ -2835,6 +2835,7 @@ struct ib_block_iter { - /* internal states */ - struct scatterlist *__sg; /* sg holding the current aligned block */ - dma_addr_t __dma_addr; /* unaligned DMA address of this block */ -+ size_t __sg_numblocks; /* ib_umem_num_dma_blocks() */ - unsigned int __sg_nents; /* number of SG entries */ - unsigned int __sg_advance; /* number of bytes to advance in sg in next step */ - unsigned int __pg_bit; /* alignment of current block */ -diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h -index 466fd3f4447c2..af8f4c304d272 100644 ---- a/include/uapi/linux/netfilter/nf_tables.h -+++ b/include/uapi/linux/netfilter/nf_tables.h -@@ -816,12 +816,14 @@ enum nft_exthdr_flags { - * @NFT_EXTHDR_OP_TCP: match against tcp options - * @NFT_EXTHDR_OP_IPV4: match against ipv4 options - * @NFT_EXTHDR_OP_SCTP: match against sctp chunks -+ * @NFT_EXTHDR_OP_DCCP: match against dccp otions - */ - enum nft_exthdr_op { - NFT_EXTHDR_OP_IPV6, - NFT_EXTHDR_OP_TCPOPT, - NFT_EXTHDR_OP_IPV4, - NFT_EXTHDR_OP_SCTP, -+ NFT_EXTHDR_OP_DCCP, - __NFT_EXTHDR_OP_MAX - }; - #define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1) -diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c -index f413ebed81ab3..35894955b4549 100644 ---- a/io_uring/io_uring.c -+++ b/io_uring/io_uring.c -@@ -1377,6 +1377,7 @@ static __cold void io_iopoll_try_reap_events(struct io_ring_ctx *ctx) - if (!(ctx->flags & IORING_SETUP_IOPOLL)) - return; - -+ percpu_ref_get(&ctx->refs); - mutex_lock(&ctx->uring_lock); - while (!wq_list_empty(&ctx->iopoll_list)) { - /* let it sleep and repeat later if can't complete a request */ -@@ -1394,6 +1395,7 @@ static __cold void io_iopoll_try_reap_events(struct io_ring_ctx *ctx) - } - } - mutex_unlock(&ctx->uring_lock); -+ percpu_ref_put(&ctx->refs); - } - - static int io_iopoll_check(struct io_ring_ctx *ctx, long min) -@@ -2800,12 +2802,7 @@ static __cold void io_ring_exit_work(struct work_struct *work) - init_completion(&exit.completion); - init_task_work(&exit.task_work, io_tctx_exit_cb); - exit.ctx = ctx; -- /* -- * Some may use context even when all refs and requests have been put, -- * and they are free to do so while still holding uring_lock or -- * completion_lock, see io_req_task_submit(). Apart from other work, -- * this lock/unlock section also waits them to finish. -- */ -+ - mutex_lock(&ctx->uring_lock); - while (!list_empty(&ctx->tctx_list)) { - WARN_ON_ONCE(time_after(jiffies, timeout)); -diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h -index d60c758326b42..acaf8dad05401 100644 ---- a/io_uring/rsrc.h -+++ b/io_uring/rsrc.h -@@ -79,17 +79,10 @@ int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, - - int __io_scm_file_account(struct io_ring_ctx *ctx, struct file *file); - --#if defined(CONFIG_UNIX) --static inline bool io_file_need_scm(struct file *filp) --{ -- return !!unix_get_socket(filp); --} --#else - static inline bool io_file_need_scm(struct file *filp) - { - return false; - } --#endif - - static inline int io_scm_file_account(struct io_ring_ctx *ctx, - struct file *file) -diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c -index 122dacb3a4439..66d1708042a72 100644 ---- a/kernel/cgroup/legacy_freezer.c -+++ b/kernel/cgroup/legacy_freezer.c -@@ -66,9 +66,15 @@ static struct freezer *parent_freezer(struct freezer *freezer) - bool cgroup_freezing(struct task_struct *task) - { - bool ret; -+ unsigned int state; - - rcu_read_lock(); -- ret = task_freezer(task)->state & CGROUP_FREEZING; -+ /* Check if the cgroup is still FREEZING, but not FROZEN. The extra -+ * !FROZEN check is required, because the FREEZING bit is not cleared -+ * when the state FROZEN is reached. -+ */ -+ state = task_freezer(task)->state; -+ ret = (state & CGROUP_FREEZING) && !(state & CGROUP_FROZEN); - rcu_read_unlock(); - - return ret; -diff --git a/kernel/cpu.c b/kernel/cpu.c -index 0e4d362e90825..551468d9c5a85 100644 ---- a/kernel/cpu.c -+++ b/kernel/cpu.c -@@ -1733,7 +1733,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { - [CPUHP_HRTIMERS_PREPARE] = { - .name = "hrtimers:prepare", - .startup.single = hrtimers_prepare_cpu, -- .teardown.single = hrtimers_dead_cpu, -+ .teardown.single = NULL, - }, - [CPUHP_SMPCFD_PREPARE] = { - .name = "smpcfd:prepare", -@@ -1800,6 +1800,12 @@ static struct cpuhp_step cpuhp_hp_states[] = { - .startup.single = NULL, - .teardown.single = smpcfd_dying_cpu, - }, -+ [CPUHP_AP_HRTIMERS_DYING] = { -+ .name = "hrtimers:dying", -+ .startup.single = NULL, -+ .teardown.single = hrtimers_cpu_dying, -+ }, -+ - /* Entry state on starting. Interrupts enabled from here on. Transient - * state for synchronsization */ - [CPUHP_AP_ONLINE] = { -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 8f2b9d8b9150e..0193243f65e5c 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1812,31 +1812,34 @@ static inline void perf_event__state_init(struct perf_event *event) - PERF_EVENT_STATE_INACTIVE; - } - --static void __perf_event_read_size(struct perf_event *event, int nr_siblings) -+static int __perf_event_read_size(u64 read_format, int nr_siblings) - { - int entry = sizeof(u64); /* value */ - int size = 0; - int nr = 1; - -- if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) -+ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) - size += sizeof(u64); - -- if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) -+ if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) - size += sizeof(u64); - -- if (event->attr.read_format & PERF_FORMAT_ID) -+ if (read_format & PERF_FORMAT_ID) - entry += sizeof(u64); - -- if (event->attr.read_format & PERF_FORMAT_LOST) -+ if (read_format & PERF_FORMAT_LOST) - entry += sizeof(u64); - -- if (event->attr.read_format & PERF_FORMAT_GROUP) { -+ if (read_format & PERF_FORMAT_GROUP) { - nr += nr_siblings; - size += sizeof(u64); - } - -- size += entry * nr; -- event->read_size = size; -+ /* -+ * Since perf_event_validate_size() limits this to 16k and inhibits -+ * adding more siblings, this will never overflow. -+ */ -+ return size + nr * entry; - } - - static void __perf_event_header_size(struct perf_event *event, u64 sample_type) -@@ -1886,8 +1889,9 @@ static void __perf_event_header_size(struct perf_event *event, u64 sample_type) - */ - static void perf_event__header_size(struct perf_event *event) - { -- __perf_event_read_size(event, -- event->group_leader->nr_siblings); -+ event->read_size = -+ __perf_event_read_size(event->attr.read_format, -+ event->group_leader->nr_siblings); - __perf_event_header_size(event, event->attr.sample_type); - } - -@@ -1918,24 +1922,35 @@ static void perf_event__id_header_size(struct perf_event *event) - event->id_header_size = size; - } - -+/* -+ * Check that adding an event to the group does not result in anybody -+ * overflowing the 64k event limit imposed by the output buffer. -+ * -+ * Specifically, check that the read_size for the event does not exceed 16k, -+ * read_size being the one term that grows with groups size. Since read_size -+ * depends on per-event read_format, also (re)check the existing events. -+ * -+ * This leaves 48k for the constant size fields and things like callchains, -+ * branch stacks and register sets. -+ */ - static bool perf_event_validate_size(struct perf_event *event) - { -- /* -- * The values computed here will be over-written when we actually -- * attach the event. -- */ -- __perf_event_read_size(event, event->group_leader->nr_siblings + 1); -- __perf_event_header_size(event, event->attr.sample_type & ~PERF_SAMPLE_READ); -- perf_event__id_header_size(event); -+ struct perf_event *sibling, *group_leader = event->group_leader; - -- /* -- * Sum the lot; should not exceed the 64k limit we have on records. -- * Conservative limit to allow for callchains and other variable fields. -- */ -- if (event->read_size + event->header_size + -- event->id_header_size + sizeof(struct perf_event_header) >= 16*1024) -+ if (__perf_event_read_size(event->attr.read_format, -+ group_leader->nr_siblings + 1) > 16*1024) - return false; - -+ if (__perf_event_read_size(group_leader->attr.read_format, -+ group_leader->nr_siblings + 1) > 16*1024) -+ return false; -+ -+ for_each_sibling_event(sibling, group_leader) { -+ if (__perf_event_read_size(sibling->attr.read_format, -+ group_leader->nr_siblings + 1) > 16*1024) -+ return false; -+ } -+ - return true; - } - -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index 3da9726232ff9..dbfddfa86c14e 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -2253,7 +2253,7 @@ int register_kretprobe(struct kretprobe *rp) - if (!rp->rph) - return -ENOMEM; - -- rp->rph->rp = rp; -+ rcu_assign_pointer(rp->rph->rp, rp); - for (i = 0; i < rp->maxactive; i++) { - inst = kzalloc(sizeof(struct kretprobe_instance) + - rp->data_size, GFP_KERNEL); -@@ -2314,7 +2314,7 @@ void unregister_kretprobes(struct kretprobe **rps, int num) - #ifdef CONFIG_KRETPROBE_ON_RETHOOK - rethook_free(rps[i]->rh); - #else -- rps[i]->rph->rp = NULL; -+ rcu_assign_pointer(rps[i]->rph->rp, NULL); - #endif - } - mutex_unlock(&kprobe_mutex); -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index e4f0e3b0c4f4f..5561dabc9b225 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -2216,29 +2216,22 @@ static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base, - } - } - --int hrtimers_dead_cpu(unsigned int scpu) -+int hrtimers_cpu_dying(unsigned int dying_cpu) - { - struct hrtimer_cpu_base *old_base, *new_base; -- int i; -+ int i, ncpu = cpumask_first(cpu_active_mask); - -- BUG_ON(cpu_online(scpu)); -- tick_cancel_sched_timer(scpu); -+ tick_cancel_sched_timer(dying_cpu); -+ -+ old_base = this_cpu_ptr(&hrtimer_bases); -+ new_base = &per_cpu(hrtimer_bases, ncpu); - -- /* -- * this BH disable ensures that raise_softirq_irqoff() does -- * not wakeup ksoftirqd (and acquire the pi-lock) while -- * holding the cpu_base lock -- */ -- local_bh_disable(); -- local_irq_disable(); -- old_base = &per_cpu(hrtimer_bases, scpu); -- new_base = this_cpu_ptr(&hrtimer_bases); - /* - * The caller is globally serialized and nobody else - * takes two locks at once, deadlock is not possible. - */ -- raw_spin_lock(&new_base->lock); -- raw_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING); -+ raw_spin_lock(&old_base->lock); -+ raw_spin_lock_nested(&new_base->lock, SINGLE_DEPTH_NESTING); - - for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) { - migrate_hrtimer_list(&old_base->clock_base[i], -@@ -2249,15 +2242,13 @@ int hrtimers_dead_cpu(unsigned int scpu) - * The migration might have changed the first expiring softirq - * timer on this CPU. Update it. - */ -- hrtimer_update_softirq_timer(new_base, false); -+ __hrtimer_get_next_event(new_base, HRTIMER_ACTIVE_SOFT); -+ /* Tell the other CPU to retrigger the next event */ -+ smp_call_function_single(ncpu, retrigger_next_event, NULL, 0); - -- raw_spin_unlock(&old_base->lock); - raw_spin_unlock(&new_base->lock); -+ raw_spin_unlock(&old_base->lock); - -- /* Check, if we got expired work to do */ -- __hrtimer_peek_ahead_timers(); -- local_irq_enable(); -- local_bh_enable(); - return 0; - } - -diff --git a/kernel/trace/rethook.c b/kernel/trace/rethook.c -index 468006cce7cae..3686626b52c57 100644 ---- a/kernel/trace/rethook.c -+++ b/kernel/trace/rethook.c -@@ -63,7 +63,7 @@ static void rethook_free_rcu(struct rcu_head *head) - */ - void rethook_stop(struct rethook *rh) - { -- WRITE_ONCE(rh->handler, NULL); -+ rcu_assign_pointer(rh->handler, NULL); - } - - /** -@@ -78,11 +78,17 @@ void rethook_stop(struct rethook *rh) - */ - void rethook_free(struct rethook *rh) - { -- WRITE_ONCE(rh->handler, NULL); -+ rethook_stop(rh); - - call_rcu(&rh->rcu, rethook_free_rcu); - } - -+static inline rethook_handler_t rethook_get_handler(struct rethook *rh) -+{ -+ return (rethook_handler_t)rcu_dereference_check(rh->handler, -+ rcu_read_lock_any_held()); -+} -+ - /** - * rethook_alloc() - Allocate struct rethook. - * @data: a data to pass the @handler when hooking the return. -@@ -102,7 +108,7 @@ struct rethook *rethook_alloc(void *data, rethook_handler_t handler) - } - - rh->data = data; -- rh->handler = handler; -+ rcu_assign_pointer(rh->handler, handler); - rh->pool.head = NULL; - refcount_set(&rh->ref, 1); - -@@ -142,9 +148,10 @@ static void free_rethook_node_rcu(struct rcu_head *head) - */ - void rethook_recycle(struct rethook_node *node) - { -- lockdep_assert_preemption_disabled(); -+ rethook_handler_t handler; - -- if (likely(READ_ONCE(node->rethook->handler))) -+ handler = rethook_get_handler(node->rethook); -+ if (likely(handler)) - freelist_add(&node->freelist, &node->rethook->pool); - else - call_rcu(&node->rcu, free_rethook_node_rcu); -@@ -160,11 +167,9 @@ NOKPROBE_SYMBOL(rethook_recycle); - */ - struct rethook_node *rethook_try_get(struct rethook *rh) - { -- rethook_handler_t handler = READ_ONCE(rh->handler); -+ rethook_handler_t handler = rethook_get_handler(rh); - struct freelist_node *fn; - -- lockdep_assert_preemption_disabled(); -- - /* Check whether @rh is going to be freed. */ - if (unlikely(!handler)) - return NULL; -@@ -312,7 +317,7 @@ unsigned long rethook_trampoline_handler(struct pt_regs *regs, - rhn = container_of(first, struct rethook_node, llist); - if (WARN_ON_ONCE(rhn->frame != frame)) - break; -- handler = READ_ONCE(rhn->rethook->handler); -+ handler = rethook_get_handler(rhn->rethook); - if (handler) - handler(rhn, rhn->rethook->data, regs); - -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index b7383358c4ea1..c02a4cb879913 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -646,8 +646,8 @@ static inline bool __rb_time_read(rb_time_t *t, u64 *ret, unsigned long *cnt) - - *cnt = rb_time_cnt(top); - -- /* If top and bottom counts don't match, this interrupted a write */ -- if (*cnt != rb_time_cnt(bottom)) -+ /* If top and msb counts don't match, this interrupted a write */ -+ if (*cnt != rb_time_cnt(msb)) - return false; - - /* The shift to msb will lose its cnt bits */ -@@ -3025,22 +3025,19 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, - local_read(&bpage->write) & ~RB_WRITE_MASK; - unsigned long event_length = rb_event_length(event); - -+ /* -+ * For the before_stamp to be different than the write_stamp -+ * to make sure that the next event adds an absolute -+ * value and does not rely on the saved write stamp, which -+ * is now going to be bogus. -+ */ -+ rb_time_set(&cpu_buffer->before_stamp, 0); -+ - /* Something came in, can't discard */ - if (!rb_time_cmpxchg(&cpu_buffer->write_stamp, - write_stamp, write_stamp - delta)) - return 0; - -- /* -- * It's possible that the event time delta is zero -- * (has the same time stamp as the previous event) -- * in which case write_stamp and before_stamp could -- * be the same. In such a case, force before_stamp -- * to be different than write_stamp. It doesn't -- * matter what it is, as long as its different. -- */ -- if (!delta) -- rb_time_set(&cpu_buffer->before_stamp, 0); -- - /* - * If an event were to come in now, it would see that the - * write_stamp and the before_stamp are different, and assume -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index ddcfc78e93e00..d2db4d6f0f2fd 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -2297,13 +2297,7 @@ int is_tracing_stopped(void) - return global_trace.stop_count; - } - --/** -- * tracing_start - quick start of the tracer -- * -- * If tracing is enabled but was stopped by tracing_stop, -- * this will start the tracer back up. -- */ --void tracing_start(void) -+static void tracing_start_tr(struct trace_array *tr) - { - struct trace_buffer *buffer; - unsigned long flags; -@@ -2311,119 +2305,83 @@ void tracing_start(void) - if (tracing_disabled) - return; - -- raw_spin_lock_irqsave(&global_trace.start_lock, flags); -- if (--global_trace.stop_count) { -- if (global_trace.stop_count < 0) { -+ raw_spin_lock_irqsave(&tr->start_lock, flags); -+ if (--tr->stop_count) { -+ if (WARN_ON_ONCE(tr->stop_count < 0)) { - /* Someone screwed up their debugging */ -- WARN_ON_ONCE(1); -- global_trace.stop_count = 0; -+ tr->stop_count = 0; - } - goto out; - } - - /* Prevent the buffers from switching */ -- arch_spin_lock(&global_trace.max_lock); -+ arch_spin_lock(&tr->max_lock); - -- buffer = global_trace.array_buffer.buffer; -+ buffer = tr->array_buffer.buffer; - if (buffer) - ring_buffer_record_enable(buffer); - - #ifdef CONFIG_TRACER_MAX_TRACE -- buffer = global_trace.max_buffer.buffer; -+ buffer = tr->max_buffer.buffer; - if (buffer) - ring_buffer_record_enable(buffer); - #endif - -- arch_spin_unlock(&global_trace.max_lock); -- -- out: -- raw_spin_unlock_irqrestore(&global_trace.start_lock, flags); --} -- --static void tracing_start_tr(struct trace_array *tr) --{ -- struct trace_buffer *buffer; -- unsigned long flags; -- -- if (tracing_disabled) -- return; -- -- /* If global, we need to also start the max tracer */ -- if (tr->flags & TRACE_ARRAY_FL_GLOBAL) -- return tracing_start(); -- -- raw_spin_lock_irqsave(&tr->start_lock, flags); -- -- if (--tr->stop_count) { -- if (tr->stop_count < 0) { -- /* Someone screwed up their debugging */ -- WARN_ON_ONCE(1); -- tr->stop_count = 0; -- } -- goto out; -- } -- -- buffer = tr->array_buffer.buffer; -- if (buffer) -- ring_buffer_record_enable(buffer); -+ arch_spin_unlock(&tr->max_lock); - - out: - raw_spin_unlock_irqrestore(&tr->start_lock, flags); - } - - /** -- * tracing_stop - quick stop of the tracer -+ * tracing_start - quick start of the tracer - * -- * Light weight way to stop tracing. Use in conjunction with -- * tracing_start. -+ * If tracing is enabled but was stopped by tracing_stop, -+ * this will start the tracer back up. - */ --void tracing_stop(void) -+void tracing_start(void) -+ -+{ -+ return tracing_start_tr(&global_trace); -+} -+ -+static void tracing_stop_tr(struct trace_array *tr) - { - struct trace_buffer *buffer; - unsigned long flags; - -- raw_spin_lock_irqsave(&global_trace.start_lock, flags); -- if (global_trace.stop_count++) -+ raw_spin_lock_irqsave(&tr->start_lock, flags); -+ if (tr->stop_count++) - goto out; - - /* Prevent the buffers from switching */ -- arch_spin_lock(&global_trace.max_lock); -+ arch_spin_lock(&tr->max_lock); - -- buffer = global_trace.array_buffer.buffer; -+ buffer = tr->array_buffer.buffer; - if (buffer) - ring_buffer_record_disable(buffer); - - #ifdef CONFIG_TRACER_MAX_TRACE -- buffer = global_trace.max_buffer.buffer; -+ buffer = tr->max_buffer.buffer; - if (buffer) - ring_buffer_record_disable(buffer); - #endif - -- arch_spin_unlock(&global_trace.max_lock); -+ arch_spin_unlock(&tr->max_lock); - - out: -- raw_spin_unlock_irqrestore(&global_trace.start_lock, flags); -+ raw_spin_unlock_irqrestore(&tr->start_lock, flags); - } - --static void tracing_stop_tr(struct trace_array *tr) -+/** -+ * tracing_stop - quick stop of the tracer -+ * -+ * Light weight way to stop tracing. Use in conjunction with -+ * tracing_start. -+ */ -+void tracing_stop(void) - { -- struct trace_buffer *buffer; -- unsigned long flags; -- -- /* If global, we need to also stop the max tracer */ -- if (tr->flags & TRACE_ARRAY_FL_GLOBAL) -- return tracing_stop(); -- -- raw_spin_lock_irqsave(&tr->start_lock, flags); -- if (tr->stop_count++) -- goto out; -- -- buffer = tr->array_buffer.buffer; -- if (buffer) -- ring_buffer_record_disable(buffer); -- -- out: -- raw_spin_unlock_irqrestore(&tr->start_lock, flags); -+ return tracing_stop_tr(&global_trace); - } - - static int trace_save_cmdline(struct task_struct *tsk) -@@ -2707,8 +2665,11 @@ void trace_buffered_event_enable(void) - for_each_tracing_cpu(cpu) { - page = alloc_pages_node(cpu_to_node(cpu), - GFP_KERNEL | __GFP_NORETRY, 0); -- if (!page) -- goto failed; -+ /* This is just an optimization and can handle failures */ -+ if (!page) { -+ pr_err("Failed to allocate event buffer\n"); -+ break; -+ } - - event = page_address(page); - memset(event, 0, sizeof(*event)); -@@ -2722,10 +2683,6 @@ void trace_buffered_event_enable(void) - WARN_ON_ONCE(1); - preempt_enable(); - } -- -- return; -- failed: -- trace_buffered_event_disable(); - } - - static void enable_trace_buffered_event(void *data) -@@ -2760,11 +2717,9 @@ void trace_buffered_event_disable(void) - if (--trace_buffered_event_ref) - return; - -- preempt_disable(); - /* For each CPU, set the buffer as used. */ -- smp_call_function_many(tracing_buffer_mask, -- disable_trace_buffered_event, NULL, 1); -- preempt_enable(); -+ on_each_cpu_mask(tracing_buffer_mask, disable_trace_buffered_event, -+ NULL, true); - - /* Wait for all current users to finish */ - synchronize_rcu(); -@@ -2773,17 +2728,19 @@ void trace_buffered_event_disable(void) - free_page((unsigned long)per_cpu(trace_buffered_event, cpu)); - per_cpu(trace_buffered_event, cpu) = NULL; - } -+ - /* -- * Make sure trace_buffered_event is NULL before clearing -- * trace_buffered_event_cnt. -+ * Wait for all CPUs that potentially started checking if they can use -+ * their event buffer only after the previous synchronize_rcu() call and -+ * they still read a valid pointer from trace_buffered_event. It must be -+ * ensured they don't see cleared trace_buffered_event_cnt else they -+ * could wrongly decide to use the pointed-to buffer which is now freed. - */ -- smp_wmb(); -+ synchronize_rcu(); - -- preempt_disable(); -- /* Do the work on each cpu */ -- smp_call_function_many(tracing_buffer_mask, -- enable_trace_buffered_event, NULL, 1); -- preempt_enable(); -+ /* For each CPU, relinquish the buffer */ -+ on_each_cpu_mask(tracing_buffer_mask, enable_trace_buffered_event, NULL, -+ true); - } - - static struct trace_buffer *temp_buffer; -@@ -6258,6 +6215,15 @@ static void set_buffer_entries(struct array_buffer *buf, unsigned long val) - per_cpu_ptr(buf->data, cpu)->entries = val; - } - -+static void update_buffer_entries(struct array_buffer *buf, int cpu) -+{ -+ if (cpu == RING_BUFFER_ALL_CPUS) { -+ set_buffer_entries(buf, ring_buffer_size(buf->buffer, 0)); -+ } else { -+ per_cpu_ptr(buf->data, cpu)->entries = ring_buffer_size(buf->buffer, cpu); -+ } -+} -+ - #ifdef CONFIG_TRACER_MAX_TRACE - /* resize @tr's buffer to the size of @size_tr's entries */ - static int resize_buffer_duplicate_size(struct array_buffer *trace_buf, -@@ -6302,13 +6268,15 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr, - if (!tr->array_buffer.buffer) - return 0; - -+ /* Do not allow tracing while resizng ring buffer */ -+ tracing_stop_tr(tr); -+ - ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu); - if (ret < 0) -- return ret; -+ goto out_start; - - #ifdef CONFIG_TRACER_MAX_TRACE -- if (!(tr->flags & TRACE_ARRAY_FL_GLOBAL) || -- !tr->current_trace->use_max_tr) -+ if (!tr->current_trace->use_max_tr) - goto out; - - ret = ring_buffer_resize(tr->max_buffer.buffer, size, cpu); -@@ -6333,22 +6301,17 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr, - WARN_ON(1); - tracing_disabled = 1; - } -- return ret; -+ goto out_start; - } - -- if (cpu == RING_BUFFER_ALL_CPUS) -- set_buffer_entries(&tr->max_buffer, size); -- else -- per_cpu_ptr(tr->max_buffer.data, cpu)->entries = size; -+ update_buffer_entries(&tr->max_buffer, cpu); - - out: - #endif /* CONFIG_TRACER_MAX_TRACE */ - -- if (cpu == RING_BUFFER_ALL_CPUS) -- set_buffer_entries(&tr->array_buffer, size); -- else -- per_cpu_ptr(tr->array_buffer.data, cpu)->entries = size; -- -+ update_buffer_entries(&tr->array_buffer, cpu); -+ out_start: -+ tracing_start_tr(tr); - return ret; - } - -diff --git a/lib/zstd/common/fse_decompress.c b/lib/zstd/common/fse_decompress.c -index 2c8bbe3e4c148..f37b7aec088ec 100644 ---- a/lib/zstd/common/fse_decompress.c -+++ b/lib/zstd/common/fse_decompress.c -@@ -312,7 +312,7 @@ size_t FSE_decompress_wksp(void* dst, size_t dstCapacity, const void* cSrc, size - - typedef struct { - short ncount[FSE_MAX_SYMBOL_VALUE + 1]; -- FSE_DTable dtable[1]; /* Dynamically sized */ -+ FSE_DTable dtable[]; /* Dynamically sized */ - } FSE_DecompressWksp; - - -diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c -index dbf5e4de97a0f..9ea21b6d266be 100644 ---- a/mm/damon/sysfs.c -+++ b/mm/damon/sysfs.c -@@ -2210,7 +2210,7 @@ static int damon_sysfs_update_target(struct damon_target *target, - struct damon_ctx *ctx, - struct damon_sysfs_target *sys_target) - { -- int err; -+ int err = 0; - - if (damon_target_has_pid(ctx)) { - err = damon_sysfs_update_target_pid(target, sys_target->pid); -diff --git a/mm/filemap.c b/mm/filemap.c -index 2d930470aacaa..d633ab8cd56f1 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -3319,7 +3319,7 @@ static bool filemap_map_pmd(struct vm_fault *vmf, struct page *page) - } - } - -- if (pmd_none(*vmf->pmd)) -+ if (pmd_none(*vmf->pmd) && vmf->prealloc_pte) - pmd_install(mm, vmf->pmd, &vmf->prealloc_pte); - - /* See comment in handle_pte_fault() */ -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index aa4a68dfb3b92..37288a7f0fa65 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -1189,6 +1189,13 @@ static int is_vma_resv_set(struct vm_area_struct *vma, unsigned long flag) - return (get_vma_private_data(vma) & flag) != 0; - } - -+bool __vma_private_lock(struct vm_area_struct *vma) -+{ -+ return !(vma->vm_flags & VM_MAYSHARE) && -+ get_vma_private_data(vma) & ~HPAGE_RESV_MASK && -+ is_vma_resv_set(vma, HPAGE_RESV_OWNER); -+} -+ - void hugetlb_dup_vma_private(struct vm_area_struct *vma) - { - VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma); -diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c -index f084a4a6b7ab2..8e0a90b45df22 100644 ---- a/net/core/drop_monitor.c -+++ b/net/core/drop_monitor.c -@@ -181,7 +181,7 @@ out: - } - - static const struct genl_multicast_group dropmon_mcgrps[] = { -- { .name = "events", }, -+ { .name = "events", .cap_sys_admin = 1 }, - }; - - static void send_dm_alert(struct work_struct *work) -@@ -1604,11 +1604,13 @@ static const struct genl_small_ops dropmon_ops[] = { - .cmd = NET_DM_CMD_START, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .doit = net_dm_cmd_trace, -+ .flags = GENL_ADMIN_PERM, - }, - { - .cmd = NET_DM_CMD_STOP, - .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .doit = net_dm_cmd_trace, -+ .flags = GENL_ADMIN_PERM, - }, - { - .cmd = NET_DM_CMD_CONFIG_GET, -diff --git a/net/core/filter.c b/net/core/filter.c -index adc327f4af1e9..3a6110ea4009f 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -2582,6 +2582,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes) - return 0; - } - -+static void sk_msg_reset_curr(struct sk_msg *msg) -+{ -+ u32 i = msg->sg.start; -+ u32 len = 0; -+ -+ do { -+ len += sk_msg_elem(msg, i)->length; -+ sk_msg_iter_var_next(i); -+ if (len >= msg->sg.size) -+ break; -+ } while (i != msg->sg.end); -+ -+ msg->sg.curr = i; -+ msg->sg.copybreak = 0; -+} -+ - static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { - .func = bpf_msg_cork_bytes, - .gpl_only = false, -@@ -2701,6 +2717,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start, - msg->sg.end - shift + NR_MSG_FRAG_IDS : - msg->sg.end - shift; - out: -+ sk_msg_reset_curr(msg); - msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset; - msg->data_end = msg->data + bytes; - return 0; -@@ -2837,6 +2854,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, - msg->sg.data[new] = rsge; - } - -+ sk_msg_reset_curr(msg); - sk_msg_compute_data_pointers(msg); - return 0; - } -@@ -3005,6 +3023,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, - - sk_mem_uncharge(msg->sk, len - pop); - msg->sg.size -= (len - pop); -+ sk_msg_reset_curr(msg); - sk_msg_compute_data_pointers(msg); - return 0; - } -diff --git a/net/core/scm.c b/net/core/scm.c -index acb7d776fa6ec..e762a4b8a1d22 100644 ---- a/net/core/scm.c -+++ b/net/core/scm.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - #include - -@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - - if (fd < 0 || !(file = fget_raw(fd))) - return -EBADF; -+ /* don't allow io_uring files */ -+ if (io_uring_get_socket(file)) { -+ fput(file); -+ return -EINVAL; -+ } - *fpp++ = file; - fpl->count++; - } -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index 5b8242265617d..d67d026d7f975 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -634,15 +634,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, - } - - if (dev->header_ops) { -+ int pull_len = tunnel->hlen + sizeof(struct iphdr); -+ - if (skb_cow_head(skb, 0)) - goto free_skb; - - tnl_params = (const struct iphdr *)skb->data; - -- /* Pull skb since ip_tunnel_xmit() needs skb->data pointing -- * to gre header. -- */ -- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); -+ if (!pskb_network_may_pull(skb, pull_len)) -+ goto free_skb; -+ -+ /* ip_tunnel_xmit() needs skb->data pointing to gre header. */ -+ skb_pull(skb, pull_len); - skb_reset_mac_header(skb); - - if (skb->ip_summed == CHECKSUM_PARTIAL && -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 288678f17ccaf..58409ea2da0af 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3473,9 +3473,25 @@ int tcp_set_window_clamp(struct sock *sk, int val) - return -EINVAL; - tp->window_clamp = 0; - } else { -- tp->window_clamp = val < SOCK_MIN_RCVBUF / 2 ? -- SOCK_MIN_RCVBUF / 2 : val; -- tp->rcv_ssthresh = min(tp->rcv_wnd, tp->window_clamp); -+ u32 new_rcv_ssthresh, old_window_clamp = tp->window_clamp; -+ u32 new_window_clamp = val < SOCK_MIN_RCVBUF / 2 ? -+ SOCK_MIN_RCVBUF / 2 : val; -+ -+ if (new_window_clamp == old_window_clamp) -+ return 0; -+ -+ tp->window_clamp = new_window_clamp; -+ if (new_window_clamp < old_window_clamp) { -+ /* need to apply the reserved mem provisioning only -+ * when shrinking the window clamp -+ */ -+ __tcp_adjust_rcv_ssthresh(sk, tp->window_clamp); -+ -+ } else { -+ new_rcv_ssthresh = min(tp->rcv_wnd, tp->window_clamp); -+ tp->rcv_ssthresh = max(new_rcv_ssthresh, -+ tp->rcv_ssthresh); -+ } - } - return 0; - } -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 65dae3d43684f..34460c9b37ae2 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3803,8 +3803,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) - * then we can probably ignore it. - */ - if (before(ack, prior_snd_una)) { -+ u32 max_window; -+ -+ /* do not accept ACK for bytes we never sent. */ -+ max_window = min_t(u64, tp->max_window, tp->bytes_acked); - /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ -- if (before(ack, prior_snd_una - tp->max_window)) { -+ if (before(ack, prior_snd_una - max_window)) { - if (!(flag & FLAG_NO_CHALLENGE_ACK)) - tcp_send_challenge_ack(sk); - return -SKB_DROP_REASON_TCP_TOO_OLD_ACK; -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index eb6640f9a7921..1840735e9cb07 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -1502,13 +1502,9 @@ out: - if (!pn_leaf && !(pn->fn_flags & RTN_RTINFO)) { - pn_leaf = fib6_find_prefix(info->nl_net, table, - pn); --#if RT6_DEBUG >= 2 -- if (!pn_leaf) { -- WARN_ON(!pn_leaf); -+ if (!pn_leaf) - pn_leaf = - info->nl_net->ipv6.fib6_null_entry; -- } --#endif - fib6_info_hold(pn_leaf); - rcu_assign_pointer(pn->leaf, pn_leaf); - } -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index 20eede37d5228..d47dfdcb899b0 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -61,6 +61,8 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET); - ip_set_dereference((inst)->ip_set_list)[id] - #define ip_set_ref_netlink(inst,id) \ - rcu_dereference_raw((inst)->ip_set_list)[id] -+#define ip_set_dereference_nfnl(p) \ -+ rcu_dereference_check(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET)) - - /* The set types are implemented in modules and registered set types - * can be found in ip_set_type_list. Adding/deleting types is -@@ -708,15 +710,10 @@ __ip_set_put_netlink(struct ip_set *set) - static struct ip_set * - ip_set_rcu_get(struct net *net, ip_set_id_t index) - { -- struct ip_set *set; - struct ip_set_net *inst = ip_set_pernet(net); - -- rcu_read_lock(); -- /* ip_set_list itself needs to be protected */ -- set = rcu_dereference(inst->ip_set_list)[index]; -- rcu_read_unlock(); -- -- return set; -+ /* ip_set_list and the set pointer need to be protected */ -+ return ip_set_dereference_nfnl(inst->ip_set_list)[index]; - } - - static inline void -@@ -1399,6 +1396,9 @@ static int ip_set_swap(struct sk_buff *skb, const struct nfnl_info *info, - ip_set(inst, to_id) = from; - write_unlock_bh(&ip_set_ref_lock); - -+ /* Make sure all readers of the old set pointers are completed. */ -+ synchronize_rcu(); -+ - return 0; - } - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 421211eba838b..05fa5141af516 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -805,7 +805,7 @@ static struct nft_table *nft_table_lookup(const struct net *net, - - static struct nft_table *nft_table_lookup_byhandle(const struct net *net, - const struct nlattr *nla, -- u8 genmask, u32 nlpid) -+ int family, u8 genmask, u32 nlpid) - { - struct nftables_pernet *nft_net; - struct nft_table *table; -@@ -813,6 +813,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net, - nft_net = nft_pernet(net); - list_for_each_entry(table, &nft_net->tables, list) { - if (be64_to_cpu(nla_get_be64(nla)) == table->handle && -+ table->family == family && - nft_active_genmask(table, genmask)) { - if (nft_table_has_owner(table) && - nlpid && table->nlpid != nlpid) -@@ -1537,7 +1538,7 @@ static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, - - if (nla[NFTA_TABLE_HANDLE]) { - attr = nla[NFTA_TABLE_HANDLE]; -- table = nft_table_lookup_byhandle(net, attr, genmask, -+ table = nft_table_lookup_byhandle(net, attr, family, genmask, - NETLINK_CB(skb).portid); - } else { - attr = nla[NFTA_TABLE_NAME]; -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index cf9a1ae87d9b1..a470e5f612843 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -279,10 +279,15 @@ static int nft_dynset_init(const struct nft_ctx *ctx, - priv->expr_array[i] = dynset_expr; - priv->num_exprs++; - -- if (set->num_exprs && -- dynset_expr->ops != set->exprs[i]->ops) { -- err = -EOPNOTSUPP; -- goto err_expr_free; -+ if (set->num_exprs) { -+ if (i >= set->num_exprs) { -+ err = -EINVAL; -+ goto err_expr_free; -+ } -+ if (dynset_expr->ops != set->exprs[i]->ops) { -+ err = -EOPNOTSUPP; -+ goto err_expr_free; -+ } - } - i++; - } -diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c -index efb50c2b41f32..de588f7b69c45 100644 ---- a/net/netfilter/nft_exthdr.c -+++ b/net/netfilter/nft_exthdr.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -214,7 +215,7 @@ static void nft_exthdr_tcp_eval(const struct nft_expr *expr, - - offset = i + priv->offset; - if (priv->flags & NFT_EXTHDR_F_PRESENT) { -- *dest = 1; -+ nft_reg_store8(dest, 1); - } else { - if (priv->len % NFT_REG32_SIZE) - dest[priv->len / NFT_REG32_SIZE] = 0; -@@ -409,6 +410,82 @@ err: - regs->verdict.code = NFT_BREAK; - } - -+static void nft_exthdr_dccp_eval(const struct nft_expr *expr, -+ struct nft_regs *regs, -+ const struct nft_pktinfo *pkt) -+{ -+ struct nft_exthdr *priv = nft_expr_priv(expr); -+ unsigned int thoff, dataoff, optoff, optlen, i; -+ u32 *dest = ®s->data[priv->dreg]; -+ const struct dccp_hdr *dh; -+ struct dccp_hdr _dh; -+ -+ if (pkt->tprot != IPPROTO_DCCP || pkt->fragoff) -+ goto err; -+ -+ thoff = nft_thoff(pkt); -+ -+ dh = skb_header_pointer(pkt->skb, thoff, sizeof(_dh), &_dh); -+ if (!dh) -+ goto err; -+ -+ dataoff = dh->dccph_doff * sizeof(u32); -+ optoff = __dccp_hdr_len(dh); -+ if (dataoff <= optoff) -+ goto err; -+ -+ optlen = dataoff - optoff; -+ -+ for (i = 0; i < optlen; ) { -+ /* Options 0 (DCCPO_PADDING) - 31 (DCCPO_MAX_RESERVED) are 1B in -+ * the length; the remaining options are at least 2B long. In -+ * all cases, the first byte contains the option type. In -+ * multi-byte options, the second byte contains the option -+ * length, which must be at least two: 1 for the type plus 1 for -+ * the length plus 0-253 for any following option data. We -+ * aren't interested in the option data, only the type and the -+ * length, so we don't need to read more than two bytes at a -+ * time. -+ */ -+ unsigned int buflen = optlen - i; -+ u8 buf[2], *bufp; -+ u8 type, len; -+ -+ if (buflen > sizeof(buf)) -+ buflen = sizeof(buf); -+ -+ bufp = skb_header_pointer(pkt->skb, thoff + optoff + i, buflen, -+ &buf); -+ if (!bufp) -+ goto err; -+ -+ type = bufp[0]; -+ -+ if (type == priv->type) { -+ nft_reg_store8(dest, 1); -+ return; -+ } -+ -+ if (type <= DCCPO_MAX_RESERVED) { -+ i++; -+ continue; -+ } -+ -+ if (buflen < 2) -+ goto err; -+ -+ len = bufp[1]; -+ -+ if (len < 2) -+ goto err; -+ -+ i += len; -+ } -+ -+err: -+ *dest = 0; -+} -+ - static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = { - [NFTA_EXTHDR_DREG] = { .type = NLA_U32 }, - [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 }, -@@ -560,6 +637,22 @@ static int nft_exthdr_ipv4_init(const struct nft_ctx *ctx, - return 0; - } - -+static int nft_exthdr_dccp_init(const struct nft_ctx *ctx, -+ const struct nft_expr *expr, -+ const struct nlattr * const tb[]) -+{ -+ struct nft_exthdr *priv = nft_expr_priv(expr); -+ int err = nft_exthdr_init(ctx, expr, tb); -+ -+ if (err < 0) -+ return err; -+ -+ if (!(priv->flags & NFT_EXTHDR_F_PRESENT)) -+ return -EOPNOTSUPP; -+ -+ return 0; -+} -+ - static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv) - { - if (nla_put_u8(skb, NFTA_EXTHDR_TYPE, priv->type)) -@@ -686,6 +779,15 @@ static const struct nft_expr_ops nft_exthdr_sctp_ops = { - .reduce = nft_exthdr_reduce, - }; - -+static const struct nft_expr_ops nft_exthdr_dccp_ops = { -+ .type = &nft_exthdr_type, -+ .size = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)), -+ .eval = nft_exthdr_dccp_eval, -+ .init = nft_exthdr_dccp_init, -+ .dump = nft_exthdr_dump, -+ .reduce = nft_exthdr_reduce, -+}; -+ - static const struct nft_expr_ops * - nft_exthdr_select_ops(const struct nft_ctx *ctx, - const struct nlattr * const tb[]) -@@ -720,6 +822,10 @@ nft_exthdr_select_ops(const struct nft_ctx *ctx, - if (tb[NFTA_EXTHDR_DREG]) - return &nft_exthdr_sctp_ops; - break; -+ case NFT_EXTHDR_OP_DCCP: -+ if (tb[NFTA_EXTHDR_DREG]) -+ return &nft_exthdr_dccp_ops; -+ break; - } - - return ERR_PTR(-EOPNOTSUPP); -diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c -index 1f12d7ade606c..5748415f74d0b 100644 ---- a/net/netfilter/nft_fib.c -+++ b/net/netfilter/nft_fib.c -@@ -144,11 +144,15 @@ void nft_fib_store_result(void *reg, const struct nft_fib *priv, - switch (priv->result) { - case NFT_FIB_RESULT_OIF: - index = dev ? dev->ifindex : 0; -- *dreg = (priv->flags & NFTA_FIB_F_PRESENT) ? !!index : index; -+ if (priv->flags & NFTA_FIB_F_PRESENT) -+ nft_reg_store8(dreg, !!index); -+ else -+ *dreg = index; -+ - break; - case NFT_FIB_RESULT_OIFNAME: - if (priv->flags & NFTA_FIB_F_PRESENT) -- *dreg = !!dev; -+ nft_reg_store8(dreg, !!dev); - else - strncpy(reg, dev ? dev->name : "", IFNAMSIZ); - break; -diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c -index deea6196d9925..4e1cc31729b80 100644 ---- a/net/netfilter/nft_set_pipapo.c -+++ b/net/netfilter/nft_set_pipapo.c -@@ -2042,6 +2042,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, - - e = f->mt[r].e; - -+ if (!nft_set_elem_active(&e->ext, iter->genmask)) -+ goto cont; -+ - elem.priv = e; - - iter->err = iter->fn(ctx, set, iter, &elem); -diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c -index e85ce69924aee..50332888c8d23 100644 ---- a/net/netfilter/xt_owner.c -+++ b/net/netfilter/xt_owner.c -@@ -76,18 +76,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) - */ - return false; - -- filp = sk->sk_socket->file; -- if (filp == NULL) -+ read_lock_bh(&sk->sk_callback_lock); -+ filp = sk->sk_socket ? sk->sk_socket->file : NULL; -+ if (filp == NULL) { -+ read_unlock_bh(&sk->sk_callback_lock); - return ((info->match ^ info->invert) & - (XT_OWNER_UID | XT_OWNER_GID)) == 0; -+ } - - if (info->match & XT_OWNER_UID) { - kuid_t uid_min = make_kuid(net->user_ns, info->uid_min); - kuid_t uid_max = make_kuid(net->user_ns, info->uid_max); - if ((uid_gte(filp->f_cred->fsuid, uid_min) && - uid_lte(filp->f_cred->fsuid, uid_max)) ^ -- !(info->invert & XT_OWNER_UID)) -+ !(info->invert & XT_OWNER_UID)) { -+ read_unlock_bh(&sk->sk_callback_lock); - return false; -+ } - } - - if (info->match & XT_OWNER_GID) { -@@ -112,10 +117,13 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par) - } - } - -- if (match ^ !(info->invert & XT_OWNER_GID)) -+ if (match ^ !(info->invert & XT_OWNER_GID)) { -+ read_unlock_bh(&sk->sk_callback_lock); - return false; -+ } - } - -+ read_unlock_bh(&sk->sk_callback_lock); - return true; - } - -diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c -index 3e16527beb914..505d3b910cc29 100644 ---- a/net/netlink/genetlink.c -+++ b/net/netlink/genetlink.c -@@ -1438,6 +1438,9 @@ static int genl_bind(struct net *net, int group) - if ((grp->flags & GENL_UNS_ADMIN_PERM) && - !ns_capable(net->user_ns, CAP_NET_ADMIN)) - ret = -EPERM; -+ if (grp->cap_sys_admin && -+ !ns_capable(net->user_ns, CAP_SYS_ADMIN)) -+ ret = -EPERM; - - break; - } -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 451bd8bfafd23..51882f07ef70c 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4275,7 +4275,7 @@ static void packet_mm_open(struct vm_area_struct *vma) - struct sock *sk = sock->sk; - - if (sk) -- atomic_inc(&pkt_sk(sk)->mapped); -+ atomic_long_inc(&pkt_sk(sk)->mapped); - } - - static void packet_mm_close(struct vm_area_struct *vma) -@@ -4285,7 +4285,7 @@ static void packet_mm_close(struct vm_area_struct *vma) - struct sock *sk = sock->sk; - - if (sk) -- atomic_dec(&pkt_sk(sk)->mapped); -+ atomic_long_dec(&pkt_sk(sk)->mapped); - } - - static const struct vm_operations_struct packet_mmap_ops = { -@@ -4380,7 +4380,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - - err = -EBUSY; - if (!closing) { -- if (atomic_read(&po->mapped)) -+ if (atomic_long_read(&po->mapped)) - goto out; - if (packet_read_pending(rb)) - goto out; -@@ -4483,7 +4483,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - - err = -EBUSY; - mutex_lock(&po->pg_vec_lock); -- if (closing || atomic_read(&po->mapped) == 0) { -+ if (closing || atomic_long_read(&po->mapped) == 0) { - err = 0; - spin_lock_bh(&rb_queue->lock); - swap(rb->pg_vec, pg_vec); -@@ -4501,9 +4501,9 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - po->prot_hook.func = (po->rx_ring.pg_vec) ? - tpacket_rcv : packet_rcv; - skb_queue_purge(rb_queue); -- if (atomic_read(&po->mapped)) -- pr_err("packet_mmap: vma is busy: %d\n", -- atomic_read(&po->mapped)); -+ if (atomic_long_read(&po->mapped)) -+ pr_err("packet_mmap: vma is busy: %ld\n", -+ atomic_long_read(&po->mapped)); - } - mutex_unlock(&po->pg_vec_lock); - -@@ -4581,7 +4581,7 @@ static int packet_mmap(struct file *file, struct socket *sock, - } - } - -- atomic_inc(&po->mapped); -+ atomic_long_inc(&po->mapped); - vma->vm_ops = &packet_mmap_ops; - err = 0; - -diff --git a/net/packet/internal.h b/net/packet/internal.h -index 3bae8ea7a36f5..b2edfe6fc8e77 100644 ---- a/net/packet/internal.h -+++ b/net/packet/internal.h -@@ -126,7 +126,7 @@ struct packet_sock { - __be16 num; - struct packet_rollover *rollover; - struct packet_mclist *mclist; -- atomic_t mapped; -+ atomic_long_t mapped; - enum tpacket_versions tp_version; - unsigned int tp_hdrlen; - unsigned int tp_reserve; -diff --git a/net/psample/psample.c b/net/psample/psample.c -index 81a794e36f535..c34e902855dbe 100644 ---- a/net/psample/psample.c -+++ b/net/psample/psample.c -@@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { - - static const struct genl_multicast_group psample_nl_mcgrps[] = { - [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, -- [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, -+ [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, -+ .flags = GENL_UNS_ADMIN_PERM }, - }; - - static struct genl_family psample_nl_family __ro_after_init; -diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c -index f7592638e61d3..5c8e02d56fd43 100644 ---- a/net/xdp/xsk.c -+++ b/net/xdp/xsk.c -@@ -722,7 +722,7 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock, - - rcu_read_lock(); - if (xsk_check_common(xs)) -- goto skip_tx; -+ goto out; - - pool = xs->pool; - -@@ -734,12 +734,11 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock, - xsk_generic_xmit(sk); - } - --skip_tx: - if (xs->rx && !xskq_prod_is_empty(xs->rx)) - mask |= EPOLLIN | EPOLLRDNORM; - if (xs->tx && xsk_tx_writeable(xs)) - mask |= EPOLLOUT | EPOLLWRNORM; -- -+out: - rcu_read_unlock(); - return mask; - } -diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl -index d48dfed6d3dba..a0f9101d5fd44 100755 ---- a/scripts/checkstack.pl -+++ b/scripts/checkstack.pl -@@ -146,15 +146,11 @@ $total_size = 0; - while (my $line = ) { - if ($line =~ m/$funcre/) { - $func = $1; -- next if $line !~ m/^($xs*)/; -+ next if $line !~ m/^($x*)/; - if ($total_size > $min_stack) { - push @stack, "$intro$total_size\n"; - } -- -- $addr = $1; -- $addr =~ s/ /0/g; -- $addr = "0x$addr"; -- -+ $addr = "0x$1"; - $intro = "$addr $func [$file]:"; - my $padlen = 56 - length($intro); - while ($padlen > 0) { -diff --git a/scripts/dtc/dt-extract-compatibles b/scripts/dtc/dt-extract-compatibles -index a1119762ed086..9686a1cf85498 100755 ---- a/scripts/dtc/dt-extract-compatibles -+++ b/scripts/dtc/dt-extract-compatibles -@@ -1,8 +1,8 @@ - #!/usr/bin/env python3 - # SPDX-License-Identifier: GPL-2.0-only - -+import fnmatch - import os --import glob - import re - import argparse - -@@ -49,6 +49,24 @@ def print_compat(filename, compatibles): - else: - print(*compatibles, sep='\n') - -+def glob_without_symlinks(root, glob): -+ for path, dirs, files in os.walk(root): -+ # Ignore hidden directories -+ for d in dirs: -+ if fnmatch.fnmatch(d, ".*"): -+ dirs.remove(d) -+ for f in files: -+ if fnmatch.fnmatch(f, glob): -+ yield os.path.join(path, f) -+ -+def files_to_parse(path_args): -+ for f in path_args: -+ if os.path.isdir(f): -+ for filename in glob_without_symlinks(f, "*.c"): -+ yield filename -+ else: -+ yield f -+ - show_filename = False - - if __name__ == "__main__": -@@ -59,11 +77,6 @@ if __name__ == "__main__": - - show_filename = args.with_filename - -- for f in args.cfile: -- if os.path.isdir(f): -- for filename in glob.iglob(f + "/**/*.c", recursive=True): -- compat_list = parse_compatibles(filename) -- print_compat(filename, compat_list) -- else: -- compat_list = parse_compatibles(f) -- print_compat(f, compat_list) -+ for f in files_to_parse(args.cfile): -+ compat_list = parse_compatibles(f) -+ print_compat(f, compat_list) -diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c -index 0572330bf8a78..a76925b46ce63 100644 ---- a/scripts/kconfig/symbol.c -+++ b/scripts/kconfig/symbol.c -@@ -122,9 +122,9 @@ static long long sym_get_range_val(struct symbol *sym, int base) - static void sym_validate_range(struct symbol *sym) - { - struct property *prop; -+ struct symbol *range_sym; - int base; - long long val, val2; -- char str[64]; - - switch (sym->type) { - case S_INT: -@@ -140,17 +140,15 @@ static void sym_validate_range(struct symbol *sym) - if (!prop) - return; - val = strtoll(sym->curr.val, NULL, base); -- val2 = sym_get_range_val(prop->expr->left.sym, base); -+ range_sym = prop->expr->left.sym; -+ val2 = sym_get_range_val(range_sym, base); - if (val >= val2) { -- val2 = sym_get_range_val(prop->expr->right.sym, base); -+ range_sym = prop->expr->right.sym; -+ val2 = sym_get_range_val(range_sym, base); - if (val <= val2) - return; - } -- if (sym->type == S_INT) -- sprintf(str, "%lld", val2); -- else -- sprintf(str, "0x%llx", val2); -- sym->curr.val = xstrdup(str); -+ sym->curr.val = range_sym->curr.val; - } - - static void sym_set_changed(struct symbol *sym) -diff --git a/sound/core/pcm.c b/sound/core/pcm.c -index 9d95e37311230..2415a3c3ac6c9 100644 ---- a/sound/core/pcm.c -+++ b/sound/core/pcm.c -@@ -253,6 +253,7 @@ static const char * const snd_pcm_state_names[] = { - STATE(DRAINING), - STATE(PAUSED), - STATE(SUSPENDED), -+ STATE(DISCONNECTED), - }; - - static const char * const snd_pcm_access_names[] = { -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d1944c83b03a2..c6cae3369a6a1 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -10031,6 +10031,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), - SND_PCI_QUIRK(0x8086, 0x3038, "Intel NUC 13", ALC295_FIXUP_CHROME_BOOK), - SND_PCI_QUIRK(0xf111, 0x0001, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0xf111, 0x0005, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0xf111, 0x0006, "Framework Laptop", ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE), - - #if 0 - /* Below is a quirk table taken from the old code. -@@ -11952,6 +11954,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x32f7, "Lenovo ThinkCentre M90", ALC897_FIXUP_HEADSET_MIC_PIN), - SND_PCI_QUIRK(0x17aa, 0x3321, "Lenovo ThinkCentre M70 Gen4", ALC897_FIXUP_HEADSET_MIC_PIN), - SND_PCI_QUIRK(0x17aa, 0x331b, "Lenovo ThinkCentre M90 Gen4", ALC897_FIXUP_HEADSET_MIC_PIN), -+ SND_PCI_QUIRK(0x17aa, 0x3364, "Lenovo ThinkCentre M90 Gen5", ALC897_FIXUP_HEADSET_MIC_PIN), - SND_PCI_QUIRK(0x17aa, 0x3742, "Lenovo TianYi510Pro-14IOB", ALC897_FIXUP_HEADSET_MIC_PIN2), - SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD), - SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index c494de5f5c066..1dde1f3196acc 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -283,6 +283,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"), -+ } -+ }, - { - .driver_data = &acp6x_card, - .matches = { -diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c -index 9f59518005a5f..840bbe991cd3a 100644 ---- a/sound/soc/codecs/lpass-tx-macro.c -+++ b/sound/soc/codecs/lpass-tx-macro.c -@@ -1871,6 +1871,11 @@ static int tx_macro_probe(struct platform_device *pdev) - - tx->dev = dev; - -+ /* Set active_decimator default value */ -+ tx->active_decimator[TX_MACRO_AIF1_CAP] = -1; -+ tx->active_decimator[TX_MACRO_AIF2_CAP] = -1; -+ tx->active_decimator[TX_MACRO_AIF3_CAP] = -1; -+ - /* set MCLK and NPL rates */ - clk_set_rate(tx->mclk, MCLK_FREQ); - clk_set_rate(tx->npl, MCLK_FREQ); -diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c -index 8a2e9771bb50e..2cfca78f0401f 100644 ---- a/sound/soc/codecs/wm_adsp.c -+++ b/sound/soc/codecs/wm_adsp.c -@@ -1401,12 +1401,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) - ret = wm_adsp_buffer_read(buf, caps->region_defs[i].base_offset, - ®ion->base_addr); - if (ret < 0) -- return ret; -+ goto err; - - ret = wm_adsp_buffer_read(buf, caps->region_defs[i].size_offset, - &offset); - if (ret < 0) -- return ret; -+ goto err; - - region->cumulative_size = offset; - -@@ -1417,6 +1417,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf) - } - - return 0; -+ -+err: -+ kfree(buf->regions); -+ return ret; - } - - static void wm_adsp_buffer_clear(struct wm_adsp_compr_buf *buf) -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index 96fd9095e544b..6364d9be28fbb 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -674,6 +674,20 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, - FSL_SAI_CR3_TRCE_MASK, - FSL_SAI_CR3_TRCE((dl_cfg[dl_cfg_idx].mask[tx] & trce_mask))); - -+ /* -+ * When the TERE and FSD_MSTR enabled before configuring the word width -+ * There will be no frame sync clock issue, because word width impact -+ * the generation of frame sync clock. -+ * -+ * TERE enabled earlier only for i.MX8MP case for the hardware limitation, -+ * We need to disable FSD_MSTR before configuring word width, then enable -+ * FSD_MSTR bit for this specific case. -+ */ -+ if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && -+ !sai->is_consumer_mode) -+ regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), -+ FSL_SAI_CR4_FSD_MSTR, 0); -+ - regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), - FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | - FSL_SAI_CR4_CHMOD_MASK, -@@ -681,6 +695,13 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, - regmap_update_bits(sai->regmap, FSL_SAI_xCR5(tx, ofs), - FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK | - FSL_SAI_CR5_FBT_MASK, val_cr5); -+ -+ /* Enable FSD_MSTR after configuring word width */ -+ if (sai->soc_data->mclk_with_tere && sai->mclk_direction_output && -+ !sai->is_consumer_mode) -+ regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), -+ FSL_SAI_CR4_FSD_MSTR, FSL_SAI_CR4_FSD_MSTR); -+ - regmap_write(sai->regmap, FSL_SAI_xMR(tx), - ~0UL - ((1 << min(channels, slots)) - 1)); - -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index ab0d459f42715..1f32e3ae3aa31 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -2978,6 +2978,7 @@ static int snd_bbfpro_controls_create(struct usb_mixer_interface *mixer) - #define SND_DJM_850_IDX 0x2 - #define SND_DJM_900NXS2_IDX 0x3 - #define SND_DJM_750MK2_IDX 0x4 -+#define SND_DJM_450_IDX 0x5 - - - #define SND_DJM_CTL(_name, suffix, _default_value, _windex) { \ -@@ -3108,6 +3109,31 @@ static const struct snd_djm_ctl snd_djm_ctls_250mk2[] = { - }; - - -+// DJM-450 -+static const u16 snd_djm_opts_450_cap1[] = { -+ 0x0103, 0x0100, 0x0106, 0x0107, 0x0108, 0x0109, 0x010d, 0x010a }; -+ -+static const u16 snd_djm_opts_450_cap2[] = { -+ 0x0203, 0x0200, 0x0206, 0x0207, 0x0208, 0x0209, 0x020d, 0x020a }; -+ -+static const u16 snd_djm_opts_450_cap3[] = { -+ 0x030a, 0x0311, 0x0312, 0x0307, 0x0308, 0x0309, 0x030d }; -+ -+static const u16 snd_djm_opts_450_pb1[] = { 0x0100, 0x0101, 0x0104 }; -+static const u16 snd_djm_opts_450_pb2[] = { 0x0200, 0x0201, 0x0204 }; -+static const u16 snd_djm_opts_450_pb3[] = { 0x0300, 0x0301, 0x0304 }; -+ -+static const struct snd_djm_ctl snd_djm_ctls_450[] = { -+ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), -+ SND_DJM_CTL("Ch1 Input", 450_cap1, 2, SND_DJM_WINDEX_CAP), -+ SND_DJM_CTL("Ch2 Input", 450_cap2, 2, SND_DJM_WINDEX_CAP), -+ SND_DJM_CTL("Ch3 Input", 450_cap3, 0, SND_DJM_WINDEX_CAP), -+ SND_DJM_CTL("Ch1 Output", 450_pb1, 0, SND_DJM_WINDEX_PB), -+ SND_DJM_CTL("Ch2 Output", 450_pb2, 1, SND_DJM_WINDEX_PB), -+ SND_DJM_CTL("Ch3 Output", 450_pb3, 2, SND_DJM_WINDEX_PB) -+}; -+ -+ - // DJM-750 - static const u16 snd_djm_opts_750_cap1[] = { - 0x0101, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a, 0x010f }; -@@ -3203,6 +3229,7 @@ static const struct snd_djm_device snd_djm_devices[] = { - [SND_DJM_850_IDX] = SND_DJM_DEVICE(850), - [SND_DJM_900NXS2_IDX] = SND_DJM_DEVICE(900nxs2), - [SND_DJM_750MK2_IDX] = SND_DJM_DEVICE(750mk2), -+ [SND_DJM_450_IDX] = SND_DJM_DEVICE(450), - }; - - -@@ -3449,6 +3476,9 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) - case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */ - err = snd_djm_controls_create(mixer, SND_DJM_250MK2_IDX); - break; -+ case USB_ID(0x2b73, 0x0013): /* Pioneer DJ DJM-450 */ -+ err = snd_djm_controls_create(mixer, SND_DJM_450_IDX); -+ break; - case USB_ID(0x08e4, 0x017f): /* Pioneer DJ DJM-750 */ - err = snd_djm_controls_create(mixer, SND_DJM_750_IDX); - break; diff --git a/patch/kernel/odroidxu4-current/patch-6.1.68-69.patch b/patch/kernel/odroidxu4-current/patch-6.1.68-69.patch deleted file mode 100644 index fd8d28e168..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.68-69.patch +++ /dev/null @@ -1,4110 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2a8ad0cec2f1c..9a3b34d2387fa 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 68 -+SUBLEVEL = 69 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index 5e56d26a22398..c9496539c3351 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -157,7 +157,7 @@ endif - - all: $(notdir $(KBUILD_IMAGE)) - -- -+vmlinuz.efi: Image - Image vmlinuz.efi: vmlinux - $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ - -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 5d0f1f7b76004..56c7df4c65325 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -822,6 +822,12 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) - if (pte_hw_dirty(pte)) - pte = pte_mkdirty(pte); - pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask); -+ /* -+ * If we end up clearing hw dirtiness for a sw-dirty PTE, set hardware -+ * dirtiness again. -+ */ -+ if (pte_sw_dirty(pte)) -+ pte = pte_mkdirty(pte); - return pte; - } - -diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile -index 01b57b7263225..ed47a3a87768e 100644 ---- a/arch/loongarch/Makefile -+++ b/arch/loongarch/Makefile -@@ -116,6 +116,8 @@ vdso_install: - - all: $(notdir $(KBUILD_IMAGE)) - -+vmlinuz.efi: vmlinux.efi -+ - vmlinux.elf vmlinux.efi vmlinuz.efi: vmlinux - $(Q)$(MAKE) $(build)=$(boot) $(bootvars-y) $(boot)/$@ - -diff --git a/arch/loongarch/kernel/time.c b/arch/loongarch/kernel/time.c -index d2b7d5df132a9..150df6e17bb6a 100644 ---- a/arch/loongarch/kernel/time.c -+++ b/arch/loongarch/kernel/time.c -@@ -58,14 +58,16 @@ static int constant_set_state_oneshot(struct clock_event_device *evt) - return 0; - } - --static int constant_set_state_oneshot_stopped(struct clock_event_device *evt) -+static int constant_set_state_periodic(struct clock_event_device *evt) - { -+ unsigned long period; - unsigned long timer_config; - - raw_spin_lock(&state_lock); - -- timer_config = csr_read64(LOONGARCH_CSR_TCFG); -- timer_config &= ~CSR_TCFG_EN; -+ period = const_clock_freq / HZ; -+ timer_config = period & CSR_TCFG_VAL; -+ timer_config |= (CSR_TCFG_PERIOD | CSR_TCFG_EN); - csr_write64(timer_config, LOONGARCH_CSR_TCFG); - - raw_spin_unlock(&state_lock); -@@ -73,16 +75,14 @@ static int constant_set_state_oneshot_stopped(struct clock_event_device *evt) - return 0; - } - --static int constant_set_state_periodic(struct clock_event_device *evt) -+static int constant_set_state_shutdown(struct clock_event_device *evt) - { -- unsigned long period; - unsigned long timer_config; - - raw_spin_lock(&state_lock); - -- period = const_clock_freq / HZ; -- timer_config = period & CSR_TCFG_VAL; -- timer_config |= (CSR_TCFG_PERIOD | CSR_TCFG_EN); -+ timer_config = csr_read64(LOONGARCH_CSR_TCFG); -+ timer_config &= ~CSR_TCFG_EN; - csr_write64(timer_config, LOONGARCH_CSR_TCFG); - - raw_spin_unlock(&state_lock); -@@ -90,11 +90,6 @@ static int constant_set_state_periodic(struct clock_event_device *evt) - return 0; - } - --static int constant_set_state_shutdown(struct clock_event_device *evt) --{ -- return 0; --} -- - static int constant_timer_next_event(unsigned long delta, struct clock_event_device *evt) - { - unsigned long timer_config; -@@ -156,7 +151,7 @@ int constant_clockevent_init(void) - cd->rating = 320; - cd->cpumask = cpumask_of(cpu); - cd->set_state_oneshot = constant_set_state_oneshot; -- cd->set_state_oneshot_stopped = constant_set_state_oneshot_stopped; -+ cd->set_state_oneshot_stopped = constant_set_state_shutdown; - cd->set_state_periodic = constant_set_state_periodic; - cd->set_state_shutdown = constant_set_state_shutdown; - cd->set_next_event = constant_timer_next_event; -diff --git a/arch/powerpc/kernel/trace/ftrace_mprofile.S b/arch/powerpc/kernel/trace/ftrace_mprofile.S -index 6f9c2dea905b7..f4a72b38488f7 100644 ---- a/arch/powerpc/kernel/trace/ftrace_mprofile.S -+++ b/arch/powerpc/kernel/trace/ftrace_mprofile.S -@@ -62,7 +62,7 @@ - .endif - - /* Save previous stack pointer (r1) */ -- addi r8, r1, SWITCH_FRAME_SIZE -+ addi r8, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE - PPC_STL r8, GPR1(r1) - - .if \allregs == 1 -@@ -182,7 +182,7 @@ ftrace_no_trace: - mflr r3 - mtctr r3 - REST_GPR(3, r1) -- addi r1, r1, SWITCH_FRAME_SIZE -+ addi r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE - mtlr r0 - bctr - #endif -diff --git a/arch/x86/events/intel/uncore_discovery.c b/arch/x86/events/intel/uncore_discovery.c -index 5fd72d4b8bbb0..7d454141433c8 100644 ---- a/arch/x86/events/intel/uncore_discovery.c -+++ b/arch/x86/events/intel/uncore_discovery.c -@@ -140,13 +140,21 @@ uncore_insert_box_info(struct uncore_unit_discovery *unit, - unsigned int *box_offset, *ids; - int i; - -- if (WARN_ON_ONCE(!unit->ctl || !unit->ctl_offset || !unit->ctr_offset)) -+ if (!unit->ctl || !unit->ctl_offset || !unit->ctr_offset) { -+ pr_info("Invalid address is detected for uncore type %d box %d, " -+ "Disable the uncore unit.\n", -+ unit->box_type, unit->box_id); - return; -+ } - - if (parsed) { - type = search_uncore_discovery_type(unit->box_type); -- if (WARN_ON_ONCE(!type)) -+ if (!type) { -+ pr_info("A spurious uncore type %d is detected, " -+ "Disable the uncore type.\n", -+ unit->box_type); - return; -+ } - /* Store the first box of each die */ - if (!type->box_ctrl_die[die]) - type->box_ctrl_die[die] = unit->ctl; -@@ -181,8 +189,12 @@ uncore_insert_box_info(struct uncore_unit_discovery *unit, - ids[i] = type->ids[i]; - box_offset[i] = type->box_offset[i]; - -- if (WARN_ON_ONCE(unit->box_id == ids[i])) -+ if (unit->box_id == ids[i]) { -+ pr_info("Duplicate uncore type %d box ID %d is detected, " -+ "Drop the duplicate uncore unit.\n", -+ unit->box_type, unit->box_id); - goto free_ids; -+ } - } - ids[i] = unit->box_id; - box_offset[i] = unit->ctl - type->box_ctrl; -diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c -index 189ae92de4d06..c18e5c764643b 100644 ---- a/arch/x86/hyperv/hv_init.c -+++ b/arch/x86/hyperv/hv_init.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -267,15 +268,31 @@ static int hv_cpu_die(unsigned int cpu) - - static int __init hv_pci_init(void) - { -- int gen2vm = efi_enabled(EFI_BOOT); -+ bool gen2vm = efi_enabled(EFI_BOOT); - - /* -- * For Generation-2 VM, we exit from pci_arch_init() by returning 0. -- * The purpose is to suppress the harmless warning: -+ * A Generation-2 VM doesn't support legacy PCI/PCIe, so both -+ * raw_pci_ops and raw_pci_ext_ops are NULL, and pci_subsys_init() -> -+ * pcibios_init() doesn't call pcibios_resource_survey() -> -+ * e820__reserve_resources_late(); as a result, any emulated persistent -+ * memory of E820_TYPE_PRAM (12) via the kernel parameter -+ * memmap=nn[KMG]!ss is not added into iomem_resource and hence can't be -+ * detected by register_e820_pmem(). Fix this by directly calling -+ * e820__reserve_resources_late() here: e820__reserve_resources_late() -+ * depends on e820__reserve_resources(), which has been called earlier -+ * from setup_arch(). Note: e820__reserve_resources_late() also adds -+ * any memory of E820_TYPE_PMEM (7) into iomem_resource, and -+ * acpi_nfit_register_region() -> acpi_nfit_insert_resource() -> -+ * region_intersects() returns REGION_INTERSECTS, so the memory of -+ * E820_TYPE_PMEM won't get added twice. -+ * -+ * We return 0 here so that pci_arch_init() won't print the warning: - * "PCI: Fatal: No config space access function found" - */ -- if (gen2vm) -+ if (gen2vm) { -+ e820__reserve_resources_late(); - return 0; -+ } - - /* For Generation-1 VM, we'll proceed in pci_arch_init(). */ - return 1; -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index 60f366f98fa2b..1b7fd1fc2f337 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -462,6 +462,7 @@ static void blkg_destroy_all(struct gendisk *disk) - struct request_queue *q = disk->queue; - struct blkcg_gq *blkg, *n; - int count = BLKG_DESTROY_BATCH_SIZE; -+ int i; - - restart: - spin_lock_irq(&q->queue_lock); -@@ -487,6 +488,18 @@ restart: - } - } - -+ /* -+ * Mark policy deactivated since policy offline has been done, and -+ * the free is scheduled, so future blkcg_deactivate_policy() can -+ * be bypassed -+ */ -+ for (i = 0; i < BLKCG_MAX_POLS; i++) { -+ struct blkcg_policy *pol = blkcg_policy[i]; -+ -+ if (pol) -+ __clear_bit(pol->plid, q->blkcg_pols); -+ } -+ - q->root_blkg = NULL; - spin_unlock_irq(&q->queue_lock); - } -diff --git a/block/blk-throttle.c b/block/blk-throttle.c -index 009b0d76bf036..62a3f62316df1 100644 ---- a/block/blk-throttle.c -+++ b/block/blk-throttle.c -@@ -1333,6 +1333,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) - tg_bps_limit(tg, READ), tg_bps_limit(tg, WRITE), - tg_iops_limit(tg, READ), tg_iops_limit(tg, WRITE)); - -+ rcu_read_lock(); - /* - * Update has_rules[] flags for the updated tg's subtree. A tg is - * considered to have rules if either the tg itself or any of its -@@ -1360,6 +1361,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global) - this_tg->latency_target = max(this_tg->latency_target, - parent_tg->latency_target); - } -+ rcu_read_unlock(); - - /* - * We're already holding queue_lock and know @tg is valid. Let's -diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c -index 94fbc3abe60e6..d3c30a28c410e 100644 ---- a/drivers/atm/solos-pci.c -+++ b/drivers/atm/solos-pci.c -@@ -449,9 +449,9 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr, - struct sk_buff *skb; - unsigned int len; - -- spin_lock(&card->cli_queue_lock); -+ spin_lock_bh(&card->cli_queue_lock); - skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]); -- spin_unlock(&card->cli_queue_lock); -+ spin_unlock_bh(&card->cli_queue_lock); - if(skb == NULL) - return sprintf(buf, "No data.\n"); - -@@ -956,14 +956,14 @@ static void pclose(struct atm_vcc *vcc) - struct pkt_hdr *header; - - /* Remove any yet-to-be-transmitted packets from the pending queue */ -- spin_lock(&card->tx_queue_lock); -+ spin_lock_bh(&card->tx_queue_lock); - skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) { - if (SKB_CB(skb)->vcc == vcc) { - skb_unlink(skb, &card->tx_queue[port]); - solos_pop(vcc, skb); - } - } -- spin_unlock(&card->tx_queue_lock); -+ spin_unlock_bh(&card->tx_queue_lock); - - skb = alloc_skb(sizeof(*header), GFP_KERNEL); - if (!skb) { -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index e94d2ff6b1223..8037aaefeb2ed 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -67,6 +67,7 @@ struct nbd_sock { - struct recv_thread_args { - struct work_struct work; - struct nbd_device *nbd; -+ struct nbd_sock *nsock; - int index; - }; - -@@ -489,15 +490,9 @@ done: - return BLK_EH_DONE; - } - --/* -- * Send or receive packet. Return a positive value on success and -- * negtive value on failue, and never return 0. -- */ --static int sock_xmit(struct nbd_device *nbd, int index, int send, -- struct iov_iter *iter, int msg_flags, int *sent) -+static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, -+ struct iov_iter *iter, int msg_flags, int *sent) - { -- struct nbd_config *config = nbd->config; -- struct socket *sock = config->socks[index]->sock; - int result; - struct msghdr msg; - unsigned int noreclaim_flag; -@@ -539,6 +534,19 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send, - return result; - } - -+/* -+ * Send or receive packet. Return a positive value on success and -+ * negtive value on failure, and never return 0. -+ */ -+static int sock_xmit(struct nbd_device *nbd, int index, int send, -+ struct iov_iter *iter, int msg_flags, int *sent) -+{ -+ struct nbd_config *config = nbd->config; -+ struct socket *sock = config->socks[index]->sock; -+ -+ return __sock_xmit(nbd, sock, send, iter, msg_flags, sent); -+} -+ - /* - * Different settings for sk->sk_sndtimeo can result in different return values - * if there is a signal pending when we enter sendmsg, because reasons? -@@ -695,7 +703,7 @@ out: - return 0; - } - --static int nbd_read_reply(struct nbd_device *nbd, int index, -+static int nbd_read_reply(struct nbd_device *nbd, struct socket *sock, - struct nbd_reply *reply) - { - struct kvec iov = {.iov_base = reply, .iov_len = sizeof(*reply)}; -@@ -704,7 +712,7 @@ static int nbd_read_reply(struct nbd_device *nbd, int index, - - reply->magic = 0; - iov_iter_kvec(&to, ITER_DEST, &iov, 1, sizeof(*reply)); -- result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL); -+ result = __sock_xmit(nbd, sock, 0, &to, MSG_WAITALL, NULL); - if (result < 0) { - if (!nbd_disconnected(nbd->config)) - dev_err(disk_to_dev(nbd->disk), -@@ -828,14 +836,14 @@ static void recv_work(struct work_struct *work) - struct nbd_device *nbd = args->nbd; - struct nbd_config *config = nbd->config; - struct request_queue *q = nbd->disk->queue; -- struct nbd_sock *nsock; -+ struct nbd_sock *nsock = args->nsock; - struct nbd_cmd *cmd; - struct request *rq; - - while (1) { - struct nbd_reply reply; - -- if (nbd_read_reply(nbd, args->index, &reply)) -+ if (nbd_read_reply(nbd, nsock->sock, &reply)) - break; - - /* -@@ -870,7 +878,6 @@ static void recv_work(struct work_struct *work) - percpu_ref_put(&q->q_usage_counter); - } - -- nsock = config->socks[args->index]; - mutex_lock(&nsock->tx_lock); - nbd_mark_nsock_dead(nbd, nsock, 1); - mutex_unlock(&nsock->tx_lock); -@@ -1214,6 +1221,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) - INIT_WORK(&args->work, recv_work); - args->index = i; - args->nbd = nbd; -+ args->nsock = nsock; - nsock->cookie++; - mutex_unlock(&nsock->tx_lock); - sockfd_put(old); -@@ -1396,6 +1404,7 @@ static int nbd_start_device(struct nbd_device *nbd) - refcount_inc(&nbd->config_refs); - INIT_WORK(&args->work, recv_work); - args->nbd = nbd; -+ args->nsock = config->socks[i]; - args->index = i; - queue_work(nbd->recv_workq, &args->work); - } -@@ -1530,17 +1539,20 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode, - return error; - } - --static struct nbd_config *nbd_alloc_config(void) -+static int nbd_alloc_and_init_config(struct nbd_device *nbd) - { - struct nbd_config *config; - -+ if (WARN_ON(nbd->config)) -+ return -EINVAL; -+ - if (!try_module_get(THIS_MODULE)) -- return ERR_PTR(-ENODEV); -+ return -ENODEV; - - config = kzalloc(sizeof(struct nbd_config), GFP_NOFS); - if (!config) { - module_put(THIS_MODULE); -- return ERR_PTR(-ENOMEM); -+ return -ENOMEM; - } - - atomic_set(&config->recv_threads, 0); -@@ -1548,7 +1560,10 @@ static struct nbd_config *nbd_alloc_config(void) - init_waitqueue_head(&config->conn_wait); - config->blksize_bits = NBD_DEF_BLKSIZE_BITS; - atomic_set(&config->live_connections, 0); -- return config; -+ nbd->config = config; -+ refcount_set(&nbd->config_refs, 1); -+ -+ return 0; - } - - static int nbd_open(struct block_device *bdev, fmode_t mode) -@@ -1567,21 +1582,17 @@ static int nbd_open(struct block_device *bdev, fmode_t mode) - goto out; - } - if (!refcount_inc_not_zero(&nbd->config_refs)) { -- struct nbd_config *config; -- - mutex_lock(&nbd->config_lock); - if (refcount_inc_not_zero(&nbd->config_refs)) { - mutex_unlock(&nbd->config_lock); - goto out; - } -- config = nbd_alloc_config(); -- if (IS_ERR(config)) { -- ret = PTR_ERR(config); -+ ret = nbd_alloc_and_init_config(nbd); -+ if (ret) { - mutex_unlock(&nbd->config_lock); - goto out; - } -- nbd->config = config; -- refcount_set(&nbd->config_refs, 1); -+ - refcount_inc(&nbd->refs); - mutex_unlock(&nbd->config_lock); - if (max_part) -@@ -1990,22 +2001,17 @@ again: - pr_err("nbd%d already in use\n", index); - return -EBUSY; - } -- if (WARN_ON(nbd->config)) { -- mutex_unlock(&nbd->config_lock); -- nbd_put(nbd); -- return -EINVAL; -- } -- config = nbd_alloc_config(); -- if (IS_ERR(config)) { -+ -+ ret = nbd_alloc_and_init_config(nbd); -+ if (ret) { - mutex_unlock(&nbd->config_lock); - nbd_put(nbd); - pr_err("couldn't allocate config\n"); -- return PTR_ERR(config); -+ return ret; - } -- nbd->config = config; -- refcount_set(&nbd->config_refs, 1); -- set_bit(NBD_RT_BOUND, &config->runtime_flags); - -+ config = nbd->config; -+ set_bit(NBD_RT_BOUND, &config->runtime_flags); - ret = nbd_genl_size_set(info, nbd); - if (ret) - goto out; -diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c -index 592d48ecf241f..7abcd7f2848ee 100644 ---- a/drivers/dma/stm32-dma.c -+++ b/drivers/dma/stm32-dma.c -@@ -1249,8 +1249,8 @@ static struct dma_async_tx_descriptor *stm32_dma_prep_dma_memcpy( - enum dma_slave_buswidth max_width; - struct stm32_dma_desc *desc; - size_t xfer_count, offset; -- u32 num_sgs, best_burst, dma_burst, threshold; -- int i; -+ u32 num_sgs, best_burst, threshold; -+ int dma_burst, i; - - num_sgs = DIV_ROUND_UP(len, STM32_DMA_ALIGNED_MAX_DATA_ITEMS); - desc = kzalloc(struct_size(desc, sg_req, num_sgs), GFP_NOWAIT); -@@ -1268,6 +1268,10 @@ static struct dma_async_tx_descriptor *stm32_dma_prep_dma_memcpy( - best_burst = stm32_dma_get_best_burst(len, STM32_DMA_MAX_BURST, - threshold, max_width); - dma_burst = stm32_dma_get_burst(chan, best_burst); -+ if (dma_burst < 0) { -+ kfree(desc); -+ return NULL; -+ } - - stm32_dma_clear_reg(&desc->sg_req[i].chan_reg); - desc->sg_req[i].chan_reg.dma_scr = -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c -index 4642cff0e1a4f..69b3829bbe53f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c -@@ -631,13 +631,14 @@ static void amdgpu_vm_pt_free(struct amdgpu_vm_bo_base *entry) - - if (!entry->bo) - return; -+ -+ entry->bo->vm_bo = NULL; - shadow = amdgpu_bo_shadowed(entry->bo); - if (shadow) { - ttm_bo_set_bulk_move(&shadow->tbo, NULL); - amdgpu_bo_unref(&shadow); - } - ttm_bo_set_bulk_move(&entry->bo->tbo, NULL); -- entry->bo->vm_bo = NULL; - - spin_lock(&entry->vm->status_lock); - list_del(&entry->vm_status); -diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c -index 809eca54fc617..856db876af141 100644 ---- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c -+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c -@@ -1690,6 +1690,32 @@ static void sdma_v5_2_get_clockgating_state(void *handle, u64 *flags) - *flags |= AMD_CG_SUPPORT_SDMA_LS; - } - -+static void sdma_v5_2_ring_begin_use(struct amdgpu_ring *ring) -+{ -+ struct amdgpu_device *adev = ring->adev; -+ -+ /* SDMA 5.2.3 (RMB) FW doesn't seem to properly -+ * disallow GFXOFF in some cases leading to -+ * hangs in SDMA. Disallow GFXOFF while SDMA is active. -+ * We can probably just limit this to 5.2.3, -+ * but it shouldn't hurt for other parts since -+ * this GFXOFF will be disallowed anyway when SDMA is -+ * active, this just makes it explicit. -+ */ -+ amdgpu_gfx_off_ctrl(adev, false); -+} -+ -+static void sdma_v5_2_ring_end_use(struct amdgpu_ring *ring) -+{ -+ struct amdgpu_device *adev = ring->adev; -+ -+ /* SDMA 5.2.3 (RMB) FW doesn't seem to properly -+ * disallow GFXOFF in some cases leading to -+ * hangs in SDMA. Allow GFXOFF when SDMA is complete. -+ */ -+ amdgpu_gfx_off_ctrl(adev, true); -+} -+ - const struct amd_ip_funcs sdma_v5_2_ip_funcs = { - .name = "sdma_v5_2", - .early_init = sdma_v5_2_early_init, -@@ -1738,6 +1764,8 @@ static const struct amdgpu_ring_funcs sdma_v5_2_ring_funcs = { - .test_ib = sdma_v5_2_ring_test_ib, - .insert_nop = sdma_v5_2_ring_insert_nop, - .pad_ib = sdma_v5_2_ring_pad_ib, -+ .begin_use = sdma_v5_2_ring_begin_use, -+ .end_use = sdma_v5_2_ring_end_use, - .emit_wreg = sdma_v5_2_ring_emit_wreg, - .emit_reg_wait = sdma_v5_2_ring_emit_reg_wait, - .emit_reg_write_reg_wait = sdma_v5_2_ring_emit_reg_write_reg_wait, -diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -index 9edd39322c822..67287ad07226c 100644 ---- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -+++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c -@@ -816,6 +816,8 @@ bool is_psr_su_specific_panel(struct dc_link *link) - ((dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x08) || - (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x07))) - isPSRSUSupported = false; -+ else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) -+ isPSRSUSupported = false; - else if (dpcd_caps->psr_info.force_psrsu_cap == 0x1) - isPSRSUSupported = true; - } -diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c -index eefa33c555aca..23d854bd73b77 100644 ---- a/drivers/gpu/drm/i915/display/intel_fb.c -+++ b/drivers/gpu/drm/i915/display/intel_fb.c -@@ -1441,8 +1441,20 @@ static u32 calc_plane_remap_info(const struct intel_framebuffer *fb, int color_p - - size += remap_info->size; - } else { -- unsigned int dst_stride = plane_view_dst_stride_tiles(fb, color_plane, -- remap_info->width); -+ unsigned int dst_stride; -+ -+ /* -+ * The hardware automagically calculates the CCS AUX surface -+ * stride from the main surface stride so can't really remap a -+ * smaller subset (unless we'd remap in whole AUX page units). -+ */ -+ if (intel_fb_needs_pot_stride_remap(fb) && -+ intel_fb_is_ccs_modifier(fb->base.modifier)) -+ dst_stride = remap_info->src_stride; -+ else -+ dst_stride = remap_info->width; -+ -+ dst_stride = plane_view_dst_stride_tiles(fb, color_plane, dst_stride); - - assign_chk_ovf(i915, remap_info->dst_stride, dst_stride); - color_plane_info->mapping_stride = dst_stride * -diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c -index 7fb52a573436e..558000db4a100 100644 ---- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c -+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c -@@ -736,6 +736,7 @@ static void mtk_drm_crtc_atomic_begin(struct drm_crtc *crtc, - crtc); - struct mtk_crtc_state *mtk_crtc_state = to_mtk_crtc_state(crtc_state); - struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc); -+ unsigned long flags; - - if (mtk_crtc->event && mtk_crtc_state->base.event) - DRM_ERROR("new event while there is still a pending event\n"); -@@ -743,7 +744,11 @@ static void mtk_drm_crtc_atomic_begin(struct drm_crtc *crtc, - if (mtk_crtc_state->base.event) { - mtk_crtc_state->base.event->pipe = drm_crtc_index(crtc); - WARN_ON(drm_crtc_vblank_get(crtc) != 0); -+ -+ spin_lock_irqsave(&crtc->dev->event_lock, flags); - mtk_crtc->event = mtk_crtc_state->base.event; -+ spin_unlock_irqrestore(&crtc->dev->event_lock, flags); -+ - mtk_crtc_state->base.event = NULL; - } - } -diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c -index d1094bb1aa429..220d6b2af4d3f 100644 ---- a/drivers/hid/hid-asus.c -+++ b/drivers/hid/hid-asus.c -@@ -380,7 +380,7 @@ static int asus_raw_event(struct hid_device *hdev, - return 0; - } - --static int asus_kbd_set_report(struct hid_device *hdev, u8 *buf, size_t buf_size) -+static int asus_kbd_set_report(struct hid_device *hdev, const u8 *buf, size_t buf_size) - { - unsigned char *dmabuf; - int ret; -@@ -403,7 +403,7 @@ static int asus_kbd_set_report(struct hid_device *hdev, u8 *buf, size_t buf_size - - static int asus_kbd_init(struct hid_device *hdev) - { -- u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x41, 0x53, 0x55, 0x53, 0x20, 0x54, -+ const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x41, 0x53, 0x55, 0x53, 0x20, 0x54, - 0x65, 0x63, 0x68, 0x2e, 0x49, 0x6e, 0x63, 0x2e, 0x00 }; - int ret; - -@@ -417,7 +417,7 @@ static int asus_kbd_init(struct hid_device *hdev) - static int asus_kbd_get_functions(struct hid_device *hdev, - unsigned char *kbd_func) - { -- u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 }; -+ const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 }; - u8 *readbuf; - int ret; - -@@ -448,7 +448,7 @@ static int asus_kbd_get_functions(struct hid_device *hdev, - - static int rog_nkey_led_init(struct hid_device *hdev) - { -- u8 buf_init_start[] = { FEATURE_KBD_LED_REPORT_ID1, 0xB9 }; -+ const u8 buf_init_start[] = { FEATURE_KBD_LED_REPORT_ID1, 0xB9 }; - u8 buf_init2[] = { FEATURE_KBD_LED_REPORT_ID1, 0x41, 0x53, 0x55, 0x53, 0x20, - 0x54, 0x65, 0x63, 0x68, 0x2e, 0x49, 0x6e, 0x63, 0x2e, 0x00 }; - u8 buf_init3[] = { FEATURE_KBD_LED_REPORT_ID1, -@@ -1012,6 +1012,24 @@ static int asus_start_multitouch(struct hid_device *hdev) - return 0; - } - -+static int __maybe_unused asus_resume(struct hid_device *hdev) { -+ struct asus_drvdata *drvdata = hid_get_drvdata(hdev); -+ int ret = 0; -+ -+ if (drvdata->kbd_backlight) { -+ const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, -+ drvdata->kbd_backlight->cdev.brightness }; -+ ret = asus_kbd_set_report(hdev, buf, sizeof(buf)); -+ if (ret < 0) { -+ hid_err(hdev, "Asus failed to set keyboard backlight: %d\n", ret); -+ goto asus_resume_err; -+ } -+ } -+ -+asus_resume_err: -+ return ret; -+} -+ - static int __maybe_unused asus_reset_resume(struct hid_device *hdev) - { - struct asus_drvdata *drvdata = hid_get_drvdata(hdev); -@@ -1303,6 +1321,7 @@ static struct hid_driver asus_driver = { - .input_configured = asus_input_configured, - #ifdef CONFIG_PM - .reset_resume = asus_reset_resume, -+ .resume = asus_resume, - #endif - .event = asus_event, - .raw_event = asus_raw_event -diff --git a/drivers/hid/hid-glorious.c b/drivers/hid/hid-glorious.c -index 558eb08c19ef9..281b3a7187cec 100644 ---- a/drivers/hid/hid-glorious.c -+++ b/drivers/hid/hid-glorious.c -@@ -21,6 +21,10 @@ MODULE_DESCRIPTION("HID driver for Glorious PC Gaming Race mice"); - * Glorious Model O and O- specify the const flag in the consumer input - * report descriptor, which leads to inputs being ignored. Fix this - * by patching the descriptor. -+ * -+ * Glorious Model I incorrectly specifes the Usage Minimum for its -+ * keyboard HID report, causing keycodes to be misinterpreted. -+ * Fix this by setting Usage Minimum to 0 in that report. - */ - static __u8 *glorious_report_fixup(struct hid_device *hdev, __u8 *rdesc, - unsigned int *rsize) -@@ -32,6 +36,10 @@ static __u8 *glorious_report_fixup(struct hid_device *hdev, __u8 *rdesc, - rdesc[85] = rdesc[113] = rdesc[141] = \ - HID_MAIN_ITEM_VARIABLE | HID_MAIN_ITEM_RELATIVE; - } -+ if (*rsize == 156 && rdesc[41] == 1) { -+ hid_info(hdev, "patching Glorious Model I keyboard report descriptor\n"); -+ rdesc[41] = 0; -+ } - return rdesc; - } - -@@ -44,6 +52,8 @@ static void glorious_update_name(struct hid_device *hdev) - model = "Model O"; break; - case USB_DEVICE_ID_GLORIOUS_MODEL_D: - model = "Model D"; break; -+ case USB_DEVICE_ID_GLORIOUS_MODEL_I: -+ model = "Model I"; break; - } - - snprintf(hdev->name, sizeof(hdev->name), "%s %s", "Glorious", model); -@@ -66,10 +76,12 @@ static int glorious_probe(struct hid_device *hdev, - } - - static const struct hid_device_id glorious_devices[] = { -- { HID_USB_DEVICE(USB_VENDOR_ID_GLORIOUS, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SINOWEALTH, - USB_DEVICE_ID_GLORIOUS_MODEL_O) }, -- { HID_USB_DEVICE(USB_VENDOR_ID_GLORIOUS, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SINOWEALTH, - USB_DEVICE_ID_GLORIOUS_MODEL_D) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LAVIEW, -+ USB_DEVICE_ID_GLORIOUS_MODEL_I) }, - { } - }; - MODULE_DEVICE_TABLE(hid, glorious_devices); -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 130fc5f341422..1be454bafcb91 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -503,10 +503,6 @@ - #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a - #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 - --#define USB_VENDOR_ID_GLORIOUS 0x258a --#define USB_DEVICE_ID_GLORIOUS_MODEL_D 0x0033 --#define USB_DEVICE_ID_GLORIOUS_MODEL_O 0x0036 -- - #define I2C_VENDOR_ID_GOODIX 0x27c6 - #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 - -@@ -729,6 +725,9 @@ - #define USB_VENDOR_ID_LABTEC 0x1020 - #define USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD 0x0006 - -+#define USB_VENDOR_ID_LAVIEW 0x22D4 -+#define USB_DEVICE_ID_GLORIOUS_MODEL_I 0x1503 -+ - #define USB_VENDOR_ID_LCPOWER 0x1241 - #define USB_DEVICE_ID_LCPOWER_LC1000 0xf767 - -@@ -1131,6 +1130,10 @@ - #define USB_VENDOR_ID_SIGMATEL 0x066F - #define USB_DEVICE_ID_SIGMATEL_STMP3780 0x3780 - -+#define USB_VENDOR_ID_SINOWEALTH 0x258a -+#define USB_DEVICE_ID_GLORIOUS_MODEL_D 0x0033 -+#define USB_DEVICE_ID_GLORIOUS_MODEL_O 0x0036 -+ - #define USB_VENDOR_ID_SIS_TOUCH 0x0457 - #define USB_DEVICE_ID_SIS9200_TOUCH 0x9200 - #define USB_DEVICE_ID_SIS817_TOUCH 0x0817 -diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c -index 7c1b33be9d134..149a3c74346b4 100644 ---- a/drivers/hid/hid-lenovo.c -+++ b/drivers/hid/hid-lenovo.c -@@ -692,7 +692,8 @@ static int lenovo_event_cptkbd(struct hid_device *hdev, - * so set middlebutton_state to 3 - * to never apply workaround anymore - */ -- if (cptkbd_data->middlebutton_state == 1 && -+ if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD && -+ cptkbd_data->middlebutton_state == 1 && - usage->type == EV_REL && - (usage->code == REL_X || usage->code == REL_Y)) { - cptkbd_data->middlebutton_state = 3; -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 8db4ae05febc8..5ec1f174127a3 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -2048,6 +2048,11 @@ static const struct hid_device_id mt_devices[] = { - MT_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT, - USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) }, - -+ /* HONOR GLO-GXXX panel */ -+ { .driver_data = MT_CLS_VTL, -+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, -+ 0x347d, 0x7853) }, -+ - /* Ilitek dual touch panel */ - { .driver_data = MT_CLS_NSMU, - MT_USB_DEVICE(USB_VENDOR_ID_ILITEK, -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 056bb32091285..60884066362a1 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -33,6 +33,7 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2), HID_QUIRK_NO_INIT_REPORTS }, - { HID_USB_DEVICE(USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD), HID_QUIRK_BADPAD }, - { HID_USB_DEVICE(USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE), HID_QUIRK_ALWAYS_POLL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ANSI), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM), HID_QUIRK_NOGET }, -diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h -index aebb7ef10e631..e86fa736dc4ee 100644 ---- a/drivers/md/bcache/bcache.h -+++ b/drivers/md/bcache/bcache.h -@@ -265,6 +265,7 @@ struct bcache_device { - #define BCACHE_DEV_WB_RUNNING 3 - #define BCACHE_DEV_RATE_DW_RUNNING 4 - int nr_stripes; -+#define BCH_MIN_STRIPE_SZ ((4 << 20) >> SECTOR_SHIFT) - unsigned int stripe_size; - atomic_t *stripe_sectors_dirty; - unsigned long *full_dirty_stripes; -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 05e3157fc7b4e..6a2f57ae0f3c2 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -974,6 +974,9 @@ err: - * - * The btree node will have either a read or a write lock held, depending on - * level and op->lock. -+ * -+ * Note: Only error code or btree pointer will be returned, it is unncessary -+ * for callers to check NULL pointer. - */ - struct btree *bch_btree_node_get(struct cache_set *c, struct btree_op *op, - struct bkey *k, int level, bool write, -@@ -1085,6 +1088,10 @@ retry: - mutex_unlock(&b->c->bucket_lock); - } - -+/* -+ * Only error code or btree pointer will be returned, it is unncessary for -+ * callers to check NULL pointer. -+ */ - struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op, - int level, bool wait, - struct btree *parent) -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 7660962e7b8b4..70e5bd8961d2f 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -905,6 +905,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, - - if (!d->stripe_size) - d->stripe_size = 1 << 31; -+ else if (d->stripe_size < BCH_MIN_STRIPE_SZ) -+ d->stripe_size = roundup(BCH_MIN_STRIPE_SZ, d->stripe_size); - - n = DIV_ROUND_UP_ULL(sectors, d->stripe_size); - if (!n || n > max_stripes) { -@@ -2017,7 +2019,7 @@ static int run_cache_set(struct cache_set *c) - c->root = bch_btree_node_get(c, NULL, k, - j->btree_level, - true, NULL); -- if (IS_ERR_OR_NULL(c->root)) -+ if (IS_ERR(c->root)) - goto err; - - list_del_init(&c->root->list); -diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c -index 01c7c6ca4789f..18c6e0d2877b5 100644 ---- a/drivers/md/bcache/writeback.c -+++ b/drivers/md/bcache/writeback.c -@@ -913,7 +913,7 @@ static int bch_dirty_init_thread(void *arg) - int cur_idx, prev_idx, skip_nr; - - k = p = NULL; -- cur_idx = prev_idx = 0; -+ prev_idx = 0; - - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); -diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c -index 3d6f0a466a9ed..f9f886289b970 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c -+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c -@@ -328,9 +328,6 @@ static int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq, - * compare it to the stored version, just create the meta - */ - if (io_sq->disable_meta_caching) { -- if (unlikely(!ena_tx_ctx->meta_valid)) -- return -EINVAL; -- - *have_meta = true; - return ena_com_create_meta(io_sq, ena_meta); - } -diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c -index 42a66b74c1e5b..044b8afde69a0 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_netdev.c -+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c -@@ -74,6 +74,8 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring, - struct ena_tx_buffer *tx_info); - static int ena_create_io_tx_queues_in_range(struct ena_adapter *adapter, - int first_index, int count); -+static void ena_free_all_io_tx_resources_in_range(struct ena_adapter *adapter, -+ int first_index, int count); - - /* Increase a stat by cnt while holding syncp seqlock on 32bit machines */ - static void ena_increase_stat(u64 *statp, u64 cnt, -@@ -457,23 +459,22 @@ static void ena_init_all_xdp_queues(struct ena_adapter *adapter) - - static int ena_setup_and_create_all_xdp_queues(struct ena_adapter *adapter) - { -+ u32 xdp_first_ring = adapter->xdp_first_ring; -+ u32 xdp_num_queues = adapter->xdp_num_queues; - int rc = 0; - -- rc = ena_setup_tx_resources_in_range(adapter, adapter->xdp_first_ring, -- adapter->xdp_num_queues); -+ rc = ena_setup_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues); - if (rc) - goto setup_err; - -- rc = ena_create_io_tx_queues_in_range(adapter, -- adapter->xdp_first_ring, -- adapter->xdp_num_queues); -+ rc = ena_create_io_tx_queues_in_range(adapter, xdp_first_ring, xdp_num_queues); - if (rc) - goto create_err; - - return 0; - - create_err: -- ena_free_all_io_tx_resources(adapter); -+ ena_free_all_io_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues); - setup_err: - return rc; - } -@@ -1617,20 +1618,23 @@ static void ena_set_rx_hash(struct ena_ring *rx_ring, - } - } - --static int ena_xdp_handle_buff(struct ena_ring *rx_ring, struct xdp_buff *xdp) -+static int ena_xdp_handle_buff(struct ena_ring *rx_ring, struct xdp_buff *xdp, u16 num_descs) - { - struct ena_rx_buffer *rx_info; - int ret; - -+ /* XDP multi-buffer packets not supported */ -+ if (unlikely(num_descs > 1)) { -+ netdev_err_once(rx_ring->adapter->netdev, -+ "xdp: dropped unsupported multi-buffer packets\n"); -+ ena_increase_stat(&rx_ring->rx_stats.xdp_drop, 1, &rx_ring->syncp); -+ return ENA_XDP_DROP; -+ } -+ - rx_info = &rx_ring->rx_buffer_info[rx_ring->ena_bufs[0].req_id]; - xdp_prepare_buff(xdp, page_address(rx_info->page), - rx_info->page_offset, - rx_ring->ena_bufs[0].len, false); -- /* If for some reason we received a bigger packet than -- * we expect, then we simply drop it -- */ -- if (unlikely(rx_ring->ena_bufs[0].len > ENA_XDP_MAX_MTU)) -- return ENA_XDP_DROP; - - ret = ena_xdp_execute(rx_ring, xdp); - -@@ -1699,7 +1703,7 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi, - ena_rx_ctx.l4_proto, ena_rx_ctx.hash); - - if (ena_xdp_present_ring(rx_ring)) -- xdp_verdict = ena_xdp_handle_buff(rx_ring, &xdp); -+ xdp_verdict = ena_xdp_handle_buff(rx_ring, &xdp, ena_rx_ctx.descs); - - /* allocate skb and fill it */ - if (xdp_verdict == ENA_XDP_PASS) -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -index b5a49166fa972..4d9d7d1edb9b3 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c -@@ -938,11 +938,14 @@ void aq_ring_free(struct aq_ring_s *self) - return; - - kfree(self->buff_ring); -+ self->buff_ring = NULL; - -- if (self->dx_ring) -+ if (self->dx_ring) { - dma_free_coherent(aq_nic_get_dev(self->aq_nic), - self->size * self->dx_size, self->dx_ring, - self->dx_ring_pa); -+ self->dx_ring = NULL; -+ } - } - - unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data) -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -index 16c490692f422..4950fde82d175 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -@@ -1923,8 +1923,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb, - - /* Skip VLAN tag if present */ - if (ether_type == ETH_P_8021Q) { -- struct vlan_ethhdr *vhdr = -- (struct vlan_ethhdr *)skb->data; -+ struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb); - - ether_type = ntohs(vhdr->h_vlan_encapsulated_proto); - } -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index e81cb825dff4c..623cdeb29ed90 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -1796,6 +1796,21 @@ static void bnxt_deliver_skb(struct bnxt *bp, struct bnxt_napi *bnapi, - napi_gro_receive(&bnapi->napi, skb); - } - -+static bool bnxt_rx_ts_valid(struct bnxt *bp, u32 flags, -+ struct rx_cmp_ext *rxcmp1, u32 *cmpl_ts) -+{ -+ u32 ts = le32_to_cpu(rxcmp1->rx_cmp_timestamp); -+ -+ if (BNXT_PTP_RX_TS_VALID(flags)) -+ goto ts_valid; -+ if (!bp->ptp_all_rx_tstamp || !ts || !BNXT_ALL_RX_TS_VALID(flags)) -+ return false; -+ -+ts_valid: -+ *cmpl_ts = ts; -+ return true; -+} -+ - /* returns the following: - * 1 - 1 packet successfully received - * 0 - successful TPA_START, packet not completed yet -@@ -1821,6 +1836,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - struct sk_buff *skb; - struct xdp_buff xdp; - u32 flags, misc; -+ u32 cmpl_ts; - void *data; - int rc = 0; - -@@ -2043,10 +2059,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - } - } - -- if (unlikely((flags & RX_CMP_FLAGS_ITYPES_MASK) == -- RX_CMP_FLAGS_ITYPE_PTP_W_TS) || bp->ptp_all_rx_tstamp) { -+ if (bnxt_rx_ts_valid(bp, flags, rxcmp1, &cmpl_ts)) { - if (bp->flags & BNXT_FLAG_CHIP_P5) { -- u32 cmpl_ts = le32_to_cpu(rxcmp1->rx_cmp_timestamp); - u64 ns, ts; - - if (!bnxt_get_rx_ts_p5(bp, &ts, cmpl_ts)) { -@@ -10708,8 +10722,10 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init, - bnxt_free_skbs(bp); - - /* Save ring stats before shutdown */ -- if (bp->bnapi && irq_re_init) -+ if (bp->bnapi && irq_re_init) { - bnxt_get_ring_stats(bp, &bp->net_stats_prev); -+ bnxt_get_ring_err_stats(bp, &bp->ring_err_stats_prev); -+ } - if (irq_re_init) { - bnxt_free_irq(bp); - bnxt_del_napi(bp); -@@ -10717,10 +10733,8 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init, - bnxt_free_mem(bp, irq_re_init); - } - --int bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) -+void bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) - { -- int rc = 0; -- - if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) { - /* If we get here, it means firmware reset is in progress - * while we are trying to close. We can safely proceed with -@@ -10735,15 +10749,18 @@ int bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) - - #ifdef CONFIG_BNXT_SRIOV - if (bp->sriov_cfg) { -+ int rc; -+ - rc = wait_event_interruptible_timeout(bp->sriov_cfg_wait, - !bp->sriov_cfg, - BNXT_SRIOV_CFG_WAIT_TMO); -- if (rc) -- netdev_warn(bp->dev, "timeout waiting for SRIOV config operation to complete!\n"); -+ if (!rc) -+ netdev_warn(bp->dev, "timeout waiting for SRIOV config operation to complete, proceeding to close!\n"); -+ else if (rc < 0) -+ netdev_warn(bp->dev, "SRIOV config operation interrupted, proceeding to close!\n"); - } - #endif - __bnxt_close_nic(bp, irq_re_init, link_re_init); -- return rc; - } - - static int bnxt_close(struct net_device *dev) -@@ -10958,6 +10975,34 @@ bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats) - clear_bit(BNXT_STATE_READ_STATS, &bp->state); - } - -+static void bnxt_get_one_ring_err_stats(struct bnxt *bp, -+ struct bnxt_total_ring_err_stats *stats, -+ struct bnxt_cp_ring_info *cpr) -+{ -+ struct bnxt_sw_stats *sw_stats = &cpr->sw_stats; -+ u64 *hw_stats = cpr->stats.sw_stats; -+ -+ stats->rx_total_l4_csum_errors += sw_stats->rx.rx_l4_csum_errors; -+ stats->rx_total_resets += sw_stats->rx.rx_resets; -+ stats->rx_total_buf_errors += sw_stats->rx.rx_buf_errors; -+ stats->rx_total_oom_discards += sw_stats->rx.rx_oom_discards; -+ stats->rx_total_netpoll_discards += sw_stats->rx.rx_netpoll_discards; -+ stats->rx_total_ring_discards += -+ BNXT_GET_RING_STATS64(hw_stats, rx_discard_pkts); -+ stats->tx_total_ring_discards += -+ BNXT_GET_RING_STATS64(hw_stats, tx_discard_pkts); -+ stats->total_missed_irqs += sw_stats->cmn.missed_irqs; -+} -+ -+void bnxt_get_ring_err_stats(struct bnxt *bp, -+ struct bnxt_total_ring_err_stats *stats) -+{ -+ int i; -+ -+ for (i = 0; i < bp->cp_nr_rings; i++) -+ bnxt_get_one_ring_err_stats(bp, stats, &bp->bnapi[i]->cp_ring); -+} -+ - static bool bnxt_mc_list_updated(struct bnxt *bp, u32 *rx_mask) - { - struct net_device *dev = bp->dev; -@@ -13882,6 +13927,8 @@ static int bnxt_resume(struct device *device) - if (rc) - goto resume_exit; - -+ bnxt_clear_reservations(bp, true); -+ - if (bnxt_hwrm_func_drv_rgtr(bp, NULL, 0, false)) { - rc = -ENODEV; - goto resume_exit; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h -index 1d2588c92977e..111098b4b6062 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h -@@ -160,7 +160,7 @@ struct rx_cmp { - #define RX_CMP_FLAGS_ERROR (1 << 6) - #define RX_CMP_FLAGS_PLACEMENT (7 << 7) - #define RX_CMP_FLAGS_RSS_VALID (1 << 10) -- #define RX_CMP_FLAGS_UNUSED (1 << 11) -+ #define RX_CMP_FLAGS_PKT_METADATA_PRESENT (1 << 11) - #define RX_CMP_FLAGS_ITYPES_SHIFT 12 - #define RX_CMP_FLAGS_ITYPES_MASK 0xf000 - #define RX_CMP_FLAGS_ITYPE_UNKNOWN (0 << 12) -@@ -187,6 +187,12 @@ struct rx_cmp { - __le32 rx_cmp_rss_hash; - }; - -+#define BNXT_PTP_RX_TS_VALID(flags) \ -+ (((flags) & RX_CMP_FLAGS_ITYPES_MASK) == RX_CMP_FLAGS_ITYPE_PTP_W_TS) -+ -+#define BNXT_ALL_RX_TS_VALID(flags) \ -+ !((flags) & RX_CMP_FLAGS_PKT_METADATA_PRESENT) -+ - #define RX_CMP_HASH_VALID(rxcmp) \ - ((rxcmp)->rx_cmp_len_flags_type & cpu_to_le32(RX_CMP_FLAGS_RSS_VALID)) - -@@ -950,6 +956,17 @@ struct bnxt_sw_stats { - struct bnxt_cmn_sw_stats cmn; - }; - -+struct bnxt_total_ring_err_stats { -+ u64 rx_total_l4_csum_errors; -+ u64 rx_total_resets; -+ u64 rx_total_buf_errors; -+ u64 rx_total_oom_discards; -+ u64 rx_total_netpoll_discards; -+ u64 rx_total_ring_discards; -+ u64 tx_total_ring_discards; -+ u64 total_missed_irqs; -+}; -+ - struct bnxt_stats_mem { - u64 *sw_stats; - u64 *hw_masks; -@@ -2007,6 +2024,8 @@ struct bnxt { - u8 pri2cos_idx[8]; - u8 pri2cos_valid; - -+ struct bnxt_total_ring_err_stats ring_err_stats_prev; -+ - u16 hwrm_max_req_len; - u16 hwrm_max_ext_req_len; - unsigned int hwrm_cmd_timeout; -@@ -2330,7 +2349,9 @@ int bnxt_open_nic(struct bnxt *, bool, bool); - int bnxt_half_open_nic(struct bnxt *bp); - void bnxt_half_close_nic(struct bnxt *bp); - void bnxt_reenable_sriov(struct bnxt *bp); --int bnxt_close_nic(struct bnxt *, bool, bool); -+void bnxt_close_nic(struct bnxt *, bool, bool); -+void bnxt_get_ring_err_stats(struct bnxt *bp, -+ struct bnxt_total_ring_err_stats *stats); - int bnxt_dbg_hwrm_rd_reg(struct bnxt *bp, u32 reg_off, u16 num_words, - u32 *reg_buf); - void bnxt_fw_exception(struct bnxt *bp); -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c -index 8a6f788f62944..2bdebd9c069d8 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c -@@ -478,15 +478,8 @@ static int bnxt_dl_reload_down(struct devlink *dl, bool netns_change, - return -ENODEV; - } - bnxt_ulp_stop(bp); -- if (netif_running(bp->dev)) { -- rc = bnxt_close_nic(bp, true, true); -- if (rc) { -- NL_SET_ERR_MSG_MOD(extack, "Failed to close"); -- dev_close(bp->dev); -- rtnl_unlock(); -- break; -- } -- } -+ if (netif_running(bp->dev)) -+ bnxt_close_nic(bp, true, true); - bnxt_vf_reps_free(bp); - rc = bnxt_hwrm_func_drv_unrgtr(bp); - if (rc) { -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -index 89f046ce1373c..7260b4671ecca 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -@@ -164,9 +164,8 @@ static int bnxt_set_coalesce(struct net_device *dev, - reset_coalesce: - if (test_bit(BNXT_STATE_OPEN, &bp->state)) { - if (update_stats) { -- rc = bnxt_close_nic(bp, true, false); -- if (!rc) -- rc = bnxt_open_nic(bp, true, false); -+ bnxt_close_nic(bp, true, false); -+ rc = bnxt_open_nic(bp, true, false); - } else { - rc = bnxt_hwrm_set_coal(bp); - } -@@ -956,12 +955,7 @@ static int bnxt_set_channels(struct net_device *dev, - * before PF unload - */ - } -- rc = bnxt_close_nic(bp, true, false); -- if (rc) { -- netdev_err(bp->dev, "Set channel failure rc :%x\n", -- rc); -- return rc; -- } -+ bnxt_close_nic(bp, true, false); - } - - if (sh) { -@@ -3634,12 +3628,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest, - bnxt_run_fw_tests(bp, test_mask, &test_results); - } else { - bnxt_ulp_stop(bp); -- rc = bnxt_close_nic(bp, true, false); -- if (rc) { -- etest->flags |= ETH_TEST_FL_FAILED; -- bnxt_ulp_start(bp, rc); -- return; -- } -+ bnxt_close_nic(bp, true, false); - bnxt_run_fw_tests(bp, test_mask, &test_results); - - buf[BNXT_MACLPBK_TEST_IDX] = 1; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c -index 4faaa9a50f4bc..ae734314f8de5 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c -@@ -506,9 +506,8 @@ static int bnxt_hwrm_ptp_cfg(struct bnxt *bp) - - if (netif_running(bp->dev)) { - if (ptp->rx_filter == HWTSTAMP_FILTER_ALL) { -- rc = bnxt_close_nic(bp, false, false); -- if (!rc) -- rc = bnxt_open_nic(bp, false, false); -+ bnxt_close_nic(bp, false, false); -+ rc = bnxt_open_nic(bp, false, false); - } else { - bnxt_ptp_cfg_tstamp_filters(bp); - } -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index b12152e2fca0a..a9e4e6464a04c 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -1125,7 +1125,7 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, - struct be_wrb_params - *wrb_params) - { -- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; -+ struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb); - unsigned int eth_hdr_len; - struct iphdr *ip; - -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c -index c39b866e2582d..16d3c3610720b 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c -@@ -139,7 +139,8 @@ int dpaa2_switch_acl_entry_add(struct dpaa2_switch_filter_block *filter_block, - err = dpsw_acl_add_entry(ethsw->mc_io, 0, ethsw->dpsw_handle, - filter_block->acl_id, acl_entry_cfg); - -- dma_unmap_single(dev, acl_entry_cfg->key_iova, sizeof(cmd_buff), -+ dma_unmap_single(dev, acl_entry_cfg->key_iova, -+ DPAA2_ETHSW_PORT_ACL_CMD_BUF_SIZE, - DMA_TO_DEVICE); - if (err) { - dev_err(dev, "dpsw_acl_add_entry() failed %d\n", err); -@@ -181,8 +182,8 @@ dpaa2_switch_acl_entry_remove(struct dpaa2_switch_filter_block *block, - err = dpsw_acl_remove_entry(ethsw->mc_io, 0, ethsw->dpsw_handle, - block->acl_id, acl_entry_cfg); - -- dma_unmap_single(dev, acl_entry_cfg->key_iova, sizeof(cmd_buff), -- DMA_TO_DEVICE); -+ dma_unmap_single(dev, acl_entry_cfg->key_iova, -+ DPAA2_ETHSW_PORT_ACL_CMD_BUF_SIZE, DMA_TO_DEVICE); - if (err) { - dev_err(dev, "dpsw_acl_remove_entry() failed %d\n", err); - kfree(cmd_buff); -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -index 2b5909fa93cfa..b98ef4ba172f6 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -@@ -1978,9 +1978,6 @@ static int dpaa2_switch_port_attr_set_event(struct net_device *netdev, - return notifier_from_errno(err); - } - --static struct notifier_block dpaa2_switch_port_switchdev_nb; --static struct notifier_block dpaa2_switch_port_switchdev_blocking_nb; -- - static int dpaa2_switch_port_bridge_join(struct net_device *netdev, - struct net_device *upper_dev, - struct netlink_ext_ack *extack) -@@ -2023,9 +2020,7 @@ static int dpaa2_switch_port_bridge_join(struct net_device *netdev, - goto err_egress_flood; - - err = switchdev_bridge_port_offload(netdev, netdev, NULL, -- &dpaa2_switch_port_switchdev_nb, -- &dpaa2_switch_port_switchdev_blocking_nb, -- false, extack); -+ NULL, NULL, false, extack); - if (err) - goto err_switchdev_offload; - -@@ -2059,9 +2054,7 @@ static int dpaa2_switch_port_restore_rxvlan(struct net_device *vdev, int vid, vo - - static void dpaa2_switch_port_pre_bridge_leave(struct net_device *netdev) - { -- switchdev_bridge_port_unoffload(netdev, NULL, -- &dpaa2_switch_port_switchdev_nb, -- &dpaa2_switch_port_switchdev_blocking_nb); -+ switchdev_bridge_port_unoffload(netdev, NULL, NULL, NULL); - } - - static int dpaa2_switch_port_bridge_leave(struct net_device *netdev) -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 33226a22d8a4a..6d1b760022821 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -3541,31 +3541,26 @@ static int fec_set_features(struct net_device *netdev, - return 0; - } - --static u16 fec_enet_get_raw_vlan_tci(struct sk_buff *skb) --{ -- struct vlan_ethhdr *vhdr; -- unsigned short vlan_TCI = 0; -- -- if (skb->protocol == htons(ETH_P_ALL)) { -- vhdr = (struct vlan_ethhdr *)(skb->data); -- vlan_TCI = ntohs(vhdr->h_vlan_TCI); -- } -- -- return vlan_TCI; --} -- - static u16 fec_enet_select_queue(struct net_device *ndev, struct sk_buff *skb, - struct net_device *sb_dev) - { - struct fec_enet_private *fep = netdev_priv(ndev); -- u16 vlan_tag; -+ u16 vlan_tag = 0; - - if (!(fep->quirks & FEC_QUIRK_HAS_AVB)) - return netdev_pick_tx(ndev, skb, NULL); - -- vlan_tag = fec_enet_get_raw_vlan_tci(skb); -- if (!vlan_tag) -+ /* VLAN is present in the payload.*/ -+ if (eth_type_vlan(skb->protocol)) { -+ struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb); -+ -+ vlan_tag = ntohs(vhdr->h_vlan_TCI); -+ /* VLAN is present in the skb but not yet pushed in the payload.*/ -+ } else if (skb_vlan_tag_present(skb)) { -+ vlan_tag = skb->vlan_tci; -+ } else { - return vlan_tag; -+ } - - return fec_enet_vlan_pri_to_queue[vlan_tag >> 13]; - } -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -index 5ad22b815b2f0..78d6752fe0519 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -@@ -1532,7 +1532,7 @@ static int hns3_handle_vtags(struct hns3_enet_ring *tx_ring, - if (unlikely(rc < 0)) - return rc; - -- vhdr = (struct vlan_ethhdr *)skb->data; -+ vhdr = skb_vlan_eth_hdr(skb); - vhdr->h_vlan_TCI |= cpu_to_be16((skb->priority << VLAN_PRIO_SHIFT) - & VLAN_PRIO_MASK); - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -index 6d26ee8eefae9..94cf82668efaa 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -@@ -2986,7 +2986,7 @@ static inline int i40e_tx_prepare_vlan_flags(struct sk_buff *skb, - rc = skb_cow_head(skb, 0); - if (rc < 0) - return rc; -- vhdr = (struct vlan_ethhdr *)skb->data; -+ vhdr = skb_vlan_eth_hdr(skb); - vhdr->h_vlan_TCI = htons(tx_flags >> - I40E_TX_FLAGS_VLAN_SHIFT); - } else { -diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h -index 7389855fa307a..ee0871d929302 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf.h -+++ b/drivers/net/ethernet/intel/iavf/iavf.h -@@ -303,6 +303,7 @@ struct iavf_adapter { - #define IAVF_FLAG_QUEUES_DISABLED BIT(17) - #define IAVF_FLAG_SETUP_NETDEV_FEATURES BIT(18) - #define IAVF_FLAG_REINIT_MSIX_NEEDED BIT(20) -+#define IAVF_FLAG_FDIR_ENABLED BIT(21) - /* duplicates for common code */ - #define IAVF_FLAG_DCB_ENABLED 0 - /* flags for admin queue service task */ -diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -index 31e02624aca48..f4ac2b164b3e9 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -@@ -1063,7 +1063,7 @@ iavf_get_ethtool_fdir_entry(struct iavf_adapter *adapter, - struct iavf_fdir_fltr *rule = NULL; - int ret = 0; - -- if (!FDIR_FLTR_SUPPORT(adapter)) -+ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) - return -EOPNOTSUPP; - - spin_lock_bh(&adapter->fdir_fltr_lock); -@@ -1205,7 +1205,7 @@ iavf_get_fdir_fltr_ids(struct iavf_adapter *adapter, struct ethtool_rxnfc *cmd, - unsigned int cnt = 0; - int val = 0; - -- if (!FDIR_FLTR_SUPPORT(adapter)) -+ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) - return -EOPNOTSUPP; - - cmd->data = IAVF_MAX_FDIR_FILTERS; -@@ -1397,7 +1397,7 @@ static int iavf_add_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx - int count = 50; - int err; - -- if (!FDIR_FLTR_SUPPORT(adapter)) -+ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) - return -EOPNOTSUPP; - - if (fsp->flow_type & FLOW_MAC_EXT) -@@ -1438,12 +1438,16 @@ static int iavf_add_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx - spin_lock_bh(&adapter->fdir_fltr_lock); - iavf_fdir_list_add_fltr(adapter, fltr); - adapter->fdir_active_fltr++; -- fltr->state = IAVF_FDIR_FLTR_ADD_REQUEST; -- adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; -+ if (adapter->link_up) { -+ fltr->state = IAVF_FDIR_FLTR_ADD_REQUEST; -+ adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; -+ } else { -+ fltr->state = IAVF_FDIR_FLTR_INACTIVE; -+ } - spin_unlock_bh(&adapter->fdir_fltr_lock); - -- mod_delayed_work(adapter->wq, &adapter->watchdog_task, 0); -- -+ if (adapter->link_up) -+ mod_delayed_work(adapter->wq, &adapter->watchdog_task, 0); - ret: - if (err && fltr) - kfree(fltr); -@@ -1465,7 +1469,7 @@ static int iavf_del_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx - struct iavf_fdir_fltr *fltr = NULL; - int err = 0; - -- if (!FDIR_FLTR_SUPPORT(adapter)) -+ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) - return -EOPNOTSUPP; - - spin_lock_bh(&adapter->fdir_fltr_lock); -@@ -1474,6 +1478,11 @@ static int iavf_del_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx - if (fltr->state == IAVF_FDIR_FLTR_ACTIVE) { - fltr->state = IAVF_FDIR_FLTR_DEL_REQUEST; - adapter->aq_required |= IAVF_FLAG_AQ_DEL_FDIR_FILTER; -+ } else if (fltr->state == IAVF_FDIR_FLTR_INACTIVE) { -+ list_del(&fltr->list); -+ kfree(fltr); -+ adapter->fdir_active_fltr--; -+ fltr = NULL; - } else { - err = -EBUSY; - } -@@ -1782,7 +1791,7 @@ static int iavf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd, - ret = 0; - break; - case ETHTOOL_GRXCLSRLCNT: -- if (!FDIR_FLTR_SUPPORT(adapter)) -+ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) - break; - spin_lock_bh(&adapter->fdir_fltr_lock); - cmd->rule_cnt = adapter->fdir_active_fltr; -diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.h b/drivers/net/ethernet/intel/iavf/iavf_fdir.h -index 9eb9f73f6adf3..d31bd923ba8cb 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_fdir.h -+++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.h -@@ -6,12 +6,25 @@ - - struct iavf_adapter; - --/* State of Flow Director filter */ -+/* State of Flow Director filter -+ * -+ * *_REQUEST states are used to mark filter to be sent to PF driver to perform -+ * an action (either add or delete filter). *_PENDING states are an indication -+ * that request was sent to PF and the driver is waiting for response. -+ * -+ * Both DELETE and DISABLE states are being used to delete a filter in PF. -+ * The difference is that after a successful response filter in DEL_PENDING -+ * state is being deleted from VF driver as well and filter in DIS_PENDING state -+ * is being changed to INACTIVE state. -+ */ - enum iavf_fdir_fltr_state_t { - IAVF_FDIR_FLTR_ADD_REQUEST, /* User requests to add filter */ - IAVF_FDIR_FLTR_ADD_PENDING, /* Filter pending add by the PF */ - IAVF_FDIR_FLTR_DEL_REQUEST, /* User requests to delete filter */ - IAVF_FDIR_FLTR_DEL_PENDING, /* Filter pending delete by the PF */ -+ IAVF_FDIR_FLTR_DIS_REQUEST, /* Filter scheduled to be disabled */ -+ IAVF_FDIR_FLTR_DIS_PENDING, /* Filter pending disable by the PF */ -+ IAVF_FDIR_FLTR_INACTIVE, /* Filter inactive on link down */ - IAVF_FDIR_FLTR_ACTIVE, /* Filter is active */ - }; - -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 4836bac2bd09d..b9c4b311cd625 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -1368,18 +1368,20 @@ static void iavf_clear_cloud_filters(struct iavf_adapter *adapter) - **/ - static void iavf_clear_fdir_filters(struct iavf_adapter *adapter) - { -- struct iavf_fdir_fltr *fdir, *fdirtmp; -+ struct iavf_fdir_fltr *fdir; - - /* remove all Flow Director filters */ - spin_lock_bh(&adapter->fdir_fltr_lock); -- list_for_each_entry_safe(fdir, fdirtmp, &adapter->fdir_list_head, -- list) { -+ list_for_each_entry(fdir, &adapter->fdir_list_head, list) { - if (fdir->state == IAVF_FDIR_FLTR_ADD_REQUEST) { -- list_del(&fdir->list); -- kfree(fdir); -- adapter->fdir_active_fltr--; -- } else { -- fdir->state = IAVF_FDIR_FLTR_DEL_REQUEST; -+ /* Cancel a request, keep filter as inactive */ -+ fdir->state = IAVF_FDIR_FLTR_INACTIVE; -+ } else if (fdir->state == IAVF_FDIR_FLTR_ADD_PENDING || -+ fdir->state == IAVF_FDIR_FLTR_ACTIVE) { -+ /* Disable filters which are active or have a pending -+ * request to PF to be added -+ */ -+ fdir->state = IAVF_FDIR_FLTR_DIS_REQUEST; - } - } - spin_unlock_bh(&adapter->fdir_fltr_lock); -@@ -4210,6 +4212,33 @@ static int iavf_setup_tc(struct net_device *netdev, enum tc_setup_type type, - } - } - -+/** -+ * iavf_restore_fdir_filters -+ * @adapter: board private structure -+ * -+ * Restore existing FDIR filters when VF netdev comes back up. -+ **/ -+static void iavf_restore_fdir_filters(struct iavf_adapter *adapter) -+{ -+ struct iavf_fdir_fltr *f; -+ -+ spin_lock_bh(&adapter->fdir_fltr_lock); -+ list_for_each_entry(f, &adapter->fdir_list_head, list) { -+ if (f->state == IAVF_FDIR_FLTR_DIS_REQUEST) { -+ /* Cancel a request, keep filter as active */ -+ f->state = IAVF_FDIR_FLTR_ACTIVE; -+ } else if (f->state == IAVF_FDIR_FLTR_DIS_PENDING || -+ f->state == IAVF_FDIR_FLTR_INACTIVE) { -+ /* Add filters which are inactive or have a pending -+ * request to PF to be deleted -+ */ -+ f->state = IAVF_FDIR_FLTR_ADD_REQUEST; -+ adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; -+ } -+ } -+ spin_unlock_bh(&adapter->fdir_fltr_lock); -+} -+ - /** - * iavf_open - Called when a network interface is made active - * @netdev: network interface device structure -@@ -4277,8 +4306,9 @@ static int iavf_open(struct net_device *netdev) - - spin_unlock_bh(&adapter->mac_vlan_list_lock); - -- /* Restore VLAN filters that were removed with IFF_DOWN */ -+ /* Restore filters that were removed with IFF_DOWN */ - iavf_restore_filters(adapter); -+ iavf_restore_fdir_filters(adapter); - - iavf_configure(adapter); - -@@ -4415,6 +4445,49 @@ static int iavf_change_mtu(struct net_device *netdev, int new_mtu) - return ret; - } - -+/** -+ * iavf_disable_fdir - disable Flow Director and clear existing filters -+ * @adapter: board private structure -+ **/ -+static void iavf_disable_fdir(struct iavf_adapter *adapter) -+{ -+ struct iavf_fdir_fltr *fdir, *fdirtmp; -+ bool del_filters = false; -+ -+ adapter->flags &= ~IAVF_FLAG_FDIR_ENABLED; -+ -+ /* remove all Flow Director filters */ -+ spin_lock_bh(&adapter->fdir_fltr_lock); -+ list_for_each_entry_safe(fdir, fdirtmp, &adapter->fdir_list_head, -+ list) { -+ if (fdir->state == IAVF_FDIR_FLTR_ADD_REQUEST || -+ fdir->state == IAVF_FDIR_FLTR_INACTIVE) { -+ /* Delete filters not registered in PF */ -+ list_del(&fdir->list); -+ kfree(fdir); -+ adapter->fdir_active_fltr--; -+ } else if (fdir->state == IAVF_FDIR_FLTR_ADD_PENDING || -+ fdir->state == IAVF_FDIR_FLTR_DIS_REQUEST || -+ fdir->state == IAVF_FDIR_FLTR_ACTIVE) { -+ /* Filters registered in PF, schedule their deletion */ -+ fdir->state = IAVF_FDIR_FLTR_DEL_REQUEST; -+ del_filters = true; -+ } else if (fdir->state == IAVF_FDIR_FLTR_DIS_PENDING) { -+ /* Request to delete filter already sent to PF, change -+ * state to DEL_PENDING to delete filter after PF's -+ * response, not set as INACTIVE -+ */ -+ fdir->state = IAVF_FDIR_FLTR_DEL_PENDING; -+ } -+ } -+ spin_unlock_bh(&adapter->fdir_fltr_lock); -+ -+ if (del_filters) { -+ adapter->aq_required |= IAVF_FLAG_AQ_DEL_FDIR_FILTER; -+ mod_delayed_work(adapter->wq, &adapter->watchdog_task, 0); -+ } -+} -+ - #define NETIF_VLAN_OFFLOAD_FEATURES (NETIF_F_HW_VLAN_CTAG_RX | \ - NETIF_F_HW_VLAN_CTAG_TX | \ - NETIF_F_HW_VLAN_STAG_RX | \ -@@ -4437,6 +4510,13 @@ static int iavf_set_features(struct net_device *netdev, - iavf_set_vlan_offload_features(adapter, netdev->features, - features); - -+ if ((netdev->features & NETIF_F_NTUPLE) ^ (features & NETIF_F_NTUPLE)) { -+ if (features & NETIF_F_NTUPLE) -+ adapter->flags |= IAVF_FLAG_FDIR_ENABLED; -+ else -+ iavf_disable_fdir(adapter); -+ } -+ - return 0; - } - -@@ -4732,6 +4812,9 @@ static netdev_features_t iavf_fix_features(struct net_device *netdev, - { - struct iavf_adapter *adapter = netdev_priv(netdev); - -+ if (!FDIR_FLTR_SUPPORT(adapter)) -+ features &= ~NETIF_F_NTUPLE; -+ - return iavf_fix_netdev_vlan_features(adapter, features); - } - -@@ -4849,6 +4932,12 @@ int iavf_process_config(struct iavf_adapter *adapter) - if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN) - netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; - -+ if (FDIR_FLTR_SUPPORT(adapter)) { -+ netdev->hw_features |= NETIF_F_NTUPLE; -+ netdev->features |= NETIF_F_NTUPLE; -+ adapter->flags |= IAVF_FLAG_FDIR_ENABLED; -+ } -+ - netdev->priv_flags |= IFF_UNICAST_FLT; - - /* Do not turn on offloads when they are requested to be turned off. -diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -index 5a66b05c03222..951ef350323a2 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -@@ -1752,8 +1752,8 @@ void iavf_add_fdir_filter(struct iavf_adapter *adapter) - **/ - void iavf_del_fdir_filter(struct iavf_adapter *adapter) - { -+ struct virtchnl_fdir_del f = {}; - struct iavf_fdir_fltr *fdir; -- struct virtchnl_fdir_del f; - bool process_fltr = false; - int len; - -@@ -1770,11 +1770,16 @@ void iavf_del_fdir_filter(struct iavf_adapter *adapter) - list_for_each_entry(fdir, &adapter->fdir_list_head, list) { - if (fdir->state == IAVF_FDIR_FLTR_DEL_REQUEST) { - process_fltr = true; -- memset(&f, 0, len); - f.vsi_id = fdir->vc_add_msg.vsi_id; - f.flow_id = fdir->flow_id; - fdir->state = IAVF_FDIR_FLTR_DEL_PENDING; - break; -+ } else if (fdir->state == IAVF_FDIR_FLTR_DIS_REQUEST) { -+ process_fltr = true; -+ f.vsi_id = fdir->vc_add_msg.vsi_id; -+ f.flow_id = fdir->flow_id; -+ fdir->state = IAVF_FDIR_FLTR_DIS_PENDING; -+ break; - } - } - spin_unlock_bh(&adapter->fdir_fltr_lock); -@@ -1918,6 +1923,48 @@ static void iavf_netdev_features_vlan_strip_set(struct net_device *netdev, - netdev->features &= ~NETIF_F_HW_VLAN_CTAG_RX; - } - -+/** -+ * iavf_activate_fdir_filters - Reactivate all FDIR filters after a reset -+ * @adapter: private adapter structure -+ * -+ * Called after a reset to re-add all FDIR filters and delete some of them -+ * if they were pending to be deleted. -+ */ -+static void iavf_activate_fdir_filters(struct iavf_adapter *adapter) -+{ -+ struct iavf_fdir_fltr *f, *ftmp; -+ bool add_filters = false; -+ -+ spin_lock_bh(&adapter->fdir_fltr_lock); -+ list_for_each_entry_safe(f, ftmp, &adapter->fdir_list_head, list) { -+ if (f->state == IAVF_FDIR_FLTR_ADD_REQUEST || -+ f->state == IAVF_FDIR_FLTR_ADD_PENDING || -+ f->state == IAVF_FDIR_FLTR_ACTIVE) { -+ /* All filters and requests have been removed in PF, -+ * restore them -+ */ -+ f->state = IAVF_FDIR_FLTR_ADD_REQUEST; -+ add_filters = true; -+ } else if (f->state == IAVF_FDIR_FLTR_DIS_REQUEST || -+ f->state == IAVF_FDIR_FLTR_DIS_PENDING) { -+ /* Link down state, leave filters as inactive */ -+ f->state = IAVF_FDIR_FLTR_INACTIVE; -+ } else if (f->state == IAVF_FDIR_FLTR_DEL_REQUEST || -+ f->state == IAVF_FDIR_FLTR_DEL_PENDING) { -+ /* Delete filters that were pending to be deleted, the -+ * list on PF is already cleared after a reset -+ */ -+ list_del(&f->list); -+ kfree(f); -+ adapter->fdir_active_fltr--; -+ } -+ } -+ spin_unlock_bh(&adapter->fdir_fltr_lock); -+ -+ if (add_filters) -+ adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; -+} -+ - /** - * iavf_virtchnl_completion - * @adapter: adapter structure -@@ -2095,7 +2142,8 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - spin_lock_bh(&adapter->fdir_fltr_lock); - list_for_each_entry(fdir, &adapter->fdir_list_head, - list) { -- if (fdir->state == IAVF_FDIR_FLTR_DEL_PENDING) { -+ if (fdir->state == IAVF_FDIR_FLTR_DEL_PENDING || -+ fdir->state == IAVF_FDIR_FLTR_DIS_PENDING) { - fdir->state = IAVF_FDIR_FLTR_ACTIVE; - dev_info(&adapter->pdev->dev, "Failed to del Flow Director filter, error %s\n", - iavf_stat_str(&adapter->hw, -@@ -2232,6 +2280,8 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - - spin_unlock_bh(&adapter->mac_vlan_list_lock); - -+ iavf_activate_fdir_filters(adapter); -+ - iavf_parse_vf_resource_msg(adapter); - - /* negotiated VIRTCHNL_VF_OFFLOAD_VLAN_V2, so wait for the -@@ -2421,7 +2471,9 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - list_for_each_entry_safe(fdir, fdir_tmp, &adapter->fdir_list_head, - list) { - if (fdir->state == IAVF_FDIR_FLTR_DEL_PENDING) { -- if (del_fltr->status == VIRTCHNL_FDIR_SUCCESS) { -+ if (del_fltr->status == VIRTCHNL_FDIR_SUCCESS || -+ del_fltr->status == -+ VIRTCHNL_FDIR_FAILURE_RULE_NONEXIST) { - dev_info(&adapter->pdev->dev, "Flow Director filter with location %u is deleted\n", - fdir->loc); - list_del(&fdir->list); -@@ -2433,6 +2485,17 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - del_fltr->status); - iavf_print_fdir_fltr(adapter, fdir); - } -+ } else if (fdir->state == IAVF_FDIR_FLTR_DIS_PENDING) { -+ if (del_fltr->status == VIRTCHNL_FDIR_SUCCESS || -+ del_fltr->status == -+ VIRTCHNL_FDIR_FAILURE_RULE_NONEXIST) { -+ fdir->state = IAVF_FDIR_FLTR_INACTIVE; -+ } else { -+ fdir->state = IAVF_FDIR_FLTR_ACTIVE; -+ dev_info(&adapter->pdev->dev, "Failed to disable Flow Director filter with status: %d\n", -+ del_fltr->status); -+ iavf_print_fdir_fltr(adapter, fdir); -+ } - } - } - spin_unlock_bh(&adapter->fdir_fltr_lock); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index 6105419ae2d5f..9e0e13638c463 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -8822,7 +8822,7 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, - - if (skb_cow_head(skb, 0)) - goto out_drop; -- vhdr = (struct vlan_ethhdr *)skb->data; -+ vhdr = skb_vlan_eth_hdr(skb); - vhdr->h_vlan_TCI = htons(tx_flags >> - IXGBE_TX_FLAGS_VLAN_SHIFT); - } else { -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -index d609512998992..b9a4efb955333 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c -@@ -642,7 +642,7 @@ static int rvu_nix_register_reporters(struct rvu_devlink *rvu_dl) - - rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq"); - if (!rvu_dl->devlink_wq) -- goto err; -+ return -ENOMEM; - - INIT_WORK(&rvu_reporters->intr_work, rvu_nix_intr_work); - INIT_WORK(&rvu_reporters->gen_work, rvu_nix_gen_work); -@@ -650,9 +650,6 @@ static int rvu_nix_register_reporters(struct rvu_devlink *rvu_dl) - INIT_WORK(&rvu_reporters->ras_work, rvu_nix_ras_work); - - return 0; --err: -- rvu_nix_health_reporters_destroy(rvu_dl); -- return -ENOMEM; - } - - static int rvu_nix_health_reporters_create(struct rvu_devlink *rvu_dl) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -index f65805860c8d4..0bcf3e5592806 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -@@ -671,6 +671,7 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc, - int blkaddr, ucast_idx, index; - struct nix_rx_action action = { 0 }; - u64 relaxed_mask; -+ u8 flow_key_alg; - - if (!hw->cap.nix_rx_multicast && is_cgx_vf(rvu, pcifunc)) - return; -@@ -701,6 +702,8 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc, - action.op = NIX_RX_ACTIONOP_UCAST; - } - -+ flow_key_alg = action.flow_key_alg; -+ - /* RX_ACTION set to MCAST for CGX PF's */ - if (hw->cap.nix_rx_multicast && pfvf->use_mce_list && - is_pf_cgxmapped(rvu, rvu_get_pf(pcifunc))) { -@@ -740,7 +743,7 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc, - req.vf = pcifunc; - req.index = action.index; - req.match_id = action.match_id; -- req.flow_key_alg = action.flow_key_alg; -+ req.flow_key_alg = flow_key_alg; - - rvu_mbox_handler_npc_install_flow(rvu, &req, &rsp); - } -@@ -854,6 +857,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, - u8 mac_addr[ETH_ALEN] = { 0 }; - struct nix_rx_action action = { 0 }; - struct rvu_pfvf *pfvf; -+ u8 flow_key_alg; - u16 vf_func; - - /* Only CGX PF/VF can add allmulticast entry */ -@@ -888,6 +892,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, - *(u64 *)&action = npc_get_mcam_action(rvu, mcam, - blkaddr, ucast_idx); - -+ flow_key_alg = action.flow_key_alg; - if (action.op != NIX_RX_ACTIONOP_RSS) { - *(u64 *)&action = 0; - action.op = NIX_RX_ACTIONOP_UCAST; -@@ -924,7 +929,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, - req.vf = pcifunc | vf_func; - req.index = action.index; - req.match_id = action.match_id; -- req.flow_key_alg = action.flow_key_alg; -+ req.flow_key_alg = flow_key_alg; - - rvu_mbox_handler_npc_install_flow(rvu, &req, &rsp); - } -@@ -990,11 +995,38 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, - mutex_unlock(&mcam->lock); - } - -+static void npc_update_rx_action_with_alg_idx(struct rvu *rvu, struct nix_rx_action action, -+ struct rvu_pfvf *pfvf, int mcam_index, int blkaddr, -+ int alg_idx) -+ -+{ -+ struct npc_mcam *mcam = &rvu->hw->mcam; -+ struct rvu_hwinfo *hw = rvu->hw; -+ int bank, op_rss; -+ -+ if (!is_mcam_entry_enabled(rvu, mcam, blkaddr, mcam_index)) -+ return; -+ -+ op_rss = (!hw->cap.nix_rx_multicast || !pfvf->use_mce_list); -+ -+ bank = npc_get_bank(mcam, mcam_index); -+ mcam_index &= (mcam->banksize - 1); -+ -+ /* If Rx action is MCAST update only RSS algorithm index */ -+ if (!op_rss) { -+ *(u64 *)&action = rvu_read64(rvu, blkaddr, -+ NPC_AF_MCAMEX_BANKX_ACTION(mcam_index, bank)); -+ -+ action.flow_key_alg = alg_idx; -+ } -+ rvu_write64(rvu, blkaddr, -+ NPC_AF_MCAMEX_BANKX_ACTION(mcam_index, bank), *(u64 *)&action); -+} -+ - void rvu_npc_update_flowkey_alg_idx(struct rvu *rvu, u16 pcifunc, int nixlf, - int group, int alg_idx, int mcam_index) - { - struct npc_mcam *mcam = &rvu->hw->mcam; -- struct rvu_hwinfo *hw = rvu->hw; - struct nix_rx_action action; - int blkaddr, index, bank; - struct rvu_pfvf *pfvf; -@@ -1050,15 +1082,16 @@ void rvu_npc_update_flowkey_alg_idx(struct rvu *rvu, u16 pcifunc, int nixlf, - /* If PF's promiscuous entry is enabled, - * Set RSS action for that entry as well - */ -- if ((!hw->cap.nix_rx_multicast || !pfvf->use_mce_list) && -- is_mcam_entry_enabled(rvu, mcam, blkaddr, index)) { -- bank = npc_get_bank(mcam, index); -- index &= (mcam->banksize - 1); -+ npc_update_rx_action_with_alg_idx(rvu, action, pfvf, index, blkaddr, -+ alg_idx); - -- rvu_write64(rvu, blkaddr, -- NPC_AF_MCAMEX_BANKX_ACTION(index, bank), -- *(u64 *)&action); -- } -+ index = npc_get_nixlf_mcam_index(mcam, pcifunc, -+ nixlf, NIXLF_ALLMULTI_ENTRY); -+ /* If PF's allmulti entry is enabled, -+ * Set RSS action for that entry as well -+ */ -+ npc_update_rx_action_with_alg_idx(rvu, action, pfvf, index, blkaddr, -+ alg_idx); - } - - void npc_enadis_default_mce_entry(struct rvu *rvu, u16 pcifunc, -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -index 55807e2043edf..a2d8ac6204054 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c -@@ -1638,6 +1638,21 @@ static void otx2_free_hw_resources(struct otx2_nic *pf) - mutex_unlock(&mbox->lock); - } - -+static bool otx2_promisc_use_mce_list(struct otx2_nic *pfvf) -+{ -+ int vf; -+ -+ /* The AF driver will determine whether to allow the VF netdev or not */ -+ if (is_otx2_vf(pfvf->pcifunc)) -+ return true; -+ -+ /* check if there are any trusted VFs associated with the PF netdev */ -+ for (vf = 0; vf < pci_num_vf(pfvf->pdev); vf++) -+ if (pfvf->vf_configs[vf].trusted) -+ return true; -+ return false; -+} -+ - static void otx2_do_set_rx_mode(struct otx2_nic *pf) - { - struct net_device *netdev = pf->netdev; -@@ -1670,7 +1685,8 @@ static void otx2_do_set_rx_mode(struct otx2_nic *pf) - if (netdev->flags & (IFF_ALLMULTI | IFF_MULTICAST)) - req->mode |= NIX_RX_MODE_ALLMULTI; - -- req->mode |= NIX_RX_MODE_USE_MCE; -+ if (otx2_promisc_use_mce_list(pf)) -+ req->mode |= NIX_RX_MODE_USE_MCE; - - otx2_sync_mbox_msg(&pf->mbox); - mutex_unlock(&pf->mbox.lock); -@@ -2634,11 +2650,14 @@ static int otx2_ndo_set_vf_trust(struct net_device *netdev, int vf, - pf->vf_configs[vf].trusted = enable; - rc = otx2_set_vf_permissions(pf, vf, OTX2_TRUSTED_VF); - -- if (rc) -+ if (rc) { - pf->vf_configs[vf].trusted = !enable; -- else -+ } else { - netdev_info(pf->netdev, "VF %d is %strusted\n", - vf, enable ? "" : "not "); -+ otx2_set_rx_mode(netdev); -+ } -+ - return rc; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index bc76fe6b06230..0ee456480a488 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -847,6 +847,7 @@ enum { - MLX5E_STATE_DESTROYING, - MLX5E_STATE_XDP_TX_ENABLED, - MLX5E_STATE_XDP_ACTIVE, -+ MLX5E_STATE_CHANNELS_ACTIVE, - }; - - struct mlx5e_modify_sq_param { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 42e6f2fcf5f59..9910a0480f589 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -2586,6 +2586,7 @@ void mlx5e_close_channels(struct mlx5e_channels *chs) - { - int i; - -+ ASSERT_RTNL(); - if (chs->ptp) { - mlx5e_ptp_close(chs->ptp); - chs->ptp = NULL; -@@ -2865,17 +2866,29 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv) - if (mlx5e_is_vport_rep(priv)) - mlx5e_rep_activate_channels(priv); - -+ set_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state); -+ - mlx5e_wait_channels_min_rx_wqes(&priv->channels); - - if (priv->rx_res) - mlx5e_rx_res_channels_activate(priv->rx_res, &priv->channels); - } - -+static void mlx5e_cancel_tx_timeout_work(struct mlx5e_priv *priv) -+{ -+ WARN_ON_ONCE(test_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state)); -+ if (current_work() != &priv->tx_timeout_work) -+ cancel_work_sync(&priv->tx_timeout_work); -+} -+ - void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv) - { - if (priv->rx_res) - mlx5e_rx_res_channels_deactivate(priv->rx_res); - -+ clear_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state); -+ mlx5e_cancel_tx_timeout_work(priv); -+ - if (mlx5e_is_vport_rep(priv)) - mlx5e_rep_deactivate_channels(priv); - -@@ -4617,8 +4630,17 @@ static void mlx5e_tx_timeout_work(struct work_struct *work) - struct net_device *netdev = priv->netdev; - int i; - -- rtnl_lock(); -- mutex_lock(&priv->state_lock); -+ /* Take rtnl_lock to ensure no change in netdev->real_num_tx_queues -+ * through this flow. However, channel closing flows have to wait for -+ * this work to finish while holding rtnl lock too. So either get the -+ * lock or find that channels are being closed for other reason and -+ * this work is not relevant anymore. -+ */ -+ while (!rtnl_trylock()) { -+ if (!test_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state)) -+ return; -+ msleep(20); -+ } - - if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) - goto unlock; -@@ -4637,7 +4659,6 @@ static void mlx5e_tx_timeout_work(struct work_struct *work) - } - - unlock: -- mutex_unlock(&priv->state_lock); - rtnl_unlock(); - } - -diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c -index de8d54b23f738..c005a9df59d1c 100644 ---- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c -+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c -@@ -1862,7 +1862,7 @@ netxen_tso_check(struct net_device *netdev, - - if (protocol == cpu_to_be16(ETH_P_8021Q)) { - -- vh = (struct vlan_ethhdr *)skb->data; -+ vh = skb_vlan_eth_hdr(skb); - protocol = vh->h_vlan_encapsulated_proto; - flags = FLAGS_VLAN_TAGGED; - -diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c -index 65e20693c549e..33f4f58ee51c6 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c -@@ -933,6 +933,7 @@ static void qed_ilt_shadow_free(struct qed_hwfn *p_hwfn) - p_dma->virt_addr = NULL; - } - kfree(p_mngr->ilt_shadow); -+ p_mngr->ilt_shadow = NULL; - } - - static int qed_ilt_blk_alloc(struct qed_hwfn *p_hwfn, -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c -index 92930a055cbcc..41894d154013b 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c -@@ -318,7 +318,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, - - if (adapter->flags & QLCNIC_VLAN_FILTERING) { - if (protocol == ETH_P_8021Q) { -- vh = (struct vlan_ethhdr *)skb->data; -+ vh = skb_vlan_eth_hdr(skb); - vlan_id = ntohs(vh->h_vlan_TCI); - } else if (skb_vlan_tag_present(skb)) { - vlan_id = skb_vlan_tag_get(skb); -@@ -468,7 +468,7 @@ static int qlcnic_tx_pkt(struct qlcnic_adapter *adapter, - u32 producer = tx_ring->producer; - - if (protocol == ETH_P_8021Q) { -- vh = (struct vlan_ethhdr *)skb->data; -+ vh = skb_vlan_eth_hdr(skb); - flags = QLCNIC_FLAGS_VLAN_TAGGED; - vlan_tci = ntohs(vh->h_vlan_TCI); - protocol = ntohs(vh->h_vlan_encapsulated_proto); -diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c -index f62c39544e086..a739c06ede4e7 100644 ---- a/drivers/net/ethernet/qualcomm/qca_debug.c -+++ b/drivers/net/ethernet/qualcomm/qca_debug.c -@@ -30,6 +30,8 @@ - - #define QCASPI_MAX_REGS 0x20 - -+#define QCASPI_RX_MAX_FRAMES 4 -+ - static const u16 qcaspi_spi_regs[] = { - SPI_REG_BFR_SIZE, - SPI_REG_WRBUF_SPC_AVA, -@@ -252,9 +254,9 @@ qcaspi_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring, - { - struct qcaspi *qca = netdev_priv(dev); - -- ring->rx_max_pending = 4; -+ ring->rx_max_pending = QCASPI_RX_MAX_FRAMES; - ring->tx_max_pending = TX_RING_MAX_LEN; -- ring->rx_pending = 4; -+ ring->rx_pending = QCASPI_RX_MAX_FRAMES; - ring->tx_pending = qca->txr.count; - } - -@@ -263,22 +265,21 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring, - struct kernel_ethtool_ringparam *kernel_ring, - struct netlink_ext_ack *extack) - { -- const struct net_device_ops *ops = dev->netdev_ops; - struct qcaspi *qca = netdev_priv(dev); - -- if ((ring->rx_pending) || -+ if (ring->rx_pending != QCASPI_RX_MAX_FRAMES || - (ring->rx_mini_pending) || - (ring->rx_jumbo_pending)) - return -EINVAL; - -- if (netif_running(dev)) -- ops->ndo_stop(dev); -+ if (qca->spi_thread) -+ kthread_park(qca->spi_thread); - - qca->txr.count = max_t(u32, ring->tx_pending, TX_RING_MIN_LEN); - qca->txr.count = min_t(u16, qca->txr.count, TX_RING_MAX_LEN); - -- if (netif_running(dev)) -- ops->ndo_open(dev); -+ if (qca->spi_thread) -+ kthread_unpark(qca->spi_thread); - - return 0; - } -diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c -index 4a1b94e5a8ea9..82f5173a2cfd5 100644 ---- a/drivers/net/ethernet/qualcomm/qca_spi.c -+++ b/drivers/net/ethernet/qualcomm/qca_spi.c -@@ -581,6 +581,18 @@ qcaspi_spi_thread(void *data) - netdev_info(qca->net_dev, "SPI thread created\n"); - while (!kthread_should_stop()) { - set_current_state(TASK_INTERRUPTIBLE); -+ if (kthread_should_park()) { -+ netif_tx_disable(qca->net_dev); -+ netif_carrier_off(qca->net_dev); -+ qcaspi_flush_tx_ring(qca); -+ kthread_parkme(); -+ if (qca->sync == QCASPI_SYNC_READY) { -+ netif_carrier_on(qca->net_dev); -+ netif_wake_queue(qca->net_dev); -+ } -+ continue; -+ } -+ - if ((qca->intr_req == qca->intr_svc) && - !qca->txr.skb[qca->txr.head]) - schedule(); -@@ -609,11 +621,17 @@ qcaspi_spi_thread(void *data) - if (intr_cause & SPI_INT_CPU_ON) { - qcaspi_qca7k_sync(qca, QCASPI_EVENT_CPUON); - -+ /* Frame decoding in progress */ -+ if (qca->frm_handle.state != qca->frm_handle.init) -+ qca->net_dev->stats.rx_dropped++; -+ -+ qcafrm_fsm_init_spi(&qca->frm_handle); -+ qca->stats.device_reset++; -+ - /* not synced. */ - if (qca->sync != QCASPI_SYNC_READY) - continue; - -- qca->stats.device_reset++; - netif_wake_queue(qca->net_dev); - netif_carrier_on(qca->net_dev); - } -diff --git a/drivers/net/ethernet/sfc/tx_tso.c b/drivers/net/ethernet/sfc/tx_tso.c -index 898e5c61d9086..d381d8164f07c 100644 ---- a/drivers/net/ethernet/sfc/tx_tso.c -+++ b/drivers/net/ethernet/sfc/tx_tso.c -@@ -147,7 +147,7 @@ static __be16 efx_tso_check_protocol(struct sk_buff *skb) - EFX_WARN_ON_ONCE_PARANOID(((struct ethhdr *)skb->data)->h_proto != - protocol); - if (protocol == htons(ETH_P_8021Q)) { -- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; -+ struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb); - - protocol = veh->h_vlan_encapsulated_proto; - } -diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig -index 31ff351740342..58091ee2bfe60 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/Kconfig -+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig -@@ -256,7 +256,7 @@ config DWMAC_INTEL - config DWMAC_LOONGSON - tristate "Loongson PCI DWMAC support" - default MACH_LOONGSON64 -- depends on STMMAC_ETH && PCI -+ depends on (MACH_LOONGSON64 || COMPILE_TEST) && STMMAC_ETH && PCI - depends on COMMON_CLK - help - This selects the LOONGSON PCI bus support for the stmmac driver, -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -index a25c187d31853..49c7aa86faaa8 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -@@ -68,17 +68,15 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id - if (!plat) - return -ENOMEM; - -+ plat->mdio_bus_data = devm_kzalloc(&pdev->dev, -+ sizeof(*plat->mdio_bus_data), -+ GFP_KERNEL); -+ if (!plat->mdio_bus_data) -+ return -ENOMEM; -+ - plat->mdio_node = of_get_child_by_name(np, "mdio"); - if (plat->mdio_node) { - dev_info(&pdev->dev, "Found MDIO subnode\n"); -- -- plat->mdio_bus_data = devm_kzalloc(&pdev->dev, -- sizeof(*plat->mdio_bus_data), -- GFP_KERNEL); -- if (!plat->mdio_bus_data) { -- ret = -ENOMEM; -- goto err_put_node; -- } - plat->mdio_bus_data->needs_reset = true; - } - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 69aac8ed84f67..deb6e95a1bca6 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -4566,13 +4566,10 @@ dma_map_err: - - static void stmmac_rx_vlan(struct net_device *dev, struct sk_buff *skb) - { -- struct vlan_ethhdr *veth; -- __be16 vlan_proto; -+ struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb); -+ __be16 vlan_proto = veth->h_vlan_proto; - u16 vlanid; - -- veth = (struct vlan_ethhdr *)skb->data; -- vlan_proto = veth->h_vlan_proto; -- - if ((vlan_proto == htons(ETH_P_8021Q) && - dev->features & NETIF_F_HW_VLAN_CTAG_RX) || - (vlan_proto == htons(ETH_P_8021AD) && -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -index 5f177ea807258..379fc887ddf46 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -@@ -483,7 +483,11 @@ int stmmac_mdio_register(struct net_device *ndev) - new_bus->parent = priv->device; - - err = of_mdiobus_register(new_bus, mdio_node); -- if (err != 0) { -+ if (err == -ENODEV) { -+ err = 0; -+ dev_info(dev, "MDIO bus is disabled\n"); -+ goto bus_register_fail; -+ } else if (err) { - dev_err_probe(dev, err, "Cannot register the MDIO bus\n"); - goto bus_register_fail; - } -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 556b2d1cd2aca..293eaf6b3ec9e 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -285,8 +285,10 @@ static int __team_options_register(struct team *team, - return 0; - - inst_rollback: -- for (i--; i >= 0; i--) -+ for (i--; i >= 0; i--) { - __team_option_inst_del_option(team, dst_opts[i]); -+ list_del(&dst_opts[i]->list); -+ } - - i = option_count; - alloc_rollback: -diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c -index a017e9de2119d..7b8afa589a53c 100644 ---- a/drivers/net/usb/aqc111.c -+++ b/drivers/net/usb/aqc111.c -@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - u16 pkt_count = 0; - u64 desc_hdr = 0; - u16 vlan_tag = 0; -- u32 skb_len = 0; -+ u32 skb_len; - - if (!skb) - goto err; - -- if (skb->len == 0) -+ skb_len = skb->len; -+ if (skb_len < sizeof(desc_hdr)) - goto err; - -- skb_len = skb->len; - /* RX Descriptor Header */ -- skb_trim(skb, skb->len - sizeof(desc_hdr)); -+ skb_trim(skb, skb_len - sizeof(desc_hdr)); - desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb)); - - /* Check these packets */ -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 4fb981b8732ef..2d82481d34e6b 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1288,6 +1288,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x19d2, 0x0168, 4)}, - {QMI_FIXED_INTF(0x19d2, 0x0176, 3)}, - {QMI_FIXED_INTF(0x19d2, 0x0178, 3)}, -+ {QMI_FIXED_INTF(0x19d2, 0x0189, 4)}, /* ZTE MF290 */ - {QMI_FIXED_INTF(0x19d2, 0x0191, 4)}, /* ZTE EuFi890 */ - {QMI_FIXED_INTF(0x19d2, 0x0199, 1)}, /* ZTE MF820S */ - {QMI_FIXED_INTF(0x19d2, 0x0200, 1)}, -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 4d833781294a4..958a02b19554d 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -8288,43 +8288,6 @@ static bool rtl_check_vendor_ok(struct usb_interface *intf) - return true; - } - --static bool rtl_vendor_mode(struct usb_interface *intf) --{ -- struct usb_host_interface *alt = intf->cur_altsetting; -- struct usb_device *udev; -- struct usb_host_config *c; -- int i, num_configs; -- -- if (alt->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) -- return rtl_check_vendor_ok(intf); -- -- /* The vendor mode is not always config #1, so to find it out. */ -- udev = interface_to_usbdev(intf); -- c = udev->config; -- num_configs = udev->descriptor.bNumConfigurations; -- if (num_configs < 2) -- return false; -- -- for (i = 0; i < num_configs; (i++, c++)) { -- struct usb_interface_descriptor *desc = NULL; -- -- if (c->desc.bNumInterfaces > 0) -- desc = &c->intf_cache[0]->altsetting->desc; -- else -- continue; -- -- if (desc->bInterfaceClass == USB_CLASS_VENDOR_SPEC) { -- usb_driver_set_configuration(udev, c->desc.bConfigurationValue); -- break; -- } -- } -- -- if (i == num_configs) -- dev_err(&intf->dev, "Unexpected Device\n"); -- -- return false; --} -- - static int rtl8152_pre_reset(struct usb_interface *intf) - { - struct r8152 *tp = usb_get_intfdata(intf); -@@ -9556,9 +9519,8 @@ static int rtl_fw_init(struct r8152 *tp) - return 0; - } - --u8 rtl8152_get_version(struct usb_interface *intf) -+static u8 __rtl_get_hw_ver(struct usb_device *udev) - { -- struct usb_device *udev = interface_to_usbdev(intf); - u32 ocp_data = 0; - __le32 *tmp; - u8 version; -@@ -9628,10 +9590,19 @@ u8 rtl8152_get_version(struct usb_interface *intf) - break; - default: - version = RTL_VER_UNKNOWN; -- dev_info(&intf->dev, "Unknown version 0x%04x\n", ocp_data); -+ dev_info(&udev->dev, "Unknown version 0x%04x\n", ocp_data); - break; - } - -+ return version; -+} -+ -+u8 rtl8152_get_version(struct usb_interface *intf) -+{ -+ u8 version; -+ -+ version = __rtl_get_hw_ver(interface_to_usbdev(intf)); -+ - dev_dbg(&intf->dev, "Detected version 0x%04x\n", version); - - return version; -@@ -9675,7 +9646,10 @@ static int rtl8152_probe(struct usb_interface *intf, - if (version == RTL_VER_UNKNOWN) - return -ENODEV; - -- if (!rtl_vendor_mode(intf)) -+ if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC) -+ return -ENODEV; -+ -+ if (!rtl_check_vendor_ok(intf)) - return -ENODEV; - - usb_reset_device(udev); -@@ -9875,43 +9849,37 @@ static void rtl8152_disconnect(struct usb_interface *intf) - } - } - --#define REALTEK_USB_DEVICE(vend, prod) { \ -- USB_DEVICE_INTERFACE_CLASS(vend, prod, USB_CLASS_VENDOR_SPEC), \ --}, \ --{ \ -- USB_DEVICE_AND_INTERFACE_INFO(vend, prod, USB_CLASS_COMM, \ -- USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), \ --} -- - /* table of devices that work with this driver */ - static const struct usb_device_id rtl8152_table[] = { - /* Realtek */ -- REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8050), -- REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8053), -- REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8152), -- REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8153), -- REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8155), -- REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8156), -+ { USB_DEVICE(VENDOR_ID_REALTEK, 0x8050) }, -+ { USB_DEVICE(VENDOR_ID_REALTEK, 0x8053) }, -+ { USB_DEVICE(VENDOR_ID_REALTEK, 0x8152) }, -+ { USB_DEVICE(VENDOR_ID_REALTEK, 0x8153) }, -+ { USB_DEVICE(VENDOR_ID_REALTEK, 0x8155) }, -+ { USB_DEVICE(VENDOR_ID_REALTEK, 0x8156) }, - - /* Microsoft */ -- REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07ab), -- REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07c6), -- REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927), -- REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0c5e), -- REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x304f), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3054), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3062), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3069), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3082), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7205), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x720c), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7214), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x721e), -- REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0xa387), -- REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041), -- REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff), -- REALTEK_USB_DEVICE(VENDOR_ID_TPLINK, 0x0601), -+ { USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07ab) }, -+ { USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07c6) }, -+ { USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927) }, -+ { USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0c5e) }, -+ { USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x304f) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x3054) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x3062) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x3069) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x3082) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x7205) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x720c) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x7214) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0x721e) }, -+ { USB_DEVICE(VENDOR_ID_LENOVO, 0xa387) }, -+ { USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041) }, -+ { USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff) }, -+ { USB_DEVICE(VENDOR_ID_TPLINK, 0x0601) }, -+ { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, -+ { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, - {} - }; - -@@ -9931,7 +9899,68 @@ static struct usb_driver rtl8152_driver = { - .disable_hub_initiated_lpm = 1, - }; - --module_usb_driver(rtl8152_driver); -+static int rtl8152_cfgselector_probe(struct usb_device *udev) -+{ -+ struct usb_host_config *c; -+ int i, num_configs; -+ -+ /* Switch the device to vendor mode, if and only if the vendor mode -+ * driver supports it. -+ */ -+ if (__rtl_get_hw_ver(udev) == RTL_VER_UNKNOWN) -+ return 0; -+ -+ /* The vendor mode is not always config #1, so to find it out. */ -+ c = udev->config; -+ num_configs = udev->descriptor.bNumConfigurations; -+ for (i = 0; i < num_configs; (i++, c++)) { -+ struct usb_interface_descriptor *desc = NULL; -+ -+ if (!c->desc.bNumInterfaces) -+ continue; -+ desc = &c->intf_cache[0]->altsetting->desc; -+ if (desc->bInterfaceClass == USB_CLASS_VENDOR_SPEC) -+ break; -+ } -+ -+ if (i == num_configs) -+ return -ENODEV; -+ -+ if (usb_set_configuration(udev, c->desc.bConfigurationValue)) { -+ dev_err(&udev->dev, "Failed to set configuration %d\n", -+ c->desc.bConfigurationValue); -+ return -ENODEV; -+ } -+ -+ return 0; -+} -+ -+static struct usb_device_driver rtl8152_cfgselector_driver = { -+ .name = MODULENAME "-cfgselector", -+ .probe = rtl8152_cfgselector_probe, -+ .id_table = rtl8152_table, -+ .generic_subclass = 1, -+ .supports_autosuspend = 1, -+}; -+ -+static int __init rtl8152_driver_init(void) -+{ -+ int ret; -+ -+ ret = usb_register_device_driver(&rtl8152_cfgselector_driver, THIS_MODULE); -+ if (ret) -+ return ret; -+ return usb_register(&rtl8152_driver); -+} -+ -+static void __exit rtl8152_driver_exit(void) -+{ -+ usb_deregister(&rtl8152_driver); -+ usb_deregister_device_driver(&rtl8152_cfgselector_driver); -+} -+ -+module_init(rtl8152_driver_init); -+module_exit(rtl8152_driver_exit); - - MODULE_AUTHOR(DRIVER_AUTHOR); - MODULE_DESCRIPTION(DRIVER_DESC); -diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c -index 9dfd3d0293054..69aef668f1056 100644 ---- a/drivers/nvme/host/auth.c -+++ b/drivers/nvme/host/auth.c -@@ -834,6 +834,8 @@ static void nvme_queue_auth_work(struct work_struct *work) - } - - fail2: -+ if (chap->status == 0) -+ chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED; - dev_dbg(ctrl->device, "%s: qid %d send failure2, status %x\n", - __func__, chap->qid, chap->status); - tl = nvme_auth_set_dhchap_failure2_data(ctrl, chap); -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 5b156c5bc04a5..eb7c87b344b8f 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1845,16 +1845,18 @@ set_pi: - return ret; - } - --static void nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) -+static int nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) - { - struct nvme_ctrl *ctrl = ns->ctrl; -+ int ret; - -- if (nvme_init_ms(ns, id)) -- return; -+ ret = nvme_init_ms(ns, id); -+ if (ret) -+ return ret; - - ns->features &= ~(NVME_NS_METADATA_SUPPORTED | NVME_NS_EXT_LBAS); - if (!ns->ms || !(ctrl->ops->flags & NVME_F_METADATA_SUPPORTED)) -- return; -+ return 0; - - if (ctrl->ops->flags & NVME_F_FABRICS) { - /* -@@ -1863,7 +1865,7 @@ static void nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) - * remap the separate metadata buffer from the block layer. - */ - if (WARN_ON_ONCE(!(id->flbas & NVME_NS_FLBAS_META_EXT))) -- return; -+ return 0; - - ns->features |= NVME_NS_EXT_LBAS; - -@@ -1890,6 +1892,7 @@ static void nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) - else - ns->features |= NVME_NS_METADATA_SUPPORTED; - } -+ return 0; - } - - static void nvme_set_queue_limits(struct nvme_ctrl *ctrl, -@@ -2070,7 +2073,11 @@ static int nvme_update_ns_info_block(struct nvme_ns *ns, - ns->lba_shift = id->lbaf[lbaf].ds; - nvme_set_queue_limits(ns->ctrl, ns->queue); - -- nvme_configure_metadata(ns, id); -+ ret = nvme_configure_metadata(ns, id); -+ if (ret < 0) { -+ blk_mq_unfreeze_queue(ns->disk->queue); -+ goto out; -+ } - nvme_set_chunk_sectors(ns, id); - nvme_update_disk_info(ns->disk, ns, id); - -diff --git a/drivers/pci/controller/pci-loongson.c b/drivers/pci/controller/pci-loongson.c -index fe0f732f6e434..a860f25473df6 100644 ---- a/drivers/pci/controller/pci-loongson.c -+++ b/drivers/pci/controller/pci-loongson.c -@@ -80,13 +80,49 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON, - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON, - DEV_LS7A_LPC, system_bus_quirk); - -+/* -+ * Some Loongson PCIe ports have hardware limitations on their Maximum Read -+ * Request Size. They can't handle anything larger than this. Sane -+ * firmware will set proper MRRS at boot, so we only need no_inc_mrrs for -+ * bridges. However, some MIPS Loongson firmware doesn't set MRRS properly, -+ * so we have to enforce maximum safe MRRS, which is 256 bytes. -+ */ -+#ifdef CONFIG_MIPS -+static void loongson_set_min_mrrs_quirk(struct pci_dev *pdev) -+{ -+ struct pci_bus *bus = pdev->bus; -+ struct pci_dev *bridge; -+ static const struct pci_device_id bridge_devids[] = { -+ { PCI_VDEVICE(LOONGSON, DEV_LS2K_PCIE_PORT0) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT0) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT1) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT2) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT3) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT4) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT5) }, -+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT6) }, -+ { 0, }, -+ }; -+ -+ /* look for the matching bridge */ -+ while (!pci_is_root_bus(bus)) { -+ bridge = bus->self; -+ bus = bus->parent; -+ -+ if (pci_match_id(bridge_devids, bridge)) { -+ if (pcie_get_readrq(pdev) > 256) { -+ pci_info(pdev, "limiting MRRS to 256\n"); -+ pcie_set_readrq(pdev, 256); -+ } -+ break; -+ } -+ } -+} -+DECLARE_PCI_FIXUP_ENABLE(PCI_ANY_ID, PCI_ANY_ID, loongson_set_min_mrrs_quirk); -+#endif -+ - static void loongson_mrrs_quirk(struct pci_dev *pdev) - { -- /* -- * Some Loongson PCIe ports have h/w limitations of maximum read -- * request size. They can't handle anything larger than this. So -- * force this limit on any devices attached under these ports. -- */ - struct pci_host_bridge *bridge = pci_find_host_bridge(pdev->bus); - - bridge->no_inc_mrrs = 1; -diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c -index ea0195337bab9..6efa3d8db9a56 100644 ---- a/drivers/pci/hotplug/acpiphp_glue.c -+++ b/drivers/pci/hotplug/acpiphp_glue.c -@@ -504,15 +504,12 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge) - if (pass && dev->subordinate) { - check_hotplug_bridge(slot, dev); - pcibios_resource_survey_bus(dev->subordinate); -- if (pci_is_root_bus(bus)) -- __pci_bus_size_bridges(dev->subordinate, &add_list); -+ __pci_bus_size_bridges(dev->subordinate, -+ &add_list); - } - } - } -- if (pci_is_root_bus(bus)) -- __pci_bus_assign_resources(bus, &add_list, NULL); -- else -- pci_assign_unassigned_bridge_resources(bus->self); -+ __pci_bus_assign_resources(bus, &add_list, NULL); - } - - acpiphp_sanitize_bus(bus); -diff --git a/drivers/platform/x86/intel/telemetry/core.c b/drivers/platform/x86/intel/telemetry/core.c -index fdf55b5d69480..e4be40f73eebf 100644 ---- a/drivers/platform/x86/intel/telemetry/core.c -+++ b/drivers/platform/x86/intel/telemetry/core.c -@@ -102,7 +102,7 @@ static const struct telemetry_core_ops telm_defpltops = { - /** - * telemetry_update_events() - Update telemetry Configuration - * @pss_evtconfig: PSS related config. No change if num_evts = 0. -- * @pss_evtconfig: IOSS related config. No change if num_evts = 0. -+ * @ioss_evtconfig: IOSS related config. No change if num_evts = 0. - * - * This API updates the IOSS & PSS Telemetry configuration. Old config - * is overwritten. Call telemetry_reset_events when logging is over -@@ -176,7 +176,7 @@ EXPORT_SYMBOL_GPL(telemetry_reset_events); - /** - * telemetry_get_eventconfig() - Returns the pss and ioss events enabled - * @pss_evtconfig: Pointer to PSS related configuration. -- * @pss_evtconfig: Pointer to IOSS related configuration. -+ * @ioss_evtconfig: Pointer to IOSS related configuration. - * @pss_len: Number of u32 elements allocated for pss_evtconfig array - * @ioss_len: Number of u32 elements allocated for ioss_evtconfig array - * -diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c -index b10ea69a638e1..2624441d2fa92 100644 ---- a/drivers/soundwire/stream.c -+++ b/drivers/soundwire/stream.c -@@ -744,14 +744,15 @@ error_1: - * sdw_ml_sync_bank_switch: Multilink register bank switch - * - * @bus: SDW bus instance -+ * @multi_link: whether this is a multi-link stream with hardware-based sync - * - * Caller function should free the buffers on error - */ --static int sdw_ml_sync_bank_switch(struct sdw_bus *bus) -+static int sdw_ml_sync_bank_switch(struct sdw_bus *bus, bool multi_link) - { - unsigned long time_left; - -- if (!bus->multi_link) -+ if (!multi_link) - return 0; - - /* Wait for completion of transfer */ -@@ -848,7 +849,7 @@ static int do_bank_switch(struct sdw_stream_runtime *stream) - bus->bank_switch_timeout = DEFAULT_BANK_SWITCH_TIMEOUT; - - /* Check if bank switch was successful */ -- ret = sdw_ml_sync_bank_switch(bus); -+ ret = sdw_ml_sync_bank_switch(bus, multi_link); - if (ret < 0) { - dev_err(bus->dev, - "multi link bank switch failed: %d\n", ret); -diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c -index 671ee8843c889..5703a9ddb6d0d 100644 ---- a/drivers/staging/gdm724x/gdm_lte.c -+++ b/drivers/staging/gdm724x/gdm_lte.c -@@ -349,7 +349,7 @@ static s32 gdm_lte_tx_nic_type(struct net_device *dev, struct sk_buff *skb) - /* Get ethernet protocol */ - eth = (struct ethhdr *)skb->data; - if (ntohs(eth->h_proto) == ETH_P_8021Q) { -- vlan_eth = (struct vlan_ethhdr *)skb->data; -+ vlan_eth = skb_vlan_eth_hdr(skb); - mac_proto = ntohs(vlan_eth->h_vlan_encapsulated_proto); - network_data = skb->data + VLAN_ETH_HLEN; - nic_type |= NIC_TYPE_F_VLAN; -@@ -435,7 +435,7 @@ static netdev_tx_t gdm_lte_tx(struct sk_buff *skb, struct net_device *dev) - * driver based on the NIC mac - */ - if (nic_type & NIC_TYPE_F_VLAN) { -- struct vlan_ethhdr *vlan_eth = (struct vlan_ethhdr *)skb->data; -+ struct vlan_ethhdr *vlan_eth = skb_vlan_eth_hdr(skb); - - nic->vlan_id = ntohs(vlan_eth->h_vlan_TCI) & VLAN_VID_MASK; - data_buf = skb->data + (VLAN_ETH_HLEN - ETH_HLEN); -diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c -index c62939e5ea1f0..37036db63aff3 100644 ---- a/fs/afs/rxrpc.c -+++ b/fs/afs/rxrpc.c -@@ -424,7 +424,7 @@ error_kill_call: - if (call->async) { - if (cancel_work_sync(&call->async_work)) - afs_put_call(call); -- afs_put_call(call); -+ afs_set_call_complete(call, ret, 0); - } - - ac->error = ret; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index afcc96a1f4276..539bc9bdcb93f 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -3390,7 +3390,8 @@ static int try_release_extent_state(struct extent_io_tree *tree, - ret = 0; - } else { - u32 clear_bits = ~(EXTENT_LOCKED | EXTENT_NODATASUM | -- EXTENT_DELALLOC_NEW | EXTENT_CTLBITS); -+ EXTENT_DELALLOC_NEW | EXTENT_CTLBITS | -+ EXTENT_QGROUP_RESERVED); - - /* - * At this point we can safely clear everything except the -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index dc6e3cce747c1..e8e4781c48a50 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2182,6 +2182,15 @@ static noinline int __btrfs_ioctl_snap_create(struct file *file, - * are limited to own subvolumes only - */ - ret = -EPERM; -+ } else if (btrfs_ino(BTRFS_I(src_inode)) != BTRFS_FIRST_FREE_OBJECTID) { -+ /* -+ * Snapshots must be made with the src_inode referring -+ * to the subvolume inode, otherwise the permission -+ * checking above is useless because we may have -+ * permission on a lower directory but not the subvol -+ * itself. -+ */ -+ ret = -EINVAL; - } else { - ret = btrfs_mksnapshot(&file->f_path, mnt_userns, - name, namelen, -diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c -index bd0c7157e3878..0321753c16b9f 100644 ---- a/fs/btrfs/ordered-data.c -+++ b/fs/btrfs/ordered-data.c -@@ -544,7 +544,9 @@ void btrfs_remove_ordered_extent(struct btrfs_inode *btrfs_inode, - release = entry->disk_num_bytes; - else - release = entry->num_bytes; -- btrfs_delalloc_release_metadata(btrfs_inode, release, false); -+ btrfs_delalloc_release_metadata(btrfs_inode, release, -+ test_bit(BTRFS_ORDERED_IOERR, -+ &entry->flags)); - } - - percpu_counter_add_batch(&fs_info->ordered_bytes, -entry->num_bytes, -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 8ebe4dc7b0170..18f5fd2a163b0 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -339,9 +339,10 @@ static void ext4_inode_extension_cleanup(struct inode *inode, ssize_t count) - return; - } - /* -- * If i_disksize got extended due to writeback of delalloc blocks while -- * the DIO was running we could fail to cleanup the orphan list in -- * ext4_handle_inode_extension(). Do it now. -+ * If i_disksize got extended either due to writeback of delalloc -+ * blocks or extending truncate while the DIO was running we could fail -+ * to cleanup the orphan list in ext4_handle_inode_extension(). Do it -+ * now. - */ - if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) { - handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); -@@ -376,10 +377,11 @@ static int ext4_dio_write_end_io(struct kiocb *iocb, ssize_t size, - * blocks. But the code in ext4_iomap_alloc() is careful to use - * zeroed/unwritten extents if this is possible; thus we won't leave - * uninitialized blocks in a file even if we didn't succeed in writing -- * as much as we intended. -+ * as much as we intended. Also we can race with truncate or write -+ * expanding the file so we have to be a bit careful here. - */ -- WARN_ON_ONCE(i_size_read(inode) < READ_ONCE(EXT4_I(inode)->i_disksize)); -- if (pos + size <= READ_ONCE(EXT4_I(inode)->i_disksize)) -+ if (pos + size <= READ_ONCE(EXT4_I(inode)->i_disksize) && -+ pos + size <= i_size_read(inode)) - return size; - return ext4_handle_inode_extension(inode, pos, size); - } -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 6ea6b7105fe35..a6e41746890d4 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -4110,6 +4110,10 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, - start = max(start, rounddown(ac->ac_o_ex.fe_logical, - (ext4_lblk_t)EXT4_BLOCKS_PER_GROUP(ac->ac_sb))); - -+ /* avoid unnecessary preallocation that may trigger assertions */ -+ if (start + size > EXT_MAX_BLOCKS) -+ size = EXT_MAX_BLOCKS - start; -+ - /* don't cover already allocated blocks in selected range */ - if (ar->pleft && start <= ar->lleft) { - size -= ar->lleft + 1 - start; -diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c -index e23e802a80130..6e71904c396f1 100644 ---- a/fs/fuse/dax.c -+++ b/fs/fuse/dax.c -@@ -1224,6 +1224,7 @@ void fuse_dax_conn_free(struct fuse_conn *fc) - if (fc->dax) { - fuse_free_dax_mem_ranges(&fc->dax->free_ranges); - kfree(fc->dax); -+ fc->dax = NULL; - } - } - -diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c -index eaa5bd148810a..88942b1fb4318 100644 ---- a/fs/smb/client/smb2misc.c -+++ b/fs/smb/client/smb2misc.c -@@ -313,6 +313,9 @@ static const bool has_smb2_data_area[NUMBER_OF_SMB2_COMMANDS] = { - char * - smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *shdr) - { -+ const int max_off = 4096; -+ const int max_len = 128 * 1024; -+ - *off = 0; - *len = 0; - -@@ -384,29 +387,20 @@ smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *shdr) - * Invalid length or offset probably means data area is invalid, but - * we have little choice but to ignore the data area in this case. - */ -- if (*off > 4096) { -- cifs_dbg(VFS, "offset %d too large, data area ignored\n", *off); -- *len = 0; -- *off = 0; -- } else if (*off < 0) { -- cifs_dbg(VFS, "negative offset %d to data invalid ignore data area\n", -- *off); -+ if (unlikely(*off < 0 || *off > max_off || -+ *len < 0 || *len > max_len)) { -+ cifs_dbg(VFS, "%s: invalid data area (off=%d len=%d)\n", -+ __func__, *off, *len); - *off = 0; - *len = 0; -- } else if (*len < 0) { -- cifs_dbg(VFS, "negative data length %d invalid, data area ignored\n", -- *len); -- *len = 0; -- } else if (*len > 128 * 1024) { -- cifs_dbg(VFS, "data area larger than 128K: %d\n", *len); -+ } else if (*off == 0) { - *len = 0; - } - - /* return pointer to beginning of data area, ie offset from SMB start */ -- if ((*off != 0) && (*len != 0)) -+ if (*off > 0 && *len > 0) - return (char *)shdr + *off; -- else -- return NULL; -+ return NULL; - } - - /* -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 6ef3c00de5ca1..1b3489a2f0db7 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -3122,7 +3122,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, - struct kvec close_iov[1]; - struct smb2_ioctl_rsp *ioctl_rsp; - struct reparse_data_buffer *reparse_buf; -- u32 plen; -+ u32 off, count, len; - - cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path); - -@@ -3202,16 +3202,22 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, - */ - if (rc == 0) { - /* See MS-FSCC 2.3.23 */ -+ off = le32_to_cpu(ioctl_rsp->OutputOffset); -+ count = le32_to_cpu(ioctl_rsp->OutputCount); -+ if (check_add_overflow(off, count, &len) || -+ len > rsp_iov[1].iov_len) { -+ cifs_tcon_dbg(VFS, "%s: invalid ioctl: off=%d count=%d\n", -+ __func__, off, count); -+ rc = -EIO; -+ goto query_rp_exit; -+ } - -- reparse_buf = (struct reparse_data_buffer *) -- ((char *)ioctl_rsp + -- le32_to_cpu(ioctl_rsp->OutputOffset)); -- plen = le32_to_cpu(ioctl_rsp->OutputCount); -- -- if (plen + le32_to_cpu(ioctl_rsp->OutputOffset) > -- rsp_iov[1].iov_len) { -- cifs_tcon_dbg(FYI, "srv returned invalid ioctl len: %d\n", -- plen); -+ reparse_buf = (void *)((u8 *)ioctl_rsp + off); -+ len = sizeof(*reparse_buf); -+ if (count < len || -+ count < le16_to_cpu(reparse_buf->ReparseDataLength) + len) { -+ cifs_tcon_dbg(VFS, "%s: invalid ioctl: off=%d count=%d\n", -+ __func__, off, count); - rc = -EIO; - goto query_rp_exit; - } -@@ -5065,6 +5071,7 @@ receive_encrypted_standard(struct TCP_Server_Info *server, - struct smb2_hdr *shdr; - unsigned int pdu_length = server->pdu_size; - unsigned int buf_size; -+ unsigned int next_cmd; - struct mid_q_entry *mid_entry; - int next_is_large; - char *next_buffer = NULL; -@@ -5093,14 +5100,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, - next_is_large = server->large_buf; - one_more: - shdr = (struct smb2_hdr *)buf; -- if (shdr->NextCommand) { -+ next_cmd = le32_to_cpu(shdr->NextCommand); -+ if (next_cmd) { -+ if (WARN_ON_ONCE(next_cmd > pdu_length)) -+ return -1; - if (next_is_large) - next_buffer = (char *)cifs_buf_get(); - else - next_buffer = (char *)cifs_small_buf_get(); -- memcpy(next_buffer, -- buf + le32_to_cpu(shdr->NextCommand), -- pdu_length - le32_to_cpu(shdr->NextCommand)); -+ memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); - } - - mid_entry = smb2_find_mid(server, buf); -@@ -5124,8 +5132,8 @@ one_more: - else - ret = cifs_handle_standard(server, mid_entry); - -- if (ret == 0 && shdr->NextCommand) { -- pdu_length -= le32_to_cpu(shdr->NextCommand); -+ if (ret == 0 && next_cmd) { -+ pdu_length -= next_cmd; - server->large_buf = next_is_large; - if (next_is_large) - server->bigbuf = buf = next_buffer; -diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h -index 9619015d78f29..c8a4014f9d395 100644 ---- a/fs/smb/common/smb2pdu.h -+++ b/fs/smb/common/smb2pdu.h -@@ -1116,7 +1116,7 @@ struct smb2_change_notify_rsp { - #define SMB2_CREATE_SD_BUFFER "SecD" /* security descriptor */ - #define SMB2_CREATE_DURABLE_HANDLE_REQUEST "DHnQ" - #define SMB2_CREATE_DURABLE_HANDLE_RECONNECT "DHnC" --#define SMB2_CREATE_ALLOCATION_SIZE "AISi" -+#define SMB2_CREATE_ALLOCATION_SIZE "AlSi" - #define SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST "MxAc" - #define SMB2_CREATE_TIMEWARP_REQUEST "TWrp" - #define SMB2_CREATE_QUERY_ON_DISK_ID "QFid" -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 683152007566c..1598ad6155fef 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -7135,6 +7135,7 @@ skip: - smb2_remove_blocked_lock, - argv); - if (rc) { -+ kfree(argv); - err = -ENOMEM; - goto out; - } -diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h -index 995513fa26904..0655aa5b57b29 100644 ---- a/include/asm-generic/qspinlock.h -+++ b/include/asm-generic/qspinlock.h -@@ -70,7 +70,7 @@ static __always_inline int queued_spin_is_locked(struct qspinlock *lock) - */ - static __always_inline int queued_spin_value_unlocked(struct qspinlock lock) - { -- return !atomic_read(&lock.val); -+ return !lock.val.counter; - } - - /** -diff --git a/include/linux/cred.h b/include/linux/cred.h -index 9ed9232af9340..09c1ed9242b4a 100644 ---- a/include/linux/cred.h -+++ b/include/linux/cred.h -@@ -108,7 +108,7 @@ static inline int groups_search(const struct group_info *group_info, kgid_t grp) - * same context as task->real_cred. - */ - struct cred { -- atomic_t usage; -+ atomic_long_t usage; - #ifdef CONFIG_DEBUG_CREDENTIALS - atomic_t subscribers; /* number of processes subscribed */ - void *put_addr; -@@ -228,7 +228,7 @@ static inline bool cap_ambient_invariant_ok(const struct cred *cred) - */ - static inline struct cred *get_new_cred(struct cred *cred) - { -- atomic_inc(&cred->usage); -+ atomic_long_inc(&cred->usage); - return cred; - } - -@@ -260,7 +260,7 @@ static inline const struct cred *get_cred_rcu(const struct cred *cred) - struct cred *nonconst_cred = (struct cred *) cred; - if (!cred) - return NULL; -- if (!atomic_inc_not_zero(&nonconst_cred->usage)) -+ if (!atomic_long_inc_not_zero(&nonconst_cred->usage)) - return NULL; - validate_creds(cred); - nonconst_cred->non_rcu = 0; -@@ -284,7 +284,7 @@ static inline void put_cred(const struct cred *_cred) - - if (cred) { - validate_creds(cred); -- if (atomic_dec_and_test(&(cred)->usage)) -+ if (atomic_long_dec_and_test(&(cred)->usage)) - __put_cred(cred); - } - } -diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h -index 68b1c41332984..e0d0a645be7cf 100644 ---- a/include/linux/if_vlan.h -+++ b/include/linux/if_vlan.h -@@ -62,6 +62,14 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb) - return (struct vlan_ethhdr *)skb_mac_header(skb); - } - -+/* Prefer this version in TX path, instead of -+ * skb_reset_mac_header() + vlan_eth_hdr() -+ */ -+static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb) -+{ -+ return (struct vlan_ethhdr *)skb->data; -+} -+ - #define VLAN_PRIO_MASK 0xe000 /* Priority Code Point */ - #define VLAN_PRIO_SHIFT 13 - #define VLAN_CFI_MASK 0x1000 /* Canonical Format Indicator / Drop Eligible Indicator */ -@@ -531,7 +539,7 @@ static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb, - */ - static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci) - { -- struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb->data; -+ struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb); - - if (!eth_type_vlan(veth->h_vlan_proto)) - return -EINVAL; -@@ -732,7 +740,7 @@ static inline bool skb_vlan_tagged_multi(struct sk_buff *skb) - if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN))) - return false; - -- veh = (struct vlan_ethhdr *)skb->data; -+ veh = skb_vlan_eth_hdr(skb); - protocol = veh->h_vlan_encapsulated_proto; - } - -diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h -index 4ef6c09cc2eec..c21e19a1514d1 100644 ---- a/include/linux/mm_inline.h -+++ b/include/linux/mm_inline.h -@@ -231,22 +231,27 @@ static inline bool lru_gen_add_folio(struct lruvec *lruvec, struct folio *folio, - if (folio_test_unevictable(folio) || !lrugen->enabled) - return false; - /* -- * There are three common cases for this page: -- * 1. If it's hot, e.g., freshly faulted in or previously hot and -- * migrated, add it to the youngest generation. -- * 2. If it's cold but can't be evicted immediately, i.e., an anon page -- * not in swapcache or a dirty page pending writeback, add it to the -- * second oldest generation. -- * 3. Everything else (clean, cold) is added to the oldest generation. -+ * There are four common cases for this page: -+ * 1. If it's hot, i.e., freshly faulted in, add it to the youngest -+ * generation, and it's protected over the rest below. -+ * 2. If it can't be evicted immediately, i.e., a dirty page pending -+ * writeback, add it to the second youngest generation. -+ * 3. If it should be evicted first, e.g., cold and clean from -+ * folio_rotate_reclaimable(), add it to the oldest generation. -+ * 4. Everything else falls between 2 & 3 above and is added to the -+ * second oldest generation if it's considered inactive, or the -+ * oldest generation otherwise. See lru_gen_is_active(). - */ - if (folio_test_active(folio)) - seq = lrugen->max_seq; - else if ((type == LRU_GEN_ANON && !folio_test_swapcache(folio)) || - (folio_test_reclaim(folio) && - (folio_test_dirty(folio) || folio_test_writeback(folio)))) -- seq = lrugen->min_seq[type] + 1; -- else -+ seq = lrugen->max_seq - 1; -+ else if (reclaiming || lrugen->min_seq[type] + MIN_NR_GENS >= lrugen->max_seq) - seq = lrugen->min_seq[type]; -+ else -+ seq = lrugen->min_seq[type] + 1; - - gen = lru_gen_from_seq(seq); - flags = (gen + 1UL) << LRU_GEN_PGOFF; -diff --git a/include/linux/usb/r8152.h b/include/linux/usb/r8152.h -index 20d88b1defc30..33a4c146dc19c 100644 ---- a/include/linux/usb/r8152.h -+++ b/include/linux/usb/r8152.h -@@ -29,6 +29,8 @@ - #define VENDOR_ID_LINKSYS 0x13b1 - #define VENDOR_ID_NVIDIA 0x0955 - #define VENDOR_ID_TPLINK 0x2357 -+#define VENDOR_ID_DLINK 0x2001 -+#define VENDOR_ID_ASUS 0x0b05 - - #if IS_REACHABLE(CONFIG_USB_RTL8152) - extern u8 rtl8152_get_version(struct usb_interface *intf); -diff --git a/include/net/addrconf.h b/include/net/addrconf.h -index c04f359655b86..86eb2aba1479c 100644 ---- a/include/net/addrconf.h -+++ b/include/net/addrconf.h -@@ -31,17 +31,22 @@ struct prefix_info { - __u8 length; - __u8 prefix_len; - -+ union __packed { -+ __u8 flags; -+ struct __packed { - #if defined(__BIG_ENDIAN_BITFIELD) -- __u8 onlink : 1, -+ __u8 onlink : 1, - autoconf : 1, - reserved : 6; - #elif defined(__LITTLE_ENDIAN_BITFIELD) -- __u8 reserved : 6, -+ __u8 reserved : 6, - autoconf : 1, - onlink : 1; - #else - #error "Please fix " - #endif -+ }; -+ }; - __be32 valid; - __be32 prefered; - __be32 reserved2; -@@ -49,6 +54,9 @@ struct prefix_info { - struct in6_addr prefix; - }; - -+/* rfc4861 4.6.2: IPv6 PIO is 32 bytes in size */ -+static_assert(sizeof(struct prefix_info) == 32); -+ - #include - #include - #include -diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h -index c8490729b4aea..31bf475eca762 100644 ---- a/include/net/if_inet6.h -+++ b/include/net/if_inet6.h -@@ -22,10 +22,6 @@ - #define IF_RS_SENT 0x10 - #define IF_READY 0x80000000 - --/* prefix flags */ --#define IF_PREFIX_ONLINK 0x01 --#define IF_PREFIX_AUTOCONF 0x02 -- - enum { - INET6_IFADDR_STATE_PREDAD, - INET6_IFADDR_STATE_DAD, -diff --git a/kernel/cred.c b/kernel/cred.c -index e10c15f51c1fe..d35bc0aa98cba 100644 ---- a/kernel/cred.c -+++ b/kernel/cred.c -@@ -99,17 +99,17 @@ static void put_cred_rcu(struct rcu_head *rcu) - - #ifdef CONFIG_DEBUG_CREDENTIALS - if (cred->magic != CRED_MAGIC_DEAD || -- atomic_read(&cred->usage) != 0 || -+ atomic_long_read(&cred->usage) != 0 || - read_cred_subscribers(cred) != 0) - panic("CRED: put_cred_rcu() sees %p with" -- " mag %x, put %p, usage %d, subscr %d\n", -+ " mag %x, put %p, usage %ld, subscr %d\n", - cred, cred->magic, cred->put_addr, -- atomic_read(&cred->usage), -+ atomic_long_read(&cred->usage), - read_cred_subscribers(cred)); - #else -- if (atomic_read(&cred->usage) != 0) -- panic("CRED: put_cred_rcu() sees %p with usage %d\n", -- cred, atomic_read(&cred->usage)); -+ if (atomic_long_read(&cred->usage) != 0) -+ panic("CRED: put_cred_rcu() sees %p with usage %ld\n", -+ cred, atomic_long_read(&cred->usage)); - #endif - - security_cred_free(cred); -@@ -134,11 +134,11 @@ static void put_cred_rcu(struct rcu_head *rcu) - */ - void __put_cred(struct cred *cred) - { -- kdebug("__put_cred(%p{%d,%d})", cred, -- atomic_read(&cred->usage), -+ kdebug("__put_cred(%p{%ld,%d})", cred, -+ atomic_long_read(&cred->usage), - read_cred_subscribers(cred)); - -- BUG_ON(atomic_read(&cred->usage) != 0); -+ BUG_ON(atomic_long_read(&cred->usage) != 0); - #ifdef CONFIG_DEBUG_CREDENTIALS - BUG_ON(read_cred_subscribers(cred) != 0); - cred->magic = CRED_MAGIC_DEAD; -@@ -161,8 +161,8 @@ void exit_creds(struct task_struct *tsk) - { - struct cred *cred; - -- kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred, -- atomic_read(&tsk->cred->usage), -+ kdebug("exit_creds(%u,%p,%p,{%ld,%d})", tsk->pid, tsk->real_cred, tsk->cred, -+ atomic_long_read(&tsk->cred->usage), - read_cred_subscribers(tsk->cred)); - - cred = (struct cred *) tsk->real_cred; -@@ -221,7 +221,7 @@ struct cred *cred_alloc_blank(void) - if (!new) - return NULL; - -- atomic_set(&new->usage, 1); -+ atomic_long_set(&new->usage, 1); - #ifdef CONFIG_DEBUG_CREDENTIALS - new->magic = CRED_MAGIC; - #endif -@@ -267,7 +267,7 @@ struct cred *prepare_creds(void) - memcpy(new, old, sizeof(struct cred)); - - new->non_rcu = 0; -- atomic_set(&new->usage, 1); -+ atomic_long_set(&new->usage, 1); - set_cred_subscribers(new, 0); - get_group_info(new->group_info); - get_uid(new->user); -@@ -355,8 +355,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags) - p->real_cred = get_cred(p->cred); - get_cred(p->cred); - alter_cred_subscribers(p->cred, 2); -- kdebug("share_creds(%p{%d,%d})", -- p->cred, atomic_read(&p->cred->usage), -+ kdebug("share_creds(%p{%ld,%d})", -+ p->cred, atomic_long_read(&p->cred->usage), - read_cred_subscribers(p->cred)); - inc_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1); - return 0; -@@ -449,8 +449,8 @@ int commit_creds(struct cred *new) - struct task_struct *task = current; - const struct cred *old = task->real_cred; - -- kdebug("commit_creds(%p{%d,%d})", new, -- atomic_read(&new->usage), -+ kdebug("commit_creds(%p{%ld,%d})", new, -+ atomic_long_read(&new->usage), - read_cred_subscribers(new)); - - BUG_ON(task->cred != old); -@@ -459,7 +459,7 @@ int commit_creds(struct cred *new) - validate_creds(old); - validate_creds(new); - #endif -- BUG_ON(atomic_read(&new->usage) < 1); -+ BUG_ON(atomic_long_read(&new->usage) < 1); - - get_cred(new); /* we will require a ref for the subj creds too */ - -@@ -532,14 +532,14 @@ EXPORT_SYMBOL(commit_creds); - */ - void abort_creds(struct cred *new) - { -- kdebug("abort_creds(%p{%d,%d})", new, -- atomic_read(&new->usage), -+ kdebug("abort_creds(%p{%ld,%d})", new, -+ atomic_long_read(&new->usage), - read_cred_subscribers(new)); - - #ifdef CONFIG_DEBUG_CREDENTIALS - BUG_ON(read_cred_subscribers(new) != 0); - #endif -- BUG_ON(atomic_read(&new->usage) < 1); -+ BUG_ON(atomic_long_read(&new->usage) < 1); - put_cred(new); - } - EXPORT_SYMBOL(abort_creds); -@@ -555,8 +555,8 @@ const struct cred *override_creds(const struct cred *new) - { - const struct cred *old = current->cred; - -- kdebug("override_creds(%p{%d,%d})", new, -- atomic_read(&new->usage), -+ kdebug("override_creds(%p{%ld,%d})", new, -+ atomic_long_read(&new->usage), - read_cred_subscribers(new)); - - validate_creds(old); -@@ -578,8 +578,8 @@ const struct cred *override_creds(const struct cred *new) - rcu_assign_pointer(current->cred, new); - alter_cred_subscribers(old, -1); - -- kdebug("override_creds() = %p{%d,%d}", old, -- atomic_read(&old->usage), -+ kdebug("override_creds() = %p{%ld,%d}", old, -+ atomic_long_read(&old->usage), - read_cred_subscribers(old)); - return old; - } -@@ -596,8 +596,8 @@ void revert_creds(const struct cred *old) - { - const struct cred *override = current->cred; - -- kdebug("revert_creds(%p{%d,%d})", old, -- atomic_read(&old->usage), -+ kdebug("revert_creds(%p{%ld,%d})", old, -+ atomic_long_read(&old->usage), - read_cred_subscribers(old)); - - validate_creds(old); -@@ -729,7 +729,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) - - *new = *old; - new->non_rcu = 0; -- atomic_set(&new->usage, 1); -+ atomic_long_set(&new->usage, 1); - set_cred_subscribers(new, 0); - get_uid(new->user); - get_user_ns(new->user_ns); -@@ -843,8 +843,8 @@ static void dump_invalid_creds(const struct cred *cred, const char *label, - cred == tsk->cred ? "[eff]" : ""); - printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n", - cred->magic, cred->put_addr); -- printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n", -- atomic_read(&cred->usage), -+ printk(KERN_ERR "CRED: ->usage=%ld, subscr=%d\n", -+ atomic_long_read(&cred->usage), - read_cred_subscribers(cred)); - printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n", - from_kuid_munged(&init_user_ns, cred->uid), -@@ -916,9 +916,9 @@ EXPORT_SYMBOL(__validate_process_creds); - */ - void validate_creds_for_do_exit(struct task_struct *tsk) - { -- kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})", -+ kdebug("validate_creds_for_do_exit(%p,%p{%ld,%d})", - tsk->real_cred, tsk->cred, -- atomic_read(&tsk->cred->usage), -+ atomic_long_read(&tsk->cred->usage), - read_cred_subscribers(tsk->cred)); - - __validate_process_creds(tsk, __FILE__, __LINE__); -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 0193243f65e5c..8c7d2f4f5fbab 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1945,6 +1945,16 @@ static bool perf_event_validate_size(struct perf_event *event) - group_leader->nr_siblings + 1) > 16*1024) - return false; - -+ /* -+ * When creating a new group leader, group_leader->ctx is initialized -+ * after the size has been validated, but we cannot safely use -+ * for_each_sibling_event() until group_leader->ctx is set. A new group -+ * leader cannot have any siblings yet, so we can safely skip checking -+ * the non-existent siblings. -+ */ -+ if (event == group_leader) -+ return true; -+ - for_each_sibling_event(sibling, group_leader) { - if (__perf_event_read_size(sibling->attr.read_format, - group_leader->nr_siblings + 1) > 16*1024) -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index c02a4cb879913..61803208706a5 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -711,6 +711,9 @@ static int rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) - unsigned long cnt2, top2, bottom2, msb2; - u64 val; - -+ /* Any interruptions in this function should cause a failure */ -+ cnt = local_read(&t->cnt); -+ - /* The cmpxchg always fails if it interrupted an update */ - if (!__rb_time_read(t, &val, &cnt2)) - return false; -@@ -718,17 +721,18 @@ static int rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) - if (val != expect) - return false; - -- cnt = local_read(&t->cnt); - if ((cnt & 3) != cnt2) - return false; - - cnt2 = cnt + 1; - - rb_time_split(val, &top, &bottom, &msb); -+ msb = rb_time_val_cnt(msb, cnt); - top = rb_time_val_cnt(top, cnt); - bottom = rb_time_val_cnt(bottom, cnt); - - rb_time_split(set, &top2, &bottom2, &msb2); -+ msb2 = rb_time_val_cnt(msb2, cnt); - top2 = rb_time_val_cnt(top2, cnt2); - bottom2 = rb_time_val_cnt(bottom2, cnt2); - -@@ -1801,6 +1805,8 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer) - free_buffer_page(bpage); - } - -+ free_page((unsigned long)cpu_buffer->free_page); -+ - kfree(cpu_buffer); - } - -@@ -2401,7 +2407,7 @@ rb_iter_head_event(struct ring_buffer_iter *iter) - */ - barrier(); - -- if ((iter->head + length) > commit || length > BUF_MAX_DATA_SIZE) -+ if ((iter->head + length) > commit || length > BUF_PAGE_SIZE) - /* Writer corrupted the read? */ - goto reset; - -@@ -3576,7 +3582,10 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, - * absolute timestamp. - * Don't bother if this is the start of a new page (w == 0). - */ -- if (unlikely(!a_ok || !b_ok || (info->before != info->after && w))) { -+ if (!w) { -+ /* Use the sub-buffer timestamp */ -+ info->delta = 0; -+ } else if (unlikely(!a_ok || !b_ok || info->before != info->after)) { - info->add_timestamp |= RB_ADD_STAMP_FORCE | RB_ADD_STAMP_EXTEND; - info->length += RB_LEN_TIME_EXTEND; - } else { -@@ -3599,26 +3608,19 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, - - /* See if we shot pass the end of this buffer page */ - if (unlikely(write > BUF_PAGE_SIZE)) { -- /* before and after may now different, fix it up*/ -- b_ok = rb_time_read(&cpu_buffer->before_stamp, &info->before); -- a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after); -- if (a_ok && b_ok && info->before != info->after) -- (void)rb_time_cmpxchg(&cpu_buffer->before_stamp, -- info->before, info->after); -- if (a_ok && b_ok) -- check_buffer(cpu_buffer, info, CHECK_FULL_PAGE); -+ check_buffer(cpu_buffer, info, CHECK_FULL_PAGE); - return rb_move_tail(cpu_buffer, tail, info); - } - - if (likely(tail == w)) { -- u64 save_before; -- bool s_ok; -- - /* Nothing interrupted us between A and C */ - /*D*/ rb_time_set(&cpu_buffer->write_stamp, info->ts); -- barrier(); -- /*E*/ s_ok = rb_time_read(&cpu_buffer->before_stamp, &save_before); -- RB_WARN_ON(cpu_buffer, !s_ok); -+ /* -+ * If something came in between C and D, the write stamp -+ * may now not be in sync. But that's fine as the before_stamp -+ * will be different and then next event will just be forced -+ * to use an absolute timestamp. -+ */ - if (likely(!(info->add_timestamp & - (RB_ADD_STAMP_FORCE | RB_ADD_STAMP_ABSOLUTE)))) - /* This did not interrupt any time update */ -@@ -3626,24 +3628,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, - else - /* Just use full timestamp for interrupting event */ - info->delta = info->ts; -- barrier(); - check_buffer(cpu_buffer, info, tail); -- if (unlikely(info->ts != save_before)) { -- /* SLOW PATH - Interrupted between C and E */ -- -- a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after); -- RB_WARN_ON(cpu_buffer, !a_ok); -- -- /* Write stamp must only go forward */ -- if (save_before > info->after) { -- /* -- * We do not care about the result, only that -- * it gets updated atomically. -- */ -- (void)rb_time_cmpxchg(&cpu_buffer->write_stamp, -- info->after, save_before); -- } -- } - } else { - u64 ts; - /* SLOW PATH - Interrupted between A and C */ -@@ -3734,6 +3719,8 @@ rb_reserve_next_event(struct trace_buffer *buffer, - if (ring_buffer_time_stamp_abs(cpu_buffer->buffer)) { - add_ts_default = RB_ADD_STAMP_ABSOLUTE; - info.length += RB_LEN_TIME_EXTEND; -+ if (info.length > BUF_MAX_DATA_SIZE) -+ goto out_fail; - } else { - add_ts_default = RB_ADD_STAMP_NONE; - } -@@ -5118,7 +5105,8 @@ ring_buffer_read_prepare(struct trace_buffer *buffer, int cpu, gfp_t flags) - if (!iter) - return NULL; - -- iter->event = kmalloc(BUF_MAX_DATA_SIZE, flags); -+ /* Holds the entire event: data and meta data */ -+ iter->event = kmalloc(BUF_PAGE_SIZE, flags); - if (!iter->event) { - kfree(iter); - return NULL; -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index d2db4d6f0f2fd..87eca95b57fb3 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -6268,7 +6268,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr, - if (!tr->array_buffer.buffer) - return 0; - -- /* Do not allow tracing while resizng ring buffer */ -+ /* Do not allow tracing while resizing ring buffer */ - tracing_stop_tr(tr); - - ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu); -@@ -6276,7 +6276,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr, - goto out_start; - - #ifdef CONFIG_TRACER_MAX_TRACE -- if (!tr->current_trace->use_max_tr) -+ if (!tr->allocated_snapshot) - goto out; - - ret = ring_buffer_resize(tr->max_buffer.buffer, size, cpu); -diff --git a/mm/shmem.c b/mm/shmem.c -index 806741bbe4a68..f7c08e169e423 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -1024,7 +1024,24 @@ whole_folios: - } - VM_BUG_ON_FOLIO(folio_test_writeback(folio), - folio); -- truncate_inode_folio(mapping, folio); -+ -+ if (!folio_test_large(folio)) { -+ truncate_inode_folio(mapping, folio); -+ } else if (truncate_inode_partial_folio(folio, lstart, lend)) { -+ /* -+ * If we split a page, reset the loop so -+ * that we pick up the new sub pages. -+ * Otherwise the THP was entirely -+ * dropped or the target range was -+ * zeroed, so just continue the loop as -+ * is. -+ */ -+ if (!folio_test_large(folio)) { -+ folio_unlock(folio); -+ index = start; -+ break; -+ } -+ } - } - index = folio->index + folio_nr_pages(folio) - 1; - folio_unlock(folio); -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 93d6f27dd40b4..3f090faa6377f 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -4770,7 +4770,7 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c - } - - /* protected */ -- if (tier > tier_idx) { -+ if (tier > tier_idx || refs == BIT(LRU_REFS_WIDTH)) { - int hist = lru_hist_from_seq(lrugen->min_seq[type]); - - gen = folio_inc_gen(lruvec, folio, false); -diff --git a/mm/workingset.c b/mm/workingset.c -index ae7e984b23c6b..6e4699055ed37 100644 ---- a/mm/workingset.c -+++ b/mm/workingset.c -@@ -289,10 +289,10 @@ static void lru_gen_refault(struct folio *folio, void *shadow) - * 1. For pages accessed through page tables, hotter pages pushed out - * hot pages which refaulted immediately. - * 2. For pages accessed multiple times through file descriptors, -- * numbers of accesses might have been out of the range. -+ * they would have been protected by sort_folio(). - */ -- if (lru_gen_in_fault() || refs == BIT(LRU_REFS_WIDTH)) { -- folio_set_workingset(folio); -+ if (lru_gen_in_fault() || refs >= BIT(LRU_REFS_WIDTH) - 1) { -+ set_mask_bits(&folio->flags, 0, LRU_REFS_MASK | BIT(PG_workingset)); - mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + type, delta); - } - unlock: -diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c -index a06f4d4a6f476..f67f14db16334 100644 ---- a/net/appletalk/ddp.c -+++ b/net/appletalk/ddp.c -@@ -1811,15 +1811,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - break; - } - case TIOCINQ: { -- /* -- * These two are safe on a single CPU system as only -- * user tasks fiddle here -- */ -- struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); -+ struct sk_buff *skb; - long amount = 0; - -+ spin_lock_irq(&sk->sk_receive_queue.lock); -+ skb = skb_peek(&sk->sk_receive_queue); - if (skb) - amount = skb->len - sizeof(struct ddpehdr); -+ spin_unlock_irq(&sk->sk_receive_queue.lock); - rc = put_user(amount, (int __user *)argp); - break; - } -diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c -index 838ebf0cabbfb..f81f8d56f5c0c 100644 ---- a/net/atm/ioctl.c -+++ b/net/atm/ioctl.c -@@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, - case SIOCINQ: - { - struct sk_buff *skb; -+ int amount; - - if (sock->state != SS_CONNECTED) { - error = -EINVAL; - goto done; - } -+ spin_lock_irq(&sk->sk_receive_queue.lock); - skb = skb_peek(&sk->sk_receive_queue); -- error = put_user(skb ? skb->len : 0, -- (int __user *)argp) ? -EFAULT : 0; -+ amount = skb ? skb->len : 0; -+ spin_unlock_irq(&sk->sk_receive_queue.lock); -+ error = put_user(amount, (int __user *)argp) ? -EFAULT : 0; - goto done; - } - case ATM_SETSC: -diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index 38d411a52f331..d7b525a495e45 100644 ---- a/net/batman-adv/soft-interface.c -+++ b/net/batman-adv/soft-interface.c -@@ -444,7 +444,7 @@ void batadv_interface_rx(struct net_device *soft_iface, - if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) - goto dropped; - -- vhdr = (struct vlan_ethhdr *)skb->data; -+ vhdr = skb_vlan_eth_hdr(skb); - - /* drop batman-in-batman packets to prevent loops */ - if (vhdr->h_vlan_encapsulated_proto != htons(ETH_P_BATMAN)) -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 5b93d1ed1ed19..67087da45a1f7 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -3210,7 +3210,13 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) - if (skb_still_in_host_queue(sk, skb)) - return -EBUSY; - -+start: - if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) { -+ if (unlikely(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) { -+ TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; -+ TCP_SKB_CB(skb)->seq++; -+ goto start; -+ } - if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) { - WARN_ON_ONCE(1); - return -EINVAL; -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index c63ccd39fc552..b8dc20fe7a4e2 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -6105,11 +6105,7 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev, - pmsg->prefix_len = pinfo->prefix_len; - pmsg->prefix_type = pinfo->type; - pmsg->prefix_pad3 = 0; -- pmsg->prefix_flags = 0; -- if (pinfo->onlink) -- pmsg->prefix_flags |= IF_PREFIX_ONLINK; -- if (pinfo->autoconf) -- pmsg->prefix_flags |= IF_PREFIX_AUTOCONF; -+ pmsg->prefix_flags = pinfo->flags; - - if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix)) - goto nla_put_failure; -diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c -index ca2b17f32670d..674937284b8d2 100644 ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -1315,9 +1315,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - case TIOCINQ: { - struct sk_buff *skb; - long amount = 0L; -- /* These two are safe on a single CPU system as only user tasks fiddle here */ -+ -+ spin_lock_irq(&sk->sk_receive_queue.lock); - if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) - amount = skb->len; -+ spin_unlock_irq(&sk->sk_receive_queue.lock); - return put_user(amount, (unsigned int __user *) argp); - } - -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 2e60bf06adff0..0323040d34bc6 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -1225,6 +1225,8 @@ alloc_payload: - } - - sk_msg_page_add(msg_pl, page, copy, offset); -+ msg_pl->sg.copybreak = 0; -+ msg_pl->sg.curr = msg_pl->sg.end; - sk_mem_charge(sk, copy); - - offset += copy; -diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c -index 79e79fd6efd19..2e25890ca52d1 100644 ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -583,7 +583,7 @@ static s64 virtio_transport_has_space(struct vsock_sock *vsk) - struct virtio_vsock_sock *vvs = vsk->trans; - s64 bytes; - -- bytes = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); -+ bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); - if (bytes < 0) - bytes = 0; - -diff --git a/scripts/sign-file.c b/scripts/sign-file.c -index 598ef5465f825..3edb156ae52c3 100644 ---- a/scripts/sign-file.c -+++ b/scripts/sign-file.c -@@ -322,7 +322,7 @@ int main(int argc, char **argv) - CMS_NOSMIMECAP | use_keyid | - use_signed_attrs), - "CMS_add1_signer"); -- ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0, -+ ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) != 1, - "CMS_final"); - - #else -@@ -341,10 +341,10 @@ int main(int argc, char **argv) - b = BIO_new_file(sig_file_name, "wb"); - ERR(!b, "%s", sig_file_name); - #ifndef USE_PKCS7 -- ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0, -+ ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) != 1, - "%s", sig_file_name); - #else -- ERR(i2d_PKCS7_bio(b, pkcs7) < 0, -+ ERR(i2d_PKCS7_bio(b, pkcs7) != 1, - "%s", sig_file_name); - #endif - BIO_free(b); -@@ -374,9 +374,9 @@ int main(int argc, char **argv) - - if (!raw_sig) { - #ifndef USE_PKCS7 -- ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name); -+ ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) != 1, "%s", dest_name); - #else -- ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name); -+ ERR(i2d_PKCS7_bio(bd, pkcs7) != 1, "%s", dest_name); - #endif - } else { - BIO *b; -@@ -396,7 +396,7 @@ int main(int argc, char **argv) - ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name); - ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name); - -- ERR(BIO_free(bd) < 0, "%s", dest_name); -+ ERR(BIO_free(bd) != 1, "%s", dest_name); - - /* Finally, if we're signing in place, replace the original. */ - if (replace_orig) -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index 7b5e09070ab9b..f460ac80c8e49 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -1993,7 +1993,10 @@ static const struct snd_pci_quirk force_connect_list[] = { - SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1), - SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1), - SND_PCI_QUIRK(0x103c, 0x8715, "HP", 1), -+ SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1), /* Z170 PRO */ -+ SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1), /* Z170M PLUS */ - SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1), -+ SND_PCI_QUIRK(0x8086, 0x2060, "Intel NUC5CPYB", 1), - SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), - {} - }; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index c6cae3369a6a1..a7c361e0daebe 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9577,6 +9577,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x841c, "HP Pavilion 15-CK0xx", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), -+ SND_PCI_QUIRK(0x103c, 0x84ae, "HP 15-db0403ng", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), - SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), -diff --git a/tools/testing/selftests/bpf/progs/bpf_loop_bench.c b/tools/testing/selftests/bpf/progs/bpf_loop_bench.c -index 4ce76eb064c41..d461746fd3c1e 100644 ---- a/tools/testing/selftests/bpf/progs/bpf_loop_bench.c -+++ b/tools/testing/selftests/bpf/progs/bpf_loop_bench.c -@@ -15,13 +15,16 @@ static int empty_callback(__u32 index, void *data) - return 0; - } - -+static int outer_loop(__u32 index, void *data) -+{ -+ bpf_loop(nr_loops, empty_callback, NULL, 0); -+ __sync_add_and_fetch(&hits, nr_loops); -+ return 0; -+} -+ - SEC("fentry/" SYS_PREFIX "sys_getpgid") - int benchmark(void *ctx) - { -- for (int i = 0; i < 1000; i++) { -- bpf_loop(nr_loops, empty_callback, NULL, 0); -- -- __sync_add_and_fetch(&hits, nr_loops); -- } -+ bpf_loop(1000, outer_loop, NULL, 0); - return 0; - } diff --git a/patch/kernel/odroidxu4-current/patch-6.1.69-70.patch b/patch/kernel/odroidxu4-current/patch-6.1.69-70.patch deleted file mode 100644 index f22e31fe78..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.69-70.patch +++ /dev/null @@ -1,5394 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml -index ff317fd7c15bf..2e1fcff3c2801 100644 ---- a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml -+++ b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml -@@ -14,9 +14,11 @@ allOf: - - properties: - compatible: -- enum: -- - fsl,imx23-ocotp -- - fsl,imx28-ocotp -+ items: -+ - enum: -+ - fsl,imx23-ocotp -+ - fsl,imx28-ocotp -+ - const: fsl,ocotp - - "#address-cells": - const: 1 -@@ -40,7 +42,7 @@ additionalProperties: false - examples: - - | - ocotp: efuse@8002c000 { -- compatible = "fsl,imx28-ocotp"; -+ compatible = "fsl,imx28-ocotp", "fsl,ocotp"; - #address-cells = <1>; - #size-cells = <1>; - reg = <0x8002c000 0x2000>; -diff --git a/Makefile b/Makefile -index 9a3b34d2387fa..270593fcafdcd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 69 -+SUBLEVEL = 70 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi -index 97ce0c4f1df7e..a79920ec461f0 100644 ---- a/arch/arm/boot/dts/dra7.dtsi -+++ b/arch/arm/boot/dts/dra7.dtsi -@@ -144,7 +144,7 @@ - - l3-noc@44000000 { - compatible = "ti,dra7-l3-noc"; -- reg = <0x44000000 0x1000>, -+ reg = <0x44000000 0x1000000>, - <0x45000000 0x1000>; - interrupts-extended = <&crossbar_mpu GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, - <&wakeupgen GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>; -diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c -index 59755b5a1ad7a..75091aa7269ae 100644 ---- a/arch/arm/mach-omap2/id.c -+++ b/arch/arm/mach-omap2/id.c -@@ -793,11 +793,16 @@ void __init omap_soc_device_init(void) - - soc_dev_attr->machine = soc_name; - soc_dev_attr->family = omap_get_family(); -+ if (!soc_dev_attr->family) { -+ kfree(soc_dev_attr); -+ return; -+ } - soc_dev_attr->revision = soc_rev; - soc_dev_attr->custom_attr_group = omap_soc_groups[0]; - - soc_dev = soc_device_register(soc_dev_attr); - if (IS_ERR(soc_dev)) { -+ kfree(soc_dev_attr->family); - kfree(soc_dev_attr); - return; - } -diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c -index 6cc380a15eb76..de94515fb17c6 100644 ---- a/arch/arm64/kvm/arm.c -+++ b/arch/arm64/kvm/arm.c -@@ -386,7 +386,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) - kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache); - kvm_timer_vcpu_terminate(vcpu); - kvm_pmu_vcpu_destroy(vcpu); -- -+ kvm_vgic_vcpu_destroy(vcpu); - kvm_arm_vcpu_destroy(vcpu); - } - -diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c -index f2f3bf4a04b0b..0919e3b8f46ec 100644 ---- a/arch/arm64/kvm/vgic/vgic-init.c -+++ b/arch/arm64/kvm/vgic/vgic-init.c -@@ -368,7 +368,7 @@ static void kvm_vgic_dist_destroy(struct kvm *kvm) - vgic_v4_teardown(kvm); - } - --void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) -+static void __kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) - { - struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; - -@@ -379,29 +379,39 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) - vgic_flush_pending_lpis(vcpu); - - INIT_LIST_HEAD(&vgic_cpu->ap_list_head); -- vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF; -+ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) { -+ vgic_unregister_redist_iodev(vcpu); -+ vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF; -+ } - } - --static void __kvm_vgic_destroy(struct kvm *kvm) -+void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) -+{ -+ struct kvm *kvm = vcpu->kvm; -+ -+ mutex_lock(&kvm->slots_lock); -+ __kvm_vgic_vcpu_destroy(vcpu); -+ mutex_unlock(&kvm->slots_lock); -+} -+ -+void kvm_vgic_destroy(struct kvm *kvm) - { - struct kvm_vcpu *vcpu; - unsigned long i; - -- lockdep_assert_held(&kvm->arch.config_lock); -+ mutex_lock(&kvm->slots_lock); - - vgic_debug_destroy(kvm); - - kvm_for_each_vcpu(i, vcpu, kvm) -- kvm_vgic_vcpu_destroy(vcpu); -+ __kvm_vgic_vcpu_destroy(vcpu); -+ -+ mutex_lock(&kvm->arch.config_lock); - - kvm_vgic_dist_destroy(kvm); --} - --void kvm_vgic_destroy(struct kvm *kvm) --{ -- mutex_lock(&kvm->arch.config_lock); -- __kvm_vgic_destroy(kvm); - mutex_unlock(&kvm->arch.config_lock); -+ mutex_unlock(&kvm->slots_lock); - } - - /** -@@ -469,25 +479,26 @@ int kvm_vgic_map_resources(struct kvm *kvm) - type = VGIC_V3; - } - -- if (ret) { -- __kvm_vgic_destroy(kvm); -+ if (ret) - goto out; -- } -+ - dist->ready = true; - dist_base = dist->vgic_dist_base; - mutex_unlock(&kvm->arch.config_lock); - - ret = vgic_register_dist_iodev(kvm, dist_base, type); -- if (ret) { -+ if (ret) - kvm_err("Unable to register VGIC dist MMIO regions\n"); -- kvm_vgic_destroy(kvm); -- } -- mutex_unlock(&kvm->slots_lock); -- return ret; - -+ goto out_slots; - out: - mutex_unlock(&kvm->arch.config_lock); -+out_slots: - mutex_unlock(&kvm->slots_lock); -+ -+ if (ret) -+ kvm_vgic_destroy(kvm); -+ - return ret; - } - -diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c -index 188d2187eede9..871a45d4fc84c 100644 ---- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c -+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c -@@ -820,7 +820,7 @@ out_unlock: - return ret; - } - --static void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu) -+void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu) - { - struct vgic_io_device *rd_dev = &vcpu->arch.vgic_cpu.rd_iodev; - -diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h -index 23e280fa0a16f..9f80a580ca771 100644 ---- a/arch/arm64/kvm/vgic/vgic.h -+++ b/arch/arm64/kvm/vgic/vgic.h -@@ -229,6 +229,7 @@ int vgic_v3_lpi_sync_pending_status(struct kvm *kvm, struct vgic_irq *irq); - int vgic_v3_save_pending_tables(struct kvm *kvm); - int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count); - int vgic_register_redist_iodev(struct kvm_vcpu *vcpu); -+void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu); - bool vgic_v3_check_base(struct kvm *kvm); - - void vgic_v3_load(struct kvm_vcpu *vcpu); -diff --git a/arch/riscv/include/asm/signal.h b/arch/riscv/include/asm/signal.h -index 532c29ef03769..956ae0a01bad1 100644 ---- a/arch/riscv/include/asm/signal.h -+++ b/arch/riscv/include/asm/signal.h -@@ -7,6 +7,6 @@ - #include - - asmlinkage __visible --void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags); -+void do_work_pending(struct pt_regs *regs, unsigned long thread_info_flags); - - #endif -diff --git a/arch/s390/include/asm/fpu/api.h b/arch/s390/include/asm/fpu/api.h -index b714ed0ef6885..9acf48e53a87f 100644 ---- a/arch/s390/include/asm/fpu/api.h -+++ b/arch/s390/include/asm/fpu/api.h -@@ -79,7 +79,7 @@ static inline int test_fp_ctl(u32 fpc) - #define KERNEL_VXR_HIGH (KERNEL_VXR_V16V23|KERNEL_VXR_V24V31) - - #define KERNEL_VXR (KERNEL_VXR_LOW|KERNEL_VXR_HIGH) --#define KERNEL_FPR (KERNEL_FPC|KERNEL_VXR_V0V7) -+#define KERNEL_FPR (KERNEL_FPC|KERNEL_VXR_LOW) - - struct kernel_fpu; - -diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c -index 46b7ee0ab01a4..6b8c93989aa31 100644 ---- a/arch/x86/kernel/alternative.c -+++ b/arch/x86/kernel/alternative.c -@@ -1015,8 +1015,8 @@ void __init_or_module text_poke_early(void *addr, const void *opcode, - } else { - local_irq_save(flags); - memcpy(addr, opcode, len); -- local_irq_restore(flags); - sync_core(); -+ local_irq_restore(flags); - - /* - * Could also do a CLFLUSH here to speed up CPU recovery; but -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 5e680e039d0e1..4686c1d9d0cfd 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -2553,3 +2553,49 @@ void bpf_jit_free(struct bpf_prog *prog) - - bpf_prog_unlock_free(prog); - } -+ -+void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, -+ struct bpf_prog *new, struct bpf_prog *old) -+{ -+ u8 *old_addr, *new_addr, *old_bypass_addr; -+ int ret; -+ -+ old_bypass_addr = old ? NULL : poke->bypass_addr; -+ old_addr = old ? (u8 *)old->bpf_func + poke->adj_off : NULL; -+ new_addr = new ? (u8 *)new->bpf_func + poke->adj_off : NULL; -+ -+ /* -+ * On program loading or teardown, the program's kallsym entry -+ * might not be in place, so we use __bpf_arch_text_poke to skip -+ * the kallsyms check. -+ */ -+ if (new) { -+ ret = __bpf_arch_text_poke(poke->tailcall_target, -+ BPF_MOD_JUMP, -+ old_addr, new_addr); -+ BUG_ON(ret < 0); -+ if (!old) { -+ ret = __bpf_arch_text_poke(poke->tailcall_bypass, -+ BPF_MOD_JUMP, -+ poke->bypass_addr, -+ NULL); -+ BUG_ON(ret < 0); -+ } -+ } else { -+ ret = __bpf_arch_text_poke(poke->tailcall_bypass, -+ BPF_MOD_JUMP, -+ old_bypass_addr, -+ poke->bypass_addr); -+ BUG_ON(ret < 0); -+ /* let other CPUs finish the execution of program -+ * so that it will not possible to expose them -+ * to invalid nop, stack unwind, nop state -+ */ -+ if (!ret) -+ synchronize_rcu(); -+ ret = __bpf_arch_text_poke(poke->tailcall_target, -+ BPF_MOD_JUMP, -+ old_addr, NULL); -+ BUG_ON(ret < 0); -+ } -+} -diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig -index 9b1ec5d8c99c8..a65fc2ae15b49 100644 ---- a/arch/x86/xen/Kconfig -+++ b/arch/x86/xen/Kconfig -@@ -9,6 +9,7 @@ config XEN - select PARAVIRT_CLOCK - select X86_HV_CALLBACK_VECTOR - depends on X86_64 || (X86_32 && X86_PAE) -+ depends on X86_64 || (X86_GENERIC || MPENTIUM4 || MCORE2 || MATOM || MK8) - depends on X86_LOCAL_APIC && X86_TSC - help - This is the Linux Xen port. Enabling this will allow the -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 426d0b42685a0..127e3ceb59799 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1777,14 +1777,43 @@ static const struct block_device_operations lo_fops = { - /* - * If max_loop is specified, create that many devices upfront. - * This also becomes a hard limit. If max_loop is not specified, -+ * the default isn't a hard limit (as before commit 85c50197716c -+ * changed the default value from 0 for max_loop=0 reasons), just - * create CONFIG_BLK_DEV_LOOP_MIN_COUNT loop devices at module - * init time. Loop devices can be requested on-demand with the - * /dev/loop-control interface, or be instantiated by accessing - * a 'dead' device node. - */ - static int max_loop = CONFIG_BLK_DEV_LOOP_MIN_COUNT; --module_param(max_loop, int, 0444); -+ -+#ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD -+static bool max_loop_specified; -+ -+static int max_loop_param_set_int(const char *val, -+ const struct kernel_param *kp) -+{ -+ int ret; -+ -+ ret = param_set_int(val, kp); -+ if (ret < 0) -+ return ret; -+ -+ max_loop_specified = true; -+ return 0; -+} -+ -+static const struct kernel_param_ops max_loop_param_ops = { -+ .set = max_loop_param_set_int, -+ .get = param_get_int, -+}; -+ -+module_param_cb(max_loop, &max_loop_param_ops, &max_loop, 0444); - MODULE_PARM_DESC(max_loop, "Maximum number of loop devices"); -+#else -+module_param(max_loop, int, 0444); -+MODULE_PARM_DESC(max_loop, "Initial number of loop devices"); -+#endif -+ - module_param(max_part, int, 0444); - MODULE_PARM_DESC(max_part, "Maximum number of partitions per loop device"); - -@@ -2089,14 +2118,18 @@ static void loop_remove(struct loop_device *lo) - put_disk(lo->lo_disk); - } - -+#ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD - static void loop_probe(dev_t dev) - { - int idx = MINOR(dev) >> part_shift; - -- if (max_loop && idx >= max_loop) -+ if (max_loop_specified && max_loop && idx >= max_loop) - return; - loop_add(idx); - } -+#else -+#define loop_probe NULL -+#endif /* !CONFIG_BLOCK_LEGACY_AUTOLOAD */ - - static int loop_control_remove(int idx) - { -@@ -2277,6 +2310,9 @@ module_exit(loop_exit); - static int __init max_loop_setup(char *str) - { - max_loop = simple_strtol(str, NULL, 0); -+#ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD -+ max_loop_specified = true; -+#endif - return 1; - } - -diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c -index c2f0f74193f0e..3fa74051f31b4 100644 ---- a/drivers/block/ublk_drv.c -+++ b/drivers/block/ublk_drv.c -@@ -103,6 +103,9 @@ struct ublk_uring_cmd_pdu { - */ - #define UBLK_IO_FLAG_NEED_GET_DATA 0x08 - -+/* atomic RW with ubq->cancel_lock */ -+#define UBLK_IO_FLAG_CANCELED 0x80000000 -+ - struct ublk_io { - /* userspace buffer address from io cmd */ - __u64 addr; -@@ -126,6 +129,7 @@ struct ublk_queue { - unsigned int max_io_sz; - bool force_abort; - unsigned short nr_io_ready; /* how many ios setup */ -+ spinlock_t cancel_lock; - struct ublk_device *dev; - struct ublk_io ios[]; - }; -@@ -1045,28 +1049,28 @@ static inline bool ublk_queue_ready(struct ublk_queue *ubq) - return ubq->nr_io_ready == ubq->q_depth; - } - --static void ublk_cmd_cancel_cb(struct io_uring_cmd *cmd, unsigned issue_flags) --{ -- io_uring_cmd_done(cmd, UBLK_IO_RES_ABORT, 0, issue_flags); --} -- - static void ublk_cancel_queue(struct ublk_queue *ubq) - { - int i; - -- if (!ublk_queue_ready(ubq)) -- return; -- - for (i = 0; i < ubq->q_depth; i++) { - struct ublk_io *io = &ubq->ios[i]; - -- if (io->flags & UBLK_IO_FLAG_ACTIVE) -- io_uring_cmd_complete_in_task(io->cmd, -- ublk_cmd_cancel_cb); -- } -+ if (io->flags & UBLK_IO_FLAG_ACTIVE) { -+ bool done; - -- /* all io commands are canceled */ -- ubq->nr_io_ready = 0; -+ spin_lock(&ubq->cancel_lock); -+ done = !!(io->flags & UBLK_IO_FLAG_CANCELED); -+ if (!done) -+ io->flags |= UBLK_IO_FLAG_CANCELED; -+ spin_unlock(&ubq->cancel_lock); -+ -+ if (!done) -+ io_uring_cmd_done(io->cmd, -+ UBLK_IO_RES_ABORT, 0, -+ IO_URING_F_UNLOCKED); -+ } -+ } - } - - /* Cancel all pending commands, must be called after del_gendisk() returns */ -@@ -1113,7 +1117,6 @@ static void __ublk_quiesce_dev(struct ublk_device *ub) - blk_mq_quiesce_queue(ub->ub_disk->queue); - ublk_wait_tagset_rqs_idle(ub); - ub->dev_info.state = UBLK_S_DEV_QUIESCED; -- ublk_cancel_dev(ub); - /* we are going to release task_struct of ubq_daemon and resets - * ->ubq_daemon to NULL. So in monitor_work, check on ubq_daemon causes UAF. - * Besides, monitor_work is not necessary in QUIESCED state since we have -@@ -1136,6 +1139,7 @@ static void ublk_quiesce_work_fn(struct work_struct *work) - __ublk_quiesce_dev(ub); - unlock: - mutex_unlock(&ub->mutex); -+ ublk_cancel_dev(ub); - } - - static void ublk_unquiesce_dev(struct ublk_device *ub) -@@ -1175,8 +1179,8 @@ static void ublk_stop_dev(struct ublk_device *ub) - put_disk(ub->ub_disk); - ub->ub_disk = NULL; - unlock: -- ublk_cancel_dev(ub); - mutex_unlock(&ub->mutex); -+ ublk_cancel_dev(ub); - cancel_delayed_work_sync(&ub->monitor_work); - } - -@@ -1353,6 +1357,7 @@ static int ublk_init_queue(struct ublk_device *ub, int q_id) - void *ptr; - int size; - -+ spin_lock_init(&ubq->cancel_lock); - ubq->flags = ub->dev_info.flags; - ubq->q_id = q_id; - ubq->q_depth = ub->dev_info.queue_depth; -@@ -1882,8 +1887,9 @@ static void ublk_queue_reinit(struct ublk_device *ub, struct ublk_queue *ubq) - int i; - - WARN_ON_ONCE(!(ubq->ubq_daemon && ubq_daemon_is_dying(ubq))); -+ - /* All old ioucmds have to be completed */ -- WARN_ON_ONCE(ubq->nr_io_ready); -+ ubq->nr_io_ready = 0; - /* old daemon is PF_EXITING, put it now */ - put_task_struct(ubq->ubq_daemon); - /* We have to reset it to NULL, otherwise ub won't accept new FETCH_REQ */ -diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c -index 4415d850d698b..44dc91555aa00 100644 ---- a/drivers/bluetooth/hci_vhci.c -+++ b/drivers/bluetooth/hci_vhci.c -@@ -11,6 +11,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -44,6 +45,7 @@ struct vhci_data { - bool wakeup; - __u16 msft_opcode; - bool aosp_capable; -+ atomic_t initialized; - }; - - static int vhci_open_dev(struct hci_dev *hdev) -@@ -75,11 +77,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) - - memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); - -- mutex_lock(&data->open_mutex); - skb_queue_tail(&data->readq, skb); -- mutex_unlock(&data->open_mutex); - -- wake_up_interruptible(&data->read_wait); -+ if (atomic_read(&data->initialized)) -+ wake_up_interruptible(&data->read_wait); - return 0; - } - -@@ -363,7 +364,8 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode) - skb_put_u8(skb, 0xff); - skb_put_u8(skb, opcode); - put_unaligned_le16(hdev->id, skb_put(skb, 2)); -- skb_queue_tail(&data->readq, skb); -+ skb_queue_head(&data->readq, skb); -+ atomic_inc(&data->initialized); - - wake_up_interruptible(&data->read_wait); - return 0; -diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c -index 59a2fe2448f17..15c6b85b125d4 100644 ---- a/drivers/bus/ti-sysc.c -+++ b/drivers/bus/ti-sysc.c -@@ -2174,13 +2174,23 @@ static int sysc_reset(struct sysc *ddata) - sysc_val = sysc_read_sysconfig(ddata); - sysc_val |= sysc_mask; - sysc_write(ddata, sysc_offset, sysc_val); -- /* Flush posted write */ -+ -+ /* -+ * Some devices need a delay before reading registers -+ * after reset. Presumably a srst_udelay is not needed -+ * for devices that use a rstctrl register reset. -+ */ -+ if (ddata->cfg.srst_udelay) -+ fsleep(ddata->cfg.srst_udelay); -+ -+ /* -+ * Flush posted write. For devices needing srst_udelay -+ * this should trigger an interconnect error if the -+ * srst_udelay value is needed but not configured. -+ */ - sysc_val = sysc_read_sysconfig(ddata); - } - -- if (ddata->cfg.srst_udelay) -- fsleep(ddata->cfg.srst_udelay); -- - if (ddata->post_reset_quirk) - ddata->post_reset_quirk(ddata); - -diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c -index c22fcaa44a614..6b7d47a52b10a 100644 ---- a/drivers/gpio/gpio-dwapb.c -+++ b/drivers/gpio/gpio-dwapb.c -@@ -283,13 +283,15 @@ static void dwapb_irq_enable(struct irq_data *d) - { - struct gpio_chip *gc = irq_data_get_irq_chip_data(d); - struct dwapb_gpio *gpio = to_dwapb_gpio(gc); -+ irq_hw_number_t hwirq = irqd_to_hwirq(d); - unsigned long flags; - u32 val; - - raw_spin_lock_irqsave(&gc->bgpio_lock, flags); -- val = dwapb_read(gpio, GPIO_INTEN); -- val |= BIT(irqd_to_hwirq(d)); -+ val = dwapb_read(gpio, GPIO_INTEN) | BIT(hwirq); - dwapb_write(gpio, GPIO_INTEN, val); -+ val = dwapb_read(gpio, GPIO_INTMASK) & ~BIT(hwirq); -+ dwapb_write(gpio, GPIO_INTMASK, val); - raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags); - } - -@@ -297,12 +299,14 @@ static void dwapb_irq_disable(struct irq_data *d) - { - struct gpio_chip *gc = irq_data_get_irq_chip_data(d); - struct dwapb_gpio *gpio = to_dwapb_gpio(gc); -+ irq_hw_number_t hwirq = irqd_to_hwirq(d); - unsigned long flags; - u32 val; - - raw_spin_lock_irqsave(&gc->bgpio_lock, flags); -- val = dwapb_read(gpio, GPIO_INTEN); -- val &= ~BIT(irqd_to_hwirq(d)); -+ val = dwapb_read(gpio, GPIO_INTMASK) | BIT(hwirq); -+ dwapb_write(gpio, GPIO_INTMASK, val); -+ val = dwapb_read(gpio, GPIO_INTEN) & ~BIT(hwirq); - dwapb_write(gpio, GPIO_INTEN, val); - raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags); - } -diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c -index 6ab1cf489d035..e40c93f0960b4 100644 ---- a/drivers/gpio/gpiolib-cdev.c -+++ b/drivers/gpio/gpiolib-cdev.c -@@ -2444,10 +2444,7 @@ static int lineinfo_unwatch(struct gpio_chardev_data *cdev, void __user *ip) - return 0; - } - --/* -- * gpio_ioctl() - ioctl handler for the GPIO chardev -- */ --static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -+static long gpio_ioctl_unlocked(struct file *file, unsigned int cmd, unsigned long arg) - { - struct gpio_chardev_data *cdev = file->private_data; - struct gpio_device *gdev = cdev->gdev; -@@ -2484,6 +2481,17 @@ static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - } - } - -+/* -+ * gpio_ioctl() - ioctl handler for the GPIO chardev -+ */ -+static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -+{ -+ struct gpio_chardev_data *cdev = file->private_data; -+ -+ return call_ioctl_locked(file, cmd, arg, cdev->gdev, -+ gpio_ioctl_unlocked); -+} -+ - #ifdef CONFIG_COMPAT - static long gpio_ioctl_compat(struct file *file, unsigned int cmd, - unsigned long arg) -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 6d5f3c5fb4a62..13e0b521e3dba 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -5104,6 +5104,9 @@ static void fill_dc_dirty_rects(struct drm_plane *plane, - if (plane->type == DRM_PLANE_TYPE_CURSOR) - return; - -+ if (new_plane_state->rotation != DRM_MODE_ROTATE_0) -+ goto ffu; -+ - num_clips = drm_plane_get_damage_clips_count(new_plane_state); - clips = drm_plane_get_damage_clips(new_plane_state); - -diff --git a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h -index 848db8676adfd..46c2b991aa108 100644 ---- a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h -+++ b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h -@@ -465,6 +465,7 @@ struct dc_cursor_mi_param { - struct fixed31_32 v_scale_ratio; - enum dc_rotation_angle rotation; - bool mirror; -+ struct dc_stream_state *stream; - }; - - /* IPP related types */ -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -index d84579da64003..009b5861a3fec 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -@@ -3427,7 +3427,8 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx) - .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz, - .v_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.vert, - .rotation = pipe_ctx->plane_state->rotation, -- .mirror = pipe_ctx->plane_state->horizontal_mirror -+ .mirror = pipe_ctx->plane_state->horizontal_mirror, -+ .stream = pipe_ctx->stream, - }; - bool pipe_split_on = false; - bool odm_combine_on = (pipe_ctx->next_odm_pipe != NULL) || -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c -index 4566bc7abf17e..aa252dc263267 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c -@@ -1075,8 +1075,16 @@ void hubp2_cursor_set_position( - if (src_y_offset < 0) - src_y_offset = 0; - /* Save necessary cursor info x, y position. w, h is saved in attribute func. */ -- hubp->cur_rect.x = src_x_offset + param->viewport.x; -- hubp->cur_rect.y = src_y_offset + param->viewport.y; -+ if (param->stream->link->psr_settings.psr_version >= DC_PSR_VERSION_SU_1 && -+ param->rotation != ROTATION_ANGLE_0) { -+ hubp->cur_rect.x = 0; -+ hubp->cur_rect.y = 0; -+ hubp->cur_rect.w = param->stream->timing.h_addressable; -+ hubp->cur_rect.h = param->stream->timing.v_addressable; -+ } else { -+ hubp->cur_rect.x = src_x_offset + param->viewport.x; -+ hubp->cur_rect.y = src_y_offset + param->viewport.y; -+ } - } - - void hubp2_clk_cntl(struct hubp *hubp, bool enable) -diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c -index 53262f6bc40b0..72bec33e371f3 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c -@@ -994,5 +994,8 @@ void dcn30_prepare_bandwidth(struct dc *dc, - dc->clk_mgr->funcs->set_max_memclk(dc->clk_mgr, dc->clk_mgr->bw_params->clk_table.entries[dc->clk_mgr->bw_params->clk_table.num_entries - 1].memclk_mhz); - - dcn20_prepare_bandwidth(dc, context); -+ -+ dc_dmub_srv_p_state_delegate(dc, -+ context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching, context); - } - -diff --git a/drivers/gpu/drm/i915/display/intel_atomic.c b/drivers/gpu/drm/i915/display/intel_atomic.c -index 18f0a5ae3bacd..a502af0b6dd47 100644 ---- a/drivers/gpu/drm/i915/display/intel_atomic.c -+++ b/drivers/gpu/drm/i915/display/intel_atomic.c -@@ -41,6 +41,7 @@ - #include "intel_global_state.h" - #include "intel_hdcp.h" - #include "intel_psr.h" -+#include "intel_fb.h" - #include "skl_universal_plane.h" - - /** -@@ -302,198 +303,6 @@ intel_crtc_destroy_state(struct drm_crtc *crtc, - kfree(crtc_state); - } - --static void intel_atomic_setup_scaler(struct intel_crtc_scaler_state *scaler_state, -- int num_scalers_need, struct intel_crtc *intel_crtc, -- const char *name, int idx, -- struct intel_plane_state *plane_state, -- int *scaler_id) --{ -- struct drm_i915_private *dev_priv = to_i915(intel_crtc->base.dev); -- int j; -- u32 mode; -- -- if (*scaler_id < 0) { -- /* find a free scaler */ -- for (j = 0; j < intel_crtc->num_scalers; j++) { -- if (scaler_state->scalers[j].in_use) -- continue; -- -- *scaler_id = j; -- scaler_state->scalers[*scaler_id].in_use = 1; -- break; -- } -- } -- -- if (drm_WARN(&dev_priv->drm, *scaler_id < 0, -- "Cannot find scaler for %s:%d\n", name, idx)) -- return; -- -- /* set scaler mode */ -- if (plane_state && plane_state->hw.fb && -- plane_state->hw.fb->format->is_yuv && -- plane_state->hw.fb->format->num_planes > 1) { -- struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane); -- if (DISPLAY_VER(dev_priv) == 9) { -- mode = SKL_PS_SCALER_MODE_NV12; -- } else if (icl_is_hdr_plane(dev_priv, plane->id)) { -- /* -- * On gen11+'s HDR planes we only use the scaler for -- * scaling. They have a dedicated chroma upsampler, so -- * we don't need the scaler to upsample the UV plane. -- */ -- mode = PS_SCALER_MODE_NORMAL; -- } else { -- struct intel_plane *linked = -- plane_state->planar_linked_plane; -- -- mode = PS_SCALER_MODE_PLANAR; -- -- if (linked) -- mode |= PS_PLANE_Y_SEL(linked->id); -- } -- } else if (DISPLAY_VER(dev_priv) >= 10) { -- mode = PS_SCALER_MODE_NORMAL; -- } else if (num_scalers_need == 1 && intel_crtc->num_scalers > 1) { -- /* -- * when only 1 scaler is in use on a pipe with 2 scalers -- * scaler 0 operates in high quality (HQ) mode. -- * In this case use scaler 0 to take advantage of HQ mode -- */ -- scaler_state->scalers[*scaler_id].in_use = 0; -- *scaler_id = 0; -- scaler_state->scalers[0].in_use = 1; -- mode = SKL_PS_SCALER_MODE_HQ; -- } else { -- mode = SKL_PS_SCALER_MODE_DYN; -- } -- -- drm_dbg_kms(&dev_priv->drm, "Attached scaler id %u.%u to %s:%d\n", -- intel_crtc->pipe, *scaler_id, name, idx); -- scaler_state->scalers[*scaler_id].mode = mode; --} -- --/** -- * intel_atomic_setup_scalers() - setup scalers for crtc per staged requests -- * @dev_priv: i915 device -- * @intel_crtc: intel crtc -- * @crtc_state: incoming crtc_state to validate and setup scalers -- * -- * This function sets up scalers based on staged scaling requests for -- * a @crtc and its planes. It is called from crtc level check path. If request -- * is a supportable request, it attaches scalers to requested planes and crtc. -- * -- * This function takes into account the current scaler(s) in use by any planes -- * not being part of this atomic state -- * -- * Returns: -- * 0 - scalers were setup succesfully -- * error code - otherwise -- */ --int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv, -- struct intel_crtc *intel_crtc, -- struct intel_crtc_state *crtc_state) --{ -- struct drm_plane *plane = NULL; -- struct intel_plane *intel_plane; -- struct intel_plane_state *plane_state = NULL; -- struct intel_crtc_scaler_state *scaler_state = -- &crtc_state->scaler_state; -- struct drm_atomic_state *drm_state = crtc_state->uapi.state; -- struct intel_atomic_state *intel_state = to_intel_atomic_state(drm_state); -- int num_scalers_need; -- int i; -- -- num_scalers_need = hweight32(scaler_state->scaler_users); -- -- /* -- * High level flow: -- * - staged scaler requests are already in scaler_state->scaler_users -- * - check whether staged scaling requests can be supported -- * - add planes using scalers that aren't in current transaction -- * - assign scalers to requested users -- * - as part of plane commit, scalers will be committed -- * (i.e., either attached or detached) to respective planes in hw -- * - as part of crtc_commit, scaler will be either attached or detached -- * to crtc in hw -- */ -- -- /* fail if required scalers > available scalers */ -- if (num_scalers_need > intel_crtc->num_scalers){ -- drm_dbg_kms(&dev_priv->drm, -- "Too many scaling requests %d > %d\n", -- num_scalers_need, intel_crtc->num_scalers); -- return -EINVAL; -- } -- -- /* walkthrough scaler_users bits and start assigning scalers */ -- for (i = 0; i < sizeof(scaler_state->scaler_users) * 8; i++) { -- int *scaler_id; -- const char *name; -- int idx; -- -- /* skip if scaler not required */ -- if (!(scaler_state->scaler_users & (1 << i))) -- continue; -- -- if (i == SKL_CRTC_INDEX) { -- name = "CRTC"; -- idx = intel_crtc->base.base.id; -- -- /* panel fitter case: assign as a crtc scaler */ -- scaler_id = &scaler_state->scaler_id; -- } else { -- name = "PLANE"; -- -- /* plane scaler case: assign as a plane scaler */ -- /* find the plane that set the bit as scaler_user */ -- plane = drm_state->planes[i].ptr; -- -- /* -- * to enable/disable hq mode, add planes that are using scaler -- * into this transaction -- */ -- if (!plane) { -- struct drm_plane_state *state; -- -- /* -- * GLK+ scalers don't have a HQ mode so it -- * isn't necessary to change between HQ and dyn mode -- * on those platforms. -- */ -- if (DISPLAY_VER(dev_priv) >= 10) -- continue; -- -- plane = drm_plane_from_index(&dev_priv->drm, i); -- state = drm_atomic_get_plane_state(drm_state, plane); -- if (IS_ERR(state)) { -- drm_dbg_kms(&dev_priv->drm, -- "Failed to add [PLANE:%d] to drm_state\n", -- plane->base.id); -- return PTR_ERR(state); -- } -- } -- -- intel_plane = to_intel_plane(plane); -- idx = plane->base.id; -- -- /* plane on different crtc cannot be a scaler user of this crtc */ -- if (drm_WARN_ON(&dev_priv->drm, -- intel_plane->pipe != intel_crtc->pipe)) -- continue; -- -- plane_state = intel_atomic_get_new_plane_state(intel_state, -- intel_plane); -- scaler_id = &plane_state->scaler_id; -- } -- -- intel_atomic_setup_scaler(scaler_state, num_scalers_need, -- intel_crtc, name, idx, -- plane_state, scaler_id); -- } -- -- return 0; --} -- - struct drm_atomic_state * - intel_atomic_state_alloc(struct drm_device *dev) - { -diff --git a/drivers/gpu/drm/i915/display/intel_atomic.h b/drivers/gpu/drm/i915/display/intel_atomic.h -index 1dc439983dd94..e506f6a873447 100644 ---- a/drivers/gpu/drm/i915/display/intel_atomic.h -+++ b/drivers/gpu/drm/i915/display/intel_atomic.h -@@ -52,8 +52,4 @@ struct intel_crtc_state * - intel_atomic_get_crtc_state(struct drm_atomic_state *state, - struct intel_crtc *crtc); - --int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv, -- struct intel_crtc *intel_crtc, -- struct intel_crtc_state *crtc_state); -- - #endif /* __INTEL_ATOMIC_H__ */ -diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c -index 1777a12f2f421..fb8d1d63407a2 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.c -+++ b/drivers/gpu/drm/i915/display/intel_display.c -@@ -6481,6 +6481,17 @@ static int intel_async_flip_check_uapi(struct intel_atomic_state *state, - return -EINVAL; - } - -+ /* -+ * FIXME: Bigjoiner+async flip is busted currently. -+ * Remove this check once the issues are fixed. -+ */ -+ if (new_crtc_state->bigjoiner_pipes) { -+ drm_dbg_kms(&i915->drm, -+ "[CRTC:%d:%s] async flip disallowed with bigjoiner\n", -+ crtc->base.base.id, crtc->base.name); -+ return -EINVAL; -+ } -+ - for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state, - new_plane_state, i) { - if (plane->pipe != crtc->pipe) -diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c -index 23d854bd73b77..c69a638796c62 100644 ---- a/drivers/gpu/drm/i915/display/intel_fb.c -+++ b/drivers/gpu/drm/i915/display/intel_fb.c -@@ -1176,7 +1176,8 @@ bool intel_fb_needs_pot_stride_remap(const struct intel_framebuffer *fb) - { - struct drm_i915_private *i915 = to_i915(fb->base.dev); - -- return IS_ALDERLAKE_P(i915) && fb->base.modifier != DRM_FORMAT_MOD_LINEAR; -+ return (IS_ALDERLAKE_P(i915) || DISPLAY_VER(i915) >= 14) && -+ intel_fb_uses_dpt(&fb->base); - } - - static int intel_fb_pitch(const struct intel_framebuffer *fb, int color_plane, unsigned int rotation) -@@ -1312,9 +1313,11 @@ plane_view_scanout_stride(const struct intel_framebuffer *fb, int color_plane, - unsigned int tile_width, - unsigned int src_stride_tiles, unsigned int dst_stride_tiles) - { -+ struct drm_i915_private *i915 = to_i915(fb->base.dev); - unsigned int stride_tiles; - -- if (IS_ALDERLAKE_P(to_i915(fb->base.dev))) -+ if ((IS_ALDERLAKE_P(i915) || DISPLAY_VER(i915) >= 14) && -+ src_stride_tiles < dst_stride_tiles) - stride_tiles = src_stride_tiles; - else - stride_tiles = dst_stride_tiles; -@@ -1520,7 +1523,8 @@ static void intel_fb_view_init(struct drm_i915_private *i915, struct intel_fb_vi - memset(view, 0, sizeof(*view)); - view->gtt.type = view_type; - -- if (view_type == I915_GTT_VIEW_REMAPPED && IS_ALDERLAKE_P(i915)) -+ if (view_type == I915_GTT_VIEW_REMAPPED && -+ (IS_ALDERLAKE_P(i915) || DISPLAY_VER(i915) >= 14)) - view->gtt.remapped.plane_alignment = SZ_2M / PAGE_SIZE; - } - -diff --git a/drivers/gpu/drm/i915/display/skl_scaler.c b/drivers/gpu/drm/i915/display/skl_scaler.c -index 90f42f63128ec..0b74f91e865d0 100644 ---- a/drivers/gpu/drm/i915/display/skl_scaler.c -+++ b/drivers/gpu/drm/i915/display/skl_scaler.c -@@ -337,6 +337,263 @@ int skl_update_scaler_plane(struct intel_crtc_state *crtc_state, - return 0; - } - -+static int intel_atomic_setup_scaler(struct intel_crtc_scaler_state *scaler_state, -+ int num_scalers_need, struct intel_crtc *intel_crtc, -+ const char *name, int idx, -+ struct intel_plane_state *plane_state, -+ int *scaler_id) -+{ -+ struct drm_i915_private *dev_priv = to_i915(intel_crtc->base.dev); -+ int j; -+ u32 mode; -+ -+ if (*scaler_id < 0) { -+ /* find a free scaler */ -+ for (j = 0; j < intel_crtc->num_scalers; j++) { -+ if (scaler_state->scalers[j].in_use) -+ continue; -+ -+ *scaler_id = j; -+ scaler_state->scalers[*scaler_id].in_use = 1; -+ break; -+ } -+ } -+ -+ if (drm_WARN(&dev_priv->drm, *scaler_id < 0, -+ "Cannot find scaler for %s:%d\n", name, idx)) -+ return -EINVAL; -+ -+ /* set scaler mode */ -+ if (plane_state && plane_state->hw.fb && -+ plane_state->hw.fb->format->is_yuv && -+ plane_state->hw.fb->format->num_planes > 1) { -+ struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane); -+ -+ if (DISPLAY_VER(dev_priv) == 9) { -+ mode = SKL_PS_SCALER_MODE_NV12; -+ } else if (icl_is_hdr_plane(dev_priv, plane->id)) { -+ /* -+ * On gen11+'s HDR planes we only use the scaler for -+ * scaling. They have a dedicated chroma upsampler, so -+ * we don't need the scaler to upsample the UV plane. -+ */ -+ mode = PS_SCALER_MODE_NORMAL; -+ } else { -+ struct intel_plane *linked = -+ plane_state->planar_linked_plane; -+ -+ mode = PS_SCALER_MODE_PLANAR; -+ -+ if (linked) -+ mode |= PS_PLANE_Y_SEL(linked->id); -+ } -+ } else if (DISPLAY_VER(dev_priv) >= 10) { -+ mode = PS_SCALER_MODE_NORMAL; -+ } else if (num_scalers_need == 1 && intel_crtc->num_scalers > 1) { -+ /* -+ * when only 1 scaler is in use on a pipe with 2 scalers -+ * scaler 0 operates in high quality (HQ) mode. -+ * In this case use scaler 0 to take advantage of HQ mode -+ */ -+ scaler_state->scalers[*scaler_id].in_use = 0; -+ *scaler_id = 0; -+ scaler_state->scalers[0].in_use = 1; -+ mode = SKL_PS_SCALER_MODE_HQ; -+ } else { -+ mode = SKL_PS_SCALER_MODE_DYN; -+ } -+ -+ /* -+ * FIXME: we should also check the scaler factors for pfit, so -+ * this shouldn't be tied directly to planes. -+ */ -+ if (plane_state && plane_state->hw.fb) { -+ const struct drm_framebuffer *fb = plane_state->hw.fb; -+ const struct drm_rect *src = &plane_state->uapi.src; -+ const struct drm_rect *dst = &plane_state->uapi.dst; -+ int hscale, vscale, max_vscale, max_hscale; -+ -+ /* -+ * FIXME: When two scalers are needed, but only one of -+ * them needs to downscale, we should make sure that -+ * the one that needs downscaling support is assigned -+ * as the first scaler, so we don't reject downscaling -+ * unnecessarily. -+ */ -+ -+ if (DISPLAY_VER(dev_priv) >= 14) { -+ /* -+ * On versions 14 and up, only the first -+ * scaler supports a vertical scaling factor -+ * of more than 1.0, while a horizontal -+ * scaling factor of 3.0 is supported. -+ */ -+ max_hscale = 0x30000 - 1; -+ if (*scaler_id == 0) -+ max_vscale = 0x30000 - 1; -+ else -+ max_vscale = 0x10000; -+ -+ } else if (DISPLAY_VER(dev_priv) >= 10 || -+ !intel_format_info_is_yuv_semiplanar(fb->format, fb->modifier)) { -+ max_hscale = 0x30000 - 1; -+ max_vscale = 0x30000 - 1; -+ } else { -+ max_hscale = 0x20000 - 1; -+ max_vscale = 0x20000 - 1; -+ } -+ -+ /* -+ * FIXME: We should change the if-else block above to -+ * support HQ vs dynamic scaler properly. -+ */ -+ -+ /* Check if required scaling is within limits */ -+ hscale = drm_rect_calc_hscale(src, dst, 1, max_hscale); -+ vscale = drm_rect_calc_vscale(src, dst, 1, max_vscale); -+ -+ if (hscale < 0 || vscale < 0) { -+ drm_dbg_kms(&dev_priv->drm, -+ "Scaler %d doesn't support required plane scaling\n", -+ *scaler_id); -+ drm_rect_debug_print("src: ", src, true); -+ drm_rect_debug_print("dst: ", dst, false); -+ -+ return -EINVAL; -+ } -+ } -+ -+ drm_dbg_kms(&dev_priv->drm, "Attached scaler id %u.%u to %s:%d\n", -+ intel_crtc->pipe, *scaler_id, name, idx); -+ scaler_state->scalers[*scaler_id].mode = mode; -+ -+ return 0; -+} -+ -+/** -+ * intel_atomic_setup_scalers() - setup scalers for crtc per staged requests -+ * @dev_priv: i915 device -+ * @intel_crtc: intel crtc -+ * @crtc_state: incoming crtc_state to validate and setup scalers -+ * -+ * This function sets up scalers based on staged scaling requests for -+ * a @crtc and its planes. It is called from crtc level check path. If request -+ * is a supportable request, it attaches scalers to requested planes and crtc. -+ * -+ * This function takes into account the current scaler(s) in use by any planes -+ * not being part of this atomic state -+ * -+ * Returns: -+ * 0 - scalers were setup successfully -+ * error code - otherwise -+ */ -+int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv, -+ struct intel_crtc *intel_crtc, -+ struct intel_crtc_state *crtc_state) -+{ -+ struct drm_plane *plane = NULL; -+ struct intel_plane *intel_plane; -+ struct intel_crtc_scaler_state *scaler_state = -+ &crtc_state->scaler_state; -+ struct drm_atomic_state *drm_state = crtc_state->uapi.state; -+ struct intel_atomic_state *intel_state = to_intel_atomic_state(drm_state); -+ int num_scalers_need; -+ int i; -+ -+ num_scalers_need = hweight32(scaler_state->scaler_users); -+ -+ /* -+ * High level flow: -+ * - staged scaler requests are already in scaler_state->scaler_users -+ * - check whether staged scaling requests can be supported -+ * - add planes using scalers that aren't in current transaction -+ * - assign scalers to requested users -+ * - as part of plane commit, scalers will be committed -+ * (i.e., either attached or detached) to respective planes in hw -+ * - as part of crtc_commit, scaler will be either attached or detached -+ * to crtc in hw -+ */ -+ -+ /* fail if required scalers > available scalers */ -+ if (num_scalers_need > intel_crtc->num_scalers) { -+ drm_dbg_kms(&dev_priv->drm, -+ "Too many scaling requests %d > %d\n", -+ num_scalers_need, intel_crtc->num_scalers); -+ return -EINVAL; -+ } -+ -+ /* walkthrough scaler_users bits and start assigning scalers */ -+ for (i = 0; i < sizeof(scaler_state->scaler_users) * 8; i++) { -+ struct intel_plane_state *plane_state = NULL; -+ int *scaler_id; -+ const char *name; -+ int idx, ret; -+ -+ /* skip if scaler not required */ -+ if (!(scaler_state->scaler_users & (1 << i))) -+ continue; -+ -+ if (i == SKL_CRTC_INDEX) { -+ name = "CRTC"; -+ idx = intel_crtc->base.base.id; -+ -+ /* panel fitter case: assign as a crtc scaler */ -+ scaler_id = &scaler_state->scaler_id; -+ } else { -+ name = "PLANE"; -+ -+ /* plane scaler case: assign as a plane scaler */ -+ /* find the plane that set the bit as scaler_user */ -+ plane = drm_state->planes[i].ptr; -+ -+ /* -+ * to enable/disable hq mode, add planes that are using scaler -+ * into this transaction -+ */ -+ if (!plane) { -+ struct drm_plane_state *state; -+ -+ /* -+ * GLK+ scalers don't have a HQ mode so it -+ * isn't necessary to change between HQ and dyn mode -+ * on those platforms. -+ */ -+ if (DISPLAY_VER(dev_priv) >= 10) -+ continue; -+ -+ plane = drm_plane_from_index(&dev_priv->drm, i); -+ state = drm_atomic_get_plane_state(drm_state, plane); -+ if (IS_ERR(state)) { -+ drm_dbg_kms(&dev_priv->drm, -+ "Failed to add [PLANE:%d] to drm_state\n", -+ plane->base.id); -+ return PTR_ERR(state); -+ } -+ } -+ -+ intel_plane = to_intel_plane(plane); -+ idx = plane->base.id; -+ -+ /* plane on different crtc cannot be a scaler user of this crtc */ -+ if (drm_WARN_ON(&dev_priv->drm, -+ intel_plane->pipe != intel_crtc->pipe)) -+ continue; -+ -+ plane_state = intel_atomic_get_new_plane_state(intel_state, -+ intel_plane); -+ scaler_id = &plane_state->scaler_id; -+ } -+ -+ ret = intel_atomic_setup_scaler(scaler_state, num_scalers_need, -+ intel_crtc, name, idx, -+ plane_state, scaler_id); -+ if (ret < 0) -+ return ret; -+ } -+ -+ return 0; -+} -+ - static int glk_coef_tap(int i) - { - return i % 7; -diff --git a/drivers/gpu/drm/i915/display/skl_scaler.h b/drivers/gpu/drm/i915/display/skl_scaler.h -index 0097d5d08e102..f040f6ac061f2 100644 ---- a/drivers/gpu/drm/i915/display/skl_scaler.h -+++ b/drivers/gpu/drm/i915/display/skl_scaler.h -@@ -8,17 +8,22 @@ - #include - - enum drm_scaling_filter; -+enum pipe; - struct drm_i915_private; -+struct intel_crtc; - struct intel_crtc_state; --struct intel_plane_state; - struct intel_plane; --enum pipe; -+struct intel_plane_state; - - int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state); - - int skl_update_scaler_plane(struct intel_crtc_state *crtc_state, - struct intel_plane_state *plane_state); - -+int intel_atomic_setup_scalers(struct drm_i915_private *dev_priv, -+ struct intel_crtc *intel_crtc, -+ struct intel_crtc_state *crtc_state); -+ - void skl_pfit_enable(const struct intel_crtc_state *crtc_state); - - void skl_program_plane_scaler(struct intel_plane *plane, -@@ -26,4 +31,5 @@ void skl_program_plane_scaler(struct intel_plane *plane, - const struct intel_plane_state *plane_state); - void skl_detach_scalers(const struct intel_crtc_state *crtc_state); - void skl_scaler_disable(const struct intel_crtc_state *old_crtc_state); -+ - #endif -diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c -index b96ae15e0ad91..6d35bb3974818 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-acpi.c -+++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c -@@ -39,8 +39,13 @@ static const struct acpi_device_id i2c_hid_acpi_blacklist[] = { - * The CHPN0001 ACPI device, which is used to describe the Chipone - * ICN8505 controller, has a _CID of PNP0C50 but is not HID compatible. - */ -- {"CHPN0001", 0 }, -- { }, -+ { "CHPN0001" }, -+ /* -+ * The IDEA5002 ACPI device causes high interrupt usage and spurious -+ * wakeups from suspend. -+ */ -+ { "IDEA5002" }, -+ { } - }; - - /* HID I²C Device: 3cdff6f7-4267-4555-ad05-b30a3d8938de */ -@@ -115,9 +120,9 @@ static int i2c_hid_acpi_probe(struct i2c_client *client) - } - - static const struct acpi_device_id i2c_hid_acpi_match[] = { -- {"ACPI0C50", 0 }, -- {"PNP0C50", 0 }, -- { }, -+ { "ACPI0C50" }, -+ { "PNP0C50" }, -+ { } - }; - MODULE_DEVICE_TABLE(acpi, i2c_hid_acpi_match); - -diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c -index 6adf3b141316b..86daf791aa27c 100644 ---- a/drivers/i2c/busses/i2c-aspeed.c -+++ b/drivers/i2c/busses/i2c-aspeed.c -@@ -249,18 +249,46 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status) - if (!slave) - return 0; - -- command = readl(bus->base + ASPEED_I2C_CMD_REG); -+ /* -+ * Handle stop conditions early, prior to SLAVE_MATCH. Some masters may drive -+ * transfers with low enough latency between the nak/stop phase of the current -+ * command and the start/address phase of the following command that the -+ * interrupts are coalesced by the time we process them. -+ */ -+ if (irq_status & ASPEED_I2CD_INTR_NORMAL_STOP) { -+ irq_handled |= ASPEED_I2CD_INTR_NORMAL_STOP; -+ bus->slave_state = ASPEED_I2C_SLAVE_STOP; -+ } -+ -+ if (irq_status & ASPEED_I2CD_INTR_TX_NAK && -+ bus->slave_state == ASPEED_I2C_SLAVE_READ_PROCESSED) { -+ irq_handled |= ASPEED_I2CD_INTR_TX_NAK; -+ bus->slave_state = ASPEED_I2C_SLAVE_STOP; -+ } -+ -+ /* Propagate any stop conditions to the slave implementation. */ -+ if (bus->slave_state == ASPEED_I2C_SLAVE_STOP) { -+ i2c_slave_event(slave, I2C_SLAVE_STOP, &value); -+ bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE; -+ } - -- /* Slave was requested, restart state machine. */ -+ /* -+ * Now that we've dealt with any potentially coalesced stop conditions, -+ * address any start conditions. -+ */ - if (irq_status & ASPEED_I2CD_INTR_SLAVE_MATCH) { - irq_handled |= ASPEED_I2CD_INTR_SLAVE_MATCH; - bus->slave_state = ASPEED_I2C_SLAVE_START; - } - -- /* Slave is not currently active, irq was for someone else. */ -+ /* -+ * If the slave has been stopped and not started then slave interrupt -+ * handling is complete. -+ */ - if (bus->slave_state == ASPEED_I2C_SLAVE_INACTIVE) - return irq_handled; - -+ command = readl(bus->base + ASPEED_I2C_CMD_REG); - dev_dbg(bus->dev, "slave irq status 0x%08x, cmd 0x%08x\n", - irq_status, command); - -@@ -279,17 +307,6 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status) - irq_handled |= ASPEED_I2CD_INTR_RX_DONE; - } - -- /* Slave was asked to stop. */ -- if (irq_status & ASPEED_I2CD_INTR_NORMAL_STOP) { -- irq_handled |= ASPEED_I2CD_INTR_NORMAL_STOP; -- bus->slave_state = ASPEED_I2C_SLAVE_STOP; -- } -- if (irq_status & ASPEED_I2CD_INTR_TX_NAK && -- bus->slave_state == ASPEED_I2C_SLAVE_READ_PROCESSED) { -- irq_handled |= ASPEED_I2CD_INTR_TX_NAK; -- bus->slave_state = ASPEED_I2C_SLAVE_STOP; -- } -- - switch (bus->slave_state) { - case ASPEED_I2C_SLAVE_READ_REQUESTED: - if (unlikely(irq_status & ASPEED_I2CD_INTR_TX_ACK)) -@@ -324,8 +341,7 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status) - i2c_slave_event(slave, I2C_SLAVE_WRITE_RECEIVED, &value); - break; - case ASPEED_I2C_SLAVE_STOP: -- i2c_slave_event(slave, I2C_SLAVE_STOP, &value); -- bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE; -+ /* Stop event handling is done early. Unreachable. */ - break; - case ASPEED_I2C_SLAVE_START: - /* Slave was just started. Waiting for the next event. */; -diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c -index 642c5c4895e37..3ac253a27dd97 100644 ---- a/drivers/iio/adc/ti_am335x_adc.c -+++ b/drivers/iio/adc/ti_am335x_adc.c -@@ -671,8 +671,10 @@ static int tiadc_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, indio_dev); - - err = tiadc_request_dma(pdev, adc_dev); -- if (err && err == -EPROBE_DEFER) -+ if (err && err != -ENODEV) { -+ dev_err_probe(&pdev->dev, err, "DMA request failed\n"); - goto err_dma; -+ } - - return 0; - -diff --git a/drivers/iio/buffer/industrialio-triggered-buffer.c b/drivers/iio/buffer/industrialio-triggered-buffer.c -index 8d4fc97d10059..2b7873e8a959b 100644 ---- a/drivers/iio/buffer/industrialio-triggered-buffer.c -+++ b/drivers/iio/buffer/industrialio-triggered-buffer.c -@@ -46,6 +46,16 @@ int iio_triggered_buffer_setup_ext(struct iio_dev *indio_dev, - struct iio_buffer *buffer; - int ret; - -+ /* -+ * iio_triggered_buffer_cleanup() assumes that the buffer allocated here -+ * is assigned to indio_dev->buffer but this is only the case if this -+ * function is the first caller to iio_device_attach_buffer(). If -+ * indio_dev->buffer is already set then we can't proceed otherwise the -+ * cleanup function will try to free a buffer that was not allocated here. -+ */ -+ if (indio_dev->buffer) -+ return -EADDRINUSE; -+ - buffer = iio_kfifo_allocate(); - if (!buffer) { - ret = -ENOMEM; -diff --git a/drivers/iio/common/ms_sensors/ms_sensors_i2c.c b/drivers/iio/common/ms_sensors/ms_sensors_i2c.c -index 6633b35a94e69..9c9bc77003c7f 100644 ---- a/drivers/iio/common/ms_sensors/ms_sensors_i2c.c -+++ b/drivers/iio/common/ms_sensors/ms_sensors_i2c.c -@@ -15,8 +15,8 @@ - /* Conversion times in us */ - static const u16 ms_sensors_ht_t_conversion_time[] = { 50000, 25000, - 13000, 7000 }; --static const u16 ms_sensors_ht_h_conversion_time[] = { 16000, 3000, -- 5000, 8000 }; -+static const u16 ms_sensors_ht_h_conversion_time[] = { 16000, 5000, -+ 3000, 8000 }; - static const u16 ms_sensors_tp_conversion_time[] = { 500, 1100, 2100, - 4100, 8220, 16440 }; - -diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c -index 86fbbe9040503..19a1ef5351d24 100644 ---- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c -+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c -@@ -736,13 +736,13 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev, - ret = inv_mpu6050_sensor_show(st, st->reg->gyro_offset, - chan->channel2, val); - mutex_unlock(&st->lock); -- return IIO_VAL_INT; -+ return ret; - case IIO_ACCEL: - mutex_lock(&st->lock); - ret = inv_mpu6050_sensor_show(st, st->reg->accl_offset, - chan->channel2, val); - mutex_unlock(&st->lock); -- return IIO_VAL_INT; -+ return ret; - - default: - return -EINVAL; -diff --git a/drivers/input/keyboard/ipaq-micro-keys.c b/drivers/input/keyboard/ipaq-micro-keys.c -index 13a66a8e3411f..e0c51189e329c 100644 ---- a/drivers/input/keyboard/ipaq-micro-keys.c -+++ b/drivers/input/keyboard/ipaq-micro-keys.c -@@ -105,6 +105,9 @@ static int micro_key_probe(struct platform_device *pdev) - keys->codes = devm_kmemdup(&pdev->dev, micro_keycodes, - keys->input->keycodesize * keys->input->keycodemax, - GFP_KERNEL); -+ if (!keys->codes) -+ return -ENOMEM; -+ - keys->input->keycode = keys->codes; - - __set_bit(EV_KEY, keys->input->evbit); -diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c -index e79f5497948b8..9116f4248fd09 100644 ---- a/drivers/input/misc/soc_button_array.c -+++ b/drivers/input/misc/soc_button_array.c -@@ -299,6 +299,11 @@ static int soc_button_parse_btn_desc(struct device *dev, - info->name = "power"; - info->event_code = KEY_POWER; - info->wakeup = true; -+ } else if (upage == 0x01 && usage == 0xc6) { -+ info->name = "airplane mode switch"; -+ info->event_type = EV_SW; -+ info->event_code = SW_RFKILL_ALL; -+ info->active_low = false; - } else if (upage == 0x01 && usage == 0xca) { - info->name = "rotation lock switch"; - info->event_type = EV_SW; -diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c -index 0c6fc954e7296..1d9494f64a215 100644 ---- a/drivers/interconnect/core.c -+++ b/drivers/interconnect/core.c -@@ -381,6 +381,9 @@ struct icc_node_data *of_icc_get_from_provider(struct of_phandle_args *spec) - } - mutex_unlock(&icc_lock); - -+ if (!node) -+ return ERR_PTR(-EINVAL); -+ - if (IS_ERR(node)) - return ERR_CAST(node); - -diff --git a/drivers/interconnect/qcom/sm8250.c b/drivers/interconnect/qcom/sm8250.c -index 5cdb058fa0959..9c2dd40d9a559 100644 ---- a/drivers/interconnect/qcom/sm8250.c -+++ b/drivers/interconnect/qcom/sm8250.c -@@ -551,6 +551,7 @@ static struct platform_driver qnoc_driver = { - .driver = { - .name = "qnoc-sm8250", - .of_match_table = qnoc_of_match, -+ .sync_state = icc_sync_state, - }, - }; - module_platform_driver(qnoc_driver); -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 382c5cc471952..100a6a236d92a 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -1914,6 +1914,13 @@ void dm_bufio_client_destroy(struct dm_bufio_client *c) - } - EXPORT_SYMBOL_GPL(dm_bufio_client_destroy); - -+void dm_bufio_client_reset(struct dm_bufio_client *c) -+{ -+ drop_buffers(c); -+ flush_work(&c->shrink_work); -+} -+EXPORT_SYMBOL_GPL(dm_bufio_client_reset); -+ - void dm_bufio_set_sector_offset(struct dm_bufio_client *c, sector_t start) - { - c->start = start; -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index fe7dad3ffa75f..77fcff82c82ac 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -1763,11 +1763,12 @@ static void integrity_metadata(struct work_struct *w) - sectors_to_process = dio->range.n_sectors; - - __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) { -+ struct bio_vec bv_copy = bv; - unsigned int pos; - char *mem, *checksums_ptr; - - again: -- mem = bvec_kmap_local(&bv); -+ mem = bvec_kmap_local(&bv_copy); - pos = 0; - checksums_ptr = checksums; - do { -@@ -1776,7 +1777,7 @@ again: - sectors_to_process -= ic->sectors_per_block; - pos += ic->sectors_per_block << SECTOR_SHIFT; - sector += ic->sectors_per_block; -- } while (pos < bv.bv_len && sectors_to_process && checksums != checksums_onstack); -+ } while (pos < bv_copy.bv_len && sectors_to_process && checksums != checksums_onstack); - kunmap_local(mem); - - r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset, -@@ -1801,9 +1802,9 @@ again: - if (!sectors_to_process) - break; - -- if (unlikely(pos < bv.bv_len)) { -- bv.bv_offset += pos; -- bv.bv_len -= pos; -+ if (unlikely(pos < bv_copy.bv_len)) { -+ bv_copy.bv_offset += pos; -+ bv_copy.bv_len -= pos; - goto again; - } - } -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 4a0e15109997b..bb0e0a270f62a 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -597,6 +597,8 @@ static int __format_metadata(struct dm_pool_metadata *pmd) - r = dm_tm_create_with_sm(pmd->bm, THIN_SUPERBLOCK_LOCATION, - &pmd->tm, &pmd->metadata_sm); - if (r < 0) { -+ pmd->tm = NULL; -+ pmd->metadata_sm = NULL; - DMERR("tm_create_with_sm failed"); - return r; - } -@@ -605,6 +607,7 @@ static int __format_metadata(struct dm_pool_metadata *pmd) - if (IS_ERR(pmd->data_sm)) { - DMERR("sm_disk_create failed"); - r = PTR_ERR(pmd->data_sm); -+ pmd->data_sm = NULL; - goto bad_cleanup_tm; - } - -@@ -635,11 +638,15 @@ static int __format_metadata(struct dm_pool_metadata *pmd) - - bad_cleanup_nb_tm: - dm_tm_destroy(pmd->nb_tm); -+ pmd->nb_tm = NULL; - bad_cleanup_data_sm: - dm_sm_destroy(pmd->data_sm); -+ pmd->data_sm = NULL; - bad_cleanup_tm: - dm_tm_destroy(pmd->tm); -+ pmd->tm = NULL; - dm_sm_destroy(pmd->metadata_sm); -+ pmd->metadata_sm = NULL; - - return r; - } -@@ -705,6 +712,8 @@ static int __open_metadata(struct dm_pool_metadata *pmd) - sizeof(disk_super->metadata_space_map_root), - &pmd->tm, &pmd->metadata_sm); - if (r < 0) { -+ pmd->tm = NULL; -+ pmd->metadata_sm = NULL; - DMERR("tm_open_with_sm failed"); - goto bad_unlock_sblock; - } -@@ -714,6 +723,7 @@ static int __open_metadata(struct dm_pool_metadata *pmd) - if (IS_ERR(pmd->data_sm)) { - DMERR("sm_disk_open failed"); - r = PTR_ERR(pmd->data_sm); -+ pmd->data_sm = NULL; - goto bad_cleanup_tm; - } - -@@ -740,9 +750,12 @@ static int __open_metadata(struct dm_pool_metadata *pmd) - - bad_cleanup_data_sm: - dm_sm_destroy(pmd->data_sm); -+ pmd->data_sm = NULL; - bad_cleanup_tm: - dm_tm_destroy(pmd->tm); -+ pmd->tm = NULL; - dm_sm_destroy(pmd->metadata_sm); -+ pmd->metadata_sm = NULL; - bad_unlock_sblock: - dm_bm_unlock(sblock); - -@@ -789,9 +802,13 @@ static void __destroy_persistent_data_objects(struct dm_pool_metadata *pmd, - bool destroy_bm) - { - dm_sm_destroy(pmd->data_sm); -+ pmd->data_sm = NULL; - dm_sm_destroy(pmd->metadata_sm); -+ pmd->metadata_sm = NULL; - dm_tm_destroy(pmd->nb_tm); -+ pmd->nb_tm = NULL; - dm_tm_destroy(pmd->tm); -+ pmd->tm = NULL; - if (destroy_bm) - dm_block_manager_destroy(pmd->bm); - } -@@ -999,8 +1016,7 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd) - __func__, r); - } - pmd_write_unlock(pmd); -- if (!pmd->fail_io) -- __destroy_persistent_data_objects(pmd, true); -+ __destroy_persistent_data_objects(pmd, true); - - kfree(pmd); - return 0; -@@ -1875,53 +1891,29 @@ static void __set_abort_with_changes_flags(struct dm_pool_metadata *pmd) - int dm_pool_abort_metadata(struct dm_pool_metadata *pmd) - { - int r = -EINVAL; -- struct dm_block_manager *old_bm = NULL, *new_bm = NULL; - - /* fail_io is double-checked with pmd->root_lock held below */ - if (unlikely(pmd->fail_io)) - return r; - -- /* -- * Replacement block manager (new_bm) is created and old_bm destroyed outside of -- * pmd root_lock to avoid ABBA deadlock that would result (due to life-cycle of -- * shrinker associated with the block manager's bufio client vs pmd root_lock). -- * - must take shrinker_rwsem without holding pmd->root_lock -- */ -- new_bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE << SECTOR_SHIFT, -- THIN_MAX_CONCURRENT_LOCKS); -- - pmd_write_lock(pmd); - if (pmd->fail_io) { - pmd_write_unlock(pmd); -- goto out; -+ return r; - } -- - __set_abort_with_changes_flags(pmd); -+ -+ /* destroy data_sm/metadata_sm/nb_tm/tm */ - __destroy_persistent_data_objects(pmd, false); -- old_bm = pmd->bm; -- if (IS_ERR(new_bm)) { -- DMERR("could not create block manager during abort"); -- pmd->bm = NULL; -- r = PTR_ERR(new_bm); -- goto out_unlock; -- } - -- pmd->bm = new_bm; -+ /* reset bm */ -+ dm_block_manager_reset(pmd->bm); -+ -+ /* rebuild data_sm/metadata_sm/nb_tm/tm */ - r = __open_or_format_metadata(pmd, false); -- if (r) { -- pmd->bm = NULL; -- goto out_unlock; -- } -- new_bm = NULL; --out_unlock: - if (r) - pmd->fail_io = true; - pmd_write_unlock(pmd); -- dm_block_manager_destroy(old_bm); --out: -- if (new_bm && !IS_ERR(new_bm)) -- dm_block_manager_destroy(new_bm); -- - return r; - } - -diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c -index 1f40100908d7c..2bbfbb704c751 100644 ---- a/drivers/md/persistent-data/dm-block-manager.c -+++ b/drivers/md/persistent-data/dm-block-manager.c -@@ -415,6 +415,12 @@ void dm_block_manager_destroy(struct dm_block_manager *bm) - } - EXPORT_SYMBOL_GPL(dm_block_manager_destroy); - -+void dm_block_manager_reset(struct dm_block_manager *bm) -+{ -+ dm_bufio_client_reset(bm->bufio); -+} -+EXPORT_SYMBOL_GPL(dm_block_manager_reset); -+ - unsigned int dm_bm_block_size(struct dm_block_manager *bm) - { - return dm_bufio_get_block_size(bm->bufio); -diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h -index 58a23b8ec1902..4371d85d3c258 100644 ---- a/drivers/md/persistent-data/dm-block-manager.h -+++ b/drivers/md/persistent-data/dm-block-manager.h -@@ -35,6 +35,7 @@ struct dm_block_manager *dm_block_manager_create( - struct block_device *bdev, unsigned int block_size, - unsigned int max_held_per_thread); - void dm_block_manager_destroy(struct dm_block_manager *bm); -+void dm_block_manager_reset(struct dm_block_manager *bm); - - unsigned int dm_bm_block_size(struct dm_block_manager *bm); - dm_block_t dm_bm_nr_blocks(struct dm_block_manager *bm); -diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h -index a015cd11f6e97..85aa0a3974fe0 100644 ---- a/drivers/md/persistent-data/dm-space-map.h -+++ b/drivers/md/persistent-data/dm-space-map.h -@@ -76,7 +76,8 @@ struct dm_space_map { - - static inline void dm_sm_destroy(struct dm_space_map *sm) - { -- sm->destroy(sm); -+ if (sm) -+ sm->destroy(sm); - } - - static inline int dm_sm_extend(struct dm_space_map *sm, dm_block_t extra_blocks) -diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c -index 39885f8355847..557a3ecfe75a0 100644 ---- a/drivers/md/persistent-data/dm-transaction-manager.c -+++ b/drivers/md/persistent-data/dm-transaction-manager.c -@@ -197,6 +197,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blocking_clone); - - void dm_tm_destroy(struct dm_transaction_manager *tm) - { -+ if (!tm) -+ return; -+ - if (!tm->is_clone) - wipe_shadow_table(tm); - -diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -index 5935be190b9e2..5f2a6fcba9670 100644 ---- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -@@ -866,10 +866,13 @@ static int atl1e_setup_ring_resources(struct atl1e_adapter *adapter) - netdev_err(adapter->netdev, "offset(%d) > ring size(%d) !!\n", - offset, adapter->ring_size); - err = -1; -- goto failed; -+ goto free_buffer; - } - - return 0; -+free_buffer: -+ kfree(tx_ring->tx_buffer); -+ tx_ring->tx_buffer = NULL; - failed: - if (adapter->ring_vir_addr != NULL) { - dma_free_coherent(&pdev->dev, adapter->ring_size, -diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c -index bfddbff7bcdfb..28fb643d2917f 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c -+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c -@@ -399,9 +399,10 @@ static int otx2_dcbnl_ieee_getpfc(struct net_device *dev, struct ieee_pfc *pfc) - static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc) - { - struct otx2_nic *pfvf = netdev_priv(dev); -+ u8 old_pfc_en; - int err; - -- /* Save PFC configuration to interface */ -+ old_pfc_en = pfvf->pfc_en; - pfvf->pfc_en = pfc->pfc_en; - - if (pfvf->hw.tx_queues >= NIX_PF_PFC_PRIO_MAX) -@@ -411,13 +412,17 @@ static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc) - * supported by the tx queue configuration - */ - err = otx2_check_pfc_config(pfvf); -- if (err) -+ if (err) { -+ pfvf->pfc_en = old_pfc_en; - return err; -+ } - - process_pfc: - err = otx2_config_priority_flow_ctrl(pfvf); -- if (err) -+ if (err) { -+ pfvf->pfc_en = old_pfc_en; - return err; -+ } - - /* Request Per channel Bpids */ - if (pfc->pfc_en) -@@ -425,6 +430,12 @@ process_pfc: - - err = otx2_pfc_txschq_update(pfvf); - if (err) { -+ if (pfc->pfc_en) -+ otx2_nix_config_bp(pfvf, false); -+ -+ otx2_pfc_txschq_stop(pfvf); -+ pfvf->pfc_en = old_pfc_en; -+ otx2_config_priority_flow_ctrl(pfvf); - dev_err(pfvf->dev, "%s failed to update TX schedulers\n", __func__); - return err; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index b3253e263ebc8..ac6a0785b10d8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -48,6 +48,25 @@ - #define CREATE_TRACE_POINTS - #include "diag/cmd_tracepoint.h" - -+struct mlx5_ifc_mbox_out_bits { -+ u8 status[0x8]; -+ u8 reserved_at_8[0x18]; -+ -+ u8 syndrome[0x20]; -+ -+ u8 reserved_at_40[0x40]; -+}; -+ -+struct mlx5_ifc_mbox_in_bits { -+ u8 opcode[0x10]; -+ u8 uid[0x10]; -+ -+ u8 reserved_at_20[0x10]; -+ u8 op_mod[0x10]; -+ -+ u8 reserved_at_40[0x40]; -+}; -+ - enum { - CMD_IF_REV = 5, - }; -@@ -71,6 +90,26 @@ enum { - MLX5_CMD_DELIVERY_STAT_CMD_DESCR_ERR = 0x10, - }; - -+static u16 in_to_opcode(void *in) -+{ -+ return MLX5_GET(mbox_in, in, opcode); -+} -+ -+/* Returns true for opcodes that might be triggered very frequently and throttle -+ * the command interface. Limit their command slots usage. -+ */ -+static bool mlx5_cmd_is_throttle_opcode(u16 op) -+{ -+ switch (op) { -+ case MLX5_CMD_OP_CREATE_GENERAL_OBJECT: -+ case MLX5_CMD_OP_DESTROY_GENERAL_OBJECT: -+ case MLX5_CMD_OP_MODIFY_GENERAL_OBJECT: -+ case MLX5_CMD_OP_QUERY_GENERAL_OBJECT: -+ return true; -+ } -+ return false; -+} -+ - static struct mlx5_cmd_work_ent * - cmd_alloc_ent(struct mlx5_cmd *cmd, struct mlx5_cmd_msg *in, - struct mlx5_cmd_msg *out, void *uout, int uout_size, -@@ -92,6 +131,7 @@ cmd_alloc_ent(struct mlx5_cmd *cmd, struct mlx5_cmd_msg *in, - ent->context = context; - ent->cmd = cmd; - ent->page_queue = page_queue; -+ ent->op = in_to_opcode(in->first.data); - refcount_set(&ent->refcnt, 1); - - return ent; -@@ -116,24 +156,27 @@ static u8 alloc_token(struct mlx5_cmd *cmd) - return token; - } - --static int cmd_alloc_index(struct mlx5_cmd *cmd) -+static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent) - { - unsigned long flags; - int ret; - - spin_lock_irqsave(&cmd->alloc_lock, flags); -- ret = find_first_bit(&cmd->bitmask, cmd->max_reg_cmds); -- if (ret < cmd->max_reg_cmds) -- clear_bit(ret, &cmd->bitmask); -+ ret = find_first_bit(&cmd->vars.bitmask, cmd->vars.max_reg_cmds); -+ if (ret < cmd->vars.max_reg_cmds) { -+ clear_bit(ret, &cmd->vars.bitmask); -+ ent->idx = ret; -+ cmd->ent_arr[ent->idx] = ent; -+ } - spin_unlock_irqrestore(&cmd->alloc_lock, flags); - -- return ret < cmd->max_reg_cmds ? ret : -ENOMEM; -+ return ret < cmd->vars.max_reg_cmds ? ret : -ENOMEM; - } - - static void cmd_free_index(struct mlx5_cmd *cmd, int idx) - { - lockdep_assert_held(&cmd->alloc_lock); -- set_bit(idx, &cmd->bitmask); -+ set_bit(idx, &cmd->vars.bitmask); - } - - static void cmd_ent_get(struct mlx5_cmd_work_ent *ent) -@@ -152,7 +195,7 @@ static void cmd_ent_put(struct mlx5_cmd_work_ent *ent) - - if (ent->idx >= 0) { - cmd_free_index(cmd, ent->idx); -- up(ent->page_queue ? &cmd->pages_sem : &cmd->sem); -+ up(ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem); - } - - cmd_free_ent(ent); -@@ -162,7 +205,7 @@ out: - - static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx) - { -- return cmd->cmd_buf + (idx << cmd->log_stride); -+ return cmd->cmd_buf + (idx << cmd->vars.log_stride); - } - - static int mlx5_calc_cmd_blocks(struct mlx5_cmd_msg *msg) -@@ -753,25 +796,6 @@ static int cmd_status_to_err(u8 status) - } - } - --struct mlx5_ifc_mbox_out_bits { -- u8 status[0x8]; -- u8 reserved_at_8[0x18]; -- -- u8 syndrome[0x20]; -- -- u8 reserved_at_40[0x40]; --}; -- --struct mlx5_ifc_mbox_in_bits { -- u8 opcode[0x10]; -- u8 uid[0x10]; -- -- u8 reserved_at_20[0x10]; -- u8 op_mod[0x10]; -- -- u8 reserved_at_40[0x40]; --}; -- - void mlx5_cmd_out_err(struct mlx5_core_dev *dev, u16 opcode, u16 op_mod, void *out) - { - u32 syndrome = MLX5_GET(mbox_out, out, syndrome); -@@ -789,7 +813,7 @@ static void cmd_status_print(struct mlx5_core_dev *dev, void *in, void *out) - u16 opcode, op_mod; - u16 uid; - -- opcode = MLX5_GET(mbox_in, in, opcode); -+ opcode = in_to_opcode(in); - op_mod = MLX5_GET(mbox_in, in, op_mod); - uid = MLX5_GET(mbox_in, in, uid); - -@@ -801,7 +825,7 @@ int mlx5_cmd_check(struct mlx5_core_dev *dev, int err, void *in, void *out) - { - /* aborted due to PCI error or via reset flow mlx5_cmd_trigger_completions() */ - if (err == -ENXIO) { -- u16 opcode = MLX5_GET(mbox_in, in, opcode); -+ u16 opcode = in_to_opcode(in); - u32 syndrome; - u8 status; - -@@ -830,9 +854,9 @@ static void dump_command(struct mlx5_core_dev *dev, - struct mlx5_cmd_work_ent *ent, int input) - { - struct mlx5_cmd_msg *msg = input ? ent->in : ent->out; -- u16 op = MLX5_GET(mbox_in, ent->lay->in, opcode); - struct mlx5_cmd_mailbox *next = msg->next; - int n = mlx5_calc_cmd_blocks(msg); -+ u16 op = ent->op; - int data_only; - u32 offset = 0; - int dump_len; -@@ -884,11 +908,6 @@ static void dump_command(struct mlx5_core_dev *dev, - mlx5_core_dbg(dev, "cmd[%d]: end dump\n", ent->idx); - } - --static u16 msg_to_opcode(struct mlx5_cmd_msg *in) --{ -- return MLX5_GET(mbox_in, in->first.data, opcode); --} -- - static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced); - - static void cb_timeout_handler(struct work_struct *work) -@@ -906,13 +925,13 @@ static void cb_timeout_handler(struct work_struct *work) - /* Maybe got handled by eq recover ? */ - if (!test_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state)) { - mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) Async, recovered after timeout\n", ent->idx, -- mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); -+ mlx5_command_str(ent->op), ent->op); - goto out; /* phew, already handled */ - } - - ent->ret = -ETIMEDOUT; - mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) Async, timeout. Will cause a leak of a command resource\n", -- ent->idx, mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); -+ ent->idx, mlx5_command_str(ent->op), ent->op); - mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true); - - out: -@@ -955,10 +974,10 @@ static void cmd_work_handler(struct work_struct *work) - cb_timeout = msecs_to_jiffies(mlx5_tout_ms(dev, CMD)); - - complete(&ent->handling); -- sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem; -+ sem = ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem; - down(sem); - if (!ent->page_queue) { -- alloc_ret = cmd_alloc_index(cmd); -+ alloc_ret = cmd_alloc_index(cmd, ent); - if (alloc_ret < 0) { - mlx5_core_err_rl(dev, "failed to allocate command entry\n"); - if (ent->callback) { -@@ -973,20 +992,18 @@ static void cmd_work_handler(struct work_struct *work) - up(sem); - return; - } -- ent->idx = alloc_ret; - } else { -- ent->idx = cmd->max_reg_cmds; -+ ent->idx = cmd->vars.max_reg_cmds; - spin_lock_irqsave(&cmd->alloc_lock, flags); -- clear_bit(ent->idx, &cmd->bitmask); -+ clear_bit(ent->idx, &cmd->vars.bitmask); -+ cmd->ent_arr[ent->idx] = ent; - spin_unlock_irqrestore(&cmd->alloc_lock, flags); - } - -- cmd->ent_arr[ent->idx] = ent; - lay = get_inst(cmd, ent->idx); - ent->lay = lay; - memset(lay, 0, sizeof(*lay)); - memcpy(lay->in, ent->in->first.data, sizeof(lay->in)); -- ent->op = be32_to_cpu(lay->in[0]) >> 16; - if (ent->in->next) - lay->in_ptr = cpu_to_be64(ent->in->next->dma); - lay->inlen = cpu_to_be32(ent->in->len); -@@ -1099,12 +1116,12 @@ static void wait_func_handle_exec_timeout(struct mlx5_core_dev *dev, - */ - if (wait_for_completion_timeout(&ent->done, timeout)) { - mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) recovered after timeout\n", ent->idx, -- mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); -+ mlx5_command_str(ent->op), ent->op); - return; - } - - mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) No done completion\n", ent->idx, -- mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); -+ mlx5_command_str(ent->op), ent->op); - - ent->ret = -ETIMEDOUT; - mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true); -@@ -1131,12 +1148,10 @@ out_err: - - if (err == -ETIMEDOUT) { - mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n", -- mlx5_command_str(msg_to_opcode(ent->in)), -- msg_to_opcode(ent->in)); -+ mlx5_command_str(ent->op), ent->op); - } else if (err == -ECANCELED) { - mlx5_core_warn(dev, "%s(0x%x) canceled on out of queue timeout.\n", -- mlx5_command_str(msg_to_opcode(ent->in)), -- msg_to_opcode(ent->in)); -+ mlx5_command_str(ent->op), ent->op); - } - mlx5_core_dbg(dev, "err %d, delivery status %s(%d)\n", - err, deliv_status_to_str(ent->status), ent->status); -@@ -1170,7 +1185,6 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, - u8 status = 0; - int err = 0; - s64 ds; -- u16 op; - - if (callback && page_queue) - return -EINVAL; -@@ -1210,9 +1224,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, - goto out_free; - - ds = ent->ts2 - ent->ts1; -- op = MLX5_GET(mbox_in, in->first.data, opcode); -- if (op < MLX5_CMD_OP_MAX) { -- stats = &cmd->stats[op]; -+ if (ent->op < MLX5_CMD_OP_MAX) { -+ stats = &cmd->stats[ent->op]; - spin_lock_irq(&stats->lock); - stats->sum += ds; - ++stats->n; -@@ -1220,7 +1233,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, - } - mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME, - "fw exec time for %s is %lld nsec\n", -- mlx5_command_str(op), ds); -+ mlx5_command_str(ent->op), ds); - - out_free: - status = ent->status; -@@ -1558,15 +1571,15 @@ void mlx5_cmd_allowed_opcode(struct mlx5_core_dev *dev, u16 opcode) - struct mlx5_cmd *cmd = &dev->cmd; - int i; - -- for (i = 0; i < cmd->max_reg_cmds; i++) -- down(&cmd->sem); -- down(&cmd->pages_sem); -+ for (i = 0; i < cmd->vars.max_reg_cmds; i++) -+ down(&cmd->vars.sem); -+ down(&cmd->vars.pages_sem); - - cmd->allowed_opcode = opcode; - -- up(&cmd->pages_sem); -- for (i = 0; i < cmd->max_reg_cmds; i++) -- up(&cmd->sem); -+ up(&cmd->vars.pages_sem); -+ for (i = 0; i < cmd->vars.max_reg_cmds; i++) -+ up(&cmd->vars.sem); - } - - static void mlx5_cmd_change_mod(struct mlx5_core_dev *dev, int mode) -@@ -1574,15 +1587,15 @@ static void mlx5_cmd_change_mod(struct mlx5_core_dev *dev, int mode) - struct mlx5_cmd *cmd = &dev->cmd; - int i; - -- for (i = 0; i < cmd->max_reg_cmds; i++) -- down(&cmd->sem); -- down(&cmd->pages_sem); -+ for (i = 0; i < cmd->vars.max_reg_cmds; i++) -+ down(&cmd->vars.sem); -+ down(&cmd->vars.pages_sem); - - cmd->mode = mode; - -- up(&cmd->pages_sem); -- for (i = 0; i < cmd->max_reg_cmds; i++) -- up(&cmd->sem); -+ up(&cmd->vars.pages_sem); -+ for (i = 0; i < cmd->vars.max_reg_cmds; i++) -+ up(&cmd->vars.sem); - } - - static int cmd_comp_notifier(struct notifier_block *nb, -@@ -1641,7 +1654,7 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force - - /* there can be at most 32 command queues */ - vector = vec & 0xffffffff; -- for (i = 0; i < (1 << cmd->log_sz); i++) { -+ for (i = 0; i < (1 << cmd->vars.log_sz); i++) { - if (test_bit(i, &vector)) { - ent = cmd->ent_arr[i]; - -@@ -1730,7 +1743,7 @@ static void mlx5_cmd_trigger_completions(struct mlx5_core_dev *dev) - /* wait for pending handlers to complete */ - mlx5_eq_synchronize_cmd_irq(dev); - spin_lock_irqsave(&dev->cmd.alloc_lock, flags); -- vector = ~dev->cmd.bitmask & ((1ul << (1 << dev->cmd.log_sz)) - 1); -+ vector = ~dev->cmd.vars.bitmask & ((1ul << (1 << dev->cmd.vars.log_sz)) - 1); - if (!vector) - goto no_trig; - -@@ -1739,14 +1752,14 @@ static void mlx5_cmd_trigger_completions(struct mlx5_core_dev *dev) - * to guarantee pending commands will not get freed in the meanwhile. - * For that reason, it also has to be done inside the alloc_lock. - */ -- for_each_set_bit(i, &bitmask, (1 << cmd->log_sz)) -+ for_each_set_bit(i, &bitmask, (1 << cmd->vars.log_sz)) - cmd_ent_get(cmd->ent_arr[i]); - vector |= MLX5_TRIGGERED_CMD_COMP; - spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags); - - mlx5_core_dbg(dev, "vector 0x%llx\n", vector); - mlx5_cmd_comp_handler(dev, vector, true); -- for_each_set_bit(i, &bitmask, (1 << cmd->log_sz)) -+ for_each_set_bit(i, &bitmask, (1 << cmd->vars.log_sz)) - cmd_ent_put(cmd->ent_arr[i]); - return; - -@@ -1759,22 +1772,22 @@ void mlx5_cmd_flush(struct mlx5_core_dev *dev) - struct mlx5_cmd *cmd = &dev->cmd; - int i; - -- for (i = 0; i < cmd->max_reg_cmds; i++) { -- while (down_trylock(&cmd->sem)) { -+ for (i = 0; i < cmd->vars.max_reg_cmds; i++) { -+ while (down_trylock(&cmd->vars.sem)) { - mlx5_cmd_trigger_completions(dev); - cond_resched(); - } - } - -- while (down_trylock(&cmd->pages_sem)) { -+ while (down_trylock(&cmd->vars.pages_sem)) { - mlx5_cmd_trigger_completions(dev); - cond_resched(); - } - - /* Unlock cmdif */ -- up(&cmd->pages_sem); -- for (i = 0; i < cmd->max_reg_cmds; i++) -- up(&cmd->sem); -+ up(&cmd->vars.pages_sem); -+ for (i = 0; i < cmd->vars.max_reg_cmds; i++) -+ up(&cmd->vars.sem); - } - - static struct mlx5_cmd_msg *alloc_msg(struct mlx5_core_dev *dev, int in_size, -@@ -1817,7 +1830,7 @@ cache_miss: - - static int is_manage_pages(void *in) - { -- return MLX5_GET(mbox_in, in, opcode) == MLX5_CMD_OP_MANAGE_PAGES; -+ return in_to_opcode(in) == MLX5_CMD_OP_MANAGE_PAGES; - } - - /* Notes: -@@ -1828,8 +1841,9 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out, - int out_size, mlx5_cmd_cbk_t callback, void *context, - bool force_polling) - { -- u16 opcode = MLX5_GET(mbox_in, in, opcode); - struct mlx5_cmd_msg *inb, *outb; -+ u16 opcode = in_to_opcode(in); -+ bool throttle_op; - int pages_queue; - gfp_t gfp; - u8 token; -@@ -1838,13 +1852,21 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out, - if (mlx5_cmd_is_down(dev) || !opcode_allowed(&dev->cmd, opcode)) - return -ENXIO; - -+ throttle_op = mlx5_cmd_is_throttle_opcode(opcode); -+ if (throttle_op) { -+ /* atomic context may not sleep */ -+ if (callback) -+ return -EINVAL; -+ down(&dev->cmd.vars.throttle_sem); -+ } -+ - pages_queue = is_manage_pages(in); - gfp = callback ? GFP_ATOMIC : GFP_KERNEL; - - inb = alloc_msg(dev, in_size, gfp); - if (IS_ERR(inb)) { - err = PTR_ERR(inb); -- return err; -+ goto out_up; - } - - token = alloc_token(&dev->cmd); -@@ -1878,6 +1900,9 @@ out_out: - mlx5_free_cmd_msg(dev, outb); - out_in: - free_msg(dev, inb); -+out_up: -+ if (throttle_op) -+ up(&dev->cmd.vars.throttle_sem); - return err; - } - -@@ -1952,8 +1977,8 @@ static int cmd_status_err(struct mlx5_core_dev *dev, int err, u16 opcode, u16 op - int mlx5_cmd_do(struct mlx5_core_dev *dev, void *in, int in_size, void *out, int out_size) - { - int err = cmd_exec(dev, in, in_size, out, out_size, NULL, NULL, false); -- u16 opcode = MLX5_GET(mbox_in, in, opcode); - u16 op_mod = MLX5_GET(mbox_in, in, op_mod); -+ u16 opcode = in_to_opcode(in); - - return cmd_status_err(dev, err, opcode, op_mod, out); - } -@@ -1998,8 +2023,8 @@ int mlx5_cmd_exec_polling(struct mlx5_core_dev *dev, void *in, int in_size, - void *out, int out_size) - { - int err = cmd_exec(dev, in, in_size, out, out_size, NULL, NULL, true); -- u16 opcode = MLX5_GET(mbox_in, in, opcode); - u16 op_mod = MLX5_GET(mbox_in, in, op_mod); -+ u16 opcode = in_to_opcode(in); - - err = cmd_status_err(dev, err, opcode, op_mod, out); - return mlx5_cmd_check(dev, err, in, out); -@@ -2051,7 +2076,7 @@ int mlx5_cmd_exec_cb(struct mlx5_async_ctx *ctx, void *in, int in_size, - - work->ctx = ctx; - work->user_callback = callback; -- work->opcode = MLX5_GET(mbox_in, in, opcode); -+ work->opcode = in_to_opcode(in); - work->op_mod = MLX5_GET(mbox_in, in, op_mod); - work->out = out; - if (WARN_ON(!atomic_inc_not_zero(&ctx->num_inflight))) -@@ -2187,16 +2212,16 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev) - goto err_free_pool; - - cmd_l = ioread32be(&dev->iseg->cmdq_addr_l_sz) & 0xff; -- cmd->log_sz = cmd_l >> 4 & 0xf; -- cmd->log_stride = cmd_l & 0xf; -- if (1 << cmd->log_sz > MLX5_MAX_COMMANDS) { -+ cmd->vars.log_sz = cmd_l >> 4 & 0xf; -+ cmd->vars.log_stride = cmd_l & 0xf; -+ if (1 << cmd->vars.log_sz > MLX5_MAX_COMMANDS) { - mlx5_core_err(dev, "firmware reports too many outstanding commands %d\n", -- 1 << cmd->log_sz); -+ 1 << cmd->vars.log_sz); - err = -EINVAL; - goto err_free_page; - } - -- if (cmd->log_sz + cmd->log_stride > MLX5_ADAPTER_PAGE_SHIFT) { -+ if (cmd->vars.log_sz + cmd->vars.log_stride > MLX5_ADAPTER_PAGE_SHIFT) { - mlx5_core_err(dev, "command queue size overflow\n"); - err = -EINVAL; - goto err_free_page; -@@ -2204,13 +2229,13 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev) - - cmd->state = MLX5_CMDIF_STATE_DOWN; - cmd->checksum_disabled = 1; -- cmd->max_reg_cmds = (1 << cmd->log_sz) - 1; -- cmd->bitmask = (1UL << cmd->max_reg_cmds) - 1; -+ cmd->vars.max_reg_cmds = (1 << cmd->vars.log_sz) - 1; -+ cmd->vars.bitmask = (1UL << cmd->vars.max_reg_cmds) - 1; - -- cmd->cmdif_rev = ioread32be(&dev->iseg->cmdif_rev_fw_sub) >> 16; -- if (cmd->cmdif_rev > CMD_IF_REV) { -+ cmd->vars.cmdif_rev = ioread32be(&dev->iseg->cmdif_rev_fw_sub) >> 16; -+ if (cmd->vars.cmdif_rev > CMD_IF_REV) { - mlx5_core_err(dev, "driver does not support command interface version. driver %d, firmware %d\n", -- CMD_IF_REV, cmd->cmdif_rev); -+ CMD_IF_REV, cmd->vars.cmdif_rev); - err = -EOPNOTSUPP; - goto err_free_page; - } -@@ -2220,8 +2245,9 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev) - for (i = 0; i < MLX5_CMD_OP_MAX; i++) - spin_lock_init(&cmd->stats[i].lock); - -- sema_init(&cmd->sem, cmd->max_reg_cmds); -- sema_init(&cmd->pages_sem, 1); -+ sema_init(&cmd->vars.sem, cmd->vars.max_reg_cmds); -+ sema_init(&cmd->vars.pages_sem, 1); -+ sema_init(&cmd->vars.throttle_sem, DIV_ROUND_UP(cmd->vars.max_reg_cmds, 2)); - - cmd_h = (u32)((u64)(cmd->dma) >> 32); - cmd_l = (u32)(cmd->dma); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c -index bb95b40d25eb5..e0b0729e238c1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c -@@ -176,8 +176,8 @@ static ssize_t slots_read(struct file *filp, char __user *buf, size_t count, - int ret; - - cmd = filp->private_data; -- weight = bitmap_weight(&cmd->bitmask, cmd->max_reg_cmds); -- field = cmd->max_reg_cmds - weight; -+ weight = bitmap_weight(&cmd->vars.bitmask, cmd->vars.max_reg_cmds); -+ field = cmd->vars.max_reg_cmds - weight; - ret = snprintf(tbuf, sizeof(tbuf), "%d\n", field); - return simple_read_from_buffer(buf, count, pos, tbuf, ret); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -index 374c0011a127b..3ba54ffa54bfe 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -@@ -691,7 +691,7 @@ static void mlx5_fw_tracer_handle_traces(struct work_struct *work) - - while (block_timestamp > tracer->last_timestamp) { - /* Check block override if it's not the first block */ -- if (!tracer->last_timestamp) { -+ if (tracer->last_timestamp) { - u64 *ts_event; - /* To avoid block override be the HW in case of buffer - * wraparound, the time stamp of the previous block -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c -index be83ad9db82a4..e1283531e0b81 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c -@@ -154,6 +154,7 @@ static int fs_udp_create_groups(struct mlx5e_flow_table *ft, enum fs_udp_type ty - in = kvzalloc(inlen, GFP_KERNEL); - if (!in || !ft->g) { - kfree(ft->g); -+ ft->g = NULL; - kvfree(in); - return -ENOMEM; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c -index 4db0483c066a8..83bb0811e7741 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c -@@ -300,6 +300,9 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, - if (err) - goto destroy_neigh_entry; - -+ e->encap_size = ipv4_encap_size; -+ e->encap_header = encap_header; -+ - if (!(nud_state & NUD_VALID)) { - neigh_event_send(attr.n, NULL); - /* the encap entry will be made valid on neigh update event -@@ -319,8 +322,6 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, - goto destroy_neigh_entry; - } - -- e->encap_size = ipv4_encap_size; -- e->encap_header = encap_header; - e->flags |= MLX5_ENCAP_ENTRY_VALID; - mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); - mlx5e_route_lookup_ipv4_put(&attr); -@@ -403,12 +404,16 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv, - if (err) - goto free_encap; - -+ e->encap_size = ipv4_encap_size; -+ kfree(e->encap_header); -+ e->encap_header = encap_header; -+ - if (!(nud_state & NUD_VALID)) { - neigh_event_send(attr.n, NULL); - /* the encap entry will be made valid on neigh update event - * and not used before that. - */ -- goto free_encap; -+ goto release_neigh; - } - - memset(&reformat_params, 0, sizeof(reformat_params)); -@@ -422,10 +427,6 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv, - goto free_encap; - } - -- e->encap_size = ipv4_encap_size; -- kfree(e->encap_header); -- e->encap_header = encap_header; -- - e->flags |= MLX5_ENCAP_ENTRY_VALID; - mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); - mlx5e_route_lookup_ipv4_put(&attr); -@@ -567,6 +568,9 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, - if (err) - goto destroy_neigh_entry; - -+ e->encap_size = ipv6_encap_size; -+ e->encap_header = encap_header; -+ - if (!(nud_state & NUD_VALID)) { - neigh_event_send(attr.n, NULL); - /* the encap entry will be made valid on neigh update event -@@ -586,8 +590,6 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, - goto destroy_neigh_entry; - } - -- e->encap_size = ipv6_encap_size; -- e->encap_header = encap_header; - e->flags |= MLX5_ENCAP_ENTRY_VALID; - mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); - mlx5e_route_lookup_ipv6_put(&attr); -@@ -669,12 +671,16 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv, - if (err) - goto free_encap; - -+ e->encap_size = ipv6_encap_size; -+ kfree(e->encap_header); -+ e->encap_header = encap_header; -+ - if (!(nud_state & NUD_VALID)) { - neigh_event_send(attr.n, NULL); - /* the encap entry will be made valid on neigh update event - * and not used before that. - */ -- goto free_encap; -+ goto release_neigh; - } - - memset(&reformat_params, 0, sizeof(reformat_params)); -@@ -688,10 +694,6 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv, - goto free_encap; - } - -- e->encap_size = ipv6_encap_size; -- kfree(e->encap_header); -- e->encap_header = encap_header; -- - e->flags |= MLX5_ENCAP_ENTRY_VALID; - mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev)); - mlx5e_route_lookup_ipv6_put(&attr); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index eeba91d9c5211..ceeb23f478e15 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -49,7 +49,7 @@ void mlx5e_ethtool_get_drvinfo(struct mlx5e_priv *priv, - count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), - "%d.%d.%04d (%.16s)", fw_rev_maj(mdev), - fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id); -- if (count == sizeof(drvinfo->fw_version)) -+ if (count >= sizeof(drvinfo->fw_version)) - snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), - "%d.%d.%04d", fw_rev_maj(mdev), - fw_rev_min(mdev), fw_rev_sub(mdev)); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 2653cb96c3105..5aeca9534f15a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -76,7 +76,7 @@ static void mlx5e_rep_get_drvinfo(struct net_device *dev, - count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), - "%d.%d.%04d (%.16s)", fw_rev_maj(mdev), - fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id); -- if (count == sizeof(drvinfo->fw_version)) -+ if (count >= sizeof(drvinfo->fw_version)) - snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version), - "%d.%d.%04d", fw_rev_maj(mdev), - fw_rev_min(mdev), fw_rev_sub(mdev)); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index d5c3173250309..3f68e3198aa64 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -277,7 +277,7 @@ int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev, - req_list_size = max_list_size; - } - -- out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_in) + -+ out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_out) + - req_list_size * MLX5_ST_SZ_BYTES(mac_address_layout); - - out = kvzalloc(out_sz, GFP_KERNEL); -diff --git a/drivers/net/ethernet/micrel/ks8851.h b/drivers/net/ethernet/micrel/ks8851.h -index fecd43754cead..e5ec0a363aff8 100644 ---- a/drivers/net/ethernet/micrel/ks8851.h -+++ b/drivers/net/ethernet/micrel/ks8851.h -@@ -350,6 +350,8 @@ union ks8851_tx_hdr { - * @rxd: Space for receiving SPI data, in DMA-able space. - * @txd: Space for transmitting SPI data, in DMA-able space. - * @msg_enable: The message flags controlling driver output (see ethtool). -+ * @tx_space: Free space in the hardware TX buffer (cached copy of KS_TXMIR). -+ * @queued_len: Space required in hardware TX buffer for queued packets in txq. - * @fid: Incrementing frame id tag. - * @rc_ier: Cached copy of KS_IER. - * @rc_ccr: Cached copy of KS_CCR. -@@ -399,6 +401,7 @@ struct ks8851_net { - struct work_struct rxctrl_work; - - struct sk_buff_head txq; -+ unsigned int queued_len; - - struct eeprom_93cx6 eeprom; - struct regulator *vdd_reg; -diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c -index cfbc900d4aeb9..0bf13b38b8f5b 100644 ---- a/drivers/net/ethernet/micrel/ks8851_common.c -+++ b/drivers/net/ethernet/micrel/ks8851_common.c -@@ -362,16 +362,18 @@ static irqreturn_t ks8851_irq(int irq, void *_ks) - handled |= IRQ_RXPSI; - - if (status & IRQ_TXI) { -- handled |= IRQ_TXI; -+ unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR); - -- /* no lock here, tx queue should have been stopped */ -+ netif_dbg(ks, intr, ks->netdev, -+ "%s: txspace %d\n", __func__, tx_space); - -- /* update our idea of how much tx space is available to the -- * system */ -- ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR); -+ spin_lock(&ks->statelock); -+ ks->tx_space = tx_space; -+ if (netif_queue_stopped(ks->netdev)) -+ netif_wake_queue(ks->netdev); -+ spin_unlock(&ks->statelock); - -- netif_dbg(ks, intr, ks->netdev, -- "%s: txspace %d\n", __func__, ks->tx_space); -+ handled |= IRQ_TXI; - } - - if (status & IRQ_RXI) -@@ -414,9 +416,6 @@ static irqreturn_t ks8851_irq(int irq, void *_ks) - if (status & IRQ_LCI) - mii_check_link(&ks->mii); - -- if (status & IRQ_TXI) -- netif_wake_queue(ks->netdev); -- - return IRQ_HANDLED; - } - -@@ -500,6 +499,7 @@ static int ks8851_net_open(struct net_device *dev) - ks8851_wrreg16(ks, KS_ISR, ks->rc_ier); - ks8851_wrreg16(ks, KS_IER, ks->rc_ier); - -+ ks->queued_len = 0; - netif_start_queue(ks->netdev); - - netif_dbg(ks, ifup, ks->netdev, "network device up\n"); -diff --git a/drivers/net/ethernet/micrel/ks8851_spi.c b/drivers/net/ethernet/micrel/ks8851_spi.c -index 70bc7253454f6..88e26c120b483 100644 ---- a/drivers/net/ethernet/micrel/ks8851_spi.c -+++ b/drivers/net/ethernet/micrel/ks8851_spi.c -@@ -286,6 +286,18 @@ static void ks8851_wrfifo_spi(struct ks8851_net *ks, struct sk_buff *txp, - netdev_err(ks->netdev, "%s: spi_sync() failed\n", __func__); - } - -+/** -+ * calc_txlen - calculate size of message to send packet -+ * @len: Length of data -+ * -+ * Returns the size of the TXFIFO message needed to send -+ * this packet. -+ */ -+static unsigned int calc_txlen(unsigned int len) -+{ -+ return ALIGN(len + 4, 4); -+} -+ - /** - * ks8851_rx_skb_spi - receive skbuff - * @ks: The device state -@@ -305,7 +317,9 @@ static void ks8851_rx_skb_spi(struct ks8851_net *ks, struct sk_buff *skb) - */ - static void ks8851_tx_work(struct work_struct *work) - { -+ unsigned int dequeued_len = 0; - struct ks8851_net_spi *kss; -+ unsigned short tx_space; - struct ks8851_net *ks; - unsigned long flags; - struct sk_buff *txb; -@@ -322,6 +336,8 @@ static void ks8851_tx_work(struct work_struct *work) - last = skb_queue_empty(&ks->txq); - - if (txb) { -+ dequeued_len += calc_txlen(txb->len); -+ - ks8851_wrreg16_spi(ks, KS_RXQCR, - ks->rc_rxqcr | RXQCR_SDA); - ks8851_wrfifo_spi(ks, txb, last); -@@ -332,6 +348,13 @@ static void ks8851_tx_work(struct work_struct *work) - } - } - -+ tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR); -+ -+ spin_lock(&ks->statelock); -+ ks->queued_len -= dequeued_len; -+ ks->tx_space = tx_space; -+ spin_unlock(&ks->statelock); -+ - ks8851_unlock_spi(ks, &flags); - } - -@@ -346,18 +369,6 @@ static void ks8851_flush_tx_work_spi(struct ks8851_net *ks) - flush_work(&kss->tx_work); - } - --/** -- * calc_txlen - calculate size of message to send packet -- * @len: Length of data -- * -- * Returns the size of the TXFIFO message needed to send -- * this packet. -- */ --static unsigned int calc_txlen(unsigned int len) --{ -- return ALIGN(len + 4, 4); --} -- - /** - * ks8851_start_xmit_spi - transmit packet using SPI - * @skb: The buffer to transmit -@@ -386,16 +397,17 @@ static netdev_tx_t ks8851_start_xmit_spi(struct sk_buff *skb, - - spin_lock(&ks->statelock); - -- if (needed > ks->tx_space) { -+ if (ks->queued_len + needed > ks->tx_space) { - netif_stop_queue(dev); - ret = NETDEV_TX_BUSY; - } else { -- ks->tx_space -= needed; -+ ks->queued_len += needed; - skb_queue_tail(&ks->txq, skb); - } - - spin_unlock(&ks->statelock); -- schedule_work(&kss->tx_work); -+ if (ret == NETDEV_TX_OK) -+ schedule_work(&kss->tx_work); - - return ret; - } -diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig -index fe4e7a7d9c0b5..8b6c4cc37c53c 100644 ---- a/drivers/net/ethernet/microsoft/Kconfig -+++ b/drivers/net/ethernet/microsoft/Kconfig -@@ -19,6 +19,7 @@ config MICROSOFT_MANA - tristate "Microsoft Azure Network Adapter (MANA) support" - depends on PCI_MSI && X86_64 - depends on PCI_HYPERV -+ select PAGE_POOL - help - This driver supports Microsoft Azure Network Adapter (MANA). - So far, the driver is only supported on X86_64. -diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c -index 0066219bb0e89..6b95262dad904 100644 ---- a/drivers/net/ethernet/mscc/ocelot_stats.c -+++ b/drivers/net/ethernet/mscc/ocelot_stats.c -@@ -216,10 +216,10 @@ static void ocelot_port_rmon_stats_cb(struct ocelot *ocelot, int port, void *pri - rmon_stats->hist_tx[0] = s[OCELOT_STAT_TX_64]; - rmon_stats->hist_tx[1] = s[OCELOT_STAT_TX_65_127]; - rmon_stats->hist_tx[2] = s[OCELOT_STAT_TX_128_255]; -- rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_128_255]; -- rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_256_511]; -- rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_512_1023]; -- rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_1024_1526]; -+ rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_256_511]; -+ rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_512_1023]; -+ rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_1024_1526]; -+ rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_1527_MAX]; - } - - void ocelot_port_get_rmon_stats(struct ocelot *ocelot, int port, -diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c -index 4ea0e155bb0d5..5a1bf42ce1566 100644 ---- a/drivers/net/usb/ax88179_178a.c -+++ b/drivers/net/usb/ax88179_178a.c -@@ -173,6 +173,7 @@ struct ax88179_data { - u8 in_pm; - u32 wol_supported; - u32 wolopts; -+ u8 disconnecting; - }; - - struct ax88179_int_data { -@@ -208,6 +209,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, - { - int ret; - int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16); -+ struct ax88179_data *ax179_data = dev->driver_priv; - - BUG_ON(!dev); - -@@ -219,7 +221,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, - ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - value, index, data, size); - -- if (unlikely(ret < 0)) -+ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting))) - netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n", - index, ret); - -@@ -231,6 +233,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, - { - int ret; - int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16); -+ struct ax88179_data *ax179_data = dev->driver_priv; - - BUG_ON(!dev); - -@@ -242,7 +245,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, - ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - value, index, data, size); - -- if (unlikely(ret < 0)) -+ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting))) - netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n", - index, ret); - -@@ -492,6 +495,20 @@ static int ax88179_resume(struct usb_interface *intf) - return usbnet_resume(intf); - } - -+static void ax88179_disconnect(struct usb_interface *intf) -+{ -+ struct usbnet *dev = usb_get_intfdata(intf); -+ struct ax88179_data *ax179_data; -+ -+ if (!dev) -+ return; -+ -+ ax179_data = dev->driver_priv; -+ ax179_data->disconnecting = 1; -+ -+ usbnet_disconnect(intf); -+} -+ - static void - ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) - { -@@ -1906,7 +1923,7 @@ static struct usb_driver ax88179_178a_driver = { - .suspend = ax88179_suspend, - .resume = ax88179_resume, - .reset_resume = ax88179_resume, -- .disconnect = usbnet_disconnect, -+ .disconnect = ax88179_disconnect, - .supports_autosuspend = 1, - .disable_hub_initiated_lpm = 1, - }; -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index 39ab6526e6b85..796972f224326 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -@@ -3034,7 +3034,7 @@ static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans, - struct iwl_rxq *rxq = &trans_pcie->rxq[0]; - u32 i, r, j, rb_len = 0; - -- spin_lock(&rxq->lock); -+ spin_lock_bh(&rxq->lock); - - r = le16_to_cpu(iwl_get_closed_rb_stts(trans, rxq)) & 0x0FFF; - -@@ -3058,7 +3058,7 @@ static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans, - *data = iwl_fw_error_next_data(*data); - } - -- spin_unlock(&rxq->lock); -+ spin_unlock_bh(&rxq->lock); - - return rb_len; - } -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index eb7c87b344b8f..5b906dbb1096c 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -4835,6 +4835,8 @@ static void nvme_fw_act_work(struct work_struct *work) - struct nvme_ctrl, fw_act_work); - unsigned long fw_act_timeout; - -+ nvme_auth_stop(ctrl); -+ - if (ctrl->mtfa) - fw_act_timeout = jiffies + - msecs_to_jiffies(ctrl->mtfa * 100); -@@ -4890,7 +4892,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) - * firmware activation. - */ - if (nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING)) { -- nvme_auth_stop(ctrl); - requeue = false; - queue_work(nvme_wq, &ctrl->fw_act_work); - } -diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c -index f71c6457e3509..2425d4813c3c5 100644 ---- a/drivers/pinctrl/pinctrl-at91-pio4.c -+++ b/drivers/pinctrl/pinctrl-at91-pio4.c -@@ -1033,6 +1033,13 @@ static const struct of_device_id atmel_pctrl_of_match[] = { - } - }; - -+/* -+ * This lock class allows to tell lockdep that parent IRQ and children IRQ do -+ * not share the same class so it does not raise false positive -+ */ -+static struct lock_class_key atmel_lock_key; -+static struct lock_class_key atmel_request_key; -+ - static int atmel_pinctrl_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -@@ -1185,6 +1192,7 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) - irq_set_chip_and_handler(irq, &atmel_gpio_irq_chip, - handle_simple_irq); - irq_set_chip_data(irq, atmel_pioctrl); -+ irq_set_lockdep_class(irq, &atmel_lock_key, &atmel_request_key); - dev_dbg(dev, - "atmel gpio irq domain: hwirq: %d, linux irq: %d\n", - i, irq); -diff --git a/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c b/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c -index 5b544fb7f3d88..3b18a03075f46 100644 ---- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c -+++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c -@@ -489,7 +489,7 @@ static int starfive_dt_node_to_map(struct pinctrl_dev *pctldev, - - nmaps = 0; - ngroups = 0; -- for_each_child_of_node(np, child) { -+ for_each_available_child_of_node(np, child) { - int npinmux = of_property_count_u32_elems(child, "pinmux"); - int npins = of_property_count_u32_elems(child, "pins"); - -@@ -524,7 +524,7 @@ static int starfive_dt_node_to_map(struct pinctrl_dev *pctldev, - nmaps = 0; - ngroups = 0; - mutex_lock(&sfp->mutex); -- for_each_child_of_node(np, child) { -+ for_each_available_child_of_node(np, child) { - int npins; - int i; - -diff --git a/drivers/reset/core.c b/drivers/reset/core.c -index f0a076e94118f..92cc13ef3e566 100644 ---- a/drivers/reset/core.c -+++ b/drivers/reset/core.c -@@ -807,6 +807,9 @@ static void __reset_control_put_internal(struct reset_control *rstc) - { - lockdep_assert_held(&reset_list_mutex); - -+ if (IS_ERR_OR_NULL(rstc)) -+ return; -+ - kref_put(&rstc->refcnt, __reset_control_release); - } - -@@ -1017,11 +1020,8 @@ EXPORT_SYMBOL_GPL(reset_control_put); - void reset_control_bulk_put(int num_rstcs, struct reset_control_bulk_data *rstcs) - { - mutex_lock(&reset_list_mutex); -- while (num_rstcs--) { -- if (IS_ERR_OR_NULL(rstcs[num_rstcs].rstc)) -- continue; -+ while (num_rstcs--) - __reset_control_put_internal(rstcs[num_rstcs].rstc); -- } - mutex_unlock(&reset_list_mutex); - } - EXPORT_SYMBOL_GPL(reset_control_bulk_put); -diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h -index 7c6efde75da66..5e115e8b2ba46 100644 ---- a/drivers/scsi/aacraid/aacraid.h -+++ b/drivers/scsi/aacraid/aacraid.h -@@ -1678,7 +1678,6 @@ struct aac_dev - u32 handle_pci_error; - bool init_reset; - u8 soft_reset_support; -- u8 use_map_queue; - }; - - #define aac_adapter_interrupt(dev) \ -diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c -index 013a9a334972e..25cee03d7f973 100644 ---- a/drivers/scsi/aacraid/commsup.c -+++ b/drivers/scsi/aacraid/commsup.c -@@ -223,12 +223,8 @@ int aac_fib_setup(struct aac_dev * dev) - struct fib *aac_fib_alloc_tag(struct aac_dev *dev, struct scsi_cmnd *scmd) - { - struct fib *fibptr; -- u32 blk_tag; -- int i; - -- blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd)); -- i = blk_mq_unique_tag_to_tag(blk_tag); -- fibptr = &dev->fibs[i]; -+ fibptr = &dev->fibs[scsi_cmd_to_rq(scmd)->tag]; - /* - * Null out fields that depend on being zero at the start of - * each I/O -diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c -index bff49b8ab057d..5ba5c18b77b46 100644 ---- a/drivers/scsi/aacraid/linit.c -+++ b/drivers/scsi/aacraid/linit.c -@@ -19,7 +19,6 @@ - - #include - #include --#include - #include - #include - #include -@@ -506,15 +505,6 @@ common_config: - return 0; - } - --static void aac_map_queues(struct Scsi_Host *shost) --{ -- struct aac_dev *aac = (struct aac_dev *)shost->hostdata; -- -- blk_mq_pci_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT], -- aac->pdev, 0); -- aac->use_map_queue = true; --} -- - /** - * aac_change_queue_depth - alter queue depths - * @sdev: SCSI device we are considering -@@ -1499,7 +1489,6 @@ static struct scsi_host_template aac_driver_template = { - .bios_param = aac_biosparm, - .shost_groups = aac_host_groups, - .slave_configure = aac_slave_configure, -- .map_queues = aac_map_queues, - .change_queue_depth = aac_change_queue_depth, - .sdev_groups = aac_dev_groups, - .eh_abort_handler = aac_eh_abort, -@@ -1787,8 +1776,6 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - shost->max_lun = AAC_MAX_LUN; - - pci_set_drvdata(pdev, shost); -- shost->nr_hw_queues = aac->max_msix; -- shost->host_tagset = 1; - - error = scsi_add_host(shost, &pdev->dev); - if (error) -@@ -1921,7 +1908,6 @@ static void aac_remove_one(struct pci_dev *pdev) - struct aac_dev *aac = (struct aac_dev *)shost->hostdata; - - aac_cancel_rescan_worker(aac); -- aac->use_map_queue = false; - scsi_remove_host(shost); - - __aac_shutdown(aac); -diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c -index 61949f3741886..11ef58204e96f 100644 ---- a/drivers/scsi/aacraid/src.c -+++ b/drivers/scsi/aacraid/src.c -@@ -493,10 +493,6 @@ static int aac_src_deliver_message(struct fib *fib) - #endif - - u16 vector_no; -- struct scsi_cmnd *scmd; -- u32 blk_tag; -- struct Scsi_Host *shost = dev->scsi_host_ptr; -- struct blk_mq_queue_map *qmap; - - atomic_inc(&q->numpending); - -@@ -509,25 +505,8 @@ static int aac_src_deliver_message(struct fib *fib) - if ((dev->comm_interface == AAC_COMM_MESSAGE_TYPE3) - && dev->sa_firmware) - vector_no = aac_get_vector(dev); -- else { -- if (!fib->vector_no || !fib->callback_data) { -- if (shost && dev->use_map_queue) { -- qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT]; -- vector_no = qmap->mq_map[raw_smp_processor_id()]; -- } -- /* -- * We hardcode the vector_no for -- * reserved commands as a valid shost is -- * absent during the init -- */ -- else -- vector_no = 0; -- } else { -- scmd = (struct scsi_cmnd *)fib->callback_data; -- blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd)); -- vector_no = blk_mq_unique_tag_to_hwq(blk_tag); -- } -- } -+ else -+ vector_no = fib->vector_no; - - if (native_hba) { - if (fib->flags & FIB_CONTEXT_FLAG_NATIVE_HBA_TMF) { -diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -index 05ddbb9bb7d8a..451a58e0fd969 100644 ---- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -@@ -429,7 +429,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, - struct fcoe_ctlr *ctlr; - struct fcoe_rcv_info *fr; - struct fcoe_percpu_s *bg; -- struct sk_buff *tmp_skb; - - interface = container_of(ptype, struct bnx2fc_interface, - fcoe_packet_type); -@@ -441,11 +440,9 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, - goto err; - } - -- tmp_skb = skb_share_check(skb, GFP_ATOMIC); -- if (!tmp_skb) -- goto err; -- -- skb = tmp_skb; -+ skb = skb_share_check(skb, GFP_ATOMIC); -+ if (!skb) -+ return -1; - - if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) { - printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n"); -diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c -index 02520f9123066..9a289d6f2e5ee 100644 ---- a/drivers/scsi/scsi_error.c -+++ b/drivers/scsi/scsi_error.c -@@ -1108,6 +1108,7 @@ retry: - - scsi_log_send(scmd); - scmd->submitter = SUBMITTED_BY_SCSI_ERROR_HANDLER; -+ scmd->flags |= SCMD_LAST; - - /* - * Lock sdev->state_mutex to avoid that scsi_device_quiesce() can -@@ -2402,6 +2403,7 @@ scsi_ioctl_reset(struct scsi_device *dev, int __user *arg) - scsi_init_command(dev, scmd); - - scmd->submitter = SUBMITTED_BY_SCSI_RESET_IOCTL; -+ scmd->flags |= SCMD_LAST; - memset(&scmd->sdb, 0, sizeof(scmd->sdb)); - - scmd->cmd_len = 0; -diff --git a/drivers/thunderbolt/debugfs.c b/drivers/thunderbolt/debugfs.c -index d89f92032c1c2..f691bce5c1477 100644 ---- a/drivers/thunderbolt/debugfs.c -+++ b/drivers/thunderbolt/debugfs.c -@@ -943,7 +943,7 @@ static void margining_port_remove(struct tb_port *port) - snprintf(dir_name, sizeof(dir_name), "port%d", port->port); - parent = debugfs_lookup(dir_name, port->sw->debugfs_dir); - if (parent) -- debugfs_remove_recursive(debugfs_lookup("margining", parent)); -+ debugfs_lookup_and_remove("margining", parent); - - kfree(port->usb4->margining); - port->usb4->margining = NULL; -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 05e28a5ce42b1..fe2173e37b061 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1033,9 +1033,9 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, - { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, - { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, -- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, -- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, -- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_UID_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_USA_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NGX_PID) }, - { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, - { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index e2099445db708..21a2b5a25fc09 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1568,9 +1568,9 @@ - #define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ - #define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ - #define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ --#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ --#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ --#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ -+#define ACTISENSE_UID_PID 0xD9AC /* USB Isolating Device */ -+#define ACTISENSE_USA_PID 0xD9AD /* USB to Serial Adapter */ -+#define ACTISENSE_NGX_PID 0xD9AE /* NGX NMEA2000 Gateway */ - #define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ - #define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ - #define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 7f2aa72d52e65..4adef92598709 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -272,6 +272,7 @@ static void option_instat_callback(struct urb *urb); - #define QUECTEL_PRODUCT_RM500Q 0x0800 - #define QUECTEL_PRODUCT_RM520N 0x0801 - #define QUECTEL_PRODUCT_EC200U 0x0901 -+#define QUECTEL_PRODUCT_EG912Y 0x6001 - #define QUECTEL_PRODUCT_EC200S_CN 0x6002 - #define QUECTEL_PRODUCT_EC200A 0x6005 - #define QUECTEL_PRODUCT_EM061K_LWW 0x6008 -@@ -1232,6 +1233,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */ - .driver_info = RSVD(3) | ZLP }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0x40) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), - .driver_info = ZLP }, -@@ -1244,6 +1246,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, - - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, -@@ -2242,6 +2245,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, - { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ - .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0da, 0xff), /* Foxconn T99W265 MBIM variant */ -+ .driver_info = RSVD(3) | RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ - .driver_info = RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */ -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 20dcbccb290b3..fd68204374f2c 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -1305,6 +1305,17 @@ UNUSUAL_DEV( 0x090c, 0x6000, 0x0100, 0x0100, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_INITIAL_READ10 ), - -+/* -+ * Patch by Tasos Sahanidis -+ * This flash drive always shows up with write protect enabled -+ * during the first mode sense. -+ */ -+UNUSUAL_DEV(0x0951, 0x1697, 0x0100, 0x0100, -+ "Kingston", -+ "DT Ultimate G3", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_WP_DETECT), -+ - /* - * This Pentax still camera is not conformant - * to the USB storage specification: - -diff --git a/fs/afs/cell.c b/fs/afs/cell.c -index 988c2ac7cecec..926cb1188eba6 100644 ---- a/fs/afs/cell.c -+++ b/fs/afs/cell.c -@@ -409,10 +409,12 @@ static int afs_update_cell(struct afs_cell *cell) - if (ret == -ENOMEM) - goto out_wake; - -- ret = -ENOMEM; - vllist = afs_alloc_vlserver_list(0); -- if (!vllist) -+ if (!vllist) { -+ if (ret >= 0) -+ ret = -ENOMEM; - goto out_wake; -+ } - - switch (ret) { - case -ENODATA: -diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c -index 91e804c70dd0a..9937993cf29dc 100644 ---- a/fs/afs/dynroot.c -+++ b/fs/afs/dynroot.c -@@ -114,6 +114,7 @@ static int afs_probe_cell_name(struct dentry *dentry) - struct afs_net *net = afs_d2net(dentry); - const char *name = dentry->d_name.name; - size_t len = dentry->d_name.len; -+ char *result = NULL; - int ret; - - /* Names prefixed with a dot are R/W mounts. */ -@@ -131,9 +132,22 @@ static int afs_probe_cell_name(struct dentry *dentry) - } - - ret = dns_query(net->net, "afsdb", name, len, "srv=1", -- NULL, NULL, false); -- if (ret == -ENODATA || ret == -ENOKEY) -+ &result, NULL, false); -+ if (ret == -ENODATA || ret == -ENOKEY || ret == 0) - ret = -ENOENT; -+ if (ret > 0 && ret >= sizeof(struct dns_server_list_v1_header)) { -+ struct dns_server_list_v1_header *v1 = (void *)result; -+ -+ if (v1->hdr.zero == 0 && -+ v1->hdr.content == DNS_PAYLOAD_IS_SERVER_LIST && -+ v1->hdr.version == 1 && -+ (v1->status != DNS_LOOKUP_GOOD && -+ v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) -+ return -ENOENT; -+ -+ } -+ -+ kfree(result); - return ret; - } - -@@ -252,20 +266,9 @@ static int afs_dynroot_d_revalidate(struct dentry *dentry, unsigned int flags) - return 1; - } - --/* -- * Allow the VFS to enquire as to whether a dentry should be unhashed (mustn't -- * sleep) -- * - called from dput() when d_count is going to 0. -- * - return 1 to request dentry be unhashed, 0 otherwise -- */ --static int afs_dynroot_d_delete(const struct dentry *dentry) --{ -- return d_really_is_positive(dentry); --} -- - const struct dentry_operations afs_dynroot_dentry_operations = { - .d_revalidate = afs_dynroot_d_revalidate, -- .d_delete = afs_dynroot_d_delete, -+ .d_delete = always_delete_dentry, - .d_release = afs_d_release, - .d_automount = afs_d_automount, - }; -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index c2d70fc1698c0..fcbb598d8c85d 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -585,6 +585,7 @@ struct afs_volume { - #define AFS_VOLUME_OFFLINE 4 /* - T if volume offline notice given */ - #define AFS_VOLUME_BUSY 5 /* - T if volume busy notice given */ - #define AFS_VOLUME_MAYBE_NO_IBULK 6 /* - T if some servers don't have InlineBulkStatus */ -+#define AFS_VOLUME_RM_TREE 7 /* - Set if volume removed from cell->volumes */ - #ifdef CONFIG_AFS_FSCACHE - struct fscache_volume *cache; /* Caching cookie */ - #endif -@@ -1517,6 +1518,7 @@ extern struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *, - extern struct afs_volume *afs_create_volume(struct afs_fs_context *); - extern int afs_activate_volume(struct afs_volume *); - extern void afs_deactivate_volume(struct afs_volume *); -+bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason); - extern struct afs_volume *afs_get_volume(struct afs_volume *, enum afs_volume_trace); - extern void afs_put_volume(struct afs_net *, struct afs_volume *, enum afs_volume_trace); - extern int afs_check_volume_status(struct afs_volume *, struct afs_operation *); -diff --git a/fs/afs/volume.c b/fs/afs/volume.c -index f4937029dcd72..1c9144e3e83ac 100644 ---- a/fs/afs/volume.c -+++ b/fs/afs/volume.c -@@ -32,8 +32,13 @@ static struct afs_volume *afs_insert_volume_into_cell(struct afs_cell *cell, - } else if (p->vid > volume->vid) { - pp = &(*pp)->rb_right; - } else { -- volume = afs_get_volume(p, afs_volume_trace_get_cell_insert); -- goto found; -+ if (afs_try_get_volume(p, afs_volume_trace_get_cell_insert)) { -+ volume = p; -+ goto found; -+ } -+ -+ set_bit(AFS_VOLUME_RM_TREE, &volume->flags); -+ rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes); - } - } - -@@ -56,7 +61,8 @@ static void afs_remove_volume_from_cell(struct afs_volume *volume) - afs_volume_trace_remove); - write_seqlock(&cell->volume_lock); - hlist_del_rcu(&volume->proc_link); -- rb_erase(&volume->cell_node, &cell->volumes); -+ if (!test_and_set_bit(AFS_VOLUME_RM_TREE, &volume->flags)) -+ rb_erase(&volume->cell_node, &cell->volumes); - write_sequnlock(&cell->volume_lock); - } - } -@@ -235,6 +241,20 @@ static void afs_destroy_volume(struct afs_net *net, struct afs_volume *volume) - _leave(" [destroyed]"); - } - -+/* -+ * Try to get a reference on a volume record. -+ */ -+bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason) -+{ -+ int r; -+ -+ if (__refcount_inc_not_zero(&volume->ref, &r)) { -+ trace_afs_volume(volume->vid, r + 1, reason); -+ return true; -+ } -+ return false; -+} -+ - /* - * Get a reference on a volume record. - */ -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index 4cd8e44cba4c5..b27795e13ff31 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -2685,13 +2685,8 @@ static int __btrfs_add_free_space_zoned(struct btrfs_block_group *block_group, - bg_reclaim_threshold = READ_ONCE(sinfo->bg_reclaim_threshold); - - spin_lock(&ctl->tree_lock); -- /* Count initial region as zone_unusable until it gets activated. */ - if (!used) - to_free = size; -- else if (initial && -- test_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &block_group->fs_info->flags) && -- (block_group->flags & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM))) -- to_free = 0; - else if (initial) - to_free = block_group->zone_capacity; - else if (offset >= block_group->alloc_offset) -@@ -2719,8 +2714,7 @@ static int __btrfs_add_free_space_zoned(struct btrfs_block_group *block_group, - reclaimable_unusable = block_group->zone_unusable - - (block_group->length - block_group->zone_capacity); - /* All the region is now unusable. Mark it as unused and reclaim */ -- if (block_group->zone_unusable == block_group->length && -- block_group->alloc_offset) { -+ if (block_group->zone_unusable == block_group->length) { - btrfs_mark_bg_unused(block_group); - } else if (bg_reclaim_threshold && - reclaimable_unusable >= -diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c -index 675dbed075d8e..99cb690da9893 100644 ---- a/fs/btrfs/zoned.c -+++ b/fs/btrfs/zoned.c -@@ -1574,19 +1574,9 @@ void btrfs_calc_zone_unusable(struct btrfs_block_group *cache) - return; - - WARN_ON(cache->bytes_super != 0); -- -- /* Check for block groups never get activated */ -- if (test_bit(BTRFS_FS_ACTIVE_ZONE_TRACKING, &cache->fs_info->flags) && -- cache->flags & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM) && -- !test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &cache->runtime_flags) && -- cache->alloc_offset == 0) { -- unusable = cache->length; -- free = 0; -- } else { -- unusable = (cache->alloc_offset - cache->used) + -- (cache->length - cache->zone_capacity); -- free = cache->zone_capacity - cache->alloc_offset; -- } -+ unusable = (cache->alloc_offset - cache->used) + -+ (cache->length - cache->zone_capacity); -+ free = cache->zone_capacity - cache->alloc_offset; - - /* We only need ->free_space in ALLOC_SEQ block groups */ - cache->cached = BTRFS_CACHE_FINISHED; -@@ -1882,7 +1872,6 @@ struct btrfs_device *btrfs_zoned_get_device(struct btrfs_fs_info *fs_info, - bool btrfs_zone_activate(struct btrfs_block_group *block_group) - { - struct btrfs_fs_info *fs_info = block_group->fs_info; -- struct btrfs_space_info *space_info = block_group->space_info; - struct map_lookup *map; - struct btrfs_device *device; - u64 physical; -@@ -1894,7 +1883,6 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - - map = block_group->physical_map; - -- spin_lock(&space_info->lock); - spin_lock(&block_group->lock); - if (test_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags)) { - ret = true; -@@ -1923,14 +1911,7 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - - /* Successfully activated all the zones */ - set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &block_group->runtime_flags); -- WARN_ON(block_group->alloc_offset != 0); -- if (block_group->zone_unusable == block_group->length) { -- block_group->zone_unusable = block_group->length - block_group->zone_capacity; -- space_info->bytes_zone_unusable -= block_group->zone_capacity; -- } - spin_unlock(&block_group->lock); -- btrfs_try_granting_tickets(fs_info, space_info); -- spin_unlock(&space_info->lock); - - /* For the active block group list */ - btrfs_get_block_group(block_group); -@@ -1943,7 +1924,6 @@ bool btrfs_zone_activate(struct btrfs_block_group *block_group) - - out_unlock: - spin_unlock(&block_group->lock); -- spin_unlock(&space_info->lock); - return ret; - } - -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index 98a9cf5318731..a9681fecbd91f 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -63,6 +63,19 @@ struct fuse_forget_link { - struct fuse_forget_link *next; - }; - -+/* Submount lookup tracking */ -+struct fuse_submount_lookup { -+ /** Refcount */ -+ refcount_t count; -+ -+ /** Unique ID, which identifies the inode between userspace -+ * and kernel */ -+ u64 nodeid; -+ -+ /** The request used for sending the FORGET message */ -+ struct fuse_forget_link *forget; -+}; -+ - /** FUSE inode */ - struct fuse_inode { - /** Inode data */ -@@ -155,6 +168,8 @@ struct fuse_inode { - */ - struct fuse_inode_dax *dax; - #endif -+ /** Submount specific lookup tracking */ -+ struct fuse_submount_lookup *submount_lookup; - }; - - /** FUSE inode state bits */ -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index bc3c3e76c646d..f81000d968875 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -68,6 +68,24 @@ struct fuse_forget_link *fuse_alloc_forget(void) - return kzalloc(sizeof(struct fuse_forget_link), GFP_KERNEL_ACCOUNT); - } - -+static struct fuse_submount_lookup *fuse_alloc_submount_lookup(void) -+{ -+ struct fuse_submount_lookup *sl; -+ -+ sl = kzalloc(sizeof(struct fuse_submount_lookup), GFP_KERNEL_ACCOUNT); -+ if (!sl) -+ return NULL; -+ sl->forget = fuse_alloc_forget(); -+ if (!sl->forget) -+ goto out_free; -+ -+ return sl; -+ -+out_free: -+ kfree(sl); -+ return NULL; -+} -+ - static struct inode *fuse_alloc_inode(struct super_block *sb) - { - struct fuse_inode *fi; -@@ -83,6 +101,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb) - fi->attr_version = 0; - fi->orig_ino = 0; - fi->state = 0; -+ fi->submount_lookup = NULL; - mutex_init(&fi->mutex); - spin_lock_init(&fi->lock); - fi->forget = fuse_alloc_forget(); -@@ -113,6 +132,17 @@ static void fuse_free_inode(struct inode *inode) - kmem_cache_free(fuse_inode_cachep, fi); - } - -+static void fuse_cleanup_submount_lookup(struct fuse_conn *fc, -+ struct fuse_submount_lookup *sl) -+{ -+ if (!refcount_dec_and_test(&sl->count)) -+ return; -+ -+ fuse_queue_forget(fc, sl->forget, sl->nodeid, 1); -+ sl->forget = NULL; -+ kfree(sl); -+} -+ - static void fuse_evict_inode(struct inode *inode) - { - struct fuse_inode *fi = get_fuse_inode(inode); -@@ -132,6 +162,11 @@ static void fuse_evict_inode(struct inode *inode) - fi->nlookup); - fi->forget = NULL; - } -+ -+ if (fi->submount_lookup) { -+ fuse_cleanup_submount_lookup(fc, fi->submount_lookup); -+ fi->submount_lookup = NULL; -+ } - } - if (S_ISREG(inode->i_mode) && !fuse_is_bad(inode)) { - WARN_ON(!list_empty(&fi->write_files)); -@@ -311,6 +346,13 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr, - fuse_dax_dontcache(inode, attr->flags); - } - -+static void fuse_init_submount_lookup(struct fuse_submount_lookup *sl, -+ u64 nodeid) -+{ -+ sl->nodeid = nodeid; -+ refcount_set(&sl->count, 1); -+} -+ - static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr) - { - inode->i_mode = attr->mode & S_IFMT; -@@ -368,12 +410,22 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid, - */ - if (fc->auto_submounts && (attr->flags & FUSE_ATTR_SUBMOUNT) && - S_ISDIR(attr->mode)) { -+ struct fuse_inode *fi; -+ - inode = new_inode(sb); - if (!inode) - return NULL; - - fuse_init_inode(inode, attr); -- get_fuse_inode(inode)->nodeid = nodeid; -+ fi = get_fuse_inode(inode); -+ fi->nodeid = nodeid; -+ fi->submount_lookup = fuse_alloc_submount_lookup(); -+ if (!fi->submount_lookup) { -+ iput(inode); -+ return NULL; -+ } -+ /* Sets nlookup = 1 on fi->submount_lookup->nlookup */ -+ fuse_init_submount_lookup(fi->submount_lookup, nodeid); - inode->i_flags |= S_AUTOMOUNT; - goto done; - } -@@ -396,11 +448,11 @@ retry: - iput(inode); - goto retry; - } --done: - fi = get_fuse_inode(inode); - spin_lock(&fi->lock); - fi->nlookup++; - spin_unlock(&fi->lock); -+done: - fuse_change_attributes(inode, attr, attr_valid, attr_version); - - return inode; -@@ -1439,6 +1491,8 @@ static int fuse_fill_super_submount(struct super_block *sb, - struct super_block *parent_sb = parent_fi->inode.i_sb; - struct fuse_attr root_attr; - struct inode *root; -+ struct fuse_submount_lookup *sl; -+ struct fuse_inode *fi; - - fuse_sb_defaults(sb); - fm->sb = sb; -@@ -1461,12 +1515,27 @@ static int fuse_fill_super_submount(struct super_block *sb, - * its nlookup should not be incremented. fuse_iget() does - * that, though, so undo it here. - */ -- get_fuse_inode(root)->nlookup--; -+ fi = get_fuse_inode(root); -+ fi->nlookup--; -+ - sb->s_d_op = &fuse_dentry_operations; - sb->s_root = d_make_root(root); - if (!sb->s_root) - return -ENOMEM; - -+ /* -+ * Grab the parent's submount_lookup pointer and take a -+ * reference on the shared nlookup from the parent. This is to -+ * prevent the last forget for this nodeid from getting -+ * triggered until all users have finished with it. -+ */ -+ sl = parent_fi->submount_lookup; -+ WARN_ON(!sl); -+ if (sl) { -+ refcount_inc(&sl->count); -+ fi->submount_lookup = sl; -+ } -+ - return 0; - } - -diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c -index 0acb455368f23..5df8d93233376 100644 ---- a/fs/smb/client/cifs_debug.c -+++ b/fs/smb/client/cifs_debug.c -@@ -38,11 +38,13 @@ void cifs_dump_detail(void *buf, struct TCP_Server_Info *server) - #ifdef CONFIG_CIFS_DEBUG2 - struct smb_hdr *smb = buf; - -- cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Flgs2: 0x%x Mid: %d Pid: %d\n", -- smb->Command, smb->Status.CifsError, -- smb->Flags, smb->Flags2, smb->Mid, smb->Pid); -- cifs_dbg(VFS, "smb buf %p len %u\n", smb, -- server->ops->calc_smb_size(smb)); -+ cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Flgs2: 0x%x Mid: %d Pid: %d Wct: %d\n", -+ smb->Command, smb->Status.CifsError, smb->Flags, -+ smb->Flags2, smb->Mid, smb->Pid, smb->WordCount); -+ if (!server->ops->check_message(buf, server->total_read, server)) { -+ cifs_dbg(VFS, "smb buf %p len %u\n", smb, -+ server->ops->calc_smb_size(smb)); -+ } - #endif /* CONFIG_CIFS_DEBUG2 */ - } - -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 2e814eadd6aef..512ac9dea9787 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -513,7 +513,8 @@ struct smb_version_operations { - struct mid_q_entry **, char **, int *); - enum securityEnum (*select_sectype)(struct TCP_Server_Info *, - enum securityEnum); -- int (*next_header)(char *); -+ int (*next_header)(struct TCP_Server_Info *server, char *buf, -+ unsigned int *noff); - /* ioctl passthrough for query_info */ - int (*ioctl_query_info)(const unsigned int xid, - struct cifs_tcon *tcon, -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 5b19918938346..f725a119ce312 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -1225,7 +1225,12 @@ next_pdu: - server->total_read += length; - - if (server->ops->next_header) { -- next_offset = server->ops->next_header(buf); -+ if (server->ops->next_header(server, buf, &next_offset)) { -+ cifs_dbg(VFS, "%s: malformed response (next_offset=%u)\n", -+ __func__, next_offset); -+ cifs_reconnect(server, true); -+ continue; -+ } - if (next_offset) - server->pdu_size = next_offset; - } -diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c -index 31e06133acc3d..41290c12d0bcc 100644 ---- a/fs/smb/client/misc.c -+++ b/fs/smb/client/misc.c -@@ -350,6 +350,10 @@ checkSMB(char *buf, unsigned int total_read, struct TCP_Server_Info *server) - cifs_dbg(VFS, "Length less than smb header size\n"); - } - return -EIO; -+ } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) { -+ cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n", -+ __func__, smb->WordCount); -+ return -EIO; - } - - /* otherwise, there is enough to get to the BCC */ -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 1b3489a2f0db7..df03d80ab6d5f 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -5196,17 +5196,22 @@ smb3_handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid) - NULL, 0, 0, false); - } - --static int --smb2_next_header(char *buf) -+static int smb2_next_header(struct TCP_Server_Info *server, char *buf, -+ unsigned int *noff) - { - struct smb2_hdr *hdr = (struct smb2_hdr *)buf; - struct smb2_transform_hdr *t_hdr = (struct smb2_transform_hdr *)buf; - -- if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) -- return sizeof(struct smb2_transform_hdr) + -- le32_to_cpu(t_hdr->OriginalMessageSize); -- -- return le32_to_cpu(hdr->NextCommand); -+ if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) { -+ *noff = le32_to_cpu(t_hdr->OriginalMessageSize); -+ if (unlikely(check_add_overflow(*noff, sizeof(*t_hdr), noff))) -+ return -EINVAL; -+ } else { -+ *noff = le32_to_cpu(hdr->NextCommand); -+ } -+ if (unlikely(*noff && *noff < MID_HEADER_SIZE(server))) -+ return -EINVAL; -+ return 0; - } - - static int -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 847d69d327c2a..05ff8a457a3d7 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -372,10 +372,15 @@ static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, - void **request_buf, unsigned int *total_len) - { - /* BB eventually switch this to SMB2 specific small buf size */ -- if (smb2_command == SMB2_SET_INFO) -+ switch (smb2_command) { -+ case SMB2_SET_INFO: -+ case SMB2_QUERY_INFO: - *request_buf = cifs_buf_get(); -- else -+ break; -+ default: - *request_buf = cifs_small_buf_get(); -+ break; -+ } - if (*request_buf == NULL) { - /* BB should we add a retry in here if not a writepage? */ - return -ENOMEM; -@@ -3523,8 +3528,13 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, - struct smb2_query_info_req *req; - struct kvec *iov = rqst->rq_iov; - unsigned int total_len; -+ size_t len; - int rc; - -+ if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) || -+ len > CIFSMaxBufSize)) -+ return -EINVAL; -+ - rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server, - (void **) &req, &total_len); - if (rc) -@@ -3546,7 +3556,7 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, - - iov[0].iov_base = (char *)req; - /* 1 for Buffer */ -- iov[0].iov_len = total_len - 1 + input_len; -+ iov[0].iov_len = len; - return 0; - } - -@@ -3554,7 +3564,7 @@ void - SMB2_query_info_free(struct smb_rqst *rqst) - { - if (rqst && rqst->rq_iov) -- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */ -+ cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */ - } - - static int -@@ -5439,6 +5449,11 @@ build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, - return 0; - } - -+static inline void free_qfs_info_req(struct kvec *iov) -+{ -+ cifs_buf_release(iov->iov_base); -+} -+ - int - SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata) -@@ -5470,7 +5485,7 @@ SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon, - - rc = cifs_send_recv(xid, ses, server, - &rqst, &resp_buftype, flags, &rsp_iov); -- cifs_small_buf_release(iov.iov_base); -+ free_qfs_info_req(&iov); - if (rc) { - cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); - goto posix_qfsinf_exit; -@@ -5521,7 +5536,7 @@ SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, - - rc = cifs_send_recv(xid, ses, server, - &rqst, &resp_buftype, flags, &rsp_iov); -- cifs_small_buf_release(iov.iov_base); -+ free_qfs_info_req(&iov); - if (rc) { - cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); - goto qfsinf_exit; -@@ -5588,7 +5603,7 @@ SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon, - - rc = cifs_send_recv(xid, ses, server, - &rqst, &resp_buftype, flags, &rsp_iov); -- cifs_small_buf_release(iov.iov_base); -+ free_qfs_info_req(&iov); - if (rc) { - cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE); - goto qfsattr_exit; -diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c -index 6b7d95b65f4b6..f4728e65d1bda 100644 ---- a/fs/ubifs/tnc.c -+++ b/fs/ubifs/tnc.c -@@ -65,6 +65,7 @@ static void do_insert_old_idx(struct ubifs_info *c, - else { - ubifs_err(c, "old idx added twice!"); - kfree(old_idx); -+ return; - } - } - rb_link_node(&old_idx->rb, parent, p); -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 1fba826f0acef..3ce9e39ecdb85 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -2681,6 +2681,9 @@ enum bpf_text_poke_type { - int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t, - void *addr1, void *addr2); - -+void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, -+ struct bpf_prog *new, struct bpf_prog *old); -+ - void *bpf_arch_text_copy(void *dst, void *src, size_t len); - int bpf_arch_text_invalidate(void *dst, size_t len); - -diff --git a/include/linux/damon.h b/include/linux/damon.h -index b13be7ae2275e..e6941b239f449 100644 ---- a/include/linux/damon.h -+++ b/include/linux/damon.h -@@ -8,6 +8,7 @@ - #ifndef _DAMON_H_ - #define _DAMON_H_ - -+#include - #include - #include - #include -@@ -452,6 +453,8 @@ struct damon_ctx { - /* private: internal use only */ - struct timespec64 last_aggregation; - struct timespec64 last_ops_update; -+ /* for waiting until the execution of the kdamond_fn is started */ -+ struct completion kdamond_started; - - /* public: */ - struct task_struct *kdamond; -diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h -index 1262d92ab88fc..2e71ca35942e9 100644 ---- a/include/linux/dm-bufio.h -+++ b/include/linux/dm-bufio.h -@@ -37,6 +37,8 @@ dm_bufio_client_create(struct block_device *bdev, unsigned int block_size, - */ - void dm_bufio_client_destroy(struct dm_bufio_client *c); - -+void dm_bufio_client_reset(struct dm_bufio_client *c); -+ - /* - * Set the sector range. - * When this function is called, there must be no I/O in progress on the bufio -diff --git a/include/linux/kasan.h b/include/linux/kasan.h -index 6e6f0238d63cc..4603e6e30c0ea 100644 ---- a/include/linux/kasan.h -+++ b/include/linux/kasan.h -@@ -471,10 +471,10 @@ static inline void kasan_free_module_shadow(const struct vm_struct *vm) {} - - #endif /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */ - --#ifdef CONFIG_KASAN -+#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) - void kasan_non_canonical_hook(unsigned long addr); --#else /* CONFIG_KASAN */ -+#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ - static inline void kasan_non_canonical_hook(unsigned long addr) { } --#endif /* CONFIG_KASAN */ -+#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ - - #endif /* LINUX_KASAN_H */ -diff --git a/include/linux/key-type.h b/include/linux/key-type.h -index 7d985a1dfe4af..5caf3ce823733 100644 ---- a/include/linux/key-type.h -+++ b/include/linux/key-type.h -@@ -73,6 +73,7 @@ struct key_type { - - unsigned int flags; - #define KEY_TYPE_NET_DOMAIN 0x00000001 /* Keys of this type have a net namespace domain */ -+#define KEY_TYPE_INSTANT_REAP 0x00000002 /* Keys of this type don't have a delay after expiring */ - - /* vet a description */ - int (*vet_description)(const char *description); -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 3660ce6a93496..93ec34a94b724 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -282,18 +282,23 @@ struct mlx5_cmd_stats { - struct mlx5_cmd { - struct mlx5_nb nb; - -+ /* members which needs to be queried or reinitialized each reload */ -+ struct { -+ u16 cmdif_rev; -+ u8 log_sz; -+ u8 log_stride; -+ int max_reg_cmds; -+ unsigned long bitmask; -+ struct semaphore sem; -+ struct semaphore pages_sem; -+ struct semaphore throttle_sem; -+ } vars; - enum mlx5_cmdif_state state; - void *cmd_alloc_buf; - dma_addr_t alloc_dma; - int alloc_size; - void *cmd_buf; - dma_addr_t dma; -- u16 cmdif_rev; -- u8 log_sz; -- u8 log_stride; -- int max_reg_cmds; -- int events; -- u32 __iomem *vector; - - /* protect command queue allocations - */ -@@ -303,11 +308,8 @@ struct mlx5_cmd { - */ - spinlock_t token_lock; - u8 token; -- unsigned long bitmask; - char wq_name[MLX5_CMD_WQ_MAX_NAME]; - struct workqueue_struct *wq; -- struct semaphore sem; -- struct semaphore pages_sem; - int mode; - u16 allowed_opcode; - struct mlx5_cmd_work_ent *ent_arr[MLX5_MAX_COMMANDS]; -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 583aebd8c1e01..5f8a534b65746 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -187,6 +187,7 @@ struct blocked_key { - struct smp_csrk { - bdaddr_t bdaddr; - u8 bdaddr_type; -+ u8 link_type; - u8 type; - u8 val[16]; - }; -@@ -196,6 +197,7 @@ struct smp_ltk { - struct rcu_head rcu; - bdaddr_t bdaddr; - u8 bdaddr_type; -+ u8 link_type; - u8 authenticated; - u8 type; - u8 enc_size; -@@ -210,6 +212,7 @@ struct smp_irk { - bdaddr_t rpa; - bdaddr_t bdaddr; - u8 addr_type; -+ u8 link_type; - u8 val[16]; - }; - -@@ -217,6 +220,8 @@ struct link_key { - struct list_head list; - struct rcu_head rcu; - bdaddr_t bdaddr; -+ u8 bdaddr_type; -+ u8 link_type; - u8 type; - u8 val[HCI_LINK_KEY_SIZE]; - u8 pin_len; -diff --git a/include/trace/events/9p.h b/include/trace/events/9p.h -index 4dfa6d7f83baa..cd104a1343e2d 100644 ---- a/include/trace/events/9p.h -+++ b/include/trace/events/9p.h -@@ -178,18 +178,21 @@ TRACE_EVENT(9p_protocol_dump, - __field( void *, clnt ) - __field( __u8, type ) - __field( __u16, tag ) -- __array( unsigned char, line, P9_PROTO_DUMP_SZ ) -+ __dynamic_array(unsigned char, line, -+ min_t(size_t, pdu->capacity, P9_PROTO_DUMP_SZ)) - ), - - TP_fast_assign( - __entry->clnt = clnt; - __entry->type = pdu->id; - __entry->tag = pdu->tag; -- memcpy(__entry->line, pdu->sdata, P9_PROTO_DUMP_SZ); -+ memcpy(__get_dynamic_array(line), pdu->sdata, -+ __get_dynamic_array_len(line)); - ), -- TP_printk("clnt %lu %s(tag = %d)\n%.3x: %16ph\n%.3x: %16ph\n", -+ TP_printk("clnt %lu %s(tag = %d)\n%*ph\n", - (unsigned long)__entry->clnt, show_9p_op(__entry->type), -- __entry->tag, 0, __entry->line, 16, __entry->line + 16) -+ __entry->tag, __get_dynamic_array_len(line), -+ __get_dynamic_array(line)) - ); - - -diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c -index 832b2659e96e2..00f23febb9a7d 100644 ---- a/kernel/bpf/arraymap.c -+++ b/kernel/bpf/arraymap.c -@@ -997,11 +997,16 @@ static void prog_array_map_poke_untrack(struct bpf_map *map, - mutex_unlock(&aux->poke_mutex); - } - -+void __weak bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, -+ struct bpf_prog *new, struct bpf_prog *old) -+{ -+ WARN_ON_ONCE(1); -+} -+ - static void prog_array_map_poke_run(struct bpf_map *map, u32 key, - struct bpf_prog *old, - struct bpf_prog *new) - { -- u8 *old_addr, *new_addr, *old_bypass_addr; - struct prog_poke_elem *elem; - struct bpf_array_aux *aux; - -@@ -1010,7 +1015,7 @@ static void prog_array_map_poke_run(struct bpf_map *map, u32 key, - - list_for_each_entry(elem, &aux->poke_progs, list) { - struct bpf_jit_poke_descriptor *poke; -- int i, ret; -+ int i; - - for (i = 0; i < elem->aux->size_poke_tab; i++) { - poke = &elem->aux->poke_tab[i]; -@@ -1029,21 +1034,10 @@ static void prog_array_map_poke_run(struct bpf_map *map, u32 key, - * activated, so tail call updates can arrive from here - * while JIT is still finishing its final fixup for - * non-activated poke entries. -- * 3) On program teardown, the program's kallsym entry gets -- * removed out of RCU callback, but we can only untrack -- * from sleepable context, therefore bpf_arch_text_poke() -- * might not see that this is in BPF text section and -- * bails out with -EINVAL. As these are unreachable since -- * RCU grace period already passed, we simply skip them. -- * 4) Also programs reaching refcount of zero while patching -+ * 3) Also programs reaching refcount of zero while patching - * is in progress is okay since we're protected under - * poke_mutex and untrack the programs before the JIT -- * buffer is freed. When we're still in the middle of -- * patching and suddenly kallsyms entry of the program -- * gets evicted, we just skip the rest which is fine due -- * to point 3). -- * 5) Any other error happening below from bpf_arch_text_poke() -- * is a unexpected bug. -+ * buffer is freed. - */ - if (!READ_ONCE(poke->tailcall_target_stable)) - continue; -@@ -1053,39 +1047,7 @@ static void prog_array_map_poke_run(struct bpf_map *map, u32 key, - poke->tail_call.key != key) - continue; - -- old_bypass_addr = old ? NULL : poke->bypass_addr; -- old_addr = old ? (u8 *)old->bpf_func + poke->adj_off : NULL; -- new_addr = new ? (u8 *)new->bpf_func + poke->adj_off : NULL; -- -- if (new) { -- ret = bpf_arch_text_poke(poke->tailcall_target, -- BPF_MOD_JUMP, -- old_addr, new_addr); -- BUG_ON(ret < 0 && ret != -EINVAL); -- if (!old) { -- ret = bpf_arch_text_poke(poke->tailcall_bypass, -- BPF_MOD_JUMP, -- poke->bypass_addr, -- NULL); -- BUG_ON(ret < 0 && ret != -EINVAL); -- } -- } else { -- ret = bpf_arch_text_poke(poke->tailcall_bypass, -- BPF_MOD_JUMP, -- old_bypass_addr, -- poke->bypass_addr); -- BUG_ON(ret < 0 && ret != -EINVAL); -- /* let other CPUs finish the execution of program -- * so that it will not possible to expose them -- * to invalid nop, stack unwind, nop state -- */ -- if (!ret) -- synchronize_rcu(); -- ret = bpf_arch_text_poke(poke->tailcall_target, -- BPF_MOD_JUMP, -- old_addr, NULL); -- BUG_ON(ret < 0 && ret != -EINVAL); -- } -+ bpf_arch_poke_desc_update(poke, new, old); - } - } - } -diff --git a/kernel/trace/synth_event_gen_test.c b/kernel/trace/synth_event_gen_test.c -index 8d77526892f45..d944924cd1e1c 100644 ---- a/kernel/trace/synth_event_gen_test.c -+++ b/kernel/trace/synth_event_gen_test.c -@@ -477,6 +477,17 @@ static int __init synth_event_gen_test_init(void) - - ret = test_trace_synth_event(); - WARN_ON(ret); -+ -+ /* Disable when done */ -+ trace_array_set_clr_event(gen_synth_test->tr, -+ "synthetic", -+ "gen_synth_test", false); -+ trace_array_set_clr_event(empty_synth_test->tr, -+ "synthetic", -+ "empty_synth_test", false); -+ trace_array_set_clr_event(create_synth_test->tr, -+ "synthetic", -+ "create_synth_test", false); - out: - return ret; - } -diff --git a/lib/vsprintf.c b/lib/vsprintf.c -index 24f37bab8bc1f..fa1c197018551 100644 ---- a/lib/vsprintf.c -+++ b/lib/vsprintf.c -@@ -2092,15 +2092,20 @@ char *fwnode_full_name_string(struct fwnode_handle *fwnode, char *buf, - - /* Loop starting from the root node to the current node. */ - for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) { -- struct fwnode_handle *__fwnode = -- fwnode_get_nth_parent(fwnode, depth); -+ /* -+ * Only get a reference for other nodes (i.e. parent nodes). -+ * fwnode refcount may be 0 here. -+ */ -+ struct fwnode_handle *__fwnode = depth ? -+ fwnode_get_nth_parent(fwnode, depth) : fwnode; - - buf = string(buf, end, fwnode_get_name_prefix(__fwnode), - default_str_spec); - buf = string(buf, end, fwnode_get_name(__fwnode), - default_str_spec); - -- fwnode_handle_put(__fwnode); -+ if (depth) -+ fwnode_handle_put(__fwnode); - } - - return buf; -diff --git a/mm/damon/core.c b/mm/damon/core.c -index 36d098d06c558..5db9bec8ae67c 100644 ---- a/mm/damon/core.c -+++ b/mm/damon/core.c -@@ -383,6 +383,8 @@ struct damon_ctx *damon_new_ctx(void) - if (!ctx) - return NULL; - -+ init_completion(&ctx->kdamond_started); -+ - ctx->attrs.sample_interval = 5 * 1000; - ctx->attrs.aggr_interval = 100 * 1000; - ctx->attrs.ops_update_interval = 60 * 1000 * 1000; -@@ -519,11 +521,14 @@ static int __damon_start(struct damon_ctx *ctx) - mutex_lock(&ctx->kdamond_lock); - if (!ctx->kdamond) { - err = 0; -+ reinit_completion(&ctx->kdamond_started); - ctx->kdamond = kthread_run(kdamond_fn, ctx, "kdamond.%d", - nr_running_ctxs); - if (IS_ERR(ctx->kdamond)) { - err = PTR_ERR(ctx->kdamond); - ctx->kdamond = NULL; -+ } else { -+ wait_for_completion(&ctx->kdamond_started); - } - } - mutex_unlock(&ctx->kdamond_lock); -@@ -1147,6 +1152,8 @@ static int kdamond_fn(void *data) - - pr_debug("kdamond (%d) starts\n", current->pid); - -+ complete(&ctx->kdamond_started); -+ - if (ctx->ops.init) - ctx->ops.init(ctx); - if (ctx->callback.before_start && ctx->callback.before_start(ctx)) -diff --git a/mm/kasan/report.c b/mm/kasan/report.c -index 66a37f177d231..5d9ae80df4954 100644 ---- a/mm/kasan/report.c -+++ b/mm/kasan/report.c -@@ -523,8 +523,9 @@ void kasan_report_async(void) - } - #endif /* CONFIG_KASAN_HW_TAGS */ - -+#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) - /* -- * With CONFIG_KASAN, accesses to bogus pointers (outside the high -+ * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high - * canonical half of the address space) cause out-of-bounds shadow memory reads - * before the actual access. For addresses in the low canonical half of the - * address space, as well as most non-canonical addresses, that out-of-bounds -@@ -560,3 +561,4 @@ void kasan_non_canonical_hook(unsigned long addr) - pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type, - orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1); - } -+#endif -diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c -index 0beb44f2fe1f0..f001582345052 100644 ---- a/net/8021q/vlan_core.c -+++ b/net/8021q/vlan_core.c -@@ -407,6 +407,8 @@ int vlan_vids_add_by_dev(struct net_device *dev, - return 0; - - list_for_each_entry(vid_info, &vlan_info->vid_list, list) { -+ if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) -+ continue; - err = vlan_vid_add(dev, vid_info->proto, vid_info->vid); - if (err) - goto unwind; -@@ -417,6 +419,8 @@ unwind: - list_for_each_entry_continue_reverse(vid_info, - &vlan_info->vid_list, - list) { -+ if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) -+ continue; - vlan_vid_del(dev, vid_info->proto, vid_info->vid); - } - -@@ -436,8 +440,11 @@ void vlan_vids_del_by_dev(struct net_device *dev, - if (!vlan_info) - return; - -- list_for_each_entry(vid_info, &vlan_info->vid_list, list) -+ list_for_each_entry(vid_info, &vlan_info->vid_list, list) { -+ if (!vlan_hw_filter_capable(by_dev, vid_info->proto)) -+ continue; - vlan_vid_del(dev, vid_info->proto, vid_info->vid); -+ } - } - EXPORT_SYMBOL(vlan_vids_del_by_dev); - -diff --git a/net/9p/protocol.c b/net/9p/protocol.c -index 4e3a2a1ffcb3f..0e6603b1ec906 100644 ---- a/net/9p/protocol.c -+++ b/net/9p/protocol.c -@@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, - uint16_t *nwname = va_arg(ap, uint16_t *); - char ***wnames = va_arg(ap, char ***); - -+ *wnames = NULL; -+ - errcode = p9pdu_readf(pdu, proto_version, - "w", nwname); - if (!errcode) { -@@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, - GFP_NOFS); - if (!*wnames) - errcode = -ENOMEM; -+ else -+ (*wnames)[0] = NULL; - } - - if (!errcode) { -@@ -414,8 +418,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, - proto_version, - "s", - &(*wnames)[i]); -- if (errcode) -+ if (errcode) { -+ (*wnames)[i] = NULL; - break; -+ } - } - } - -@@ -423,11 +429,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt, - if (*wnames) { - int i; - -- for (i = 0; i < *nwname; i++) -+ for (i = 0; i < *nwname; i++) { -+ if (!(*wnames)[i]) -+ break; - kfree((*wnames)[i]); -+ } -+ kfree(*wnames); -+ *wnames = NULL; - } -- kfree(*wnames); -- *wnames = NULL; - } - } - break; -diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c -index 1c3c7ff5c3c66..f1b7510359e4b 100644 ---- a/net/bluetooth/af_bluetooth.c -+++ b/net/bluetooth/af_bluetooth.c -@@ -264,11 +264,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - if (flags & MSG_OOB) - return -EOPNOTSUPP; - -+ lock_sock(sk); -+ - skb = skb_recv_datagram(sk, flags, &err); - if (!skb) { - if (sk->sk_shutdown & RCV_SHUTDOWN) -- return 0; -+ err = 0; - -+ release_sock(sk); - return err; - } - -@@ -294,6 +297,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - - skb_free_datagram(sk, skb); - -+ release_sock(sk); -+ - if (flags & MSG_TRUNC) - copied = skblen; - -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index c86a45344fe28..dcb13c64e8e7c 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -515,6 +515,9 @@ static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data, - { - struct hci_rp_read_class_of_dev *rp = data; - -+ if (WARN_ON(!hdev)) -+ return HCI_ERROR_UNSPECIFIED; -+ - bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); - - if (rp->status) -@@ -746,9 +749,23 @@ static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data, - } else { - conn->enc_key_size = rp->key_size; - status = 0; -+ -+ if (conn->enc_key_size < hdev->min_enc_key_size) { -+ /* As slave role, the conn->state has been set to -+ * BT_CONNECTED and l2cap conn req might not be received -+ * yet, at this moment the l2cap layer almost does -+ * nothing with the non-zero status. -+ * So we also clear encrypt related bits, and then the -+ * handler of l2cap conn req will get the right secure -+ * state at a later time. -+ */ -+ status = HCI_ERROR_AUTH_FAILURE; -+ clear_bit(HCI_CONN_ENCRYPT, &conn->flags); -+ clear_bit(HCI_CONN_AES_CCM, &conn->flags); -+ } - } - -- hci_encrypt_cfm(conn, 0); -+ hci_encrypt_cfm(conn, status); - - done: - hci_dev_unlock(hdev); -@@ -2298,7 +2315,8 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status) - return; - } - -- set_bit(HCI_INQUIRY, &hdev->flags); -+ if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY)) -+ set_bit(HCI_INQUIRY, &hdev->flags); - } - - static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status) -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index a7899857aee5d..4c5793053393f 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -6493,6 +6493,14 @@ drop: - kfree_skb(skb); - } - -+static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident) -+{ -+ struct l2cap_cmd_rej_unk rej; -+ -+ rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); -+ l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); -+} -+ - static inline void l2cap_sig_channel(struct l2cap_conn *conn, - struct sk_buff *skb) - { -@@ -6518,23 +6526,24 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, - - if (len > skb->len || !cmd->ident) { - BT_DBG("corrupted command"); -+ l2cap_sig_send_rej(conn, cmd->ident); - break; - } - - err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); - if (err) { -- struct l2cap_cmd_rej_unk rej; -- - BT_ERR("Wrong link type (%d)", err); -- -- rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); -- l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, -- sizeof(rej), &rej); -+ l2cap_sig_send_rej(conn, cmd->ident); - } - - skb_pull(skb, len); - } - -+ if (skb->len > 0) { -+ BT_DBG("corrupted command"); -+ l2cap_sig_send_rej(conn, 0); -+ } -+ - drop: - kfree_skb(skb); - } -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index d2e8565d0b33f..6d631a2e60166 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -2883,7 +2883,8 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, - for (i = 0; i < key_count; i++) { - struct mgmt_link_key_info *key = &cp->keys[i]; - -- if (key->addr.type != BDADDR_BREDR || key->type > 0x08) -+ /* Considering SMP over BREDR/LE, there is no need to check addr_type */ -+ if (key->type > 0x08) - return mgmt_cmd_status(sk, hdev->id, - MGMT_OP_LOAD_LINK_KEYS, - MGMT_STATUS_INVALID_PARAMS); -@@ -7129,6 +7130,7 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, - - for (i = 0; i < irk_count; i++) { - struct mgmt_irk_info *irk = &cp->irks[i]; -+ u8 addr_type = le_addr_type(irk->addr.type); - - if (hci_is_blocked_key(hdev, - HCI_BLOCKED_KEY_TYPE_IRK, -@@ -7138,8 +7140,12 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, - continue; - } - -+ /* When using SMP over BR/EDR, the addr type should be set to BREDR */ -+ if (irk->addr.type == BDADDR_BREDR) -+ addr_type = BDADDR_BREDR; -+ - hci_add_irk(hdev, &irk->addr.bdaddr, -- le_addr_type(irk->addr.type), irk->val, -+ addr_type, irk->val, - BDADDR_ANY); - } - -@@ -7220,6 +7226,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, - for (i = 0; i < key_count; i++) { - struct mgmt_ltk_info *key = &cp->keys[i]; - u8 type, authenticated; -+ u8 addr_type = le_addr_type(key->addr.type); - - if (hci_is_blocked_key(hdev, - HCI_BLOCKED_KEY_TYPE_LTK, -@@ -7254,8 +7261,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, - continue; - } - -+ /* When using SMP over BR/EDR, the addr type should be set to BREDR */ -+ if (key->addr.type == BDADDR_BREDR) -+ addr_type = BDADDR_BREDR; -+ - hci_add_ltk(hdev, &key->addr.bdaddr, -- le_addr_type(key->addr.type), type, authenticated, -+ addr_type, type, authenticated, - key->val, key->enc_size, key->ediv, key->rand); - } - -@@ -9523,7 +9534,7 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, - - ev.store_hint = persistent; - bacpy(&ev.key.addr.bdaddr, &key->bdaddr); -- ev.key.addr.type = BDADDR_BREDR; -+ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); - ev.key.type = key->type; - memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); - ev.key.pin_len = key->pin_len; -@@ -9574,7 +9585,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) - ev.store_hint = persistent; - - bacpy(&ev.key.addr.bdaddr, &key->bdaddr); -- ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); -+ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); - ev.key.type = mgmt_ltk_type(key); - ev.key.enc_size = key->enc_size; - ev.key.ediv = key->ediv; -@@ -9603,7 +9614,7 @@ void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) - - bacpy(&ev.rpa, &irk->rpa); - bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); -- ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); -+ ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); - memcpy(ev.irk.val, irk->val, sizeof(irk->val)); - - mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); -@@ -9632,7 +9643,7 @@ void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, - ev.store_hint = persistent; - - bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); -- ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); -+ ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); - ev.key.type = csrk->type; - memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); - -diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c -index 70663229b3cc9..ecb005bce65ac 100644 ---- a/net/bluetooth/smp.c -+++ b/net/bluetooth/smp.c -@@ -1058,6 +1058,7 @@ static void smp_notify_keys(struct l2cap_conn *conn) - } - - if (smp->remote_irk) { -+ smp->remote_irk->link_type = hcon->type; - mgmt_new_irk(hdev, smp->remote_irk, persistent); - - /* Now that user space can be considered to know the -@@ -1072,24 +1073,28 @@ static void smp_notify_keys(struct l2cap_conn *conn) - } - - if (smp->csrk) { -+ smp->csrk->link_type = hcon->type; - smp->csrk->bdaddr_type = hcon->dst_type; - bacpy(&smp->csrk->bdaddr, &hcon->dst); - mgmt_new_csrk(hdev, smp->csrk, persistent); - } - - if (smp->responder_csrk) { -+ smp->responder_csrk->link_type = hcon->type; - smp->responder_csrk->bdaddr_type = hcon->dst_type; - bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); - mgmt_new_csrk(hdev, smp->responder_csrk, persistent); - } - - if (smp->ltk) { -+ smp->ltk->link_type = hcon->type; - smp->ltk->bdaddr_type = hcon->dst_type; - bacpy(&smp->ltk->bdaddr, &hcon->dst); - mgmt_new_ltk(hdev, smp->ltk, persistent); - } - - if (smp->responder_ltk) { -+ smp->responder_ltk->link_type = hcon->type; - smp->responder_ltk->bdaddr_type = hcon->dst_type; - bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); - mgmt_new_ltk(hdev, smp->responder_ltk, persistent); -@@ -1109,6 +1114,8 @@ static void smp_notify_keys(struct l2cap_conn *conn) - key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, - smp->link_key, type, 0, &persistent); - if (key) { -+ key->link_type = hcon->type; -+ key->bdaddr_type = hcon->dst_type; - mgmt_new_link_key(hdev, key, persistent); - - /* Don't keep debug keys around if the relevant -diff --git a/net/core/dev.c b/net/core/dev.c -index 0d5aa820fd830..0a5566b6f8a25 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -3551,6 +3551,9 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, - if (gso_segs > READ_ONCE(dev->gso_max_segs)) - return features & ~NETIF_F_GSO_MASK; - -+ if (unlikely(skb->len >= READ_ONCE(dev->gso_max_size))) -+ return features & ~NETIF_F_GSO_MASK; -+ - if (!skb_shinfo(skb)->gso_type) { - skb_warn_bad_offload(skb); - return features & ~NETIF_F_GSO_MASK; -diff --git a/net/core/stream.c b/net/core/stream.c -index 051aa71a8ad0f..30e7deff4c551 100644 ---- a/net/core/stream.c -+++ b/net/core/stream.c -@@ -79,7 +79,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) - remove_wait_queue(sk_sleep(sk), &wait); - sk->sk_write_pending--; - } while (!done); -- return 0; -+ return done < 0 ? done : 0; - } - EXPORT_SYMBOL(sk_stream_wait_connect); - -diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c -index 3aced951d5ab8..03f8f33dc134c 100644 ---- a/net/dns_resolver/dns_key.c -+++ b/net/dns_resolver/dns_key.c -@@ -91,6 +91,7 @@ const struct cred *dns_resolver_cache; - static int - dns_resolver_preparse(struct key_preparsed_payload *prep) - { -+ const struct dns_server_list_v1_header *v1; - const struct dns_payload_header *bin; - struct user_key_payload *upayload; - unsigned long derrno; -@@ -122,6 +123,13 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) - return -EINVAL; - } - -+ v1 = (const struct dns_server_list_v1_header *)bin; -+ if ((v1->status != DNS_LOOKUP_GOOD && -+ v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) { -+ if (prep->expiry == TIME64_MAX) -+ prep->expiry = ktime_get_real_seconds() + 1; -+ } -+ - result_len = datalen; - goto store_result; - } -@@ -314,7 +322,7 @@ static long dns_resolver_read(const struct key *key, - - struct key_type key_type_dns_resolver = { - .name = "dns_resolver", -- .flags = KEY_TYPE_NET_DOMAIN, -+ .flags = KEY_TYPE_NET_DOMAIN | KEY_TYPE_INSTANT_REAP, - .preparse = dns_resolver_preparse, - .free_preparse = dns_resolver_free_preparse, - .instantiate = generic_key_instantiate, -diff --git a/net/ife/ife.c b/net/ife/ife.c -index 13bbf8cb6a396..be05b690b9ef2 100644 ---- a/net/ife/ife.c -+++ b/net/ife/ife.c -@@ -82,6 +82,7 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen) - if (unlikely(!pskb_may_pull(skb, total_pull))) - return NULL; - -+ ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len); - skb_set_mac_header(skb, total_pull); - __skb_pull(skb, total_pull); - *metalen = ifehdrln - IFE_METAHDRLEN; -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 2ca442f485132..a2c4866080bd7 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1694,10 +1694,10 @@ static int sta_link_apply_parameters(struct ieee80211_local *local, - lockdep_is_held(&local->sta_mtx)); - - /* -- * If there are no changes, then accept a link that doesn't exist, -+ * If there are no changes, then accept a link that exist, - * unless it's a new link. - */ -- if (params->link_id < 0 && !new_link && -+ if (params->link_id >= 0 && !new_link && - !params->link_mac && !params->txpwr_set && - !params->supported_rates_len && - !params->ht_capa && !params->vht_capa && -diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c -index bd0b7c189adfa..711c3377f428b 100644 ---- a/net/mac80211/mesh_plink.c -+++ b/net/mac80211/mesh_plink.c -@@ -1051,8 +1051,8 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata, - case WLAN_SP_MESH_PEERING_OPEN: - if (!matches_local) - event = OPN_RJCT; -- if (!mesh_plink_free_count(sdata) || -- (sta->mesh->plid && sta->mesh->plid != plid)) -+ else if (!mesh_plink_free_count(sdata) || -+ (sta->mesh->plid && sta->mesh->plid != plid)) - event = OPN_IGNR; - else - event = OPN_ACPT; -@@ -1060,9 +1060,9 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata, - case WLAN_SP_MESH_PEERING_CONFIRM: - if (!matches_local) - event = CNF_RJCT; -- if (!mesh_plink_free_count(sdata) || -- sta->mesh->llid != llid || -- (sta->mesh->plid && sta->mesh->plid != plid)) -+ else if (!mesh_plink_free_count(sdata) || -+ sta->mesh->llid != llid || -+ (sta->mesh->plid && sta->mesh->plid != plid)) - event = CNF_IGNR; - else - event = CNF_ACPT; -@@ -1230,6 +1230,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, - return; - } - elems = ieee802_11_parse_elems(baseaddr, len - baselen, true, NULL); -- mesh_process_plink_frame(sdata, mgmt, elems, rx_status); -- kfree(elems); -+ if (elems) { -+ mesh_process_plink_frame(sdata, mgmt, elems, rx_status); -+ kfree(elems); -+ } - } -diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c -index 2cc95c8dc4c7b..f74baefd855d3 100644 ---- a/net/rfkill/rfkill-gpio.c -+++ b/net/rfkill/rfkill-gpio.c -@@ -116,6 +116,14 @@ static int rfkill_gpio_probe(struct platform_device *pdev) - return -EINVAL; - } - -+ ret = gpiod_direction_output(rfkill->reset_gpio, true); -+ if (ret) -+ return ret; -+ -+ ret = gpiod_direction_output(rfkill->shutdown_gpio, true); -+ if (ret) -+ return ret; -+ - rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev, - rfkill->type, &rfkill_gpio_ops, - rfkill); -diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c -index 674937284b8d2..29b74a569e0b0 100644 ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -182,21 +182,47 @@ void rose_kill_by_neigh(struct rose_neigh *neigh) - */ - static void rose_kill_by_device(struct net_device *dev) - { -- struct sock *s; -+ struct sock *sk, *array[16]; -+ struct rose_sock *rose; -+ bool rescan; -+ int i, cnt; - -+start: -+ rescan = false; -+ cnt = 0; - spin_lock_bh(&rose_list_lock); -- sk_for_each(s, &rose_list) { -- struct rose_sock *rose = rose_sk(s); -+ sk_for_each(sk, &rose_list) { -+ rose = rose_sk(sk); -+ if (rose->device == dev) { -+ if (cnt == ARRAY_SIZE(array)) { -+ rescan = true; -+ break; -+ } -+ sock_hold(sk); -+ array[cnt++] = sk; -+ } -+ } -+ spin_unlock_bh(&rose_list_lock); - -+ for (i = 0; i < cnt; i++) { -+ sk = array[cnt]; -+ rose = rose_sk(sk); -+ lock_sock(sk); -+ spin_lock_bh(&rose_list_lock); - if (rose->device == dev) { -- rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); -+ rose_disconnect(sk, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); - if (rose->neighbour) - rose->neighbour->use--; - netdev_put(rose->device, &rose->dev_tracker); - rose->device = NULL; - } -+ spin_unlock_bh(&rose_list_lock); -+ release_sock(sk); -+ sock_put(sk); -+ cond_resched(); - } -- spin_unlock_bh(&rose_list_lock); -+ if (rescan) -+ goto start; - } - - /* -@@ -656,7 +682,10 @@ static int rose_release(struct socket *sock) - break; - } - -+ spin_lock_bh(&rose_list_lock); - netdev_put(rose->device, &rose->dev_tracker); -+ rose->device = NULL; -+ spin_unlock_bh(&rose_list_lock); - sock->sk = NULL; - release_sock(sk); - sock_put(sk); -diff --git a/net/wireless/certs/wens.hex b/net/wireless/certs/wens.hex -new file mode 100644 -index 0000000000000..0d50369bede98 ---- /dev/null -+++ b/net/wireless/certs/wens.hex -@@ -0,0 +1,87 @@ -+/* Chen-Yu Tsai's regdb certificate */ -+0x30, 0x82, 0x02, 0xa7, 0x30, 0x82, 0x01, 0x8f, -+0x02, 0x14, 0x61, 0xc0, 0x38, 0x65, 0x1a, 0xab, -+0xdc, 0xf9, 0x4b, 0xd0, 0xac, 0x7f, 0xf0, 0x6c, -+0x72, 0x48, 0xdb, 0x18, 0xc6, 0x00, 0x30, 0x0d, -+0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, -+0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x0f, 0x31, -+0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, -+0x0c, 0x04, 0x77, 0x65, 0x6e, 0x73, 0x30, 0x20, -+0x17, 0x0d, 0x32, 0x33, 0x31, 0x32, 0x30, 0x31, -+0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, 0x18, -+0x0f, 0x32, 0x31, 0x32, 0x33, 0x31, 0x31, 0x30, -+0x37, 0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, -+0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, -+0x55, 0x04, 0x03, 0x0c, 0x04, 0x77, 0x65, 0x6e, -+0x73, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, -+0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, -+0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, -+0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, -+0x01, 0x00, 0xa9, 0x7a, 0x2c, 0x78, 0x4d, 0xa7, -+0x19, 0x2d, 0x32, 0x52, 0xa0, 0x2e, 0x6c, 0xef, -+0x88, 0x7f, 0x15, 0xc5, 0xb6, 0x69, 0x54, 0x16, -+0x43, 0x14, 0x79, 0x53, 0xb7, 0xae, 0x88, 0xfe, -+0xc0, 0xb7, 0x5d, 0x47, 0x8e, 0x1a, 0xe1, 0xef, -+0xb3, 0x90, 0x86, 0xda, 0xd3, 0x64, 0x81, 0x1f, -+0xce, 0x5d, 0x9e, 0x4b, 0x6e, 0x58, 0x02, 0x3e, -+0xb2, 0x6f, 0x5e, 0x42, 0x47, 0x41, 0xf4, 0x2c, -+0xb8, 0xa8, 0xd4, 0xaa, 0xc0, 0x0e, 0xe6, 0x48, -+0xf0, 0xa8, 0xce, 0xcb, 0x08, 0xae, 0x37, 0xaf, -+0xf6, 0x40, 0x39, 0xcb, 0x55, 0x6f, 0x5b, 0x4f, -+0x85, 0x34, 0xe6, 0x69, 0x10, 0x50, 0x72, 0x5e, -+0x4e, 0x9d, 0x4c, 0xba, 0x38, 0x36, 0x0d, 0xce, -+0x73, 0x38, 0xd7, 0x27, 0x02, 0x2a, 0x79, 0x03, -+0xe1, 0xac, 0xcf, 0xb0, 0x27, 0x85, 0x86, 0x93, -+0x17, 0xab, 0xec, 0x42, 0x77, 0x37, 0x65, 0x8a, -+0x44, 0xcb, 0xd6, 0x42, 0x93, 0x92, 0x13, 0xe3, -+0x39, 0x45, 0xc5, 0x6e, 0x00, 0x4a, 0x7f, 0xcb, -+0x42, 0x17, 0x2b, 0x25, 0x8c, 0xb8, 0x17, 0x3b, -+0x15, 0x36, 0x59, 0xde, 0x42, 0xce, 0x21, 0xe6, -+0xb6, 0xc7, 0x6e, 0x5e, 0x26, 0x1f, 0xf7, 0x8a, -+0x57, 0x9e, 0xa5, 0x96, 0x72, 0xb7, 0x02, 0x32, -+0xeb, 0x07, 0x2b, 0x73, 0xe2, 0x4f, 0x66, 0x58, -+0x9a, 0xeb, 0x0f, 0x07, 0xb6, 0xab, 0x50, 0x8b, -+0xc3, 0x8f, 0x17, 0xfa, 0x0a, 0x99, 0xc2, 0x16, -+0x25, 0xbf, 0x2d, 0x6b, 0x1a, 0xaa, 0xe6, 0x3e, -+0x5f, 0xeb, 0x6d, 0x9b, 0x5d, 0x4d, 0x42, 0x83, -+0x2d, 0x39, 0xb8, 0xc9, 0xac, 0xdb, 0x3a, 0x91, -+0x50, 0xdf, 0xbb, 0xb1, 0x76, 0x6d, 0x15, 0x73, -+0xfd, 0xc6, 0xe6, 0x6b, 0x71, 0x9e, 0x67, 0x36, -+0x22, 0x83, 0x79, 0xb1, 0xd6, 0xb8, 0x84, 0x52, -+0xaf, 0x96, 0x5b, 0xc3, 0x63, 0x02, 0x4e, 0x78, -+0x70, 0x57, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, -+0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, -+0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, -+0x01, 0x01, 0x00, 0x24, 0x28, 0xee, 0x22, 0x74, -+0x7f, 0x7c, 0xfa, 0x6c, 0x1f, 0xb3, 0x18, 0xd1, -+0xc2, 0x3d, 0x7d, 0x29, 0x42, 0x88, 0xad, 0x82, -+0xa5, 0xb1, 0x8a, 0x05, 0xd0, 0xec, 0x5c, 0x91, -+0x20, 0xf6, 0x82, 0xfd, 0xd5, 0x67, 0x60, 0x5f, -+0x31, 0xf5, 0xbd, 0x88, 0x91, 0x70, 0xbd, 0xb8, -+0xb9, 0x8c, 0x88, 0xfe, 0x53, 0xc9, 0x54, 0x9b, -+0x43, 0xc4, 0x7a, 0x43, 0x74, 0x6b, 0xdd, 0xb0, -+0xb1, 0x3b, 0x33, 0x45, 0x46, 0x78, 0xa3, 0x1c, -+0xef, 0x54, 0x68, 0xf7, 0x85, 0x9c, 0xe4, 0x51, -+0x6f, 0x06, 0xaf, 0x81, 0xdb, 0x2a, 0x7b, 0x7b, -+0x6f, 0xa8, 0x9c, 0x67, 0xd8, 0xcb, 0xc9, 0x91, -+0x40, 0x00, 0xae, 0xd9, 0xa1, 0x9f, 0xdd, 0xa6, -+0x43, 0x0e, 0x28, 0x7b, 0xaa, 0x1b, 0xe9, 0x84, -+0xdb, 0x76, 0x64, 0x42, 0x70, 0xc9, 0xc0, 0xeb, -+0xae, 0x84, 0x11, 0x16, 0x68, 0x4e, 0x84, 0x9e, -+0x7e, 0x92, 0x36, 0xee, 0x1c, 0x3b, 0x08, 0x63, -+0xeb, 0x79, 0x84, 0x15, 0x08, 0x9d, 0xaf, 0xc8, -+0x9a, 0xc7, 0x34, 0xd3, 0x94, 0x4b, 0xd1, 0x28, -+0x97, 0xbe, 0xd1, 0x45, 0x75, 0xdc, 0x35, 0x62, -+0xac, 0x1d, 0x1f, 0xb7, 0xb7, 0x15, 0x87, 0xc8, -+0x98, 0xc0, 0x24, 0x31, 0x56, 0x8d, 0xed, 0xdb, -+0x06, 0xc6, 0x46, 0xbf, 0x4b, 0x6d, 0xa6, 0xd5, -+0xab, 0xcc, 0x60, 0xfc, 0xe5, 0x37, 0xb6, 0x53, -+0x7d, 0x58, 0x95, 0xa9, 0x56, 0xc7, 0xf7, 0xee, -+0xc3, 0xa0, 0x76, 0xf7, 0x65, 0x4d, 0x53, 0xfa, -+0xff, 0x5f, 0x76, 0x33, 0x5a, 0x08, 0xfa, 0x86, -+0x92, 0x5a, 0x13, 0xfa, 0x1a, 0xfc, 0xf2, 0x1b, -+0x8c, 0x7f, 0x42, 0x6d, 0xb7, 0x7e, 0xb7, 0xb4, -+0xf0, 0xc7, 0x83, 0xbb, 0xa2, 0x81, 0x03, 0x2d, -+0xd4, 0x2a, 0x63, 0x3f, 0xf7, 0x31, 0x2e, 0x40, -+0x33, 0x5c, 0x46, 0xbc, 0x9b, 0xc1, 0x05, 0xa5, -+0x45, 0x4e, 0xc3, -diff --git a/net/wireless/core.h b/net/wireless/core.h -index e1accacc6f233..ee980965a7cfb 100644 ---- a/net/wireless/core.h -+++ b/net/wireless/core.h -@@ -297,6 +297,7 @@ struct cfg80211_cqm_config { - u32 rssi_hyst; - s32 last_rssi_event_value; - enum nl80211_cqm_rssi_threshold_event last_rssi_event_type; -+ bool use_range_api; - int n_rssi_thresholds; - s32 rssi_thresholds[]; - }; -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index b19b5acfaf3a9..70fb14b8bab07 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -12574,10 +12574,6 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, - int i, n, low_index; - int err; - -- /* RSSI reporting disabled? */ -- if (!cqm_config) -- return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); -- - /* - * Obtain current RSSI value if possible, if not and no RSSI threshold - * event has been received yet, we should receive an event after a -@@ -12652,18 +12648,6 @@ static int nl80211_set_cqm_rssi(struct genl_info *info, - wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) - return -EOPNOTSUPP; - -- if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { -- if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ -- return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); -- -- return rdev_set_cqm_rssi_config(rdev, dev, -- thresholds[0], hysteresis); -- } -- -- if (!wiphy_ext_feature_isset(&rdev->wiphy, -- NL80211_EXT_FEATURE_CQM_RSSI_LIST)) -- return -EOPNOTSUPP; -- - if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ - n_thresholds = 0; - -@@ -12671,6 +12655,26 @@ static int nl80211_set_cqm_rssi(struct genl_info *info, - old = rcu_dereference_protected(wdev->cqm_config, - lockdep_is_held(&wdev->mtx)); - -+ /* if already disabled just succeed */ -+ if (!n_thresholds && !old) { -+ err = 0; -+ goto unlock; -+ } -+ -+ if (n_thresholds > 1) { -+ if (!wiphy_ext_feature_isset(&rdev->wiphy, -+ NL80211_EXT_FEATURE_CQM_RSSI_LIST) || -+ !rdev->ops->set_cqm_rssi_range_config) { -+ err = -EOPNOTSUPP; -+ goto unlock; -+ } -+ } else { -+ if (!rdev->ops->set_cqm_rssi_config) { -+ err = -EOPNOTSUPP; -+ goto unlock; -+ } -+ } -+ - if (n_thresholds) { - cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds, - n_thresholds), -@@ -12685,13 +12689,26 @@ static int nl80211_set_cqm_rssi(struct genl_info *info, - memcpy(cqm_config->rssi_thresholds, thresholds, - flex_array_size(cqm_config, rssi_thresholds, - n_thresholds)); -+ cqm_config->use_range_api = n_thresholds > 1 || -+ !rdev->ops->set_cqm_rssi_config; - - rcu_assign_pointer(wdev->cqm_config, cqm_config); -+ -+ if (cqm_config->use_range_api) -+ err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config); -+ else -+ err = rdev_set_cqm_rssi_config(rdev, dev, -+ thresholds[0], -+ hysteresis); - } else { - RCU_INIT_POINTER(wdev->cqm_config, NULL); -+ /* if enabled as range also disable via range */ -+ if (old->use_range_api) -+ err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); -+ else -+ err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0); - } - -- err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config); - if (err) { - rcu_assign_pointer(wdev->cqm_config, old); - kfree_rcu(cqm_config, rcu_head); -@@ -18758,10 +18775,11 @@ void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work) - wdev_lock(wdev); - cqm_config = rcu_dereference_protected(wdev->cqm_config, - lockdep_is_held(&wdev->mtx)); -- if (!wdev->cqm_config) -+ if (!cqm_config) - goto unlock; - -- cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config); -+ if (cqm_config->use_range_api) -+ cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config); - - rssi_level = cqm_config->last_rssi_event_value; - rssi_event = cqm_config->last_rssi_event_type; -diff --git a/security/keys/gc.c b/security/keys/gc.c -index 3c90807476eb0..eaddaceda14ea 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -66,6 +66,19 @@ void key_schedule_gc(time64_t gc_at) - } - } - -+/* -+ * Set the expiration time on a key. -+ */ -+void key_set_expiry(struct key *key, time64_t expiry) -+{ -+ key->expiry = expiry; -+ if (expiry != TIME64_MAX) { -+ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) -+ expiry += key_gc_delay; -+ key_schedule_gc(expiry); -+ } -+} -+ - /* - * Schedule a dead links collection run. - */ -@@ -176,7 +189,6 @@ static void key_garbage_collector(struct work_struct *work) - static u8 gc_state; /* Internal persistent state */ - #define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */ - #define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */ --#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */ - #define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */ - #define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */ - #define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */ -@@ -184,21 +196,17 @@ static void key_garbage_collector(struct work_struct *work) - - struct rb_node *cursor; - struct key *key; -- time64_t new_timer, limit; -+ time64_t new_timer, limit, expiry; - - kenter("[%lx,%x]", key_gc_flags, gc_state); - - limit = ktime_get_real_seconds(); -- if (limit > key_gc_delay) -- limit -= key_gc_delay; -- else -- limit = key_gc_delay; - - /* Work out what we're going to be doing in this pass */ - gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2; - gc_state <<= 1; - if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags)) -- gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER; -+ gc_state |= KEY_GC_REAPING_LINKS; - - if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) - gc_state |= KEY_GC_REAPING_DEAD_1; -@@ -233,8 +241,11 @@ continue_scanning: - } - } - -- if (gc_state & KEY_GC_SET_TIMER) { -- if (key->expiry > limit && key->expiry < new_timer) { -+ expiry = key->expiry; -+ if (expiry != TIME64_MAX) { -+ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) -+ expiry += key_gc_delay; -+ if (expiry > limit && expiry < new_timer) { - kdebug("will expire %x in %lld", - key_serial(key), key->expiry - limit); - new_timer = key->expiry; -@@ -276,7 +287,7 @@ maybe_resched: - */ - kdebug("pass complete"); - -- if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) { -+ if (new_timer != TIME64_MAX) { - new_timer += key_gc_delay; - key_schedule_gc(new_timer); - } -diff --git a/security/keys/internal.h b/security/keys/internal.h -index 3c1e7122076b9..ec2ec335b6133 100644 ---- a/security/keys/internal.h -+++ b/security/keys/internal.h -@@ -174,6 +174,7 @@ extern unsigned key_gc_delay; - extern void keyring_gc(struct key *keyring, time64_t limit); - extern void keyring_restriction_gc(struct key *keyring, - struct key_type *dead_type); -+void key_set_expiry(struct key *key, time64_t expiry); - extern void key_schedule_gc(time64_t gc_at); - extern void key_schedule_gc_links(void); - extern void key_gc_keytype(struct key_type *ktype); -@@ -222,10 +223,18 @@ extern struct key *key_get_instantiation_authkey(key_serial_t target_id); - */ - static inline bool key_is_dead(const struct key *key, time64_t limit) - { -+ time64_t expiry = key->expiry; -+ -+ if (expiry != TIME64_MAX) { -+ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) -+ expiry += key_gc_delay; -+ if (expiry <= limit) -+ return true; -+ } -+ - return - key->flags & ((1 << KEY_FLAG_DEAD) | - (1 << KEY_FLAG_INVALIDATED)) || -- (key->expiry > 0 && key->expiry <= limit) || - key->domain_tag->removed; - } - -diff --git a/security/keys/key.c b/security/keys/key.c -index c45afdd1dfbb4..e65240641ca57 100644 ---- a/security/keys/key.c -+++ b/security/keys/key.c -@@ -294,6 +294,7 @@ struct key *key_alloc(struct key_type *type, const char *desc, - key->uid = uid; - key->gid = gid; - key->perm = perm; -+ key->expiry = TIME64_MAX; - key->restrict_link = restrict_link; - key->last_used_at = ktime_get_real_seconds(); - -@@ -463,10 +464,7 @@ static int __key_instantiate_and_link(struct key *key, - if (authkey) - key_invalidate(authkey); - -- if (prep->expiry != TIME64_MAX) { -- key->expiry = prep->expiry; -- key_schedule_gc(prep->expiry + key_gc_delay); -- } -+ key_set_expiry(key, prep->expiry); - } - } - -@@ -606,8 +604,7 @@ int key_reject_and_link(struct key *key, - atomic_inc(&key->user->nikeys); - mark_key_instantiated(key, -error); - notify_key(key, NOTIFY_KEY_INSTANTIATED, -error); -- key->expiry = ktime_get_real_seconds() + timeout; -- key_schedule_gc(key->expiry + key_gc_delay); -+ key_set_expiry(key, ktime_get_real_seconds() + timeout); - - if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) - awaken = 1; -@@ -722,16 +719,14 @@ found_kernel_type: - - void key_set_timeout(struct key *key, unsigned timeout) - { -- time64_t expiry = 0; -+ time64_t expiry = TIME64_MAX; - - /* make the changes with the locks held to prevent races */ - down_write(&key->sem); - - if (timeout > 0) - expiry = ktime_get_real_seconds() + timeout; -- -- key->expiry = expiry; -- key_schedule_gc(key->expiry + key_gc_delay); -+ key_set_expiry(key, expiry); - - up_write(&key->sem); - } -diff --git a/security/keys/proc.c b/security/keys/proc.c -index d0cde6685627f..4f4e2c1824f18 100644 ---- a/security/keys/proc.c -+++ b/security/keys/proc.c -@@ -198,7 +198,7 @@ static int proc_keys_show(struct seq_file *m, void *v) - - /* come up with a suitable timeout value */ - expiry = READ_ONCE(key->expiry); -- if (expiry == 0) { -+ if (expiry == TIME64_MAX) { - memcpy(xbuf, "perm", 5); - } else if (now >= expiry) { - memcpy(xbuf, "expd", 5); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index a7c361e0daebe..a88ed60dcd96a 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9735,6 +9735,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), -+ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), - SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), -diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c -index 4d3c3365488a2..d8259afc60b08 100644 ---- a/sound/soc/codecs/hdmi-codec.c -+++ b/sound/soc/codecs/hdmi-codec.c -@@ -834,8 +834,9 @@ static int hdmi_dai_probe(struct snd_soc_dai *dai) - static void hdmi_codec_jack_report(struct hdmi_codec_priv *hcp, - unsigned int jack_status) - { -- if (hcp->jack && jack_status != hcp->jack_status) { -- snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_LINEOUT); -+ if (jack_status != hcp->jack_status) { -+ if (hcp->jack) -+ snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_LINEOUT); - hcp->jack_status = jack_status; - } - } -@@ -864,6 +865,13 @@ static int hdmi_codec_set_jack(struct snd_soc_component *component, - - if (hcp->hcd.ops->hook_plugged_cb) { - hcp->jack = jack; -+ -+ /* -+ * Report the initial jack status which may have been provided -+ * by the parent hdmi driver while the hpd hook was registered. -+ */ -+ snd_soc_jack_report(jack, hcp->jack_status, SND_JACK_LINEOUT); -+ - return 0; - } - -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index 6364d9be28fbb..cf1cd0460ad98 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -715,6 +715,9 @@ static int fsl_sai_hw_free(struct snd_pcm_substream *substream, - bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; - unsigned int ofs = sai->soc_data->reg_offset; - -+ /* Clear xMR to avoid channel swap with mclk_with_tere enabled case */ -+ regmap_write(sai->regmap, FSL_SAI_xMR(tx), 0); -+ - regmap_update_bits(sai->regmap, FSL_SAI_xCR3(tx, ofs), - FSL_SAI_CR3_TRCE_MASK, 0); - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index f458328f9ec42..33380cad3a735 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1385,7 +1385,7 @@ free_buf: - - static int snd_usb_motu_m_series_boot_quirk(struct usb_device *dev) - { -- msleep(2000); -+ msleep(4000); - - return 0; - } -@@ -1628,7 +1628,7 @@ int snd_usb_apply_boot_quirk_once(struct usb_device *dev, - unsigned int id) - { - switch (id) { -- case USB_ID(0x07fd, 0x0008): /* MOTU M Series */ -+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series, 1st hardware version */ - return snd_usb_motu_m_series_boot_quirk(dev); - } - -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index ea6fc59e9f62f..e52d513009fb0 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -2652,7 +2652,7 @@ backup_tests() - fi - - if reset "mpc backup" && -- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then -+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then - pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup - run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow - chk_join_nr 0 0 0 -@@ -2660,7 +2660,7 @@ backup_tests() - fi - - if reset "mpc backup both sides" && -- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then -+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then - pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow,backup - pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup - run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow -@@ -2669,7 +2669,7 @@ backup_tests() - fi - - if reset "mpc switch to backup" && -- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then -+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then - pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow - run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow backup - chk_join_nr 0 0 0 -@@ -2677,7 +2677,7 @@ backup_tests() - fi - - if reset "mpc switch to backup both sides" && -- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then -+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then - pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow - pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow - run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow backup diff --git a/patch/kernel/odroidxu4-current/patch-6.1.70-71.patch b/patch/kernel/odroidxu4-current/patch-6.1.70-71.patch deleted file mode 100644 index b085fc4d77..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.70-71.patch +++ /dev/null @@ -1,7517 +0,0 @@ -diff --git a/Makefile b/Makefile -index 270593fcafdcd..2840e36fd5596 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 70 -+SUBLEVEL = 71 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi -index 32d397b3950b9..b2e7f6a710740 100644 ---- a/arch/arm/boot/dts/am33xx.dtsi -+++ b/arch/arm/boot/dts/am33xx.dtsi -@@ -349,6 +349,7 @@ - , - , - ; -+ ti,sysc-delay-us = <2>; - clocks = <&l3s_clkctrl AM3_L3S_USB_OTG_HS_CLKCTRL 0>; - clock-names = "fck"; - #address-cells = <1>; -diff --git a/drivers/base/property.c b/drivers/base/property.c -index b0c40d9734847..eb9b01c2ff1d9 100644 ---- a/drivers/base/property.c -+++ b/drivers/base/property.c -@@ -17,12 +17,19 @@ - #include - #include - --struct fwnode_handle *dev_fwnode(const struct device *dev) -+struct fwnode_handle *__dev_fwnode(struct device *dev) - { - return IS_ENABLED(CONFIG_OF) && dev->of_node ? - of_fwnode_handle(dev->of_node) : dev->fwnode; - } --EXPORT_SYMBOL_GPL(dev_fwnode); -+EXPORT_SYMBOL_GPL(__dev_fwnode); -+ -+const struct fwnode_handle *__dev_fwnode_const(const struct device *dev) -+{ -+ return IS_ENABLED(CONFIG_OF) && dev->of_node ? -+ of_fwnode_handle(dev->of_node) : dev->fwnode; -+} -+EXPORT_SYMBOL_GPL(__dev_fwnode_const); - - /** - * device_property_present - check if a property of a device is present -diff --git a/drivers/iio/imu/adis16475.c b/drivers/iio/imu/adis16475.c -index aec55f7e1f260..2d939773445d7 100644 ---- a/drivers/iio/imu/adis16475.c -+++ b/drivers/iio/imu/adis16475.c -@@ -1243,50 +1243,6 @@ static int adis16475_config_irq_pin(struct adis16475 *st) - return 0; - } - --static const struct of_device_id adis16475_of_match[] = { -- { .compatible = "adi,adis16470", -- .data = &adis16475_chip_info[ADIS16470] }, -- { .compatible = "adi,adis16475-1", -- .data = &adis16475_chip_info[ADIS16475_1] }, -- { .compatible = "adi,adis16475-2", -- .data = &adis16475_chip_info[ADIS16475_2] }, -- { .compatible = "adi,adis16475-3", -- .data = &adis16475_chip_info[ADIS16475_3] }, -- { .compatible = "adi,adis16477-1", -- .data = &adis16475_chip_info[ADIS16477_1] }, -- { .compatible = "adi,adis16477-2", -- .data = &adis16475_chip_info[ADIS16477_2] }, -- { .compatible = "adi,adis16477-3", -- .data = &adis16475_chip_info[ADIS16477_3] }, -- { .compatible = "adi,adis16465-1", -- .data = &adis16475_chip_info[ADIS16465_1] }, -- { .compatible = "adi,adis16465-2", -- .data = &adis16475_chip_info[ADIS16465_2] }, -- { .compatible = "adi,adis16465-3", -- .data = &adis16475_chip_info[ADIS16465_3] }, -- { .compatible = "adi,adis16467-1", -- .data = &adis16475_chip_info[ADIS16467_1] }, -- { .compatible = "adi,adis16467-2", -- .data = &adis16475_chip_info[ADIS16467_2] }, -- { .compatible = "adi,adis16467-3", -- .data = &adis16475_chip_info[ADIS16467_3] }, -- { .compatible = "adi,adis16500", -- .data = &adis16475_chip_info[ADIS16500] }, -- { .compatible = "adi,adis16505-1", -- .data = &adis16475_chip_info[ADIS16505_1] }, -- { .compatible = "adi,adis16505-2", -- .data = &adis16475_chip_info[ADIS16505_2] }, -- { .compatible = "adi,adis16505-3", -- .data = &adis16475_chip_info[ADIS16505_3] }, -- { .compatible = "adi,adis16507-1", -- .data = &adis16475_chip_info[ADIS16507_1] }, -- { .compatible = "adi,adis16507-2", -- .data = &adis16475_chip_info[ADIS16507_2] }, -- { .compatible = "adi,adis16507-3", -- .data = &adis16475_chip_info[ADIS16507_3] }, -- { }, --}; --MODULE_DEVICE_TABLE(of, adis16475_of_match); - - static int adis16475_probe(struct spi_device *spi) - { -@@ -1300,7 +1256,7 @@ static int adis16475_probe(struct spi_device *spi) - - st = iio_priv(indio_dev); - -- st->info = device_get_match_data(&spi->dev); -+ st->info = spi_get_device_match_data(spi); - if (!st->info) - return -EINVAL; - -@@ -1340,12 +1296,83 @@ static int adis16475_probe(struct spi_device *spi) - return 0; - } - -+static const struct of_device_id adis16475_of_match[] = { -+ { .compatible = "adi,adis16470", -+ .data = &adis16475_chip_info[ADIS16470] }, -+ { .compatible = "adi,adis16475-1", -+ .data = &adis16475_chip_info[ADIS16475_1] }, -+ { .compatible = "adi,adis16475-2", -+ .data = &adis16475_chip_info[ADIS16475_2] }, -+ { .compatible = "adi,adis16475-3", -+ .data = &adis16475_chip_info[ADIS16475_3] }, -+ { .compatible = "adi,adis16477-1", -+ .data = &adis16475_chip_info[ADIS16477_1] }, -+ { .compatible = "adi,adis16477-2", -+ .data = &adis16475_chip_info[ADIS16477_2] }, -+ { .compatible = "adi,adis16477-3", -+ .data = &adis16475_chip_info[ADIS16477_3] }, -+ { .compatible = "adi,adis16465-1", -+ .data = &adis16475_chip_info[ADIS16465_1] }, -+ { .compatible = "adi,adis16465-2", -+ .data = &adis16475_chip_info[ADIS16465_2] }, -+ { .compatible = "adi,adis16465-3", -+ .data = &adis16475_chip_info[ADIS16465_3] }, -+ { .compatible = "adi,adis16467-1", -+ .data = &adis16475_chip_info[ADIS16467_1] }, -+ { .compatible = "adi,adis16467-2", -+ .data = &adis16475_chip_info[ADIS16467_2] }, -+ { .compatible = "adi,adis16467-3", -+ .data = &adis16475_chip_info[ADIS16467_3] }, -+ { .compatible = "adi,adis16500", -+ .data = &adis16475_chip_info[ADIS16500] }, -+ { .compatible = "adi,adis16505-1", -+ .data = &adis16475_chip_info[ADIS16505_1] }, -+ { .compatible = "adi,adis16505-2", -+ .data = &adis16475_chip_info[ADIS16505_2] }, -+ { .compatible = "adi,adis16505-3", -+ .data = &adis16475_chip_info[ADIS16505_3] }, -+ { .compatible = "adi,adis16507-1", -+ .data = &adis16475_chip_info[ADIS16507_1] }, -+ { .compatible = "adi,adis16507-2", -+ .data = &adis16475_chip_info[ADIS16507_2] }, -+ { .compatible = "adi,adis16507-3", -+ .data = &adis16475_chip_info[ADIS16507_3] }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(of, adis16475_of_match); -+ -+static const struct spi_device_id adis16475_ids[] = { -+ { "adis16470", (kernel_ulong_t)&adis16475_chip_info[ADIS16470] }, -+ { "adis16475-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_1] }, -+ { "adis16475-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_2] }, -+ { "adis16475-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_3] }, -+ { "adis16477-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_1] }, -+ { "adis16477-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_2] }, -+ { "adis16477-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_3] }, -+ { "adis16465-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_1] }, -+ { "adis16465-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_2] }, -+ { "adis16465-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_3] }, -+ { "adis16467-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_1] }, -+ { "adis16467-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_2] }, -+ { "adis16467-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_3] }, -+ { "adis16500", (kernel_ulong_t)&adis16475_chip_info[ADIS16500] }, -+ { "adis16505-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_1] }, -+ { "adis16505-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_2] }, -+ { "adis16505-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_3] }, -+ { "adis16507-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_1] }, -+ { "adis16507-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_2] }, -+ { "adis16507-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_3] }, -+ { } -+}; -+MODULE_DEVICE_TABLE(spi, adis16475_ids); -+ - static struct spi_driver adis16475_driver = { - .driver = { - .name = "adis16475", - .of_match_table = adis16475_of_match, - }, - .probe = adis16475_probe, -+ .id_table = adis16475_ids, - }; - module_spi_driver(adis16475_driver); - -diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c -index c4f22d50dba58..78daf2b2143c5 100644 ---- a/drivers/spi/spi-atmel.c -+++ b/drivers/spi/spi-atmel.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - - /* SPI register offsets */ -@@ -278,6 +279,7 @@ struct atmel_spi { - bool keep_cs; - - u32 fifo_size; -+ bool last_polarity; - u8 native_cs_free; - u8 native_cs_for_gpio; - }; -@@ -290,6 +292,22 @@ struct atmel_spi_device { - #define SPI_MAX_DMA_XFER 65535 /* true for both PDC and DMA */ - #define INVALID_DMA_ADDRESS 0xffffffff - -+/* -+ * This frequency can be anything supported by the controller, but to avoid -+ * unnecessary delay, the highest possible frequency is chosen. -+ * -+ * This frequency is the highest possible which is not interfering with other -+ * chip select registers (see Note for Serial Clock Bit Rate configuration in -+ * Atmel-11121F-ATARM-SAMA5D3-Series-Datasheet_02-Feb-16, page 1283) -+ */ -+#define DUMMY_MSG_FREQUENCY 0x02 -+/* -+ * 8 bits is the minimum data the controller is capable of sending. -+ * -+ * This message can be anything as it should not be treated by any SPI device. -+ */ -+#define DUMMY_MSG 0xAA -+ - /* - * Version 2 of the SPI controller has - * - CR.LASTXFER -@@ -303,6 +321,43 @@ static bool atmel_spi_is_v2(struct atmel_spi *as) - return as->caps.is_spi2; - } - -+/* -+ * Send a dummy message. -+ * -+ * This is sometimes needed when using a CS GPIO to force clock transition when -+ * switching between devices with different polarities. -+ */ -+static void atmel_spi_send_dummy(struct atmel_spi *as, struct spi_device *spi, int chip_select) -+{ -+ u32 status; -+ u32 csr; -+ -+ /* -+ * Set a clock frequency to allow sending message on SPI bus. -+ * The frequency here can be anything, but is needed for -+ * the controller to send the data. -+ */ -+ csr = spi_readl(as, CSR0 + 4 * chip_select); -+ csr = SPI_BFINS(SCBR, DUMMY_MSG_FREQUENCY, csr); -+ spi_writel(as, CSR0 + 4 * chip_select, csr); -+ -+ /* -+ * Read all data coming from SPI bus, needed to be able to send -+ * the message. -+ */ -+ spi_readl(as, RDR); -+ while (spi_readl(as, SR) & SPI_BIT(RDRF)) { -+ spi_readl(as, RDR); -+ cpu_relax(); -+ } -+ -+ spi_writel(as, TDR, DUMMY_MSG); -+ -+ readl_poll_timeout_atomic(as->regs + SPI_SR, status, -+ (status & SPI_BIT(TXEMPTY)), 1, 1000); -+} -+ -+ - /* - * Earlier SPI controllers (e.g. on at91rm9200) have a design bug whereby - * they assume that spi slave device state will not change on deselect, so -@@ -319,11 +374,17 @@ static bool atmel_spi_is_v2(struct atmel_spi *as) - * Master on Chip Select 0.") No workaround exists for that ... so for - * nCS0 on that chip, we (a) don't use the GPIO, (b) can't support CS_HIGH, - * and (c) will trigger that first erratum in some cases. -+ * -+ * When changing the clock polarity, the SPI controller waits for the next -+ * transmission to enforce the default clock state. This may be an issue when -+ * using a GPIO as Chip Select: the clock level is applied only when the first -+ * packet is sent, once the CS has already been asserted. The workaround is to -+ * avoid this by sending a first (dummy) message before toggling the CS state. - */ -- - static void cs_activate(struct atmel_spi *as, struct spi_device *spi) - { - struct atmel_spi_device *asd = spi->controller_state; -+ bool new_polarity; - int chip_select; - u32 mr; - -@@ -352,6 +413,25 @@ static void cs_activate(struct atmel_spi *as, struct spi_device *spi) - } - - mr = spi_readl(as, MR); -+ -+ /* -+ * Ensures the clock polarity is valid before we actually -+ * assert the CS to avoid spurious clock edges to be -+ * processed by the spi devices. -+ */ -+ if (spi_get_csgpiod(spi, 0)) { -+ new_polarity = (asd->csr & SPI_BIT(CPOL)) != 0; -+ if (new_polarity != as->last_polarity) { -+ /* -+ * Need to disable the GPIO before sending the dummy -+ * message because it is already set by the spi core. -+ */ -+ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), 0); -+ atmel_spi_send_dummy(as, spi, chip_select); -+ as->last_polarity = new_polarity; -+ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), 1); -+ } -+ } - } else { - u32 cpol = (spi->mode & SPI_CPOL) ? SPI_BIT(CPOL) : 0; - int i; -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 5d046be8b2dd5..22d227878bc44 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -360,6 +360,18 @@ const struct spi_device_id *spi_get_device_id(const struct spi_device *sdev) - } - EXPORT_SYMBOL_GPL(spi_get_device_id); - -+const void *spi_get_device_match_data(const struct spi_device *sdev) -+{ -+ const void *match; -+ -+ match = device_get_match_data(&sdev->dev); -+ if (match) -+ return match; -+ -+ return (const void *)spi_get_device_id(sdev)->driver_data; -+} -+EXPORT_SYMBOL_GPL(spi_get_device_match_data); -+ - static int spi_match_device(struct device *dev, struct device_driver *drv) - { - const struct spi_device *spi = to_spi_device(dev); -@@ -592,7 +604,7 @@ static void spi_dev_set_name(struct spi_device *spi) - } - - dev_set_name(&spi->dev, "%s.%u", dev_name(&spi->controller->dev), -- spi->chip_select); -+ spi_get_chipselect(spi, 0)); - } - - static int spi_dev_check(struct device *dev, void *data) -@@ -601,7 +613,7 @@ static int spi_dev_check(struct device *dev, void *data) - struct spi_device *new_spi = data; - - if (spi->controller == new_spi->controller && -- spi->chip_select == new_spi->chip_select) -+ spi_get_chipselect(spi, 0) == spi_get_chipselect(new_spi, 0)) - return -EBUSY; - return 0; - } -@@ -626,7 +638,7 @@ static int __spi_add_device(struct spi_device *spi) - status = bus_for_each_dev(&spi_bus_type, NULL, spi, spi_dev_check); - if (status) { - dev_err(dev, "chipselect %d already in use\n", -- spi->chip_select); -+ spi_get_chipselect(spi, 0)); - return status; - } - -@@ -637,7 +649,7 @@ static int __spi_add_device(struct spi_device *spi) - } - - if (ctlr->cs_gpiods) -- spi->cs_gpiod = ctlr->cs_gpiods[spi->chip_select]; -+ spi_set_csgpiod(spi, 0, ctlr->cs_gpiods[spi_get_chipselect(spi, 0)]); - - /* - * Drivers may modify this initial i/o setup, but will -@@ -680,8 +692,8 @@ int spi_add_device(struct spi_device *spi) - int status; - - /* Chipselects are numbered 0..max; validate. */ -- if (spi->chip_select >= ctlr->num_chipselect) { -- dev_err(dev, "cs%d >= max %d\n", spi->chip_select, -+ if (spi_get_chipselect(spi, 0) >= ctlr->num_chipselect) { -+ dev_err(dev, "cs%d >= max %d\n", spi_get_chipselect(spi, 0), - ctlr->num_chipselect); - return -EINVAL; - } -@@ -702,8 +714,8 @@ static int spi_add_device_locked(struct spi_device *spi) - struct device *dev = ctlr->dev.parent; - - /* Chipselects are numbered 0..max; validate. */ -- if (spi->chip_select >= ctlr->num_chipselect) { -- dev_err(dev, "cs%d >= max %d\n", spi->chip_select, -+ if (spi_get_chipselect(spi, 0) >= ctlr->num_chipselect) { -+ dev_err(dev, "cs%d >= max %d\n", spi_get_chipselect(spi, 0), - ctlr->num_chipselect); - return -EINVAL; - } -@@ -749,7 +761,7 @@ struct spi_device *spi_new_device(struct spi_controller *ctlr, - - WARN_ON(strlen(chip->modalias) >= sizeof(proxy->modalias)); - -- proxy->chip_select = chip->chip_select; -+ spi_set_chipselect(proxy, 0, chip->chip_select); - proxy->max_speed_hz = chip->max_speed_hz; - proxy->mode = chip->mode; - proxy->irq = chip->irq; -@@ -958,24 +970,23 @@ static void spi_set_cs(struct spi_device *spi, bool enable, bool force) - * Avoid calling into the driver (or doing delays) if the chip select - * isn't actually changing from the last time this was called. - */ -- if (!force && ((enable && spi->controller->last_cs == spi->chip_select) || -- (!enable && spi->controller->last_cs != spi->chip_select)) && -+ if (!force && ((enable && spi->controller->last_cs == spi_get_chipselect(spi, 0)) || -+ (!enable && spi->controller->last_cs != spi_get_chipselect(spi, 0))) && - (spi->controller->last_cs_mode_high == (spi->mode & SPI_CS_HIGH))) - return; - - trace_spi_set_cs(spi, activate); - -- spi->controller->last_cs = enable ? spi->chip_select : -1; -+ spi->controller->last_cs = enable ? spi_get_chipselect(spi, 0) : -1; - spi->controller->last_cs_mode_high = spi->mode & SPI_CS_HIGH; - -- if ((spi->cs_gpiod || !spi->controller->set_cs_timing) && !activate) { -+ if ((spi_get_csgpiod(spi, 0) || !spi->controller->set_cs_timing) && !activate) - spi_delay_exec(&spi->cs_hold, NULL); -- } - - if (spi->mode & SPI_CS_HIGH) - enable = !enable; - -- if (spi->cs_gpiod) { -+ if (spi_get_csgpiod(spi, 0)) { - if (!(spi->mode & SPI_NO_CS)) { - /* - * Historically ACPI has no means of the GPIO polarity and -@@ -988,10 +999,10 @@ static void spi_set_cs(struct spi_device *spi, bool enable, bool force) - * into account. - */ - if (has_acpi_companion(&spi->dev)) -- gpiod_set_value_cansleep(spi->cs_gpiod, !enable); -+ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), !enable); - else - /* Polarity handled by GPIO library */ -- gpiod_set_value_cansleep(spi->cs_gpiod, activate); -+ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), activate); - } - /* Some SPI masters need both GPIO CS & slave_select */ - if ((spi->controller->flags & SPI_MASTER_GPIO_SS) && -@@ -1001,7 +1012,7 @@ static void spi_set_cs(struct spi_device *spi, bool enable, bool force) - spi->controller->set_cs(spi, !enable); - } - -- if (spi->cs_gpiod || !spi->controller->set_cs_timing) { -+ if (spi_get_csgpiod(spi, 0) || !spi->controller->set_cs_timing) { - if (activate) - spi_delay_exec(&spi->cs_setup, NULL); - else -@@ -2291,7 +2302,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, - nc, rc); - return rc; - } -- spi->chip_select = value; -+ spi_set_chipselect(spi, 0, value); - - /* Device speed */ - if (!of_property_read_u32(nc, "spi-max-frequency", &value)) -@@ -2405,7 +2416,7 @@ struct spi_device *spi_new_ancillary_device(struct spi_device *spi, - strscpy(ancillary->modalias, "dummy", sizeof(ancillary->modalias)); - - /* Use provided chip-select for ancillary device */ -- ancillary->chip_select = chip_select; -+ spi_set_chipselect(ancillary, 0, chip_select); - - /* Take over SPI mode/speed from SPI main device */ - ancillary->max_speed_hz = spi->max_speed_hz; -@@ -2652,7 +2663,7 @@ struct spi_device *acpi_spi_device_alloc(struct spi_controller *ctlr, - spi->mode |= lookup.mode; - spi->irq = lookup.irq; - spi->bits_per_word = lookup.bits_per_word; -- spi->chip_select = lookup.chip_select; -+ spi_set_chipselect(spi, 0, lookup.chip_select); - - return spi; - } -@@ -3611,6 +3622,37 @@ static int __spi_validate_bits_per_word(struct spi_controller *ctlr, - return 0; - } - -+/** -+ * spi_set_cs_timing - configure CS setup, hold, and inactive delays -+ * @spi: the device that requires specific CS timing configuration -+ * -+ * Return: zero on success, else a negative error code. -+ */ -+static int spi_set_cs_timing(struct spi_device *spi) -+{ -+ struct device *parent = spi->controller->dev.parent; -+ int status = 0; -+ -+ if (spi->controller->set_cs_timing && !spi_get_csgpiod(spi, 0)) { -+ if (spi->controller->auto_runtime_pm) { -+ status = pm_runtime_get_sync(parent); -+ if (status < 0) { -+ pm_runtime_put_noidle(parent); -+ dev_err(&spi->controller->dev, "Failed to power device: %d\n", -+ status); -+ return status; -+ } -+ -+ status = spi->controller->set_cs_timing(spi); -+ pm_runtime_mark_last_busy(parent); -+ pm_runtime_put_autosuspend(parent); -+ } else { -+ status = spi->controller->set_cs_timing(spi); -+ } -+ } -+ return status; -+} -+ - /** - * spi_setup - setup SPI mode and clock rate - * @spi: the device whose settings are being modified -@@ -3707,6 +3749,12 @@ int spi_setup(struct spi_device *spi) - } - } - -+ status = spi_set_cs_timing(spi); -+ if (status) { -+ mutex_unlock(&spi->controller->io_mutex); -+ return status; -+ } -+ - if (spi->controller->auto_runtime_pm && spi->controller->set_cs) { - status = pm_runtime_resume_and_get(spi->controller->dev.parent); - if (status < 0) { -@@ -3790,7 +3838,7 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message) - * cs_change is set for each transfer. - */ - if ((spi->mode & SPI_CS_WORD) && (!(ctlr->mode_bits & SPI_CS_WORD) || -- spi->cs_gpiod)) { -+ spi_get_csgpiod(spi, 0))) { - size_t maxsize; - int ret; - -diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c -index c4c1fbc12b4cd..dc968960769e1 100644 ---- a/drivers/usb/host/fotg210-hcd.c -+++ b/drivers/usb/host/fotg210-hcd.c -@@ -429,8 +429,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh, - temp = size; - size -= temp; - next += temp; -- if (temp == size) -- goto done; - } - - temp = snprintf(next, size, "\n"); -@@ -440,7 +438,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh, - size -= temp; - next += temp; - --done: - *sizep = size; - *nextp = next; - } -diff --git a/fs/namei.c b/fs/namei.c -index 5e1c2ab2ae709..b5578f4ce5d6e 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -253,6 +253,7 @@ getname_kernel(const char * filename) - - return result; - } -+EXPORT_SYMBOL(getname_kernel); - - void putname(struct filename *name) - { -@@ -271,6 +272,7 @@ void putname(struct filename *name) - } else - __putname(name); - } -+EXPORT_SYMBOL(putname); - - /** - * check_acl - perform ACL permission checking -@@ -1581,8 +1583,9 @@ static struct dentry *lookup_dcache(const struct qstr *name, - * when directory is guaranteed to have no in-lookup children - * at all. - */ --static struct dentry *__lookup_hash(const struct qstr *name, -- struct dentry *base, unsigned int flags) -+struct dentry *lookup_one_qstr_excl(const struct qstr *name, -+ struct dentry *base, -+ unsigned int flags) - { - struct dentry *dentry = lookup_dcache(name, base, flags); - struct dentry *old; -@@ -1606,6 +1609,7 @@ static struct dentry *__lookup_hash(const struct qstr *name, - } - return dentry; - } -+EXPORT_SYMBOL(lookup_one_qstr_excl); - - static struct dentry *lookup_fast(struct nameidata *nd) - { -@@ -2532,16 +2536,17 @@ static int path_parentat(struct nameidata *nd, unsigned flags, - } - - /* Note: this does not consume "name" */ --static int filename_parentat(int dfd, struct filename *name, -- unsigned int flags, struct path *parent, -- struct qstr *last, int *type) -+static int __filename_parentat(int dfd, struct filename *name, -+ unsigned int flags, struct path *parent, -+ struct qstr *last, int *type, -+ const struct path *root) - { - int retval; - struct nameidata nd; - - if (IS_ERR(name)) - return PTR_ERR(name); -- set_nameidata(&nd, dfd, name, NULL); -+ set_nameidata(&nd, dfd, name, root); - retval = path_parentat(&nd, flags | LOOKUP_RCU, parent); - if (unlikely(retval == -ECHILD)) - retval = path_parentat(&nd, flags, parent); -@@ -2556,6 +2561,13 @@ static int filename_parentat(int dfd, struct filename *name, - return retval; - } - -+static int filename_parentat(int dfd, struct filename *name, -+ unsigned int flags, struct path *parent, -+ struct qstr *last, int *type) -+{ -+ return __filename_parentat(dfd, name, flags, parent, last, type, NULL); -+} -+ - /* does lookup, returns the object with parent locked */ - static struct dentry *__kern_path_locked(struct filename *name, struct path *path) - { -@@ -2571,7 +2583,7 @@ static struct dentry *__kern_path_locked(struct filename *name, struct path *pat - return ERR_PTR(-EINVAL); - } - inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); -- d = __lookup_hash(&last, path->dentry, 0); -+ d = lookup_one_qstr_excl(&last, path->dentry, 0); - if (IS_ERR(d)) { - inode_unlock(path->dentry->d_inode); - path_put(path); -@@ -2599,6 +2611,24 @@ int kern_path(const char *name, unsigned int flags, struct path *path) - } - EXPORT_SYMBOL(kern_path); - -+/** -+ * vfs_path_parent_lookup - lookup a parent path relative to a dentry-vfsmount pair -+ * @filename: filename structure -+ * @flags: lookup flags -+ * @parent: pointer to struct path to fill -+ * @last: last component -+ * @type: type of the last component -+ * @root: pointer to struct path of the base directory -+ */ -+int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, -+ struct path *parent, struct qstr *last, int *type, -+ const struct path *root) -+{ -+ return __filename_parentat(AT_FDCWD, filename, flags, parent, last, -+ type, root); -+} -+EXPORT_SYMBOL(vfs_path_parent_lookup); -+ - /** - * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair - * @dentry: pointer to dentry of the base directory -@@ -2980,20 +3010,10 @@ static inline int may_create(struct user_namespace *mnt_userns, - return inode_permission(mnt_userns, dir, MAY_WRITE | MAY_EXEC); - } - --/* -- * p1 and p2 should be directories on the same fs. -- */ --struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) -+static struct dentry *lock_two_directories(struct dentry *p1, struct dentry *p2) - { - struct dentry *p; - -- if (p1 == p2) { -- inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); -- return NULL; -- } -- -- mutex_lock(&p1->d_sb->s_vfs_rename_mutex); -- - p = d_ancestor(p2, p1); - if (p) { - inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); -@@ -3012,8 +3032,64 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) - I_MUTEX_PARENT, I_MUTEX_PARENT2); - return NULL; - } -+ -+/* -+ * p1 and p2 should be directories on the same fs. -+ */ -+struct dentry *lock_rename(struct dentry *p1, struct dentry *p2) -+{ -+ if (p1 == p2) { -+ inode_lock_nested(p1->d_inode, I_MUTEX_PARENT); -+ return NULL; -+ } -+ -+ mutex_lock(&p1->d_sb->s_vfs_rename_mutex); -+ return lock_two_directories(p1, p2); -+} - EXPORT_SYMBOL(lock_rename); - -+/* -+ * c1 and p2 should be on the same fs. -+ */ -+struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2) -+{ -+ if (READ_ONCE(c1->d_parent) == p2) { -+ /* -+ * hopefully won't need to touch ->s_vfs_rename_mutex at all. -+ */ -+ inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); -+ /* -+ * now that p2 is locked, nobody can move in or out of it, -+ * so the test below is safe. -+ */ -+ if (likely(c1->d_parent == p2)) -+ return NULL; -+ -+ /* -+ * c1 got moved out of p2 while we'd been taking locks; -+ * unlock and fall back to slow case. -+ */ -+ inode_unlock(p2->d_inode); -+ } -+ -+ mutex_lock(&c1->d_sb->s_vfs_rename_mutex); -+ /* -+ * nobody can move out of any directories on this fs. -+ */ -+ if (likely(c1->d_parent != p2)) -+ return lock_two_directories(c1->d_parent, p2); -+ -+ /* -+ * c1 got moved into p2 while we were taking locks; -+ * we need p2 locked and ->s_vfs_rename_mutex unlocked, -+ * for consistency with lock_rename(). -+ */ -+ inode_lock_nested(p2->d_inode, I_MUTEX_PARENT); -+ mutex_unlock(&c1->d_sb->s_vfs_rename_mutex); -+ return NULL; -+} -+EXPORT_SYMBOL(lock_rename_child); -+ - void unlock_rename(struct dentry *p1, struct dentry *p2) - { - inode_unlock(p1->d_inode); -@@ -3806,7 +3882,8 @@ static struct dentry *filename_create(int dfd, struct filename *name, - if (last.name[last.len] && !want_dir) - create_flags = 0; - inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT); -- dentry = __lookup_hash(&last, path->dentry, reval_flag | create_flags); -+ dentry = lookup_one_qstr_excl(&last, path->dentry, -+ reval_flag | create_flags); - if (IS_ERR(dentry)) - goto unlock; - -@@ -4168,7 +4245,7 @@ retry: - goto exit2; - - inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); -- dentry = __lookup_hash(&last, path.dentry, lookup_flags); -+ dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); - error = PTR_ERR(dentry); - if (IS_ERR(dentry)) - goto exit3; -@@ -4302,7 +4379,7 @@ retry: - goto exit2; - retry_deleg: - inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT); -- dentry = __lookup_hash(&last, path.dentry, lookup_flags); -+ dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags); - error = PTR_ERR(dentry); - if (!IS_ERR(dentry)) { - struct user_namespace *mnt_userns; -@@ -4876,7 +4953,8 @@ retry: - retry_deleg: - trap = lock_rename(new_path.dentry, old_path.dentry); - -- old_dentry = __lookup_hash(&old_last, old_path.dentry, lookup_flags); -+ old_dentry = lookup_one_qstr_excl(&old_last, old_path.dentry, -+ lookup_flags); - error = PTR_ERR(old_dentry); - if (IS_ERR(old_dentry)) - goto exit3; -@@ -4884,7 +4962,8 @@ retry_deleg: - error = -ENOENT; - if (d_is_negative(old_dentry)) - goto exit4; -- new_dentry = __lookup_hash(&new_last, new_path.dentry, lookup_flags | target_flags); -+ new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry, -+ lookup_flags | target_flags); - error = PTR_ERR(new_dentry); - if (IS_ERR(new_dentry)) - goto exit4; -diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c -index 573de0d49e172..b3b4542e31ed5 100644 ---- a/fs/nfsd/nfsctl.c -+++ b/fs/nfsd/nfsctl.c -@@ -716,8 +716,10 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred - - err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); - -- if (err >= 0 && -- !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) -+ if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) -+ nfsd_last_thread(net); -+ else if (err >= 0 && -+ !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) - svc_get(nn->nfsd_serv); - - nfsd_put(net); -@@ -767,6 +769,9 @@ out_close: - svc_xprt_put(xprt); - } - out_err: -+ if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) -+ nfsd_last_thread(net); -+ - nfsd_put(net); - return err; - } -diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h -index 09726c5b9a317..53166cce7062c 100644 ---- a/fs/nfsd/nfsd.h -+++ b/fs/nfsd/nfsd.h -@@ -97,7 +97,12 @@ int nfsd_pool_stats_open(struct inode *, struct file *); - int nfsd_pool_stats_release(struct inode *, struct file *); - void nfsd_shutdown_threads(struct net *net); - --void nfsd_put(struct net *net); -+static inline void nfsd_put(struct net *net) -+{ -+ struct nfsd_net *nn = net_generic(net, nfsd_net_id); -+ -+ svc_put(nn->nfsd_serv); -+} - - bool i_am_nfsd(void); - -@@ -134,6 +139,7 @@ int nfsd_vers(struct nfsd_net *nn, int vers, enum vers_op change); - int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op change); - void nfsd_reset_versions(struct nfsd_net *nn); - int nfsd_create_serv(struct net *net); -+void nfsd_last_thread(struct net *net); - - extern int nfsd_max_blksize; - -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index f6cc99af81925..350c6c72f793f 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -523,9 +523,14 @@ static struct notifier_block nfsd_inet6addr_notifier = { - /* Only used under nfsd_mutex, so this atomic may be overkill: */ - static atomic_t nfsd_notifier_refcount = ATOMIC_INIT(0); - --static void nfsd_last_thread(struct svc_serv *serv, struct net *net) -+void nfsd_last_thread(struct net *net) - { - struct nfsd_net *nn = net_generic(net, nfsd_net_id); -+ struct svc_serv *serv = nn->nfsd_serv; -+ -+ spin_lock(&nfsd_notifier_lock); -+ nn->nfsd_serv = NULL; -+ spin_unlock(&nfsd_notifier_lock); - - /* check if the notifier still has clients */ - if (atomic_dec_return(&nfsd_notifier_refcount) == 0) { -@@ -535,6 +540,8 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net) - #endif - } - -+ svc_xprt_destroy_all(serv, net); -+ - /* - * write_ports can create the server without actually starting - * any threads--if we get shut down before any threads are -@@ -625,7 +632,8 @@ void nfsd_shutdown_threads(struct net *net) - svc_get(serv); - /* Kill outstanding nfsd threads */ - svc_set_num_threads(serv, NULL, 0); -- nfsd_put(net); -+ nfsd_last_thread(net); -+ svc_put(serv); - mutex_unlock(&nfsd_mutex); - } - -@@ -655,9 +663,6 @@ int nfsd_create_serv(struct net *net) - serv->sv_maxconn = nn->max_connections; - error = svc_bind(serv, net); - if (error < 0) { -- /* NOT nfsd_put() as notifiers (see below) haven't -- * been set up yet. -- */ - svc_put(serv); - return error; - } -@@ -700,29 +705,6 @@ int nfsd_get_nrthreads(int n, int *nthreads, struct net *net) - return 0; - } - --/* This is the callback for kref_put() below. -- * There is no code here as the first thing to be done is -- * call svc_shutdown_net(), but we cannot get the 'net' from -- * the kref. So do all the work when kref_put returns true. -- */ --static void nfsd_noop(struct kref *ref) --{ --} -- --void nfsd_put(struct net *net) --{ -- struct nfsd_net *nn = net_generic(net, nfsd_net_id); -- -- if (kref_put(&nn->nfsd_serv->sv_refcnt, nfsd_noop)) { -- svc_xprt_destroy_all(nn->nfsd_serv, net); -- nfsd_last_thread(nn->nfsd_serv, net); -- svc_destroy(&nn->nfsd_serv->sv_refcnt); -- spin_lock(&nfsd_notifier_lock); -- nn->nfsd_serv = NULL; -- spin_unlock(&nfsd_notifier_lock); -- } --} -- - int nfsd_set_nrthreads(int n, int *nthreads, struct net *net) - { - int i = 0; -@@ -773,7 +755,7 @@ int nfsd_set_nrthreads(int n, int *nthreads, struct net *net) - if (err) - break; - } -- nfsd_put(net); -+ svc_put(nn->nfsd_serv); - return err; - } - -@@ -788,6 +770,7 @@ nfsd_svc(int nrservs, struct net *net, const struct cred *cred) - int error; - bool nfsd_up_before; - struct nfsd_net *nn = net_generic(net, nfsd_net_id); -+ struct svc_serv *serv; - - mutex_lock(&nfsd_mutex); - dprintk("nfsd: creating service\n"); -@@ -807,22 +790,25 @@ nfsd_svc(int nrservs, struct net *net, const struct cred *cred) - goto out; - - nfsd_up_before = nn->nfsd_net_up; -+ serv = nn->nfsd_serv; - - error = nfsd_startup_net(net, cred); - if (error) - goto out_put; -- error = svc_set_num_threads(nn->nfsd_serv, NULL, nrservs); -+ error = svc_set_num_threads(serv, NULL, nrservs); - if (error) - goto out_shutdown; -- error = nn->nfsd_serv->sv_nrthreads; -+ error = serv->sv_nrthreads; -+ if (error == 0) -+ nfsd_last_thread(net); - out_shutdown: - if (error < 0 && !nfsd_up_before) - nfsd_shutdown_net(net); - out_put: - /* Threads now hold service active */ - if (xchg(&nn->keep_active, 0)) -- nfsd_put(net); -- nfsd_put(net); -+ svc_put(serv); -+ svc_put(serv); - out: - mutex_unlock(&nfsd_mutex); - return error; -@@ -1138,11 +1124,12 @@ int nfsd_pool_stats_open(struct inode *inode, struct file *file) - - int nfsd_pool_stats_release(struct inode *inode, struct file *file) - { -+ struct seq_file *seq = file->private_data; -+ struct svc_serv *serv = seq->private; - int ret = seq_release(inode, file); -- struct net *net = inode->i_sb->s_fs_info; - - mutex_lock(&nfsd_mutex); -- nfsd_put(net); -+ svc_put(serv); - mutex_unlock(&nfsd_mutex); - return ret; - } -diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h -index c8a4014f9d395..07549957b3099 100644 ---- a/fs/smb/common/smb2pdu.h -+++ b/fs/smb/common/smb2pdu.h -@@ -1196,6 +1196,7 @@ struct create_posix { - #define SMB2_LEASE_WRITE_CACHING_LE cpu_to_le32(0x04) - - #define SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE cpu_to_le32(0x02) -+#define SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE cpu_to_le32(0x04) - - #define SMB2_LEASE_KEY_SIZE 16 - -diff --git a/fs/smb/server/Kconfig b/fs/smb/server/Kconfig -index e1fe17747ed69..d036ab80fec35 100644 ---- a/fs/smb/server/Kconfig -+++ b/fs/smb/server/Kconfig -@@ -1,5 +1,5 @@ - config SMB_SERVER -- tristate "SMB3 server support (EXPERIMENTAL)" -+ tristate "SMB3 server support" - depends on INET - depends on MULTIUSER - depends on FILE_LOCKING -@@ -33,14 +33,16 @@ config SMB_SERVER - in ksmbd-tools, available from - https://github.com/cifsd-team/ksmbd-tools. - More detail about how to run the ksmbd kernel server is -- available via README file -+ available via the README file - (https://github.com/cifsd-team/ksmbd-tools/blob/master/README). - - ksmbd kernel server includes support for auto-negotiation, - Secure negotiate, Pre-authentication integrity, oplock/lease, - compound requests, multi-credit, packet signing, RDMA(smbdirect), - smb3 encryption, copy-offload, secure per-user session -- establishment via NTLM or NTLMv2. -+ establishment via Kerberos or NTLMv2. -+ -+if SMB_SERVER - - config SMB_SERVER_SMBDIRECT - bool "Support for SMB Direct protocol" -@@ -54,6 +56,8 @@ config SMB_SERVER_SMBDIRECT - SMB Direct allows transferring SMB packets over RDMA. If unsure, - say N. - -+endif -+ - config SMB_SERVER_CHECK_CAP_NET_ADMIN - bool "Enable check network administration capability" - depends on SMB_SERVER -diff --git a/fs/smb/server/asn1.c b/fs/smb/server/asn1.c -index c03eba0903682..4a4b2b03ff33d 100644 ---- a/fs/smb/server/asn1.c -+++ b/fs/smb/server/asn1.c -@@ -208,32 +208,29 @@ int ksmbd_neg_token_init_mech_type(void *context, size_t hdrlen, - return 0; - } - --int ksmbd_neg_token_init_mech_token(void *context, size_t hdrlen, -- unsigned char tag, const void *value, -- size_t vlen) -+static int ksmbd_neg_token_alloc(void *context, size_t hdrlen, -+ unsigned char tag, const void *value, -+ size_t vlen) - { - struct ksmbd_conn *conn = context; - -- conn->mechToken = kmalloc(vlen + 1, GFP_KERNEL); -+ conn->mechToken = kmemdup_nul(value, vlen, GFP_KERNEL); - if (!conn->mechToken) - return -ENOMEM; - -- memcpy(conn->mechToken, value, vlen); -- conn->mechToken[vlen] = '\0'; - return 0; - } - --int ksmbd_neg_token_targ_resp_token(void *context, size_t hdrlen, -+int ksmbd_neg_token_init_mech_token(void *context, size_t hdrlen, - unsigned char tag, const void *value, - size_t vlen) - { -- struct ksmbd_conn *conn = context; -- -- conn->mechToken = kmalloc(vlen + 1, GFP_KERNEL); -- if (!conn->mechToken) -- return -ENOMEM; -+ return ksmbd_neg_token_alloc(context, hdrlen, tag, value, vlen); -+} - -- memcpy(conn->mechToken, value, vlen); -- conn->mechToken[vlen] = '\0'; -- return 0; -+int ksmbd_neg_token_targ_resp_token(void *context, size_t hdrlen, -+ unsigned char tag, const void *value, -+ size_t vlen) -+{ -+ return ksmbd_neg_token_alloc(context, hdrlen, tag, value, vlen); - } -diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c -index 15e5684e328c1..229a6527870d0 100644 ---- a/fs/smb/server/auth.c -+++ b/fs/smb/server/auth.c -@@ -1032,11 +1032,15 @@ static struct scatterlist *ksmbd_init_sg(struct kvec *iov, unsigned int nvec, - { - struct scatterlist *sg; - unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 20; -- int i, nr_entries[3] = {0}, total_entries = 0, sg_idx = 0; -+ int i, *nr_entries, total_entries = 0, sg_idx = 0; - - if (!nvec) - return NULL; - -+ nr_entries = kcalloc(nvec, sizeof(int), GFP_KERNEL); -+ if (!nr_entries) -+ return NULL; -+ - for (i = 0; i < nvec - 1; i++) { - unsigned long kaddr = (unsigned long)iov[i + 1].iov_base; - -@@ -1054,8 +1058,10 @@ static struct scatterlist *ksmbd_init_sg(struct kvec *iov, unsigned int nvec, - total_entries += 2; - - sg = kmalloc_array(total_entries, sizeof(struct scatterlist), GFP_KERNEL); -- if (!sg) -+ if (!sg) { -+ kfree(nr_entries); - return NULL; -+ } - - sg_init_table(sg, total_entries); - smb2_sg_set_buf(&sg[sg_idx++], iov[0].iov_base + 24, assoc_data_len); -@@ -1089,6 +1095,7 @@ static struct scatterlist *ksmbd_init_sg(struct kvec *iov, unsigned int nvec, - } - } - smb2_sg_set_buf(&sg[sg_idx], sign, SMB2_SIGNATURE_SIZE); -+ kfree(nr_entries); - return sg; - } - -diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c -index ff97cad8d5b45..b6fa1e285c401 100644 ---- a/fs/smb/server/connection.c -+++ b/fs/smb/server/connection.c -@@ -114,10 +114,8 @@ void ksmbd_conn_enqueue_request(struct ksmbd_work *work) - struct ksmbd_conn *conn = work->conn; - struct list_head *requests_queue = NULL; - -- if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) { -+ if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) - requests_queue = &conn->requests; -- work->syncronous = true; -- } - - if (requests_queue) { - atomic_inc(&conn->req_running); -@@ -127,28 +125,22 @@ void ksmbd_conn_enqueue_request(struct ksmbd_work *work) - } - } - --int ksmbd_conn_try_dequeue_request(struct ksmbd_work *work) -+void ksmbd_conn_try_dequeue_request(struct ksmbd_work *work) - { - struct ksmbd_conn *conn = work->conn; -- int ret = 1; - - if (list_empty(&work->request_entry) && - list_empty(&work->async_request_entry)) -- return 0; -+ return; - -- if (!work->multiRsp) -- atomic_dec(&conn->req_running); -+ atomic_dec(&conn->req_running); - spin_lock(&conn->request_lock); -- if (!work->multiRsp) { -- list_del_init(&work->request_entry); -- if (work->syncronous == false) -- list_del_init(&work->async_request_entry); -- ret = 0; -- } -+ list_del_init(&work->request_entry); - spin_unlock(&conn->request_lock); -+ if (work->asynchronous) -+ release_async_work(work); - - wake_up_all(&conn->req_running_q); -- return ret; - } - - void ksmbd_conn_lock(struct ksmbd_conn *conn) -@@ -175,63 +167,31 @@ void ksmbd_all_conn_set_status(u64 sess_id, u32 status) - - void ksmbd_conn_wait_idle(struct ksmbd_conn *conn, u64 sess_id) - { -- struct ksmbd_conn *bind_conn; -- - wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2); -- -- down_read(&conn_list_lock); -- list_for_each_entry(bind_conn, &conn_list, conns_list) { -- if (bind_conn == conn) -- continue; -- -- if ((bind_conn->binding || xa_load(&bind_conn->sessions, sess_id)) && -- !ksmbd_conn_releasing(bind_conn) && -- atomic_read(&bind_conn->req_running)) { -- wait_event(bind_conn->req_running_q, -- atomic_read(&bind_conn->req_running) == 0); -- } -- } -- up_read(&conn_list_lock); - } - - int ksmbd_conn_write(struct ksmbd_work *work) - { - struct ksmbd_conn *conn = work->conn; -- size_t len = 0; - int sent; -- struct kvec iov[3]; -- int iov_idx = 0; - - if (!work->response_buf) { - pr_err("NULL response header\n"); - return -EINVAL; - } - -- if (work->tr_buf) { -- iov[iov_idx] = (struct kvec) { work->tr_buf, -- sizeof(struct smb2_transform_hdr) + 4 }; -- len += iov[iov_idx++].iov_len; -- } -+ if (work->send_no_response) -+ return 0; - -- if (work->aux_payload_sz) { -- iov[iov_idx] = (struct kvec) { work->response_buf, work->resp_hdr_sz }; -- len += iov[iov_idx++].iov_len; -- iov[iov_idx] = (struct kvec) { work->aux_payload_buf, work->aux_payload_sz }; -- len += iov[iov_idx++].iov_len; -- } else { -- if (work->tr_buf) -- iov[iov_idx].iov_len = work->resp_hdr_sz; -- else -- iov[iov_idx].iov_len = get_rfc1002_len(work->response_buf) + 4; -- iov[iov_idx].iov_base = work->response_buf; -- len += iov[iov_idx++].iov_len; -- } -+ if (!work->iov_idx) -+ return -EINVAL; - - ksmbd_conn_lock(conn); -- sent = conn->transport->ops->writev(conn->transport, &iov[0], -- iov_idx, len, -- work->need_invalidate_rkey, -- work->remote_key); -+ sent = conn->transport->ops->writev(conn->transport, work->iov, -+ work->iov_cnt, -+ get_rfc1002_len(work->iov[0].iov_base) + 4, -+ work->need_invalidate_rkey, -+ work->remote_key); - ksmbd_conn_unlock(conn); - - if (sent < 0) { -@@ -345,7 +305,7 @@ int ksmbd_conn_handler_loop(void *p) - max_allowed_pdu_size = SMB3_MAX_MSGSIZE; - - if (pdu_size > max_allowed_pdu_size) { -- pr_err_ratelimited("PDU length(%u) excceed maximum allowed pdu size(%u) on connection(%d)\n", -+ pr_err_ratelimited("PDU length(%u) exceeded maximum allowed pdu size(%u) on connection(%d)\n", - pdu_size, max_allowed_pdu_size, - READ_ONCE(conn->status)); - break; -diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h -index 335fdd714d595..3c005246a32e8 100644 ---- a/fs/smb/server/connection.h -+++ b/fs/smb/server/connection.h -@@ -159,7 +159,7 @@ int ksmbd_conn_rdma_write(struct ksmbd_conn *conn, - struct smb2_buffer_desc_v1 *desc, - unsigned int desc_len); - void ksmbd_conn_enqueue_request(struct ksmbd_work *work); --int ksmbd_conn_try_dequeue_request(struct ksmbd_work *work); -+void ksmbd_conn_try_dequeue_request(struct ksmbd_work *work); - void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops); - int ksmbd_conn_handler_loop(void *p); - int ksmbd_conn_transport_init(void); -diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h -index ce866ff159bfe..b7521e41402e0 100644 ---- a/fs/smb/server/ksmbd_netlink.h -+++ b/fs/smb/server/ksmbd_netlink.h -@@ -74,6 +74,7 @@ struct ksmbd_heartbeat { - #define KSMBD_GLOBAL_FLAG_SMB2_LEASES BIT(0) - #define KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION BIT(1) - #define KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL BIT(2) -+#define KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF BIT(3) - - /* - * IPC request for ksmbd server startup -@@ -351,7 +352,8 @@ enum KSMBD_TREE_CONN_STATUS { - #define KSMBD_SHARE_FLAG_STREAMS BIT(11) - #define KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS BIT(12) - #define KSMBD_SHARE_FLAG_ACL_XATTR BIT(13) --#define KSMBD_SHARE_FLAG_UPDATE BIT(14) -+#define KSMBD_SHARE_FLAG_UPDATE BIT(14) -+#define KSMBD_SHARE_FLAG_CROSSMNT BIT(15) - - /* - * Tree connect request flags. -diff --git a/fs/smb/server/ksmbd_work.c b/fs/smb/server/ksmbd_work.c -index 14b9caebf7a4f..d7c676c151e20 100644 ---- a/fs/smb/server/ksmbd_work.c -+++ b/fs/smb/server/ksmbd_work.c -@@ -27,18 +27,38 @@ struct ksmbd_work *ksmbd_alloc_work_struct(void) - INIT_LIST_HEAD(&work->async_request_entry); - INIT_LIST_HEAD(&work->fp_entry); - INIT_LIST_HEAD(&work->interim_entry); -+ INIT_LIST_HEAD(&work->aux_read_list); -+ work->iov_alloc_cnt = 4; -+ work->iov = kcalloc(work->iov_alloc_cnt, sizeof(struct kvec), -+ GFP_KERNEL); -+ if (!work->iov) { -+ kmem_cache_free(work_cache, work); -+ work = NULL; -+ } - } - return work; - } - - void ksmbd_free_work_struct(struct ksmbd_work *work) - { -+ struct aux_read *ar, *tmp; -+ - WARN_ON(work->saved_cred != NULL); - - kvfree(work->response_buf); -- kvfree(work->aux_payload_buf); -+ -+ list_for_each_entry_safe(ar, tmp, &work->aux_read_list, entry) { -+ kvfree(ar->buf); -+ list_del(&ar->entry); -+ kfree(ar); -+ } -+ - kfree(work->tr_buf); - kvfree(work->request_buf); -+ kfree(work->iov); -+ if (!list_empty(&work->interim_entry)) -+ list_del(&work->interim_entry); -+ - if (work->async_id) - ksmbd_release_id(&work->conn->async_ida, work->async_id); - kmem_cache_free(work_cache, work); -@@ -77,3 +97,81 @@ bool ksmbd_queue_work(struct ksmbd_work *work) - { - return queue_work(ksmbd_wq, &work->work); - } -+ -+static inline void __ksmbd_iov_pin(struct ksmbd_work *work, void *ib, -+ unsigned int ib_len) -+{ -+ work->iov[++work->iov_idx].iov_base = ib; -+ work->iov[work->iov_idx].iov_len = ib_len; -+ work->iov_cnt++; -+} -+ -+static int __ksmbd_iov_pin_rsp(struct ksmbd_work *work, void *ib, int len, -+ void *aux_buf, unsigned int aux_size) -+{ -+ struct aux_read *ar = NULL; -+ int need_iov_cnt = 1; -+ -+ if (aux_size) { -+ need_iov_cnt++; -+ ar = kmalloc(sizeof(struct aux_read), GFP_KERNEL); -+ if (!ar) -+ return -ENOMEM; -+ } -+ -+ if (work->iov_alloc_cnt < work->iov_cnt + need_iov_cnt) { -+ struct kvec *new; -+ -+ work->iov_alloc_cnt += 4; -+ new = krealloc(work->iov, -+ sizeof(struct kvec) * work->iov_alloc_cnt, -+ GFP_KERNEL | __GFP_ZERO); -+ if (!new) { -+ kfree(ar); -+ work->iov_alloc_cnt -= 4; -+ return -ENOMEM; -+ } -+ work->iov = new; -+ } -+ -+ /* Plus rfc_length size on first iov */ -+ if (!work->iov_idx) { -+ work->iov[work->iov_idx].iov_base = work->response_buf; -+ *(__be32 *)work->iov[0].iov_base = 0; -+ work->iov[work->iov_idx].iov_len = 4; -+ work->iov_cnt++; -+ } -+ -+ __ksmbd_iov_pin(work, ib, len); -+ inc_rfc1001_len(work->iov[0].iov_base, len); -+ -+ if (aux_size) { -+ __ksmbd_iov_pin(work, aux_buf, aux_size); -+ inc_rfc1001_len(work->iov[0].iov_base, aux_size); -+ -+ ar->buf = aux_buf; -+ list_add(&ar->entry, &work->aux_read_list); -+ } -+ -+ return 0; -+} -+ -+int ksmbd_iov_pin_rsp(struct ksmbd_work *work, void *ib, int len) -+{ -+ return __ksmbd_iov_pin_rsp(work, ib, len, NULL, 0); -+} -+ -+int ksmbd_iov_pin_rsp_read(struct ksmbd_work *work, void *ib, int len, -+ void *aux_buf, unsigned int aux_size) -+{ -+ return __ksmbd_iov_pin_rsp(work, ib, len, aux_buf, aux_size); -+} -+ -+int allocate_interim_rsp_buf(struct ksmbd_work *work) -+{ -+ work->response_buf = kzalloc(MAX_CIFS_SMALL_BUFFER_SIZE, GFP_KERNEL); -+ if (!work->response_buf) -+ return -ENOMEM; -+ work->response_sz = MAX_CIFS_SMALL_BUFFER_SIZE; -+ return 0; -+} -diff --git a/fs/smb/server/ksmbd_work.h b/fs/smb/server/ksmbd_work.h -index 5ece58e40c979..8ca2c813246e6 100644 ---- a/fs/smb/server/ksmbd_work.h -+++ b/fs/smb/server/ksmbd_work.h -@@ -19,6 +19,11 @@ enum { - KSMBD_WORK_CLOSED, - }; - -+struct aux_read { -+ void *buf; -+ struct list_head entry; -+}; -+ - /* one of these for every pending CIFS request at the connection */ - struct ksmbd_work { - /* Server corresponding to this mid */ -@@ -31,13 +36,19 @@ struct ksmbd_work { - /* Response buffer */ - void *response_buf; - -- /* Read data buffer */ -- void *aux_payload_buf; -+ struct list_head aux_read_list; -+ -+ struct kvec *iov; -+ int iov_alloc_cnt; -+ int iov_cnt; -+ int iov_idx; - - /* Next cmd hdr in compound req buf*/ - int next_smb2_rcv_hdr_off; - /* Next cmd hdr in compound rsp buf*/ - int next_smb2_rsp_hdr_off; -+ /* Current cmd hdr in compound rsp buf*/ -+ int curr_smb2_rsp_hdr_off; - - /* - * Current Local FID assigned compound response if SMB2 CREATE -@@ -53,22 +64,17 @@ struct ksmbd_work { - unsigned int credits_granted; - - /* response smb header size */ -- unsigned int resp_hdr_sz; - unsigned int response_sz; -- /* Read data count */ -- unsigned int aux_payload_sz; - - void *tr_buf; - - unsigned char state; -- /* Multiple responses for one request e.g. SMB ECHO */ -- bool multiRsp:1; - /* No response for cancelled request */ - bool send_no_response:1; - /* Request is encrypted */ - bool encrypted:1; - /* Is this SYNC or ASYNC ksmbd_work */ -- bool syncronous:1; -+ bool asynchronous:1; - bool need_invalidate_rkey:1; - - unsigned int remote_key; -@@ -95,6 +101,15 @@ static inline void *ksmbd_resp_buf_next(struct ksmbd_work *work) - return work->response_buf + work->next_smb2_rsp_hdr_off + 4; - } - -+/** -+ * ksmbd_resp_buf_curr - Get current buffer on compound response. -+ * @work: smb work containing response buffer -+ */ -+static inline void *ksmbd_resp_buf_curr(struct ksmbd_work *work) -+{ -+ return work->response_buf + work->curr_smb2_rsp_hdr_off + 4; -+} -+ - /** - * ksmbd_req_buf_next - Get next buffer on compound request. - * @work: smb work containing response buffer -@@ -113,5 +128,8 @@ int ksmbd_work_pool_init(void); - int ksmbd_workqueue_init(void); - void ksmbd_workqueue_destroy(void); - bool ksmbd_queue_work(struct ksmbd_work *work); -- -+int ksmbd_iov_pin_rsp_read(struct ksmbd_work *work, void *ib, int len, -+ void *aux_buf, unsigned int aux_size); -+int ksmbd_iov_pin_rsp(struct ksmbd_work *work, void *ib, int len); -+int allocate_interim_rsp_buf(struct ksmbd_work *work); - #endif /* __KSMBD_WORK_H__ */ -diff --git a/fs/smb/server/mgmt/share_config.h b/fs/smb/server/mgmt/share_config.h -index 3fd3382939421..5f591751b9236 100644 ---- a/fs/smb/server/mgmt/share_config.h -+++ b/fs/smb/server/mgmt/share_config.h -@@ -34,29 +34,22 @@ struct ksmbd_share_config { - #define KSMBD_SHARE_INVALID_UID ((__u16)-1) - #define KSMBD_SHARE_INVALID_GID ((__u16)-1) - --static inline int share_config_create_mode(struct ksmbd_share_config *share, -- umode_t posix_mode) -+static inline umode_t -+share_config_create_mode(struct ksmbd_share_config *share, -+ umode_t posix_mode) - { -- if (!share->force_create_mode) { -- if (!posix_mode) -- return share->create_mask; -- else -- return posix_mode & share->create_mask; -- } -- return share->force_create_mode & share->create_mask; -+ umode_t mode = (posix_mode ?: (umode_t)-1) & share->create_mask; -+ -+ return mode | share->force_create_mode; - } - --static inline int share_config_directory_mode(struct ksmbd_share_config *share, -- umode_t posix_mode) -+static inline umode_t -+share_config_directory_mode(struct ksmbd_share_config *share, -+ umode_t posix_mode) - { -- if (!share->force_directory_mode) { -- if (!posix_mode) -- return share->directory_mask; -- else -- return posix_mode & share->directory_mask; -- } -+ umode_t mode = (posix_mode ?: (umode_t)-1) & share->directory_mask; - -- return share->force_directory_mode & share->directory_mask; -+ return mode | share->force_directory_mode; - } - - static inline int test_share_config_flag(struct ksmbd_share_config *share, -diff --git a/fs/smb/server/mgmt/tree_connect.c b/fs/smb/server/mgmt/tree_connect.c -index f07a05f376513..d2c81a8a11dda 100644 ---- a/fs/smb/server/mgmt/tree_connect.c -+++ b/fs/smb/server/mgmt/tree_connect.c -@@ -73,7 +73,10 @@ ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess, - - tree_conn->user = sess->user; - tree_conn->share_conf = sc; -+ tree_conn->t_state = TREE_NEW; - status.tree_conn = tree_conn; -+ atomic_set(&tree_conn->refcount, 1); -+ init_waitqueue_head(&tree_conn->refcount_q); - - ret = xa_err(xa_store(&sess->tree_conns, tree_conn->id, tree_conn, - GFP_KERNEL)); -@@ -93,14 +96,33 @@ out_error: - return status; - } - -+void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon) -+{ -+ /* -+ * Checking waitqueue to releasing tree connect on -+ * tree disconnect. waitqueue_active is safe because it -+ * uses atomic operation for condition. -+ */ -+ if (!atomic_dec_return(&tcon->refcount) && -+ waitqueue_active(&tcon->refcount_q)) -+ wake_up(&tcon->refcount_q); -+} -+ - int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess, - struct ksmbd_tree_connect *tree_conn) - { - int ret; - -+ write_lock(&sess->tree_conns_lock); -+ xa_erase(&sess->tree_conns, tree_conn->id); -+ write_unlock(&sess->tree_conns_lock); -+ -+ if (!atomic_dec_and_test(&tree_conn->refcount)) -+ wait_event(tree_conn->refcount_q, -+ atomic_read(&tree_conn->refcount) == 0); -+ - ret = ksmbd_ipc_tree_disconnect_request(sess->id, tree_conn->id); - ksmbd_release_tree_conn_id(sess, tree_conn->id); -- xa_erase(&sess->tree_conns, tree_conn->id); - ksmbd_share_config_put(tree_conn->share_conf); - kfree(tree_conn); - return ret; -@@ -111,26 +133,19 @@ struct ksmbd_tree_connect *ksmbd_tree_conn_lookup(struct ksmbd_session *sess, - { - struct ksmbd_tree_connect *tcon; - -+ read_lock(&sess->tree_conns_lock); - tcon = xa_load(&sess->tree_conns, id); - if (tcon) { -- if (test_bit(TREE_CONN_EXPIRE, &tcon->status)) -+ if (tcon->t_state != TREE_CONNECTED) -+ tcon = NULL; -+ else if (!atomic_inc_not_zero(&tcon->refcount)) - tcon = NULL; - } -+ read_unlock(&sess->tree_conns_lock); - - return tcon; - } - --struct ksmbd_share_config *ksmbd_tree_conn_share(struct ksmbd_session *sess, -- unsigned int id) --{ -- struct ksmbd_tree_connect *tc; -- -- tc = ksmbd_tree_conn_lookup(sess, id); -- if (tc) -- return tc->share_conf; -- return NULL; --} -- - int ksmbd_tree_conn_session_logoff(struct ksmbd_session *sess) - { - int ret = 0; -@@ -140,8 +155,18 @@ int ksmbd_tree_conn_session_logoff(struct ksmbd_session *sess) - if (!sess) - return -EINVAL; - -- xa_for_each(&sess->tree_conns, id, tc) -+ xa_for_each(&sess->tree_conns, id, tc) { -+ write_lock(&sess->tree_conns_lock); -+ if (tc->t_state == TREE_DISCONNECTED) { -+ write_unlock(&sess->tree_conns_lock); -+ ret = -ENOENT; -+ continue; -+ } -+ tc->t_state = TREE_DISCONNECTED; -+ write_unlock(&sess->tree_conns_lock); -+ - ret |= ksmbd_tree_conn_disconnect(sess, tc); -+ } - xa_destroy(&sess->tree_conns); - return ret; - } -diff --git a/fs/smb/server/mgmt/tree_connect.h b/fs/smb/server/mgmt/tree_connect.h -index 700df36cf3e30..6377a70b811c8 100644 ---- a/fs/smb/server/mgmt/tree_connect.h -+++ b/fs/smb/server/mgmt/tree_connect.h -@@ -14,7 +14,11 @@ struct ksmbd_share_config; - struct ksmbd_user; - struct ksmbd_conn; - --#define TREE_CONN_EXPIRE 1 -+enum { -+ TREE_NEW = 0, -+ TREE_CONNECTED, -+ TREE_DISCONNECTED -+}; - - struct ksmbd_tree_connect { - int id; -@@ -27,7 +31,9 @@ struct ksmbd_tree_connect { - - int maximal_access; - bool posix_extensions; -- unsigned long status; -+ atomic_t refcount; -+ wait_queue_head_t refcount_q; -+ unsigned int t_state; - }; - - struct ksmbd_tree_conn_status { -@@ -46,6 +52,7 @@ struct ksmbd_session; - struct ksmbd_tree_conn_status - ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess, - const char *share_name); -+void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon); - - int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess, - struct ksmbd_tree_connect *tree_conn); -@@ -53,9 +60,6 @@ int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess, - struct ksmbd_tree_connect *ksmbd_tree_conn_lookup(struct ksmbd_session *sess, - unsigned int id); - --struct ksmbd_share_config *ksmbd_tree_conn_share(struct ksmbd_session *sess, -- unsigned int id); -- - int ksmbd_tree_conn_session_logoff(struct ksmbd_session *sess); - - #endif /* __TREE_CONNECT_MANAGEMENT_H__ */ -diff --git a/fs/smb/server/mgmt/user_config.h b/fs/smb/server/mgmt/user_config.h -index 6a44109617f14..e068a19fd9049 100644 ---- a/fs/smb/server/mgmt/user_config.h -+++ b/fs/smb/server/mgmt/user_config.h -@@ -18,7 +18,6 @@ struct ksmbd_user { - - size_t passkey_sz; - char *passkey; -- unsigned int failed_login_count; - }; - - static inline bool user_guest(struct ksmbd_user *user) -diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c -index cf6621e21ba36..15f68ee050894 100644 ---- a/fs/smb/server/mgmt/user_session.c -+++ b/fs/smb/server/mgmt/user_session.c -@@ -25,7 +25,6 @@ static DECLARE_RWSEM(sessions_table_lock); - struct ksmbd_session_rpc { - int id; - unsigned int method; -- struct list_head list; - }; - - static void free_channel_list(struct ksmbd_session *sess) -@@ -58,15 +57,14 @@ static void __session_rpc_close(struct ksmbd_session *sess, - static void ksmbd_session_rpc_clear_list(struct ksmbd_session *sess) - { - struct ksmbd_session_rpc *entry; -+ long index; - -- while (!list_empty(&sess->rpc_handle_list)) { -- entry = list_entry(sess->rpc_handle_list.next, -- struct ksmbd_session_rpc, -- list); -- -- list_del(&entry->list); -+ xa_for_each(&sess->rpc_handle_list, index, entry) { -+ xa_erase(&sess->rpc_handle_list, index); - __session_rpc_close(sess, entry); - } -+ -+ xa_destroy(&sess->rpc_handle_list); - } - - static int __rpc_method(char *rpc_name) -@@ -102,13 +100,13 @@ int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name) - - entry = kzalloc(sizeof(struct ksmbd_session_rpc), GFP_KERNEL); - if (!entry) -- return -EINVAL; -+ return -ENOMEM; - -- list_add(&entry->list, &sess->rpc_handle_list); - entry->method = method; - entry->id = ksmbd_ipc_id_alloc(); - if (entry->id < 0) - goto free_entry; -+ xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL); - - resp = ksmbd_rpc_open(sess, entry->id); - if (!resp) -@@ -117,9 +115,9 @@ int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name) - kvfree(resp); - return entry->id; - free_id: -+ xa_erase(&sess->rpc_handle_list, entry->id); - ksmbd_rpc_id_free(entry->id); - free_entry: -- list_del(&entry->list); - kfree(entry); - return -EINVAL; - } -@@ -128,24 +126,17 @@ void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id) - { - struct ksmbd_session_rpc *entry; - -- list_for_each_entry(entry, &sess->rpc_handle_list, list) { -- if (entry->id == id) { -- list_del(&entry->list); -- __session_rpc_close(sess, entry); -- break; -- } -- } -+ entry = xa_erase(&sess->rpc_handle_list, id); -+ if (entry) -+ __session_rpc_close(sess, entry); - } - - int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id) - { - struct ksmbd_session_rpc *entry; - -- list_for_each_entry(entry, &sess->rpc_handle_list, list) { -- if (entry->id == id) -- return entry->method; -- } -- return 0; -+ entry = xa_load(&sess->rpc_handle_list, id); -+ return entry ? entry->method : 0; - } - - void ksmbd_session_destroy(struct ksmbd_session *sess) -@@ -362,8 +353,9 @@ static struct ksmbd_session *__session_create(int protocol) - set_session_flag(sess, protocol); - xa_init(&sess->tree_conns); - xa_init(&sess->ksmbd_chann_list); -- INIT_LIST_HEAD(&sess->rpc_handle_list); -+ xa_init(&sess->rpc_handle_list); - sess->sequence_number = 1; -+ rwlock_init(&sess->tree_conns_lock); - - ret = __init_smb2_session(sess); - if (ret) -diff --git a/fs/smb/server/mgmt/user_session.h b/fs/smb/server/mgmt/user_session.h -index 51f38e5b61abb..63cb08fffde84 100644 ---- a/fs/smb/server/mgmt/user_session.h -+++ b/fs/smb/server/mgmt/user_session.h -@@ -52,7 +52,7 @@ struct ksmbd_session { - struct xarray ksmbd_chann_list; - struct xarray tree_conns; - struct ida tree_conn_ida; -- struct list_head rpc_handle_list; -+ struct xarray rpc_handle_list; - - __u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE]; - __u8 smb3decryptionkey[SMB3_ENC_DEC_KEY_SIZE]; -@@ -60,6 +60,7 @@ struct ksmbd_session { - - struct ksmbd_file_table file_table; - unsigned long last_active; -+ rwlock_t tree_conns_lock; - }; - - static inline int test_session_flag(struct ksmbd_session *sess, int bit) -diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c -index c81aee9ce7ec4..af0f6914eca45 100644 ---- a/fs/smb/server/oplock.c -+++ b/fs/smb/server/oplock.c -@@ -102,9 +102,10 @@ static int alloc_lease(struct oplock_info *opinfo, struct lease_ctx_info *lctx) - lease->new_state = 0; - lease->flags = lctx->flags; - lease->duration = lctx->duration; -+ lease->is_dir = lctx->is_dir; - memcpy(lease->parent_lease_key, lctx->parent_lease_key, SMB2_LEASE_KEY_SIZE); - lease->version = lctx->version; -- lease->epoch = 0; -+ lease->epoch = le16_to_cpu(lctx->epoch); - INIT_LIST_HEAD(&opinfo->lease_entry); - opinfo->o_lease = lease; - -@@ -395,8 +396,8 @@ void close_id_del_oplock(struct ksmbd_file *fp) - { - struct oplock_info *opinfo; - -- if (S_ISDIR(file_inode(fp->filp)->i_mode)) -- return; -+ if (fp->reserve_lease_break) -+ smb_lazy_parent_lease_break_close(fp); - - opinfo = opinfo_get(fp); - if (!opinfo) -@@ -543,12 +544,13 @@ static struct oplock_info *same_client_has_lease(struct ksmbd_inode *ci, - /* upgrading lease */ - if ((atomic_read(&ci->op_count) + - atomic_read(&ci->sop_count)) == 1) { -- if (lease->state == -- (lctx->req_state & lease->state)) { -+ if (lease->state != SMB2_LEASE_NONE_LE && -+ lease->state == (lctx->req_state & lease->state)) { - lease->state |= lctx->req_state; - if (lctx->req_state & - SMB2_LEASE_WRITE_CACHING_LE) - lease_read_to_write(opinfo); -+ - } - } else if ((atomic_read(&ci->op_count) + - atomic_read(&ci->sop_count)) > 1) { -@@ -616,15 +618,6 @@ static int oplock_break_pending(struct oplock_info *opinfo, int req_op_level) - return 0; - } - --static inline int allocate_oplock_break_buf(struct ksmbd_work *work) --{ -- work->response_buf = kzalloc(MAX_CIFS_SMALL_BUFFER_SIZE, GFP_KERNEL); -- if (!work->response_buf) -- return -ENOMEM; -- work->response_sz = MAX_CIFS_SMALL_BUFFER_SIZE; -- return 0; --} -- - /** - * __smb2_oplock_break_noti() - send smb2 oplock break cmd from conn - * to client -@@ -639,7 +632,6 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) - { - struct smb2_oplock_break *rsp = NULL; - struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); -- struct ksmbd_conn *conn = work->conn; - struct oplock_break_info *br_info = work->request_buf; - struct smb2_hdr *rsp_hdr; - struct ksmbd_file *fp; -@@ -648,7 +640,7 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) - if (!fp) - goto out; - -- if (allocate_oplock_break_buf(work)) { -+ if (allocate_interim_rsp_buf(work)) { - pr_err("smb2_allocate_rsp_buf failed! "); - ksmbd_fd_put(work, fp); - goto out; -@@ -656,8 +648,6 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) - - rsp_hdr = smb2_get_msg(work->response_buf); - memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); -- *(__be32 *)work->response_buf = -- cpu_to_be32(conn->vals->header_size); - rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER; - rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; - rsp_hdr->CreditRequest = cpu_to_le16(0); -@@ -684,13 +674,15 @@ static void __smb2_oplock_break_noti(struct work_struct *wk) - rsp->PersistentFid = fp->persistent_id; - rsp->VolatileFid = fp->volatile_id; - -- inc_rfc1001_len(work->response_buf, 24); -+ ksmbd_fd_put(work, fp); -+ if (ksmbd_iov_pin_rsp(work, (void *)rsp, -+ sizeof(struct smb2_oplock_break))) -+ goto out; - - ksmbd_debug(OPLOCK, - "sending oplock break v_id %llu p_id = %llu lock level = %d\n", - rsp->VolatileFid, rsp->PersistentFid, rsp->OplockLevel); - -- ksmbd_fd_put(work, fp); - ksmbd_conn_write(work); - - out: -@@ -751,18 +743,15 @@ static void __smb2_lease_break_noti(struct work_struct *wk) - struct smb2_lease_break *rsp = NULL; - struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); - struct lease_break_info *br_info = work->request_buf; -- struct ksmbd_conn *conn = work->conn; - struct smb2_hdr *rsp_hdr; - -- if (allocate_oplock_break_buf(work)) { -+ if (allocate_interim_rsp_buf(work)) { - ksmbd_debug(OPLOCK, "smb2_allocate_rsp_buf failed! "); - goto out; - } - - rsp_hdr = smb2_get_msg(work->response_buf); - memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); -- *(__be32 *)work->response_buf = -- cpu_to_be32(conn->vals->header_size); - rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER; - rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; - rsp_hdr->CreditRequest = cpu_to_le16(0); -@@ -791,7 +780,9 @@ static void __smb2_lease_break_noti(struct work_struct *wk) - rsp->AccessMaskHint = 0; - rsp->ShareMaskHint = 0; - -- inc_rfc1001_len(work->response_buf, 44); -+ if (ksmbd_iov_pin_rsp(work, (void *)rsp, -+ sizeof(struct smb2_lease_break))) -+ goto out; - - ksmbd_conn_write(work); - -@@ -844,7 +835,8 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo) - interim_entry); - setup_async_work(in_work, NULL, NULL); - smb2_send_interim_resp(in_work, STATUS_PENDING); -- list_del(&in_work->interim_entry); -+ list_del_init(&in_work->interim_entry); -+ release_async_work(in_work); - } - INIT_WORK(&work->work, __smb2_lease_break_noti); - ksmbd_queue_work(work); -@@ -910,7 +902,8 @@ static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level) - lease->new_state = - SMB2_LEASE_READ_CACHING_LE; - } else { -- if (lease->state & SMB2_LEASE_HANDLE_CACHING_LE) -+ if (lease->state & SMB2_LEASE_HANDLE_CACHING_LE && -+ !lease->is_dir) - lease->new_state = - SMB2_LEASE_READ_CACHING_LE; - else -@@ -1042,6 +1035,7 @@ static void copy_lease(struct oplock_info *op1, struct oplock_info *op2) - SMB2_LEASE_KEY_SIZE); - lease2->duration = lease1->duration; - lease2->flags = lease1->flags; -+ lease2->epoch = lease1->epoch++; - } - - static int add_lease_global_list(struct oplock_info *opinfo) -@@ -1091,6 +1085,89 @@ static void set_oplock_level(struct oplock_info *opinfo, int level, - } - } - -+void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, -+ struct lease_ctx_info *lctx) -+{ -+ struct oplock_info *opinfo; -+ struct ksmbd_inode *p_ci = NULL; -+ -+ if (lctx->version != 2) -+ return; -+ -+ p_ci = ksmbd_inode_lookup_lock(fp->filp->f_path.dentry->d_parent); -+ if (!p_ci) -+ return; -+ -+ read_lock(&p_ci->m_lock); -+ list_for_each_entry(opinfo, &p_ci->m_op_list, op_entry) { -+ if (!opinfo->is_lease) -+ continue; -+ -+ if (opinfo->o_lease->state != SMB2_OPLOCK_LEVEL_NONE && -+ (!(lctx->flags & SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE) || -+ !compare_guid_key(opinfo, fp->conn->ClientGUID, -+ lctx->parent_lease_key))) { -+ if (!atomic_inc_not_zero(&opinfo->refcount)) -+ continue; -+ -+ atomic_inc(&opinfo->conn->r_count); -+ if (ksmbd_conn_releasing(opinfo->conn)) { -+ atomic_dec(&opinfo->conn->r_count); -+ continue; -+ } -+ -+ read_unlock(&p_ci->m_lock); -+ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); -+ opinfo_conn_put(opinfo); -+ read_lock(&p_ci->m_lock); -+ } -+ } -+ read_unlock(&p_ci->m_lock); -+ -+ ksmbd_inode_put(p_ci); -+} -+ -+void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) -+{ -+ struct oplock_info *opinfo; -+ struct ksmbd_inode *p_ci = NULL; -+ -+ rcu_read_lock(); -+ opinfo = rcu_dereference(fp->f_opinfo); -+ rcu_read_unlock(); -+ -+ if (!opinfo->is_lease || opinfo->o_lease->version != 2) -+ return; -+ -+ p_ci = ksmbd_inode_lookup_lock(fp->filp->f_path.dentry->d_parent); -+ if (!p_ci) -+ return; -+ -+ read_lock(&p_ci->m_lock); -+ list_for_each_entry(opinfo, &p_ci->m_op_list, op_entry) { -+ if (!opinfo->is_lease) -+ continue; -+ -+ if (opinfo->o_lease->state != SMB2_OPLOCK_LEVEL_NONE) { -+ if (!atomic_inc_not_zero(&opinfo->refcount)) -+ continue; -+ -+ atomic_inc(&opinfo->conn->r_count); -+ if (ksmbd_conn_releasing(opinfo->conn)) { -+ atomic_dec(&opinfo->conn->r_count); -+ continue; -+ } -+ read_unlock(&p_ci->m_lock); -+ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); -+ opinfo_conn_put(opinfo); -+ read_lock(&p_ci->m_lock); -+ } -+ } -+ read_unlock(&p_ci->m_lock); -+ -+ ksmbd_inode_put(p_ci); -+} -+ - /** - * smb_grant_oplock() - handle oplock/lease request on file open - * @work: smb work -@@ -1114,10 +1191,6 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, - bool prev_op_has_lease; - __le32 prev_op_state = 0; - -- /* not support directory lease */ -- if (S_ISDIR(file_inode(fp->filp)->i_mode)) -- return 0; -- - opinfo = alloc_opinfo(work, pid, tid); - if (!opinfo) - return -ENOMEM; -@@ -1374,6 +1447,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) - memcpy(buf->lcontext.LeaseKey, lease->lease_key, - SMB2_LEASE_KEY_SIZE); - buf->lcontext.LeaseFlags = lease->flags; -+ buf->lcontext.Epoch = cpu_to_le16(++lease->epoch); - buf->lcontext.LeaseState = lease->state; - memcpy(buf->lcontext.ParentLeaseKey, lease->parent_lease_key, - SMB2_LEASE_KEY_SIZE); -@@ -1410,10 +1484,11 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) - /** - * parse_lease_state() - parse lease context containted in file open request - * @open_req: buffer containing smb2 file open(create) request -+ * @is_dir: whether leasing file is directory - * - * Return: oplock state, -ENOENT if create lease context not found - */ --struct lease_ctx_info *parse_lease_state(void *open_req) -+struct lease_ctx_info *parse_lease_state(void *open_req, bool is_dir) - { - struct create_context *cc; - struct smb2_create_req *req = (struct smb2_create_req *)open_req; -@@ -1431,8 +1506,14 @@ struct lease_ctx_info *parse_lease_state(void *open_req) - struct create_lease_v2 *lc = (struct create_lease_v2 *)cc; - - memcpy(lreq->lease_key, lc->lcontext.LeaseKey, SMB2_LEASE_KEY_SIZE); -- lreq->req_state = lc->lcontext.LeaseState; -+ if (is_dir) { -+ lreq->req_state = lc->lcontext.LeaseState & -+ ~SMB2_LEASE_WRITE_CACHING_LE; -+ lreq->is_dir = true; -+ } else -+ lreq->req_state = lc->lcontext.LeaseState; - lreq->flags = lc->lcontext.LeaseFlags; -+ lreq->epoch = lc->lcontext.Epoch; - lreq->duration = lc->lcontext.LeaseDuration; - memcpy(lreq->parent_lease_key, lc->lcontext.ParentLeaseKey, - SMB2_LEASE_KEY_SIZE); -diff --git a/fs/smb/server/oplock.h b/fs/smb/server/oplock.h -index 4b0fe6da76940..5b93ea9196c01 100644 ---- a/fs/smb/server/oplock.h -+++ b/fs/smb/server/oplock.h -@@ -34,7 +34,9 @@ struct lease_ctx_info { - __le32 flags; - __le64 duration; - __u8 parent_lease_key[SMB2_LEASE_KEY_SIZE]; -+ __le16 epoch; - int version; -+ bool is_dir; - }; - - struct lease_table { -@@ -53,6 +55,7 @@ struct lease { - __u8 parent_lease_key[SMB2_LEASE_KEY_SIZE]; - int version; - unsigned short epoch; -+ bool is_dir; - struct lease_table *l_lb; - }; - -@@ -108,7 +111,7 @@ void opinfo_put(struct oplock_info *opinfo); - - /* Lease related functions */ - void create_lease_buf(u8 *rbuf, struct lease *lease); --struct lease_ctx_info *parse_lease_state(void *open_req); -+struct lease_ctx_info *parse_lease_state(void *open_req, bool is_dir); - __u8 smb2_map_lease_to_oplock(__le32 lease_state); - int lease_read_to_write(struct oplock_info *opinfo); - -@@ -124,4 +127,7 @@ struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn, - int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci, - struct lease_ctx_info *lctx); - void destroy_lease_table(struct ksmbd_conn *conn); -+void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, -+ struct lease_ctx_info *lctx); -+void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp); - #endif /* __KSMBD_OPLOCK_H */ -diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c -index 9804cabe72a84..11b201e6ee44b 100644 ---- a/fs/smb/server/server.c -+++ b/fs/smb/server/server.c -@@ -115,8 +115,10 @@ static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn, - if (check_conn_state(work)) - return SERVER_HANDLER_CONTINUE; - -- if (ksmbd_verify_smb_message(work)) -+ if (ksmbd_verify_smb_message(work)) { -+ conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); - return SERVER_HANDLER_ABORT; -+ } - - command = conn->ops->get_cmd_val(work); - *cmd = command; -@@ -163,6 +165,7 @@ static void __handle_ksmbd_work(struct ksmbd_work *work, - { - u16 command = 0; - int rc; -+ bool is_chained = false; - - if (conn->ops->allocate_rsp_buf(work)) - return; -@@ -229,16 +232,17 @@ static void __handle_ksmbd_work(struct ksmbd_work *work, - } - } - -+ is_chained = is_chained_smb2_message(work); -+ - if (work->sess && - (work->sess->sign || smb3_11_final_sess_setup_resp(work) || - conn->ops->is_sign_req(work, command))) - conn->ops->set_sign_rsp(work); -- } while (is_chained_smb2_message(work)); -- -- if (work->send_no_response) -- return; -+ } while (is_chained == true); - - send: -+ if (work->tcon) -+ ksmbd_tree_connect_put(work->tcon); - smb3_preauth_hash_rsp(work); - if (work->sess && work->sess->enc && work->encrypted && - conn->ops->encrypt_resp) { -@@ -442,11 +446,9 @@ static ssize_t stats_show(struct class *class, struct class_attribute *attr, - "reset", - "shutdown" - }; -- -- ssize_t sz = scnprintf(buf, PAGE_SIZE, "%d %s %d %lu\n", stats_version, -- state[server_conf.state], server_conf.tcp_port, -- server_conf.ipc_last_active / HZ); -- return sz; -+ return sysfs_emit(buf, "%d %s %d %lu\n", stats_version, -+ state[server_conf.state], server_conf.tcp_port, -+ server_conf.ipc_last_active / HZ); - } - - static ssize_t kill_server_store(struct class *class, -@@ -478,19 +480,13 @@ static ssize_t debug_show(struct class *class, struct class_attribute *attr, - - for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { - if ((ksmbd_debug_types >> i) & 1) { -- pos = scnprintf(buf + sz, -- PAGE_SIZE - sz, -- "[%s] ", -- debug_type_strings[i]); -+ pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]); - } else { -- pos = scnprintf(buf + sz, -- PAGE_SIZE - sz, -- "%s ", -- debug_type_strings[i]); -+ pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]); - } - sz += pos; - } -- sz += scnprintf(buf + sz, PAGE_SIZE - sz, "\n"); -+ sz += sysfs_emit_at(buf, sz, "\n"); - return sz; - } - -@@ -599,8 +595,6 @@ static int __init ksmbd_server_init(void) - if (ret) - goto err_crypto_destroy; - -- pr_warn_once("The ksmbd server is experimental\n"); -- - return 0; - - err_crypto_destroy: -diff --git a/fs/smb/server/smb2misc.c b/fs/smb/server/smb2misc.c -index e881df1d10cbd..03dded29a9804 100644 ---- a/fs/smb/server/smb2misc.c -+++ b/fs/smb/server/smb2misc.c -@@ -106,16 +106,25 @@ static int smb2_get_data_area_len(unsigned int *off, unsigned int *len, - break; - case SMB2_CREATE: - { -+ unsigned short int name_off = -+ le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset); -+ unsigned short int name_len = -+ le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength); -+ - if (((struct smb2_create_req *)hdr)->CreateContextsLength) { - *off = le32_to_cpu(((struct smb2_create_req *) - hdr)->CreateContextsOffset); - *len = le32_to_cpu(((struct smb2_create_req *) - hdr)->CreateContextsLength); -- break; -+ if (!name_len) -+ break; -+ -+ if (name_off + name_len < (u64)*off + *len) -+ break; - } - -- *off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset); -- *len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength); -+ *off = name_off; -+ *len = name_len; - break; - } - case SMB2_QUERY_INFO: -@@ -440,10 +449,8 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work) - - validate_credit: - if ((work->conn->vals->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU) && -- smb2_validate_credit_charge(work->conn, hdr)) { -- work->conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); -+ smb2_validate_credit_charge(work->conn, hdr)) - return 1; -- } - - return 0; - } -diff --git a/fs/smb/server/smb2ops.c b/fs/smb/server/smb2ops.c -index ab23da2120b94..535402629655e 100644 ---- a/fs/smb/server/smb2ops.c -+++ b/fs/smb/server/smb2ops.c -@@ -221,7 +221,8 @@ void init_smb3_0_server(struct ksmbd_conn *conn) - conn->signing_algorithm = SIGNING_ALG_AES_CMAC_LE; - - if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES) -- conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING; -+ conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING | -+ SMB2_GLOBAL_CAP_DIRECTORY_LEASING; - - if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION && - conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION) -@@ -245,10 +246,12 @@ void init_smb3_02_server(struct ksmbd_conn *conn) - conn->signing_algorithm = SIGNING_ALG_AES_CMAC_LE; - - if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES) -- conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING; -+ conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING | -+ SMB2_GLOBAL_CAP_DIRECTORY_LEASING; - -- if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION && -- conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION) -+ if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION || -+ (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) && -+ conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)) - conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; - - if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) -@@ -269,7 +272,13 @@ int init_smb3_11_server(struct ksmbd_conn *conn) - conn->signing_algorithm = SIGNING_ALG_AES_CMAC_LE; - - if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES) -- conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING; -+ conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING | -+ SMB2_GLOBAL_CAP_DIRECTORY_LEASING; -+ -+ if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION || -+ (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) && -+ conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)) -+ conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; - - if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) - conn->vals->capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL; -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 1598ad6155fef..ea48dd06d4da3 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -144,12 +144,18 @@ void smb2_set_err_rsp(struct ksmbd_work *work) - err_rsp = smb2_get_msg(work->response_buf); - - if (err_rsp->hdr.Status != STATUS_STOPPED_ON_SYMLINK) { -+ int err; -+ - err_rsp->StructureSize = SMB2_ERROR_STRUCTURE_SIZE2_LE; - err_rsp->ErrorContextCount = 0; - err_rsp->Reserved = 0; - err_rsp->ByteCount = 0; - err_rsp->ErrorData[0] = 0; -- inc_rfc1001_len(work->response_buf, SMB2_ERROR_STRUCTURE_SIZE2); -+ err = ksmbd_iov_pin_rsp(work, (void *)err_rsp, -+ __SMB2_HEADER_STRUCTURE_SIZE + -+ SMB2_ERROR_STRUCTURE_SIZE2); -+ if (err) -+ work->send_no_response = 1; - } - } - -@@ -224,11 +230,12 @@ void set_smb2_rsp_status(struct ksmbd_work *work, __le32 err) - { - struct smb2_hdr *rsp_hdr; - -- if (work->next_smb2_rcv_hdr_off) -- rsp_hdr = ksmbd_resp_buf_next(work); -- else -- rsp_hdr = smb2_get_msg(work->response_buf); -+ rsp_hdr = smb2_get_msg(work->response_buf); - rsp_hdr->Status = err; -+ -+ work->iov_idx = 0; -+ work->iov_cnt = 0; -+ work->next_smb2_rcv_hdr_off = 0; - smb2_set_err_rsp(work); - } - -@@ -244,9 +251,7 @@ int init_smb2_neg_rsp(struct ksmbd_work *work) - struct smb2_hdr *rsp_hdr; - struct smb2_negotiate_rsp *rsp; - struct ksmbd_conn *conn = work->conn; -- -- *(__be32 *)work->response_buf = -- cpu_to_be32(conn->vals->header_size); -+ int err; - - rsp_hdr = smb2_get_msg(work->response_buf); - memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); -@@ -285,13 +290,14 @@ int init_smb2_neg_rsp(struct ksmbd_work *work) - rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH); - ksmbd_copy_gss_neg_header((char *)(&rsp->hdr) + - le16_to_cpu(rsp->SecurityBufferOffset)); -- inc_rfc1001_len(work->response_buf, -- sizeof(struct smb2_negotiate_rsp) - -- sizeof(struct smb2_hdr) - sizeof(rsp->Buffer) + -- AUTH_GSS_LENGTH); - rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE; - if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) - rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE; -+ err = ksmbd_iov_pin_rsp(work, rsp, -+ sizeof(struct smb2_negotiate_rsp) - -+ sizeof(rsp->Buffer) + AUTH_GSS_LENGTH); -+ if (err) -+ return err; - conn->use_spnego = true; - - ksmbd_conn_set_need_negotiate(conn); -@@ -390,11 +396,12 @@ static void init_chained_smb2_rsp(struct ksmbd_work *work) - next_hdr_offset = le32_to_cpu(req->NextCommand); - - new_len = ALIGN(len, 8); -- inc_rfc1001_len(work->response_buf, -- sizeof(struct smb2_hdr) + new_len - len); -+ work->iov[work->iov_idx].iov_len += (new_len - len); -+ inc_rfc1001_len(work->response_buf, new_len - len); - rsp->NextCommand = cpu_to_le32(new_len); - - work->next_smb2_rcv_hdr_off += next_hdr_offset; -+ work->curr_smb2_rsp_hdr_off = work->next_smb2_rsp_hdr_off; - work->next_smb2_rsp_hdr_off += new_len; - ksmbd_debug(SMB, - "Compound req new_len = %d rcv off = %d rsp off = %d\n", -@@ -470,10 +477,10 @@ bool is_chained_smb2_message(struct ksmbd_work *work) - len = len - get_rfc1002_len(work->response_buf); - if (len) { - ksmbd_debug(SMB, "padding len %u\n", len); -+ work->iov[work->iov_idx].iov_len += len; - inc_rfc1001_len(work->response_buf, len); -- if (work->aux_payload_sz) -- work->aux_payload_sz += len; - } -+ work->curr_smb2_rsp_hdr_off = work->next_smb2_rsp_hdr_off; - } - return false; - } -@@ -488,11 +495,8 @@ int init_smb2_rsp_hdr(struct ksmbd_work *work) - { - struct smb2_hdr *rsp_hdr = smb2_get_msg(work->response_buf); - struct smb2_hdr *rcv_hdr = smb2_get_msg(work->request_buf); -- struct ksmbd_conn *conn = work->conn; - - memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2); -- *(__be32 *)work->response_buf = -- cpu_to_be32(conn->vals->header_size); - rsp_hdr->ProtocolId = rcv_hdr->ProtocolId; - rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE; - rsp_hdr->Command = rcv_hdr->Command; -@@ -508,12 +512,6 @@ int init_smb2_rsp_hdr(struct ksmbd_work *work) - rsp_hdr->SessionId = rcv_hdr->SessionId; - memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16); - -- work->syncronous = true; -- if (work->async_id) { -- ksmbd_release_id(&conn->async_ida, work->async_id); -- work->async_id = 0; -- } -- - return 0; - } - -@@ -549,7 +547,7 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) - if (le32_to_cpu(hdr->NextCommand) > 0) - sz = large_sz; - -- work->response_buf = kvmalloc(sz, GFP_KERNEL | __GFP_ZERO); -+ work->response_buf = kvzalloc(sz, GFP_KERNEL); - if (!work->response_buf) - return -ENOMEM; - -@@ -659,21 +657,16 @@ smb2_get_name(const char *src, const int maxlen, struct nls_table *local_nls) - - int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) - { -- struct smb2_hdr *rsp_hdr; - struct ksmbd_conn *conn = work->conn; - int id; - -- rsp_hdr = smb2_get_msg(work->response_buf); -- rsp_hdr->Flags |= SMB2_FLAGS_ASYNC_COMMAND; -- - id = ksmbd_acquire_async_msg_id(&conn->async_ida); - if (id < 0) { - pr_err("Failed to alloc async message id\n"); - return id; - } -- work->syncronous = false; -+ work->asynchronous = true; - work->async_id = id; -- rsp_hdr->Id.AsyncId = cpu_to_le64(id); - - ksmbd_debug(SMB, - "Send interim Response to inform async request id : %d\n", -@@ -691,18 +684,47 @@ int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) - return 0; - } - -+void release_async_work(struct ksmbd_work *work) -+{ -+ struct ksmbd_conn *conn = work->conn; -+ -+ spin_lock(&conn->request_lock); -+ list_del_init(&work->async_request_entry); -+ spin_unlock(&conn->request_lock); -+ -+ work->asynchronous = 0; -+ work->cancel_fn = NULL; -+ kfree(work->cancel_argv); -+ work->cancel_argv = NULL; -+ if (work->async_id) { -+ ksmbd_release_id(&conn->async_ida, work->async_id); -+ work->async_id = 0; -+ } -+} -+ - void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) - { - struct smb2_hdr *rsp_hdr; -+ struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); - -- rsp_hdr = smb2_get_msg(work->response_buf); -- smb2_set_err_rsp(work); -+ if (allocate_interim_rsp_buf(in_work)) { -+ pr_err("smb_allocate_rsp_buf failed!\n"); -+ ksmbd_free_work_struct(in_work); -+ return; -+ } -+ -+ in_work->conn = work->conn; -+ memcpy(smb2_get_msg(in_work->response_buf), ksmbd_resp_buf_next(work), -+ __SMB2_HEADER_STRUCTURE_SIZE); -+ -+ rsp_hdr = smb2_get_msg(in_work->response_buf); -+ rsp_hdr->Flags |= SMB2_FLAGS_ASYNC_COMMAND; -+ rsp_hdr->Id.AsyncId = cpu_to_le64(work->async_id); -+ smb2_set_err_rsp(in_work); - rsp_hdr->Status = status; - -- work->multiRsp = 1; -- ksmbd_conn_write(work); -- rsp_hdr->Status = 0; -- work->multiRsp = 0; -+ ksmbd_conn_write(in_work); -+ ksmbd_free_work_struct(in_work); - } - - static __le32 smb2_get_reparse_tag_special_file(umode_t mode) -@@ -774,19 +796,6 @@ static void build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt, - pneg_ctxt->Ciphers[0] = cipher_type; - } - --static void build_compression_ctxt(struct smb2_compression_capabilities_context *pneg_ctxt, -- __le16 comp_algo) --{ -- pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES; -- pneg_ctxt->DataLength = -- cpu_to_le16(sizeof(struct smb2_compression_capabilities_context) -- - sizeof(struct smb2_neg_context)); -- pneg_ctxt->Reserved = cpu_to_le32(0); -- pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(1); -- pneg_ctxt->Flags = cpu_to_le32(0); -- pneg_ctxt->CompressionAlgorithms[0] = comp_algo; --} -- - static void build_sign_cap_ctxt(struct smb2_signing_capabilities *pneg_ctxt, - __le16 sign_algo) - { -@@ -822,11 +831,10 @@ static void build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt) - pneg_ctxt->Name[15] = 0x7C; - } - --static void assemble_neg_contexts(struct ksmbd_conn *conn, -- struct smb2_negotiate_rsp *rsp, -- void *smb2_buf_len) -+static unsigned int assemble_neg_contexts(struct ksmbd_conn *conn, -+ struct smb2_negotiate_rsp *rsp) - { -- char *pneg_ctxt = (char *)rsp + -+ char * const pneg_ctxt = (char *)rsp + - le32_to_cpu(rsp->NegotiateContextOffset); - int neg_ctxt_cnt = 1; - int ctxt_size; -@@ -835,62 +843,46 @@ static void assemble_neg_contexts(struct ksmbd_conn *conn, - "assemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n"); - build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt, - conn->preauth_info->Preauth_HashId); -- rsp->NegotiateContextCount = cpu_to_le16(neg_ctxt_cnt); -- inc_rfc1001_len(smb2_buf_len, AUTH_GSS_PADDING); - ctxt_size = sizeof(struct smb2_preauth_neg_context); -- /* Round to 8 byte boundary */ -- pneg_ctxt += round_up(sizeof(struct smb2_preauth_neg_context), 8); - - if (conn->cipher_type) { -+ /* Round to 8 byte boundary */ - ctxt_size = round_up(ctxt_size, 8); - ksmbd_debug(SMB, - "assemble SMB2_ENCRYPTION_CAPABILITIES context\n"); -- build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt, -+ build_encrypt_ctxt((struct smb2_encryption_neg_context *) -+ (pneg_ctxt + ctxt_size), - conn->cipher_type); -- rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt); -+ neg_ctxt_cnt++; - ctxt_size += sizeof(struct smb2_encryption_neg_context) + 2; -- /* Round to 8 byte boundary */ -- pneg_ctxt += -- round_up(sizeof(struct smb2_encryption_neg_context) + 2, -- 8); - } - -- if (conn->compress_algorithm) { -- ctxt_size = round_up(ctxt_size, 8); -- ksmbd_debug(SMB, -- "assemble SMB2_COMPRESSION_CAPABILITIES context\n"); -- /* Temporarily set to SMB3_COMPRESS_NONE */ -- build_compression_ctxt((struct smb2_compression_capabilities_context *)pneg_ctxt, -- conn->compress_algorithm); -- rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt); -- ctxt_size += sizeof(struct smb2_compression_capabilities_context) + 2; -- /* Round to 8 byte boundary */ -- pneg_ctxt += round_up(sizeof(struct smb2_compression_capabilities_context) + 2, -- 8); -- } -+ /* compression context not yet supported */ -+ WARN_ON(conn->compress_algorithm != SMB3_COMPRESS_NONE); - - if (conn->posix_ext_supported) { - ctxt_size = round_up(ctxt_size, 8); - ksmbd_debug(SMB, - "assemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n"); -- build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt); -- rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt); -+ build_posix_ctxt((struct smb2_posix_neg_context *) -+ (pneg_ctxt + ctxt_size)); -+ neg_ctxt_cnt++; - ctxt_size += sizeof(struct smb2_posix_neg_context); -- /* Round to 8 byte boundary */ -- pneg_ctxt += round_up(sizeof(struct smb2_posix_neg_context), 8); - } - - if (conn->signing_negotiated) { - ctxt_size = round_up(ctxt_size, 8); - ksmbd_debug(SMB, - "assemble SMB2_SIGNING_CAPABILITIES context\n"); -- build_sign_cap_ctxt((struct smb2_signing_capabilities *)pneg_ctxt, -+ build_sign_cap_ctxt((struct smb2_signing_capabilities *) -+ (pneg_ctxt + ctxt_size), - conn->signing_algorithm); -- rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt); -+ neg_ctxt_cnt++; - ctxt_size += sizeof(struct smb2_signing_capabilities) + 2; - } - -- inc_rfc1001_len(smb2_buf_len, ctxt_size); -+ rsp->NegotiateContextCount = cpu_to_le16(neg_ctxt_cnt); -+ return ctxt_size + AUTH_GSS_PADDING; - } - - static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn, -@@ -935,7 +927,7 @@ static void decode_encrypt_ctxt(struct ksmbd_conn *conn, - return; - } - -- if (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION)) -+ if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) - return; - - for (i = 0; i < cph_cnt; i++) { -@@ -1106,7 +1098,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work) - struct smb2_negotiate_req *req = smb2_get_msg(work->request_buf); - struct smb2_negotiate_rsp *rsp = smb2_get_msg(work->response_buf); - int rc = 0; -- unsigned int smb2_buf_len, smb2_neg_size; -+ unsigned int smb2_buf_len, smb2_neg_size, neg_ctxt_len = 0; - __le32 status; - - ksmbd_debug(SMB, "Received negotiate request\n"); -@@ -1199,7 +1191,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work) - conn->preauth_info->Preauth_HashValue); - rsp->NegotiateContextOffset = - cpu_to_le32(OFFSET_OF_NEG_CONTEXT); -- assemble_neg_contexts(conn, rsp, work->response_buf); -+ neg_ctxt_len = assemble_neg_contexts(conn, rsp); - break; - case SMB302_PROT_ID: - init_smb3_02_server(conn); -@@ -1249,9 +1241,6 @@ int smb2_handle_negotiate(struct ksmbd_work *work) - rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH); - ksmbd_copy_gss_neg_header((char *)(&rsp->hdr) + - le16_to_cpu(rsp->SecurityBufferOffset)); -- inc_rfc1001_len(work->response_buf, sizeof(struct smb2_negotiate_rsp) - -- sizeof(struct smb2_hdr) - sizeof(rsp->Buffer) + -- AUTH_GSS_LENGTH); - rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE; - conn->use_spnego = true; - -@@ -1269,9 +1258,16 @@ int smb2_handle_negotiate(struct ksmbd_work *work) - ksmbd_conn_set_need_negotiate(conn); - - err_out: -+ if (rc) -+ rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; -+ -+ if (!rc) -+ rc = ksmbd_iov_pin_rsp(work, rsp, -+ sizeof(struct smb2_negotiate_rsp) - -+ sizeof(rsp->Buffer) + -+ AUTH_GSS_LENGTH + neg_ctxt_len); - if (rc < 0) - smb2_set_err_rsp(work); -- - return rc; - } - -@@ -1471,7 +1467,6 @@ static int ntlm_authenticate(struct ksmbd_work *work, - memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len); - rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len); - kfree(spnego_blob); -- inc_rfc1001_len(work->response_buf, spnego_blob_len - 1); - } - - user = session_user(conn, req); -@@ -1544,7 +1539,8 @@ static int ntlm_authenticate(struct ksmbd_work *work, - return -EINVAL; - } - sess->enc = true; -- rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; -+ if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION) -+ rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; - /* - * signing is disable if encryption is enable - * on this session -@@ -1616,7 +1612,6 @@ static int krb5_authenticate(struct ksmbd_work *work, - return -EINVAL; - } - rsp->SecurityBufferLength = cpu_to_le16(out_len); -- inc_rfc1001_len(work->response_buf, out_len - 1); - - if ((conn->sign || server_conf.enforced_signing) || - (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) -@@ -1630,7 +1625,8 @@ static int krb5_authenticate(struct ksmbd_work *work, - return -EINVAL; - } - sess->enc = true; -- rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; -+ if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION) -+ rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE; - sess->sign = false; - } - -@@ -1687,7 +1683,6 @@ int smb2_sess_setup(struct ksmbd_work *work) - rsp->SessionFlags = 0; - rsp->SecurityBufferOffset = cpu_to_le16(72); - rsp->SecurityBufferLength = 0; -- inc_rfc1001_len(work->response_buf, 9); - - ksmbd_conn_lock(conn); - if (!req->hdr.SessionId) { -@@ -1823,13 +1818,6 @@ int smb2_sess_setup(struct ksmbd_work *work) - goto out_err; - rsp->hdr.Status = - STATUS_MORE_PROCESSING_REQUIRED; -- /* -- * Note: here total size -1 is done as an -- * adjustment for 0 size blob -- */ -- inc_rfc1001_len(work->response_buf, -- le16_to_cpu(rsp->SecurityBufferLength) - 1); -- - } else if (negblob->MessageType == NtLmAuthenticate) { - rc = ntlm_authenticate(work, req, rsp); - if (rc) -@@ -1914,6 +1902,18 @@ out_err: - ksmbd_conn_set_need_negotiate(conn); - } - } -+ smb2_set_err_rsp(work); -+ } else { -+ unsigned int iov_len; -+ -+ if (rsp->SecurityBufferLength) -+ iov_len = offsetof(struct smb2_sess_setup_rsp, Buffer) + -+ le16_to_cpu(rsp->SecurityBufferLength); -+ else -+ iov_len = sizeof(struct smb2_sess_setup_rsp); -+ rc = ksmbd_iov_pin_rsp(work, rsp, iov_len); -+ if (rc) -+ rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; - } - - ksmbd_conn_unlock(conn); -@@ -1991,14 +1991,20 @@ int smb2_tree_connect(struct ksmbd_work *work) - if (conn->posix_ext_supported) - status.tree_conn->posix_extensions = true; - -+ write_lock(&sess->tree_conns_lock); -+ status.tree_conn->t_state = TREE_CONNECTED; -+ write_unlock(&sess->tree_conns_lock); - rsp->StructureSize = cpu_to_le16(16); -- inc_rfc1001_len(work->response_buf, 16); - out_err1: - rsp->Capabilities = 0; - rsp->Reserved = 0; - /* default manual caching */ - rsp->ShareFlags = SMB2_SHAREFLAG_MANUAL_CACHING; - -+ rc = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_tree_connect_rsp)); -+ if (rc) -+ status.ret = KSMBD_TREE_CONN_STATUS_NOMEM; -+ - if (!IS_ERR(treename)) - kfree(treename); - if (!IS_ERR(name)) -@@ -2111,26 +2117,56 @@ int smb2_tree_disconnect(struct ksmbd_work *work) - struct smb2_tree_disconnect_req *req; - struct ksmbd_session *sess = work->sess; - struct ksmbd_tree_connect *tcon = work->tcon; -+ int err; - - WORK_BUFFERS(work, req, rsp); - -- rsp->StructureSize = cpu_to_le16(4); -- inc_rfc1001_len(work->response_buf, 4); -- - ksmbd_debug(SMB, "request\n"); - -- if (!tcon || test_and_set_bit(TREE_CONN_EXPIRE, &tcon->status)) { -+ if (!tcon) { - ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId); - - rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; -- smb2_set_err_rsp(work); -- return 0; -+ err = -ENOENT; -+ goto err_out; - } - - ksmbd_close_tree_conn_fds(work); -- ksmbd_tree_conn_disconnect(sess, tcon); -+ -+ write_lock(&sess->tree_conns_lock); -+ if (tcon->t_state == TREE_DISCONNECTED) { -+ write_unlock(&sess->tree_conns_lock); -+ rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; -+ err = -ENOENT; -+ goto err_out; -+ } -+ -+ WARN_ON_ONCE(atomic_dec_and_test(&tcon->refcount)); -+ tcon->t_state = TREE_DISCONNECTED; -+ write_unlock(&sess->tree_conns_lock); -+ -+ err = ksmbd_tree_conn_disconnect(sess, tcon); -+ if (err) { -+ rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; -+ goto err_out; -+ } -+ - work->tcon = NULL; -+ -+ rsp->StructureSize = cpu_to_le16(4); -+ err = ksmbd_iov_pin_rsp(work, rsp, -+ sizeof(struct smb2_tree_disconnect_rsp)); -+ if (err) { -+ rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; -+ goto err_out; -+ } -+ - return 0; -+ -+err_out: -+ smb2_set_err_rsp(work); -+ return err; -+ - } - - /** -@@ -2146,17 +2182,23 @@ int smb2_session_logoff(struct ksmbd_work *work) - struct smb2_logoff_rsp *rsp; - struct ksmbd_session *sess; - u64 sess_id; -+ int err; - - WORK_BUFFERS(work, req, rsp); - -- sess_id = le64_to_cpu(req->hdr.SessionId); -- -- rsp->StructureSize = cpu_to_le16(4); -- inc_rfc1001_len(work->response_buf, 4); -- - ksmbd_debug(SMB, "request\n"); - -+ ksmbd_conn_lock(conn); -+ if (!ksmbd_conn_good(conn)) { -+ ksmbd_conn_unlock(conn); -+ rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; -+ smb2_set_err_rsp(work); -+ return -ENOENT; -+ } -+ sess_id = le64_to_cpu(req->hdr.SessionId); - ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_RECONNECT); -+ ksmbd_conn_unlock(conn); -+ - ksmbd_close_session_fds(work); - ksmbd_conn_wait_idle(conn, sess_id); - -@@ -2169,7 +2211,7 @@ int smb2_session_logoff(struct ksmbd_work *work) - ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId); - rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED; - smb2_set_err_rsp(work); -- return 0; -+ return -ENOENT; - } - - ksmbd_destroy_file_table(&sess->file_table); -@@ -2178,6 +2220,14 @@ int smb2_session_logoff(struct ksmbd_work *work) - ksmbd_free_user(sess->user); - sess->user = NULL; - ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_NEGOTIATE); -+ -+ rsp->StructureSize = cpu_to_le16(4); -+ err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_logoff_rsp)); -+ if (err) { -+ rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; -+ smb2_set_err_rsp(work); -+ return err; -+ } - return 0; - } - -@@ -2230,7 +2280,10 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work) - rsp->CreateContextsOffset = 0; - rsp->CreateContextsLength = 0; - -- inc_rfc1001_len(work->response_buf, 88); /* StructureSize - 1*/ -+ err = ksmbd_iov_pin_rsp(work, rsp, offsetof(struct smb2_create_rsp, Buffer)); -+ if (err) -+ goto out; -+ - kfree(name); - return 0; - -@@ -2309,7 +2362,7 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, - /* delete the EA only when it exits */ - if (rc > 0) { - rc = ksmbd_vfs_remove_xattr(user_ns, -- path->dentry, -+ path, - attr_name); - - if (rc < 0) { -@@ -2323,9 +2376,9 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len, - /* if the EA doesn't exist, just do nothing. */ - rc = 0; - } else { -- rc = ksmbd_vfs_setxattr(user_ns, -- path->dentry, attr_name, value, -- le16_to_cpu(eabuf->EaValueLength), 0); -+ rc = ksmbd_vfs_setxattr(user_ns, path, attr_name, value, -+ le16_to_cpu(eabuf->EaValueLength), -+ 0, true); - if (rc < 0) { - ksmbd_debug(SMB, - "ksmbd_vfs_setxattr is failed(%d)\n", -@@ -2388,8 +2441,7 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path, - return -EBADF; - } - -- rc = ksmbd_vfs_setxattr(user_ns, path->dentry, -- xattr_stream_name, NULL, 0, 0); -+ rc = ksmbd_vfs_setxattr(user_ns, path, xattr_stream_name, NULL, 0, 0, false); - if (rc < 0) - pr_err("Failed to store XATTR stream name :%d\n", rc); - return 0; -@@ -2417,7 +2469,7 @@ static int smb2_remove_smb_xattrs(const struct path *path) - if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) && - !strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, - STREAM_PREFIX_LEN)) { -- err = ksmbd_vfs_remove_xattr(user_ns, path->dentry, -+ err = ksmbd_vfs_remove_xattr(user_ns, path, - name); - if (err) - ksmbd_debug(SMB, "remove xattr failed : %s\n", -@@ -2464,8 +2516,7 @@ static void smb2_new_xattrs(struct ksmbd_tree_connect *tcon, const struct path * - da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME | - XATTR_DOSINFO_ITIME; - -- rc = ksmbd_vfs_set_dos_attrib_xattr(mnt_user_ns(path->mnt), -- path->dentry, &da); -+ rc = ksmbd_vfs_set_dos_attrib_xattr(mnt_user_ns(path->mnt), path, &da, true); - if (rc) - ksmbd_debug(SMB, "failed to store file attribute into xattr\n"); - } -@@ -2492,8 +2543,9 @@ static void smb2_update_xattrs(struct ksmbd_tree_connect *tcon, - } - } - --static int smb2_creat(struct ksmbd_work *work, struct path *path, char *name, -- int open_flags, umode_t posix_mode, bool is_dir) -+static int smb2_creat(struct ksmbd_work *work, struct path *parent_path, -+ struct path *path, char *name, int open_flags, -+ umode_t posix_mode, bool is_dir) - { - struct ksmbd_tree_connect *tcon = work->tcon; - struct ksmbd_share_config *share = tcon->share_conf; -@@ -2520,7 +2572,7 @@ static int smb2_creat(struct ksmbd_work *work, struct path *path, char *name, - return rc; - } - -- rc = ksmbd_vfs_kern_path(work, name, 0, path, 0); -+ rc = ksmbd_vfs_kern_path_locked(work, name, 0, parent_path, path, 0); - if (rc) { - pr_err("cannot get linux path (%s), err = %d\n", - name, rc); -@@ -2554,7 +2606,7 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work, - sizeof(struct create_sd_buf_req)) - return -EINVAL; - return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd, -- le32_to_cpu(sd_buf->ccontext.DataLength), true); -+ le32_to_cpu(sd_buf->ccontext.DataLength), true, false); - } - - static void ksmbd_acls_fattr(struct smb_fattr *fattr, -@@ -2590,7 +2642,7 @@ int smb2_open(struct ksmbd_work *work) - struct ksmbd_tree_connect *tcon = work->tcon; - struct smb2_create_req *req; - struct smb2_create_rsp *rsp; -- struct path path; -+ struct path path, parent_path; - struct ksmbd_share_config *share = tcon->share_conf; - struct ksmbd_file *fp = NULL; - struct file *filp = NULL; -@@ -2614,6 +2666,7 @@ int smb2_open(struct ksmbd_work *work) - u64 time; - umode_t posix_mode = 0; - __le32 daccess, maximal_access = 0; -+ int iov_len = 0; - - WORK_BUFFERS(work, req, rsp); - -@@ -2635,7 +2688,7 @@ int smb2_open(struct ksmbd_work *work) - *(char *)req->Buffer == '\\') { - pr_err("not allow directory name included leading slash\n"); - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } - - name = smb2_get_name(req->Buffer, -@@ -2646,7 +2699,7 @@ int smb2_open(struct ksmbd_work *work) - if (rc != -ENOMEM) - rc = -ENOENT; - name = NULL; -- goto err_out1; -+ goto err_out2; - } - - ksmbd_debug(SMB, "converted name = %s\n", name); -@@ -2654,48 +2707,44 @@ int smb2_open(struct ksmbd_work *work) - if (!test_share_config_flag(work->tcon->share_conf, - KSMBD_SHARE_FLAG_STREAMS)) { - rc = -EBADF; -- goto err_out1; -+ goto err_out2; - } - rc = parse_stream_name(name, &stream_name, &s_type); - if (rc < 0) -- goto err_out1; -+ goto err_out2; - } - - rc = ksmbd_validate_filename(name); - if (rc < 0) -- goto err_out1; -+ goto err_out2; - - if (ksmbd_share_veto_filename(share, name)) { - rc = -ENOENT; - ksmbd_debug(SMB, "Reject open(), vetoed file: %s\n", - name); -- goto err_out1; -+ goto err_out2; - } - } else { - name = kstrdup("", GFP_KERNEL); - if (!name) { - rc = -ENOMEM; -- goto err_out1; -+ goto err_out2; - } - } - -- req_op_level = req->RequestedOplockLevel; -- if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) -- lc = parse_lease_state(req); -- - if (le32_to_cpu(req->ImpersonationLevel) > le32_to_cpu(IL_DELEGATE)) { - pr_err("Invalid impersonationlevel : 0x%x\n", - le32_to_cpu(req->ImpersonationLevel)); - rc = -EIO; - rsp->hdr.Status = STATUS_BAD_IMPERSONATION_LEVEL; -- goto err_out1; -+ goto err_out2; - } - - if (req->CreateOptions && !(req->CreateOptions & CREATE_OPTIONS_MASK_LE)) { - pr_err("Invalid create options : 0x%x\n", - le32_to_cpu(req->CreateOptions)); - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } else { - if (req->CreateOptions & FILE_SEQUENTIAL_ONLY_LE && - req->CreateOptions & FILE_RANDOM_ACCESS_LE) -@@ -2705,13 +2754,13 @@ int smb2_open(struct ksmbd_work *work) - (FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION | - FILE_RESERVE_OPFILTER_LE)) { - rc = -EOPNOTSUPP; -- goto err_out1; -+ goto err_out2; - } - - if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) { - if (req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE) { - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } else if (req->CreateOptions & FILE_NO_COMPRESSION_LE) { - req->CreateOptions = ~(FILE_NO_COMPRESSION_LE); - } -@@ -2723,21 +2772,21 @@ int smb2_open(struct ksmbd_work *work) - pr_err("Invalid create disposition : 0x%x\n", - le32_to_cpu(req->CreateDisposition)); - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } - - if (!(req->DesiredAccess & DESIRED_ACCESS_MASK)) { - pr_err("Invalid desired access : 0x%x\n", - le32_to_cpu(req->DesiredAccess)); - rc = -EACCES; -- goto err_out1; -+ goto err_out2; - } - - if (req->FileAttributes && !(req->FileAttributes & FILE_ATTRIBUTE_MASK_LE)) { - pr_err("Invalid file attribute : 0x%x\n", - le32_to_cpu(req->FileAttributes)); - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } - - if (req->CreateContextsOffset) { -@@ -2745,19 +2794,19 @@ int smb2_open(struct ksmbd_work *work) - context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER, 4); - if (IS_ERR(context)) { - rc = PTR_ERR(context); -- goto err_out1; -+ goto err_out2; - } else if (context) { - ea_buf = (struct create_ea_buf_req *)context; - if (le16_to_cpu(context->DataOffset) + - le32_to_cpu(context->DataLength) < - sizeof(struct create_ea_buf_req)) { - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } - if (req->CreateOptions & FILE_NO_EA_KNOWLEDGE_LE) { - rsp->hdr.Status = STATUS_ACCESS_DENIED; - rc = -EACCES; -- goto err_out1; -+ goto err_out2; - } - } - -@@ -2765,7 +2814,7 @@ int smb2_open(struct ksmbd_work *work) - SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST, 4); - if (IS_ERR(context)) { - rc = PTR_ERR(context); -- goto err_out1; -+ goto err_out2; - } else if (context) { - ksmbd_debug(SMB, - "get query maximal access context\n"); -@@ -2776,11 +2825,11 @@ int smb2_open(struct ksmbd_work *work) - SMB2_CREATE_TIMEWARP_REQUEST, 4); - if (IS_ERR(context)) { - rc = PTR_ERR(context); -- goto err_out1; -+ goto err_out2; - } else if (context) { - ksmbd_debug(SMB, "get timewarp context\n"); - rc = -EBADF; -- goto err_out1; -+ goto err_out2; - } - - if (tcon->posix_extensions) { -@@ -2788,7 +2837,7 @@ int smb2_open(struct ksmbd_work *work) - SMB2_CREATE_TAG_POSIX, 16); - if (IS_ERR(context)) { - rc = PTR_ERR(context); -- goto err_out1; -+ goto err_out2; - } else if (context) { - struct create_posix *posix = - (struct create_posix *)context; -@@ -2796,7 +2845,7 @@ int smb2_open(struct ksmbd_work *work) - le32_to_cpu(context->DataLength) < - sizeof(struct create_posix) - 4) { - rc = -EINVAL; -- goto err_out1; -+ goto err_out2; - } - ksmbd_debug(SMB, "get posix context\n"); - -@@ -2808,11 +2857,14 @@ int smb2_open(struct ksmbd_work *work) - - if (ksmbd_override_fsids(work)) { - rc = -ENOMEM; -- goto err_out1; -+ goto err_out2; - } - -- rc = ksmbd_vfs_kern_path(work, name, LOOKUP_NO_SYMLINKS, &path, 1); -+ rc = ksmbd_vfs_kern_path_locked(work, name, LOOKUP_NO_SYMLINKS, -+ &parent_path, &path, 1); - if (!rc) { -+ file_present = true; -+ - if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) { - /* - * If file exists with under flags, return access -@@ -2821,7 +2873,6 @@ int smb2_open(struct ksmbd_work *work) - if (req->CreateDisposition == FILE_OVERWRITE_IF_LE || - req->CreateDisposition == FILE_OPEN_IF_LE) { - rc = -EACCES; -- path_put(&path); - goto err_out; - } - -@@ -2829,26 +2880,23 @@ int smb2_open(struct ksmbd_work *work) - ksmbd_debug(SMB, - "User does not have write permission\n"); - rc = -EACCES; -- path_put(&path); - goto err_out; - } - } else if (d_is_symlink(path.dentry)) { - rc = -EACCES; -- path_put(&path); - goto err_out; - } -- } - -- if (rc) { -+ file_present = true; -+ user_ns = mnt_user_ns(path.mnt); -+ } else { - if (rc != -ENOENT) - goto err_out; - ksmbd_debug(SMB, "can not get linux path for %s, rc = %d\n", - name, rc); - rc = 0; -- } else { -- file_present = true; -- user_ns = mnt_user_ns(path.mnt); - } -+ - if (stream_name) { - if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) { - if (s_type == DATA_STREAM) { -@@ -2910,11 +2958,9 @@ int smb2_open(struct ksmbd_work *work) - if (!file_present) { - daccess = cpu_to_le32(GENERIC_ALL_FLAGS); - } else { -- rc = ksmbd_vfs_query_maximal_access(user_ns, -+ ksmbd_vfs_query_maximal_access(user_ns, - path.dentry, - &daccess); -- if (rc) -- goto err_out; - already_permitted = true; - } - maximal_access = daccess; -@@ -2935,7 +2981,8 @@ int smb2_open(struct ksmbd_work *work) - - /*create file if not present */ - if (!file_present) { -- rc = smb2_creat(work, &path, name, open_flags, posix_mode, -+ rc = smb2_creat(work, &parent_path, &path, name, open_flags, -+ posix_mode, - req->CreateOptions & FILE_DIRECTORY_FILE_LE); - if (rc) { - if (rc == -ENOENT) { -@@ -2976,15 +3023,16 @@ int smb2_open(struct ksmbd_work *work) - - if ((daccess & FILE_DELETE_LE) || - (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) { -- rc = ksmbd_vfs_may_delete(user_ns, -- path.dentry); -+ rc = inode_permission(user_ns, -+ d_inode(path.dentry->d_parent), -+ MAY_EXEC | MAY_WRITE); - if (rc) - goto err_out; - } - } - } - -- rc = ksmbd_query_inode_status(d_inode(path.dentry->d_parent)); -+ rc = ksmbd_query_inode_status(path.dentry->d_parent); - if (rc == KSMBD_INODE_STATUS_PENDING_DELETE) { - rc = -EBUSY; - goto err_out; -@@ -3040,7 +3088,7 @@ int smb2_open(struct ksmbd_work *work) - struct inode *inode = d_inode(path.dentry); - - posix_acl_rc = ksmbd_vfs_inherit_posix_acl(user_ns, -- inode, -+ &path, - d_inode(path.dentry->d_parent)); - if (posix_acl_rc) - ksmbd_debug(SMB, "inherit posix acl failed : %d\n", posix_acl_rc); -@@ -3056,7 +3104,7 @@ int smb2_open(struct ksmbd_work *work) - if (rc) { - if (posix_acl_rc) - ksmbd_vfs_set_init_posix_acl(user_ns, -- inode); -+ &path); - - if (test_share_config_flag(work->tcon->share_conf, - KSMBD_SHARE_FLAG_ACL_XATTR)) { -@@ -3096,9 +3144,10 @@ int smb2_open(struct ksmbd_work *work) - - rc = ksmbd_vfs_set_sd_xattr(conn, - user_ns, -- path.dentry, -+ &path, - pntsd, -- pntsd_size); -+ pntsd_size, -+ false); - kfree(pntsd); - if (rc) - pr_err("failed to store ntacl in xattr : %d\n", -@@ -3121,11 +3170,6 @@ int smb2_open(struct ksmbd_work *work) - - fp->attrib_only = !(req->DesiredAccess & ~(FILE_READ_ATTRIBUTES_LE | - FILE_WRITE_ATTRIBUTES_LE | FILE_SYNCHRONIZE_LE)); -- if (!S_ISDIR(file_inode(filp)->i_mode) && open_flags & O_TRUNC && -- !fp->attrib_only && !stream_name) { -- smb_break_all_oplock(work, fp); -- need_truncate = 1; -- } - - /* fp should be searchable through ksmbd_inode.m_fp_list - * after daccess, saccess, attrib_only, and stream are -@@ -3141,23 +3185,43 @@ int smb2_open(struct ksmbd_work *work) - goto err_out; - } - -+ if (file_present || created) -+ ksmbd_vfs_kern_path_unlock(&parent_path, &path); -+ -+ if (!S_ISDIR(file_inode(filp)->i_mode) && open_flags & O_TRUNC && -+ !fp->attrib_only && !stream_name) { -+ smb_break_all_oplock(work, fp); -+ need_truncate = 1; -+ } -+ -+ req_op_level = req->RequestedOplockLevel; -+ if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) -+ lc = parse_lease_state(req, S_ISDIR(file_inode(filp)->i_mode)); -+ - share_ret = ksmbd_smb_check_shared_mode(fp->filp, fp); - if (!test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_OPLOCKS) || - (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && - !(conn->vals->capabilities & SMB2_GLOBAL_CAP_LEASING))) { - if (share_ret < 0 && !S_ISDIR(file_inode(fp->filp)->i_mode)) { - rc = share_ret; -- goto err_out; -+ goto err_out1; - } - } else { - if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { -+ /* -+ * Compare parent lease using parent key. If there is no -+ * a lease that has same parent key, Send lease break -+ * notification. -+ */ -+ smb_send_parent_lease_break_noti(fp, lc); -+ - req_op_level = smb2_map_lease_to_oplock(lc->req_state); - ksmbd_debug(SMB, - "lease req for(%s) req oplock state 0x%x, lease state 0x%x\n", - name, req_op_level, lc->req_state); - rc = find_same_lease_key(sess, fp->f_ci, lc); - if (rc) -- goto err_out; -+ goto err_out1; - } else if (open_flags == O_RDONLY && - (req_op_level == SMB2_OPLOCK_LEVEL_BATCH || - req_op_level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) -@@ -3168,16 +3232,16 @@ int smb2_open(struct ksmbd_work *work) - le32_to_cpu(req->hdr.Id.SyncId.TreeId), - lc, share_ret); - if (rc < 0) -- goto err_out; -+ goto err_out1; - } - - if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) - ksmbd_fd_set_delete_on_close(fp, file_info); - - if (need_truncate) { -- rc = smb2_create_truncate(&path); -+ rc = smb2_create_truncate(&fp->filp->f_path); - if (rc) -- goto err_out; -+ goto err_out1; - } - - if (req->CreateContextsOffset) { -@@ -3187,7 +3251,7 @@ int smb2_open(struct ksmbd_work *work) - SMB2_CREATE_ALLOCATION_SIZE, 4); - if (IS_ERR(az_req)) { - rc = PTR_ERR(az_req); -- goto err_out; -+ goto err_out1; - } else if (az_req) { - loff_t alloc_size; - int err; -@@ -3196,7 +3260,7 @@ int smb2_open(struct ksmbd_work *work) - le32_to_cpu(az_req->ccontext.DataLength) < - sizeof(struct create_alloc_size_req)) { - rc = -EINVAL; -- goto err_out; -+ goto err_out1; - } - alloc_size = le64_to_cpu(az_req->AllocationSize); - ksmbd_debug(SMB, -@@ -3214,7 +3278,7 @@ int smb2_open(struct ksmbd_work *work) - context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4); - if (IS_ERR(context)) { - rc = PTR_ERR(context); -- goto err_out; -+ goto err_out1; - } else if (context) { - ksmbd_debug(SMB, "get query on disk id context\n"); - query_disk_id = 1; -@@ -3223,7 +3287,7 @@ int smb2_open(struct ksmbd_work *work) - - rc = ksmbd_vfs_getattr(&path, &stat); - if (rc) -- goto err_out; -+ goto err_out1; - - if (stat.result_mask & STATX_BTIME) - fp->create_time = ksmbd_UnixTimeToNT(stat.btime); -@@ -3266,7 +3330,7 @@ int smb2_open(struct ksmbd_work *work) - - rsp->CreateContextsOffset = 0; - rsp->CreateContextsLength = 0; -- inc_rfc1001_len(work->response_buf, 88); /* StructureSize - 1*/ -+ iov_len = offsetof(struct smb2_create_rsp, Buffer); - - /* If lease is request send lease context response */ - if (opinfo && opinfo->is_lease) { -@@ -3281,8 +3345,7 @@ int smb2_open(struct ksmbd_work *work) - create_lease_buf(rsp->Buffer, opinfo->o_lease); - le32_add_cpu(&rsp->CreateContextsLength, - conn->vals->create_lease_size); -- inc_rfc1001_len(work->response_buf, -- conn->vals->create_lease_size); -+ iov_len += conn->vals->create_lease_size; - next_ptr = &lease_ccontext->Next; - next_off = conn->vals->create_lease_size; - } -@@ -3302,8 +3365,7 @@ int smb2_open(struct ksmbd_work *work) - le32_to_cpu(maximal_access)); - le32_add_cpu(&rsp->CreateContextsLength, - conn->vals->create_mxac_size); -- inc_rfc1001_len(work->response_buf, -- conn->vals->create_mxac_size); -+ iov_len += conn->vals->create_mxac_size; - if (next_ptr) - *next_ptr = cpu_to_le32(next_off); - next_ptr = &mxac_ccontext->Next; -@@ -3321,8 +3383,7 @@ int smb2_open(struct ksmbd_work *work) - stat.ino, tcon->id); - le32_add_cpu(&rsp->CreateContextsLength, - conn->vals->create_disk_id_size); -- inc_rfc1001_len(work->response_buf, -- conn->vals->create_disk_id_size); -+ iov_len += conn->vals->create_disk_id_size; - if (next_ptr) - *next_ptr = cpu_to_le32(next_off); - next_ptr = &disk_id_ccontext->Next; -@@ -3336,8 +3397,7 @@ int smb2_open(struct ksmbd_work *work) - fp); - le32_add_cpu(&rsp->CreateContextsLength, - conn->vals->create_posix_size); -- inc_rfc1001_len(work->response_buf, -- conn->vals->create_posix_size); -+ iov_len += conn->vals->create_posix_size; - if (next_ptr) - *next_ptr = cpu_to_le32(next_off); - } -@@ -3348,10 +3408,17 @@ int smb2_open(struct ksmbd_work *work) - } - - err_out: -- if (file_present || created) -- path_put(&path); -- ksmbd_revert_fsids(work); -+ if (rc && (file_present || created)) -+ ksmbd_vfs_kern_path_unlock(&parent_path, &path); -+ - err_out1: -+ ksmbd_revert_fsids(work); -+ -+err_out2: -+ if (!rc) { -+ ksmbd_update_fstate(&work->sess->file_table, fp, FP_INITED); -+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp, iov_len); -+ } - if (rc) { - if (rc == -EINVAL) - rsp->hdr.Status = STATUS_INVALID_PARAMETER; -@@ -3525,7 +3592,7 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, - goto free_conv_name; - } - -- struct_sz = readdir_info_level_struct_sz(info_level) - 1 + conv_len; -+ struct_sz = readdir_info_level_struct_sz(info_level) + conv_len; - next_entry_offset = ALIGN(struct_sz, KSMBD_DIR_INFO_ALIGNMENT); - d_info->last_entry_off_align = next_entry_offset - struct_sz; - -@@ -3777,7 +3844,7 @@ static int reserve_populate_dentry(struct ksmbd_dir_info *d_info, - return -EOPNOTSUPP; - - conv_len = (d_info->name_len + 1) * 2; -- next_entry_offset = ALIGN(struct_sz - 1 + conv_len, -+ next_entry_offset = ALIGN(struct_sz + conv_len, - KSMBD_DIR_INFO_ALIGNMENT); - - if (next_entry_offset > d_info->out_buf_len) { -@@ -4077,7 +4144,10 @@ int smb2_query_dir(struct ksmbd_work *work) - rsp->OutputBufferOffset = cpu_to_le16(0); - rsp->OutputBufferLength = cpu_to_le32(0); - rsp->Buffer[0] = 0; -- inc_rfc1001_len(work->response_buf, 9); -+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ sizeof(struct smb2_query_directory_rsp)); -+ if (rc) -+ goto err_out; - } else { - no_buf_len: - ((struct file_directory_info *) -@@ -4089,7 +4159,11 @@ no_buf_len: - rsp->StructureSize = cpu_to_le16(9); - rsp->OutputBufferOffset = cpu_to_le16(72); - rsp->OutputBufferLength = cpu_to_le32(d_info.data_count); -- inc_rfc1001_len(work->response_buf, 8 + d_info.data_count); -+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ offsetof(struct smb2_query_directory_rsp, Buffer) + -+ d_info.data_count); -+ if (rc) -+ goto err_out; - } - - kfree(srch_ptr); -@@ -4130,27 +4204,18 @@ err_out2: - * @reqOutputBufferLength: max buffer length expected in command response - * @rsp: query info response buffer contains output buffer length - * @rsp_org: base response buffer pointer in case of chained response -- * @infoclass_size: query info class response buffer size - * - * Return: 0 on success, otherwise error - */ - static int buffer_check_err(int reqOutputBufferLength, - struct smb2_query_info_rsp *rsp, -- void *rsp_org, int infoclass_size) -+ void *rsp_org) - { - if (reqOutputBufferLength < le32_to_cpu(rsp->OutputBufferLength)) { -- if (reqOutputBufferLength < infoclass_size) { -- pr_err("Invalid Buffer Size Requested\n"); -- rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH; -- *(__be32 *)rsp_org = cpu_to_be32(sizeof(struct smb2_hdr)); -- return -EINVAL; -- } -- -- ksmbd_debug(SMB, "Buffer Overflow\n"); -- rsp->hdr.Status = STATUS_BUFFER_OVERFLOW; -- *(__be32 *)rsp_org = cpu_to_be32(sizeof(struct smb2_hdr) + -- reqOutputBufferLength); -- rsp->OutputBufferLength = cpu_to_le32(reqOutputBufferLength); -+ pr_err("Invalid Buffer Size Requested\n"); -+ rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH; -+ *(__be32 *)rsp_org = cpu_to_be32(sizeof(struct smb2_hdr)); -+ return -EINVAL; - } - return 0; - } -@@ -4169,7 +4234,6 @@ static void get_standard_info_pipe(struct smb2_query_info_rsp *rsp, - sinfo->Directory = 0; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_standard_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_standard_info)); - } - - static void get_internal_info_pipe(struct smb2_query_info_rsp *rsp, u64 num, -@@ -4183,7 +4247,6 @@ static void get_internal_info_pipe(struct smb2_query_info_rsp *rsp, u64 num, - file_info->IndexNumber = cpu_to_le64(num | (1ULL << 63)); - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_internal_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_internal_info)); - } - - static int smb2_get_info_file_pipe(struct ksmbd_session *sess, -@@ -4209,14 +4272,12 @@ static int smb2_get_info_file_pipe(struct ksmbd_session *sess, - case FILE_STANDARD_INFORMATION: - get_standard_info_pipe(rsp, rsp_org); - rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), -- rsp, rsp_org, -- FILE_STANDARD_INFORMATION_SIZE); -+ rsp, rsp_org); - break; - case FILE_INTERNAL_INFORMATION: - get_internal_info_pipe(rsp, id, rsp_org); - rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), -- rsp, rsp_org, -- FILE_INTERNAL_INFORMATION_SIZE); -+ rsp, rsp_org); - break; - default: - ksmbd_debug(SMB, "smb2_info_file_pipe for %u not supported\n", -@@ -4384,7 +4445,6 @@ done: - if (rsp_data_cnt == 0) - rsp->hdr.Status = STATUS_NO_EAS_ON_FILE; - rsp->OutputBufferLength = cpu_to_le32(rsp_data_cnt); -- inc_rfc1001_len(rsp_org, rsp_data_cnt); - out: - kvfree(xattr_list); - return rc; -@@ -4399,7 +4459,6 @@ static void get_file_access_info(struct smb2_query_info_rsp *rsp, - file_info->AccessFlags = fp->daccess; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_access_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_access_info)); - } - - static int get_file_basic_info(struct smb2_query_info_rsp *rsp, -@@ -4429,7 +4488,6 @@ static int get_file_basic_info(struct smb2_query_info_rsp *rsp, - basic_info->Pad1 = 0; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_basic_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_basic_info)); - return 0; - } - -@@ -4454,8 +4512,6 @@ static void get_file_standard_info(struct smb2_query_info_rsp *rsp, - sinfo->Directory = S_ISDIR(stat.mode) ? 1 : 0; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_standard_info)); -- inc_rfc1001_len(rsp_org, -- sizeof(struct smb2_file_standard_info)); - } - - static void get_file_alignment_info(struct smb2_query_info_rsp *rsp, -@@ -4467,8 +4523,6 @@ static void get_file_alignment_info(struct smb2_query_info_rsp *rsp, - file_info->AlignmentRequirement = 0; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_alignment_info)); -- inc_rfc1001_len(rsp_org, -- sizeof(struct smb2_file_alignment_info)); - } - - static int get_file_all_info(struct ksmbd_work *work, -@@ -4532,7 +4586,6 @@ static int get_file_all_info(struct ksmbd_work *work, - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_all_info) + conv_len - 1); - kfree(filename); -- inc_rfc1001_len(rsp_org, le32_to_cpu(rsp->OutputBufferLength)); - return 0; - } - -@@ -4555,7 +4608,6 @@ static void get_file_alternate_info(struct ksmbd_work *work, - file_info->FileNameLength = cpu_to_le32(conv_len); - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_alt_name_info) + conv_len); -- inc_rfc1001_len(rsp_org, le32_to_cpu(rsp->OutputBufferLength)); - } - - static void get_file_stream_info(struct ksmbd_work *work, -@@ -4655,7 +4707,6 @@ out: - kvfree(xattr_list); - - rsp->OutputBufferLength = cpu_to_le32(nbytes); -- inc_rfc1001_len(rsp_org, nbytes); - } - - static void get_file_internal_info(struct smb2_query_info_rsp *rsp, -@@ -4670,7 +4721,6 @@ static void get_file_internal_info(struct smb2_query_info_rsp *rsp, - file_info->IndexNumber = cpu_to_le64(stat.ino); - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_internal_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_internal_info)); - } - - static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, -@@ -4706,7 +4756,6 @@ static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, - file_info->Reserved = cpu_to_le32(0); - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_ntwrk_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_ntwrk_info)); - return 0; - } - -@@ -4718,7 +4767,6 @@ static void get_file_ea_info(struct smb2_query_info_rsp *rsp, void *rsp_org) - file_info->EASize = 0; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_ea_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_ea_info)); - } - - static void get_file_position_info(struct smb2_query_info_rsp *rsp, -@@ -4730,7 +4778,6 @@ static void get_file_position_info(struct smb2_query_info_rsp *rsp, - file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos); - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_pos_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_pos_info)); - } - - static void get_file_mode_info(struct smb2_query_info_rsp *rsp, -@@ -4742,7 +4789,6 @@ static void get_file_mode_info(struct smb2_query_info_rsp *rsp, - file_info->Mode = fp->coption & FILE_MODE_INFO_MASK; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_mode_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_mode_info)); - } - - static void get_file_compression_info(struct smb2_query_info_rsp *rsp, -@@ -4764,7 +4810,6 @@ static void get_file_compression_info(struct smb2_query_info_rsp *rsp, - - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_comp_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_comp_info)); - } - - static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp, -@@ -4783,11 +4828,10 @@ static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp, - file_info->ReparseTag = 0; - rsp->OutputBufferLength = - cpu_to_le32(sizeof(struct smb2_file_attr_tag_info)); -- inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_attr_tag_info)); - return 0; - } - --static int find_file_posix_info(struct smb2_query_info_rsp *rsp, -+static void find_file_posix_info(struct smb2_query_info_rsp *rsp, - struct ksmbd_file *fp, void *rsp_org) - { - struct smb311_posix_qinfo *file_info; -@@ -4825,8 +4869,6 @@ static int find_file_posix_info(struct smb2_query_info_rsp *rsp, - SIDUNIX_GROUP, (struct smb_sid *)&file_info->Sids[16]); - - rsp->OutputBufferLength = cpu_to_le32(out_buf_len); -- inc_rfc1001_len(rsp_org, out_buf_len); -- return out_buf_len; - } - - static int smb2_get_info_file(struct ksmbd_work *work, -@@ -4836,7 +4878,6 @@ static int smb2_get_info_file(struct ksmbd_work *work, - struct ksmbd_file *fp; - int fileinfoclass = 0; - int rc = 0; -- int file_infoclass_size; - unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; - - if (test_share_config_flag(work->tcon->share_conf, -@@ -4869,85 +4910,69 @@ static int smb2_get_info_file(struct ksmbd_work *work, - switch (fileinfoclass) { - case FILE_ACCESS_INFORMATION: - get_file_access_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_ACCESS_INFORMATION_SIZE; - break; - - case FILE_BASIC_INFORMATION: - rc = get_file_basic_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_BASIC_INFORMATION_SIZE; - break; - - case FILE_STANDARD_INFORMATION: - get_file_standard_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_STANDARD_INFORMATION_SIZE; - break; - - case FILE_ALIGNMENT_INFORMATION: - get_file_alignment_info(rsp, work->response_buf); -- file_infoclass_size = FILE_ALIGNMENT_INFORMATION_SIZE; - break; - - case FILE_ALL_INFORMATION: - rc = get_file_all_info(work, rsp, fp, work->response_buf); -- file_infoclass_size = FILE_ALL_INFORMATION_SIZE; - break; - - case FILE_ALTERNATE_NAME_INFORMATION: - get_file_alternate_info(work, rsp, fp, work->response_buf); -- file_infoclass_size = FILE_ALTERNATE_NAME_INFORMATION_SIZE; - break; - - case FILE_STREAM_INFORMATION: - get_file_stream_info(work, rsp, fp, work->response_buf); -- file_infoclass_size = FILE_STREAM_INFORMATION_SIZE; - break; - - case FILE_INTERNAL_INFORMATION: - get_file_internal_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_INTERNAL_INFORMATION_SIZE; - break; - - case FILE_NETWORK_OPEN_INFORMATION: - rc = get_file_network_open_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_NETWORK_OPEN_INFORMATION_SIZE; - break; - - case FILE_EA_INFORMATION: - get_file_ea_info(rsp, work->response_buf); -- file_infoclass_size = FILE_EA_INFORMATION_SIZE; - break; - - case FILE_FULL_EA_INFORMATION: - rc = smb2_get_ea(work, fp, req, rsp, work->response_buf); -- file_infoclass_size = FILE_FULL_EA_INFORMATION_SIZE; - break; - - case FILE_POSITION_INFORMATION: - get_file_position_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_POSITION_INFORMATION_SIZE; - break; - - case FILE_MODE_INFORMATION: - get_file_mode_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_MODE_INFORMATION_SIZE; - break; - - case FILE_COMPRESSION_INFORMATION: - get_file_compression_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_COMPRESSION_INFORMATION_SIZE; - break; - - case FILE_ATTRIBUTE_TAG_INFORMATION: - rc = get_file_attribute_tag_info(rsp, fp, work->response_buf); -- file_infoclass_size = FILE_ATTRIBUTE_TAG_INFORMATION_SIZE; - break; - case SMB_FIND_FILE_POSIX_INFO: - if (!work->tcon->posix_extensions) { - pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); - rc = -EOPNOTSUPP; - } else { -- file_infoclass_size = find_file_posix_info(rsp, fp, -- work->response_buf); -+ find_file_posix_info(rsp, fp, work->response_buf); - } - break; - default: -@@ -4957,8 +4982,7 @@ static int smb2_get_info_file(struct ksmbd_work *work, - } - if (!rc) - rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), -- rsp, work->response_buf, -- file_infoclass_size); -+ rsp, work->response_buf); - ksmbd_fd_put(work, fp); - return rc; - } -@@ -4974,7 +4998,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - struct kstatfs stfs; - struct path path; - int rc = 0, len; -- int fs_infoclass_size = 0; - - if (!share->path) - return -EIO; -@@ -5004,8 +5027,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->DeviceType = cpu_to_le32(stfs.f_type); - info->DeviceCharacteristics = cpu_to_le32(0x00000020); - rsp->OutputBufferLength = cpu_to_le32(8); -- inc_rfc1001_len(work->response_buf, 8); -- fs_infoclass_size = FS_DEVICE_INFORMATION_SIZE; - break; - } - case FS_ATTRIBUTE_INFORMATION: -@@ -5034,8 +5055,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->FileSystemNameLen = cpu_to_le32(len); - sz = sizeof(struct filesystem_attribute_info) - 2 + len; - rsp->OutputBufferLength = cpu_to_le32(sz); -- inc_rfc1001_len(work->response_buf, sz); -- fs_infoclass_size = FS_ATTRIBUTE_INFORMATION_SIZE; - break; - } - case FS_VOLUME_INFORMATION: -@@ -5062,8 +5081,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->Reserved = 0; - sz = sizeof(struct filesystem_vol_info) - 2 + len; - rsp->OutputBufferLength = cpu_to_le32(sz); -- inc_rfc1001_len(work->response_buf, sz); -- fs_infoclass_size = FS_VOLUME_INFORMATION_SIZE; - break; - } - case FS_SIZE_INFORMATION: -@@ -5076,8 +5093,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->SectorsPerAllocationUnit = cpu_to_le32(1); - info->BytesPerSector = cpu_to_le32(stfs.f_bsize); - rsp->OutputBufferLength = cpu_to_le32(24); -- inc_rfc1001_len(work->response_buf, 24); -- fs_infoclass_size = FS_SIZE_INFORMATION_SIZE; - break; - } - case FS_FULL_SIZE_INFORMATION: -@@ -5093,8 +5108,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->SectorsPerAllocationUnit = cpu_to_le32(1); - info->BytesPerSector = cpu_to_le32(stfs.f_bsize); - rsp->OutputBufferLength = cpu_to_le32(32); -- inc_rfc1001_len(work->response_buf, 32); -- fs_infoclass_size = FS_FULL_SIZE_INFORMATION_SIZE; - break; - } - case FS_OBJECT_ID_INFORMATION: -@@ -5114,8 +5127,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->extended_info.rel_date = 0; - memcpy(info->extended_info.version_string, "1.1.0", strlen("1.1.0")); - rsp->OutputBufferLength = cpu_to_le32(64); -- inc_rfc1001_len(work->response_buf, 64); -- fs_infoclass_size = FS_OBJECT_ID_INFORMATION_SIZE; - break; - } - case FS_SECTOR_SIZE_INFORMATION: -@@ -5137,8 +5148,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->ByteOffsetForSectorAlignment = 0; - info->ByteOffsetForPartitionAlignment = 0; - rsp->OutputBufferLength = cpu_to_le32(28); -- inc_rfc1001_len(work->response_buf, 28); -- fs_infoclass_size = FS_SECTOR_SIZE_INFORMATION_SIZE; - break; - } - case FS_CONTROL_INFORMATION: -@@ -5159,8 +5168,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->DefaultQuotaLimit = cpu_to_le64(SMB2_NO_FID); - info->Padding = 0; - rsp->OutputBufferLength = cpu_to_le32(48); -- inc_rfc1001_len(work->response_buf, 48); -- fs_infoclass_size = FS_CONTROL_INFORMATION_SIZE; - break; - } - case FS_POSIX_INFORMATION: -@@ -5180,8 +5187,6 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - info->TotalFileNodes = cpu_to_le64(stfs.f_files); - info->FreeFileNodes = cpu_to_le64(stfs.f_ffree); - rsp->OutputBufferLength = cpu_to_le32(56); -- inc_rfc1001_len(work->response_buf, 56); -- fs_infoclass_size = FS_POSIX_INFORMATION_SIZE; - } - break; - } -@@ -5190,8 +5195,7 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, - return -EOPNOTSUPP; - } - rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength), -- rsp, work->response_buf, -- fs_infoclass_size); -+ rsp, work->response_buf); - path_put(&path); - return rc; - } -@@ -5225,7 +5229,6 @@ static int smb2_get_info_sec(struct ksmbd_work *work, - - secdesclen = sizeof(struct smb_ntsd); - rsp->OutputBufferLength = cpu_to_le32(secdesclen); -- inc_rfc1001_len(work->response_buf, secdesclen); - - return 0; - } -@@ -5270,7 +5273,6 @@ static int smb2_get_info_sec(struct ksmbd_work *work, - return rc; - - rsp->OutputBufferLength = cpu_to_le32(secdesclen); -- inc_rfc1001_len(work->response_buf, secdesclen); - return 0; - } - -@@ -5309,6 +5311,14 @@ int smb2_query_info(struct ksmbd_work *work) - rc = -EOPNOTSUPP; - } - -+ if (!rc) { -+ rsp->StructureSize = cpu_to_le16(9); -+ rsp->OutputBufferOffset = cpu_to_le16(72); -+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ offsetof(struct smb2_query_info_rsp, Buffer) + -+ le32_to_cpu(rsp->OutputBufferLength)); -+ } -+ - if (rc < 0) { - if (rc == -EACCES) - rsp->hdr.Status = STATUS_ACCESS_DENIED; -@@ -5316,6 +5326,8 @@ int smb2_query_info(struct ksmbd_work *work) - rsp->hdr.Status = STATUS_FILE_CLOSED; - else if (rc == -EIO) - rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR; -+ else if (rc == -ENOMEM) -+ rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; - else if (rc == -EOPNOTSUPP || rsp->hdr.Status == 0) - rsp->hdr.Status = STATUS_INVALID_INFO_CLASS; - smb2_set_err_rsp(work); -@@ -5324,9 +5336,6 @@ int smb2_query_info(struct ksmbd_work *work) - rc); - return rc; - } -- rsp->StructureSize = cpu_to_le16(9); -- rsp->OutputBufferOffset = cpu_to_le16(72); -- inc_rfc1001_len(work->response_buf, 8); - return 0; - } - -@@ -5357,8 +5366,9 @@ static noinline int smb2_close_pipe(struct ksmbd_work *work) - rsp->AllocationSize = 0; - rsp->EndOfFile = 0; - rsp->Attributes = 0; -- inc_rfc1001_len(work->response_buf, 60); -- return 0; -+ -+ return ksmbd_iov_pin_rsp(work, (void *)rsp, -+ sizeof(struct smb2_close_rsp)); - } - - /** -@@ -5463,15 +5473,17 @@ int smb2_close(struct ksmbd_work *work) - - err = ksmbd_close_fd(work, volatile_id); - out: -+ if (!err) -+ err = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ sizeof(struct smb2_close_rsp)); -+ - if (err) { - if (rsp->hdr.Status == 0) - rsp->hdr.Status = STATUS_FILE_CLOSED; - smb2_set_err_rsp(work); -- } else { -- inc_rfc1001_len(work->response_buf, 60); - } - -- return 0; -+ return err; - } - - /** -@@ -5489,50 +5501,24 @@ int smb2_echo(struct ksmbd_work *work) - - rsp->StructureSize = cpu_to_le16(4); - rsp->Reserved = 0; -- inc_rfc1001_len(work->response_buf, 4); -- return 0; -+ return ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_echo_rsp)); - } - - static int smb2_rename(struct ksmbd_work *work, - struct ksmbd_file *fp, -- struct user_namespace *user_ns, - struct smb2_file_rename_info *file_info, - struct nls_table *local_nls) - { - struct ksmbd_share_config *share = fp->tcon->share_conf; -- char *new_name = NULL, *abs_oldname = NULL, *old_name = NULL; -- char *pathname = NULL; -- struct path path; -- bool file_present = true; -- int rc; -+ char *new_name = NULL; -+ int rc, flags = 0; - - ksmbd_debug(SMB, "setting FILE_RENAME_INFO\n"); -- pathname = kmalloc(PATH_MAX, GFP_KERNEL); -- if (!pathname) -- return -ENOMEM; -- -- abs_oldname = file_path(fp->filp, pathname, PATH_MAX); -- if (IS_ERR(abs_oldname)) { -- rc = -EINVAL; -- goto out; -- } -- old_name = strrchr(abs_oldname, '/'); -- if (old_name && old_name[1] != '\0') { -- old_name++; -- } else { -- ksmbd_debug(SMB, "can't get last component in path %s\n", -- abs_oldname); -- rc = -ENOENT; -- goto out; -- } -- - new_name = smb2_get_name(file_info->FileName, - le32_to_cpu(file_info->FileNameLength), - local_nls); -- if (IS_ERR(new_name)) { -- rc = PTR_ERR(new_name); -- goto out; -- } -+ if (IS_ERR(new_name)) -+ return PTR_ERR(new_name); - - if (strchr(new_name, ':')) { - int s_type; -@@ -5558,10 +5544,10 @@ static int smb2_rename(struct ksmbd_work *work, - if (rc) - goto out; - -- rc = ksmbd_vfs_setxattr(user_ns, -- fp->filp->f_path.dentry, -+ rc = ksmbd_vfs_setxattr(file_mnt_user_ns(fp->filp), -+ &fp->filp->f_path, - xattr_stream_name, -- NULL, 0, 0); -+ NULL, 0, 0, true); - if (rc < 0) { - pr_err("failed to store stream name in xattr: %d\n", - rc); -@@ -5573,47 +5559,18 @@ static int smb2_rename(struct ksmbd_work *work, - } - - ksmbd_debug(SMB, "new name %s\n", new_name); -- rc = ksmbd_vfs_kern_path(work, new_name, LOOKUP_NO_SYMLINKS, &path, 1); -- if (rc) { -- if (rc != -ENOENT) -- goto out; -- file_present = false; -- } else { -- path_put(&path); -- } -- - if (ksmbd_share_veto_filename(share, new_name)) { - rc = -ENOENT; - ksmbd_debug(SMB, "Can't rename vetoed file: %s\n", new_name); - goto out; - } - -- if (file_info->ReplaceIfExists) { -- if (file_present) { -- rc = ksmbd_vfs_remove_file(work, new_name); -- if (rc) { -- if (rc != -ENOTEMPTY) -- rc = -EINVAL; -- ksmbd_debug(SMB, "cannot delete %s, rc %d\n", -- new_name, rc); -- goto out; -- } -- } -- } else { -- if (file_present && -- strncmp(old_name, path.dentry->d_name.name, strlen(old_name))) { -- rc = -EEXIST; -- ksmbd_debug(SMB, -- "cannot rename already existing file\n"); -- goto out; -- } -- } -+ if (!file_info->ReplaceIfExists) -+ flags = RENAME_NOREPLACE; - -- rc = ksmbd_vfs_fp_rename(work, fp, new_name); -+ rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags); - out: -- kfree(pathname); -- if (!IS_ERR(new_name)) -- kfree(new_name); -+ kfree(new_name); - return rc; - } - -@@ -5624,8 +5581,8 @@ static int smb2_create_link(struct ksmbd_work *work, - struct nls_table *local_nls) - { - char *link_name = NULL, *target_name = NULL, *pathname = NULL; -- struct path path; -- bool file_present = true; -+ struct path path, parent_path; -+ bool file_present = false; - int rc; - - if (buf_len < (u64)sizeof(struct smb2_file_link_info) + -@@ -5653,18 +5610,17 @@ static int smb2_create_link(struct ksmbd_work *work, - } - - ksmbd_debug(SMB, "target name is %s\n", target_name); -- rc = ksmbd_vfs_kern_path(work, link_name, LOOKUP_NO_SYMLINKS, &path, 0); -+ rc = ksmbd_vfs_kern_path_locked(work, link_name, LOOKUP_NO_SYMLINKS, -+ &parent_path, &path, 0); - if (rc) { - if (rc != -ENOENT) - goto out; -- file_present = false; -- } else { -- path_put(&path); -- } -+ } else -+ file_present = true; - - if (file_info->ReplaceIfExists) { - if (file_present) { -- rc = ksmbd_vfs_remove_file(work, link_name); -+ rc = ksmbd_vfs_remove_file(work, &path); - if (rc) { - rc = -EINVAL; - ksmbd_debug(SMB, "cannot delete %s\n", -@@ -5684,6 +5640,9 @@ static int smb2_create_link(struct ksmbd_work *work, - if (rc) - rc = -EINVAL; - out: -+ if (file_present) -+ ksmbd_vfs_kern_path_unlock(&parent_path, &path); -+ - if (!IS_ERR(link_name)) - kfree(link_name); - kfree(pathname); -@@ -5750,8 +5709,8 @@ static int set_file_basic_info(struct ksmbd_file *fp, - da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME | - XATTR_DOSINFO_ITIME; - -- rc = ksmbd_vfs_set_dos_attrib_xattr(user_ns, -- filp->f_path.dentry, &da); -+ rc = ksmbd_vfs_set_dos_attrib_xattr(user_ns, &filp->f_path, &da, -+ true); - if (rc) - ksmbd_debug(SMB, - "failed to restore file attribute in EA\n"); -@@ -5861,12 +5820,6 @@ static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp, - struct smb2_file_rename_info *rename_info, - unsigned int buf_len) - { -- struct user_namespace *user_ns; -- struct ksmbd_file *parent_fp; -- struct dentry *parent; -- struct dentry *dentry = fp->filp->f_path.dentry; -- int ret; -- - if (!(fp->daccess & FILE_DELETE_LE)) { - pr_err("no right to delete : 0x%x\n", fp->daccess); - return -EACCES; -@@ -5876,32 +5829,10 @@ static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp, - le32_to_cpu(rename_info->FileNameLength)) - return -EINVAL; - -- user_ns = file_mnt_user_ns(fp->filp); -- if (ksmbd_stream_fd(fp)) -- goto next; -- -- parent = dget_parent(dentry); -- ret = ksmbd_vfs_lock_parent(user_ns, parent, dentry); -- if (ret) { -- dput(parent); -- return ret; -- } -- -- parent_fp = ksmbd_lookup_fd_inode(d_inode(parent)); -- inode_unlock(d_inode(parent)); -- dput(parent); -+ if (!le32_to_cpu(rename_info->FileNameLength)) -+ return -EINVAL; - -- if (parent_fp) { -- if (parent_fp->daccess & FILE_DELETE_LE) { -- pr_err("parent dir is opened with delete access\n"); -- ksmbd_fd_put(work, parent_fp); -- return -ESHARE; -- } -- ksmbd_fd_put(work, parent_fp); -- } --next: -- return smb2_rename(work, fp, user_ns, rename_info, -- work->conn->local_nls); -+ return smb2_rename(work, fp, rename_info, work->conn->local_nls); - } - - static int set_file_disposition_info(struct ksmbd_file *fp, -@@ -6091,7 +6022,7 @@ static int smb2_set_info_sec(struct ksmbd_file *fp, int addition_info, - fp->saccess |= FILE_SHARE_DELETE_LE; - - return set_info_sec(fp->conn, fp->tcon, &fp->filp->f_path, pntsd, -- buf_len, false); -+ buf_len, false, true); - } - - /** -@@ -6161,7 +6092,10 @@ int smb2_set_info(struct ksmbd_work *work) - goto err_out; - - rsp->StructureSize = cpu_to_le16(2); -- inc_rfc1001_len(work->response_buf, 2); -+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ sizeof(struct smb2_set_info_rsp)); -+ if (rc) -+ goto err_out; - ksmbd_fd_put(work, fp); - return 0; - -@@ -6208,28 +6142,36 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) - - id = req->VolatileFileId; - -- inc_rfc1001_len(work->response_buf, 16); - rpc_resp = ksmbd_rpc_read(work->sess, id); - if (rpc_resp) { -+ void *aux_payload_buf; -+ - if (rpc_resp->flags != KSMBD_RPC_OK) { - err = -EINVAL; - goto out; - } - -- work->aux_payload_buf = -- kvmalloc(rpc_resp->payload_sz, GFP_KERNEL | __GFP_ZERO); -- if (!work->aux_payload_buf) { -+ aux_payload_buf = -+ kvmalloc(rpc_resp->payload_sz, GFP_KERNEL); -+ if (!aux_payload_buf) { - err = -ENOMEM; - goto out; - } - -- memcpy(work->aux_payload_buf, rpc_resp->payload, -- rpc_resp->payload_sz); -+ memcpy(aux_payload_buf, rpc_resp->payload, rpc_resp->payload_sz); - - nbytes = rpc_resp->payload_sz; -- work->resp_hdr_sz = get_rfc1002_len(work->response_buf) + 4; -- work->aux_payload_sz = nbytes; -+ err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, -+ offsetof(struct smb2_read_rsp, Buffer), -+ aux_payload_buf, nbytes); -+ if (err) -+ goto out; - kvfree(rpc_resp); -+ } else { -+ err = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ offsetof(struct smb2_read_rsp, Buffer)); -+ if (err) -+ goto out; - } - - rsp->StructureSize = cpu_to_le16(17); -@@ -6238,7 +6180,6 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) - rsp->DataLength = cpu_to_le32(nbytes); - rsp->DataRemaining = 0; - rsp->Flags = 0; -- inc_rfc1001_len(work->response_buf, nbytes); - return 0; - - out: -@@ -6312,13 +6253,8 @@ int smb2_read(struct ksmbd_work *work) - int err = 0; - bool is_rdma_channel = false; - unsigned int max_read_size = conn->vals->max_read_size; -- -- WORK_BUFFERS(work, req, rsp); -- if (work->next_smb2_rcv_hdr_off) { -- work->send_no_response = 1; -- err = -EOPNOTSUPP; -- goto out; -- } -+ unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; -+ void *aux_payload_buf; - - if (test_share_config_flag(work->tcon->share_conf, - KSMBD_SHARE_FLAG_PIPE)) { -@@ -6326,6 +6262,25 @@ int smb2_read(struct ksmbd_work *work) - return smb2_read_pipe(work); - } - -+ if (work->next_smb2_rcv_hdr_off) { -+ req = ksmbd_req_buf_next(work); -+ rsp = ksmbd_resp_buf_next(work); -+ if (!has_file_id(req->VolatileFileId)) { -+ ksmbd_debug(SMB, "Compound request set FID = %llu\n", -+ work->compound_fid); -+ id = work->compound_fid; -+ pid = work->compound_pfid; -+ } -+ } else { -+ req = smb2_get_msg(work->request_buf); -+ rsp = smb2_get_msg(work->response_buf); -+ } -+ -+ if (!has_file_id(id)) { -+ id = req->VolatileFileId; -+ pid = req->PersistentFileId; -+ } -+ - if (req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE || - req->Channel == SMB2_CHANNEL_RDMA_V1) { - is_rdma_channel = true; -@@ -6348,7 +6303,7 @@ int smb2_read(struct ksmbd_work *work) - goto out; - } - -- fp = ksmbd_lookup_fd_slow(work, req->VolatileFileId, req->PersistentFileId); -+ fp = ksmbd_lookup_fd_slow(work, id, pid); - if (!fp) { - err = -ENOENT; - goto out; -@@ -6374,21 +6329,20 @@ int smb2_read(struct ksmbd_work *work) - ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n", - fp->filp, offset, length); - -- work->aux_payload_buf = kvmalloc(length, GFP_KERNEL | __GFP_ZERO); -- if (!work->aux_payload_buf) { -+ aux_payload_buf = kvzalloc(length, GFP_KERNEL); -+ if (!aux_payload_buf) { - err = -ENOMEM; - goto out; - } - -- nbytes = ksmbd_vfs_read(work, fp, length, &offset); -+ nbytes = ksmbd_vfs_read(work, fp, length, &offset, aux_payload_buf); - if (nbytes < 0) { - err = nbytes; - goto out; - } - - if ((nbytes == 0 && length != 0) || nbytes < mincount) { -- kvfree(work->aux_payload_buf); -- work->aux_payload_buf = NULL; -+ kvfree(aux_payload_buf); - rsp->hdr.Status = STATUS_END_OF_FILE; - smb2_set_err_rsp(work); - ksmbd_fd_put(work, fp); -@@ -6401,11 +6355,10 @@ int smb2_read(struct ksmbd_work *work) - if (is_rdma_channel == true) { - /* write data to the client using rdma channel */ - remain_bytes = smb2_read_rdma_channel(work, req, -- work->aux_payload_buf, -+ aux_payload_buf, - nbytes); -- kvfree(work->aux_payload_buf); -- work->aux_payload_buf = NULL; -- -+ kvfree(aux_payload_buf); -+ aux_payload_buf = NULL; - nbytes = 0; - if (remain_bytes < 0) { - err = (int)remain_bytes; -@@ -6419,10 +6372,11 @@ int smb2_read(struct ksmbd_work *work) - rsp->DataLength = cpu_to_le32(nbytes); - rsp->DataRemaining = cpu_to_le32(remain_bytes); - rsp->Flags = 0; -- inc_rfc1001_len(work->response_buf, 16); -- work->resp_hdr_sz = get_rfc1002_len(work->response_buf) + 4; -- work->aux_payload_sz = nbytes; -- inc_rfc1001_len(work->response_buf, nbytes); -+ err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, -+ offsetof(struct smb2_read_rsp, Buffer), -+ aux_payload_buf, nbytes); -+ if (err) -+ goto out; - ksmbd_fd_put(work, fp); - return 0; - -@@ -6505,8 +6459,8 @@ static noinline int smb2_write_pipe(struct ksmbd_work *work) - rsp->DataLength = cpu_to_le32(length); - rsp->DataRemaining = 0; - rsp->Reserved2 = 0; -- inc_rfc1001_len(work->response_buf, 16); -- return 0; -+ err = ksmbd_iov_pin_rsp(work, (void *)rsp, -+ offsetof(struct smb2_write_rsp, Buffer)); - out: - if (err) { - rsp->hdr.Status = STATUS_INVALID_HANDLE; -@@ -6525,7 +6479,7 @@ static ssize_t smb2_write_rdma_channel(struct ksmbd_work *work, - int ret; - ssize_t nbytes; - -- data_buf = kvmalloc(length, GFP_KERNEL | __GFP_ZERO); -+ data_buf = kvzalloc(length, GFP_KERNEL); - if (!data_buf) - return -ENOMEM; - -@@ -6662,7 +6616,9 @@ int smb2_write(struct ksmbd_work *work) - rsp->DataLength = cpu_to_le32(nbytes); - rsp->DataRemaining = 0; - rsp->Reserved2 = 0; -- inc_rfc1001_len(work->response_buf, 16); -+ err = ksmbd_iov_pin_rsp(work, rsp, offsetof(struct smb2_write_rsp, Buffer)); -+ if (err) -+ goto out; - ksmbd_fd_put(work, fp); - return 0; - -@@ -6709,15 +6665,11 @@ int smb2_flush(struct ksmbd_work *work) - - rsp->StructureSize = cpu_to_le16(4); - rsp->Reserved = 0; -- inc_rfc1001_len(work->response_buf, 4); -- return 0; -+ return ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_flush_rsp)); - - out: -- if (err) { -- rsp->hdr.Status = STATUS_INVALID_HANDLE; -- smb2_set_err_rsp(work); -- } -- -+ rsp->hdr.Status = STATUS_INVALID_HANDLE; -+ smb2_set_err_rsp(work); - return err; - } - -@@ -6843,7 +6795,7 @@ static int smb2_set_flock_flags(struct file_lock *flock, int flags) - case SMB2_LOCKFLAG_UNLOCK: - ksmbd_debug(SMB, "received unlock request\n"); - flock->fl_type = F_UNLCK; -- cmd = 0; -+ cmd = F_SETLK; - break; - } - -@@ -6949,6 +6901,7 @@ int smb2_lock(struct ksmbd_work *work) - if (lock_start > U64_MAX - lock_length) { - pr_err("Invalid lock range requested\n"); - rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE; -+ locks_free_lock(flock); - goto out; - } - -@@ -6968,6 +6921,7 @@ int smb2_lock(struct ksmbd_work *work) - "the end offset(%llx) is smaller than the start offset(%llx)\n", - flock->fl_end, flock->fl_start); - rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE; -+ locks_free_lock(flock); - goto out; - } - -@@ -6979,6 +6933,7 @@ int smb2_lock(struct ksmbd_work *work) - flock->fl_type != F_UNLCK) { - pr_err("conflict two locks in one request\n"); - err = -EINVAL; -+ locks_free_lock(flock); - goto out; - } - } -@@ -6987,6 +6942,7 @@ int smb2_lock(struct ksmbd_work *work) - smb_lock = smb2_lock_init(flock, cmd, flags, &lock_list); - if (!smb_lock) { - err = -EINVAL; -+ locks_free_lock(flock); - goto out; - } - } -@@ -7118,10 +7074,6 @@ skip: - - ksmbd_debug(SMB, - "would have to wait for getting lock\n"); -- spin_lock(&work->conn->llist_lock); -- list_add_tail(&smb_lock->clist, -- &work->conn->lock_list); -- spin_unlock(&work->conn->llist_lock); - list_add(&smb_lock->llist, &rollback_list); - - argv = kmalloc(sizeof(void *), GFP_KERNEL); -@@ -7147,19 +7099,12 @@ skip: - - ksmbd_vfs_posix_lock_wait(flock); - -- spin_lock(&work->conn->request_lock); - spin_lock(&fp->f_lock); - list_del(&work->fp_entry); -- work->cancel_fn = NULL; -- kfree(argv); - spin_unlock(&fp->f_lock); -- spin_unlock(&work->conn->request_lock); - - if (work->state != KSMBD_WORK_ACTIVE) { - list_del(&smb_lock->llist); -- spin_lock(&work->conn->llist_lock); -- list_del(&smb_lock->clist); -- spin_unlock(&work->conn->llist_lock); - locks_free_lock(flock); - - if (work->state == KSMBD_WORK_CANCELLED) { -@@ -7171,8 +7116,7 @@ skip: - work->send_no_response = 1; - goto out; - } -- init_smb2_rsp_hdr(work); -- smb2_set_err_rsp(work); -+ - rsp->hdr.Status = - STATUS_RANGE_NOT_LOCKED; - kfree(smb_lock); -@@ -7180,19 +7124,16 @@ skip: - } - - list_del(&smb_lock->llist); -- spin_lock(&work->conn->llist_lock); -- list_del(&smb_lock->clist); -- spin_unlock(&work->conn->llist_lock); -- -+ release_async_work(work); - goto retry; - } else if (!rc) { -+ list_add(&smb_lock->llist, &rollback_list); - spin_lock(&work->conn->llist_lock); - list_add_tail(&smb_lock->clist, - &work->conn->lock_list); - list_add_tail(&smb_lock->flist, - &fp->lock_list); - spin_unlock(&work->conn->llist_lock); -- list_add(&smb_lock->llist, &rollback_list); - ksmbd_debug(SMB, "successful in taking lock\n"); - } else { - goto out; -@@ -7207,7 +7148,10 @@ skip: - ksmbd_debug(SMB, "successful in taking lock\n"); - rsp->hdr.Status = STATUS_SUCCESS; - rsp->Reserved = 0; -- inc_rfc1001_len(work->response_buf, 4); -+ err = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lock_rsp)); -+ if (err) -+ goto out; -+ - ksmbd_fd_put(work, fp); - return 0; - -@@ -7226,7 +7170,7 @@ out: - rlock->fl_start = smb_lock->start; - rlock->fl_end = smb_lock->end; - -- rc = vfs_lock_file(filp, 0, rlock, NULL); -+ rc = vfs_lock_file(filp, F_SETLK, rlock, NULL); - if (rc) - pr_err("rollback unlock fail : %d\n", rc); - -@@ -7648,7 +7592,8 @@ static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id, - - da.attr = le32_to_cpu(fp->f_ci->m_fattr); - ret = ksmbd_vfs_set_dos_attrib_xattr(user_ns, -- fp->filp->f_path.dentry, &da); -+ &fp->filp->f_path, -+ &da, true); - if (ret) - fp->f_ci->m_fattr = old_fattr; - } -@@ -8003,9 +7948,9 @@ dup_ext_out: - rsp->Reserved = cpu_to_le16(0); - rsp->Flags = cpu_to_le32(0); - rsp->Reserved2 = cpu_to_le32(0); -- inc_rfc1001_len(work->response_buf, 48 + nbytes); -- -- return 0; -+ ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_ioctl_rsp) + nbytes); -+ if (!ret) -+ return ret; - - out: - if (ret == -EACCES) -@@ -8140,8 +8085,9 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work) - rsp->Reserved2 = 0; - rsp->VolatileFid = volatile_id; - rsp->PersistentFid = persistent_id; -- inc_rfc1001_len(work->response_buf, 24); -- return; -+ ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_oplock_break)); -+ if (!ret) -+ return; - - err_out: - opinfo->op_state = OPLOCK_STATE_NONE; -@@ -8273,6 +8219,11 @@ static void smb21_lease_break_ack(struct ksmbd_work *work) - le32_to_cpu(req->LeaseState)); - } - -+ if (ret < 0) { -+ rsp->hdr.Status = err; -+ goto err_out; -+ } -+ - lease_state = lease->state; - opinfo->op_state = OPLOCK_STATE_NONE; - wake_up_interruptible_all(&opinfo->oplock_q); -@@ -8280,22 +8231,17 @@ static void smb21_lease_break_ack(struct ksmbd_work *work) - wake_up_interruptible_all(&opinfo->oplock_brk); - opinfo_put(opinfo); - -- if (ret < 0) { -- rsp->hdr.Status = err; -- goto err_out; -- } -- - rsp->StructureSize = cpu_to_le16(36); - rsp->Reserved = 0; - rsp->Flags = 0; - memcpy(rsp->LeaseKey, req->LeaseKey, 16); - rsp->LeaseState = lease_state; - rsp->LeaseDuration = 0; -- inc_rfc1001_len(work->response_buf, 36); -- return; -+ ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lease_ack)); -+ if (!ret) -+ return; - - err_out: -- opinfo->op_state = OPLOCK_STATE_NONE; - wake_up_interruptible_all(&opinfo->oplock_q); - atomic_dec(&opinfo->breaking_cnt); - wake_up_interruptible_all(&opinfo->oplock_brk); -@@ -8430,43 +8376,19 @@ int smb2_check_sign_req(struct ksmbd_work *work) - void smb2_set_sign_rsp(struct ksmbd_work *work) - { - struct smb2_hdr *hdr; -- struct smb2_hdr *req_hdr; - char signature[SMB2_HMACSHA256_SIZE]; -- struct kvec iov[2]; -- size_t len; -+ struct kvec *iov; - int n_vec = 1; - -- hdr = smb2_get_msg(work->response_buf); -- if (work->next_smb2_rsp_hdr_off) -- hdr = ksmbd_resp_buf_next(work); -- -- req_hdr = ksmbd_req_buf_next(work); -- -- if (!work->next_smb2_rsp_hdr_off) { -- len = get_rfc1002_len(work->response_buf); -- if (req_hdr->NextCommand) -- len = ALIGN(len, 8); -- } else { -- len = get_rfc1002_len(work->response_buf) - -- work->next_smb2_rsp_hdr_off; -- len = ALIGN(len, 8); -- } -- -- if (req_hdr->NextCommand) -- hdr->NextCommand = cpu_to_le32(len); -- -+ hdr = ksmbd_resp_buf_curr(work); - hdr->Flags |= SMB2_FLAGS_SIGNED; - memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); - -- iov[0].iov_base = (char *)&hdr->ProtocolId; -- iov[0].iov_len = len; -- -- if (work->aux_payload_sz) { -- iov[0].iov_len -= work->aux_payload_sz; -- -- iov[1].iov_base = work->aux_payload_buf; -- iov[1].iov_len = work->aux_payload_sz; -+ if (hdr->Command == SMB2_READ) { -+ iov = &work->iov[work->iov_idx - 1]; - n_vec++; -+ } else { -+ iov = &work->iov[work->iov_idx]; - } - - if (!ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, n_vec, -@@ -8542,29 +8464,14 @@ int smb3_check_sign_req(struct ksmbd_work *work) - void smb3_set_sign_rsp(struct ksmbd_work *work) - { - struct ksmbd_conn *conn = work->conn; -- struct smb2_hdr *req_hdr, *hdr; -+ struct smb2_hdr *hdr; - struct channel *chann; - char signature[SMB2_CMACAES_SIZE]; -- struct kvec iov[2]; -+ struct kvec *iov; - int n_vec = 1; -- size_t len; - char *signing_key; - -- hdr = smb2_get_msg(work->response_buf); -- if (work->next_smb2_rsp_hdr_off) -- hdr = ksmbd_resp_buf_next(work); -- -- req_hdr = ksmbd_req_buf_next(work); -- -- if (!work->next_smb2_rsp_hdr_off) { -- len = get_rfc1002_len(work->response_buf); -- if (req_hdr->NextCommand) -- len = ALIGN(len, 8); -- } else { -- len = get_rfc1002_len(work->response_buf) - -- work->next_smb2_rsp_hdr_off; -- len = ALIGN(len, 8); -- } -+ hdr = ksmbd_resp_buf_curr(work); - - if (conn->binding == false && - le16_to_cpu(hdr->Command) == SMB2_SESSION_SETUP_HE) { -@@ -8580,21 +8487,18 @@ void smb3_set_sign_rsp(struct ksmbd_work *work) - if (!signing_key) - return; - -- if (req_hdr->NextCommand) -- hdr->NextCommand = cpu_to_le32(len); -- - hdr->Flags |= SMB2_FLAGS_SIGNED; - memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE); -- iov[0].iov_base = (char *)&hdr->ProtocolId; -- iov[0].iov_len = len; -- if (work->aux_payload_sz) { -- iov[0].iov_len -= work->aux_payload_sz; -- iov[1].iov_base = work->aux_payload_buf; -- iov[1].iov_len = work->aux_payload_sz; -+ -+ if (hdr->Command == SMB2_READ) { -+ iov = &work->iov[work->iov_idx - 1]; - n_vec++; -+ } else { -+ iov = &work->iov[work->iov_idx]; - } - -- if (!ksmbd_sign_smb3_pdu(conn, signing_key, iov, n_vec, signature)) -+ if (!ksmbd_sign_smb3_pdu(conn, signing_key, iov, n_vec, -+ signature)) - memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE); - } - -@@ -8661,45 +8565,22 @@ static void fill_transform_hdr(void *tr_buf, char *old_buf, __le16 cipher_type) - - int smb3_encrypt_resp(struct ksmbd_work *work) - { -- char *buf = work->response_buf; -- struct kvec iov[3]; -+ struct kvec *iov = work->iov; - int rc = -ENOMEM; -- int buf_size = 0, rq_nvec = 2 + (work->aux_payload_sz ? 1 : 0); -- -- if (ARRAY_SIZE(iov) < rq_nvec) -- return -ENOMEM; -+ void *tr_buf; - -- work->tr_buf = kzalloc(sizeof(struct smb2_transform_hdr) + 4, GFP_KERNEL); -- if (!work->tr_buf) -+ tr_buf = kzalloc(sizeof(struct smb2_transform_hdr) + 4, GFP_KERNEL); -+ if (!tr_buf) - return rc; - - /* fill transform header */ -- fill_transform_hdr(work->tr_buf, buf, work->conn->cipher_type); -+ fill_transform_hdr(tr_buf, work->response_buf, work->conn->cipher_type); - -- iov[0].iov_base = work->tr_buf; -+ iov[0].iov_base = tr_buf; - iov[0].iov_len = sizeof(struct smb2_transform_hdr) + 4; -- buf_size += iov[0].iov_len - 4; -- -- iov[1].iov_base = buf + 4; -- iov[1].iov_len = get_rfc1002_len(buf); -- if (work->aux_payload_sz) { -- iov[1].iov_len = work->resp_hdr_sz - 4; -- -- iov[2].iov_base = work->aux_payload_buf; -- iov[2].iov_len = work->aux_payload_sz; -- buf_size += iov[2].iov_len; -- } -- buf_size += iov[1].iov_len; -- work->resp_hdr_sz = iov[1].iov_len; -- -- rc = ksmbd_crypt_message(work, iov, rq_nvec, 1); -- if (rc) -- return rc; -- -- memmove(buf, iov[1].iov_base, iov[1].iov_len); -- *(__be32 *)work->tr_buf = cpu_to_be32(buf_size); -+ work->tr_buf = tr_buf; - -- return rc; -+ return ksmbd_crypt_message(work, iov, work->iov_idx + 1, 1); - } - - bool smb3_is_transform_hdr(void *buf) -diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h -index 665a837378540..59e3de95961c1 100644 ---- a/fs/smb/server/smb2pdu.h -+++ b/fs/smb/server/smb2pdu.h -@@ -446,7 +446,7 @@ struct smb2_posix_info { - /* SidBuffer contain two sids (UNIX user sid(16), UNIX group sid(16)) */ - u8 SidBuffer[32]; - __le32 name_len; -- u8 name[1]; -+ u8 name[]; - /* - * var sized owner SID - * var sized group SID -@@ -488,6 +488,7 @@ int find_matching_smb2_dialect(int start_index, __le16 *cli_dialects, - struct file_lock *smb_flock_init(struct file *f); - int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), - void **arg); -+void release_async_work(struct ksmbd_work *work); - void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status); - struct channel *lookup_chann_list(struct ksmbd_session *sess, - struct ksmbd_conn *conn); -diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c -index adc41b57b84c6..d160363c09ebc 100644 ---- a/fs/smb/server/smb_common.c -+++ b/fs/smb/server/smb_common.c -@@ -266,7 +266,7 @@ static int ksmbd_negotiate_smb_dialect(void *buf) - if (smb2_neg_size > smb_buf_length) - goto err_out; - -- if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) > -+ if (struct_size(req, Dialects, le16_to_cpu(req->DialectCount)) > - smb_buf_length) - goto err_out; - -@@ -319,12 +319,6 @@ static int init_smb1_rsp_hdr(struct ksmbd_work *work) - struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf; - struct smb_hdr *rcv_hdr = (struct smb_hdr *)work->request_buf; - -- /* -- * Remove 4 byte direct TCP header. -- */ -- *(__be32 *)work->response_buf = -- cpu_to_be32(sizeof(struct smb_hdr) - 4); -- - rsp_hdr->Command = SMB_COM_NEGOTIATE; - *(__le32 *)rsp_hdr->Protocol = SMB1_PROTO_NUMBER; - rsp_hdr->Flags = SMBFLG_RESPONSE; -@@ -359,8 +353,8 @@ static int smb1_check_user_session(struct ksmbd_work *work) - */ - static int smb1_allocate_rsp_buf(struct ksmbd_work *work) - { -- work->response_buf = kmalloc(MAX_CIFS_SMALL_BUFFER_SIZE, -- GFP_KERNEL | __GFP_ZERO); -+ work->response_buf = kzalloc(MAX_CIFS_SMALL_BUFFER_SIZE, -+ GFP_KERNEL); - work->response_sz = MAX_CIFS_SMALL_BUFFER_SIZE; - - if (!work->response_buf) { -@@ -571,10 +565,11 @@ static int smb_handle_negotiate(struct ksmbd_work *work) - - ksmbd_debug(SMB, "Unsupported SMB1 protocol\n"); - -- /* Add 2 byte bcc and 2 byte DialectIndex. */ -- inc_rfc1001_len(work->response_buf, 4); -- neg_rsp->hdr.Status.CifsError = STATUS_SUCCESS; -+ if (ksmbd_iov_pin_rsp(work, (void *)neg_rsp, -+ sizeof(struct smb_negotiate_rsp) - 4)) -+ return -ENOMEM; - -+ neg_rsp->hdr.Status.CifsError = STATUS_SUCCESS; - neg_rsp->hdr.WordCount = 1; - neg_rsp->DialectIndex = cpu_to_le16(work->conn->dialect); - neg_rsp->ByteCount = 0; -diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h -index 1cbb492cdefec..f1092519c0c28 100644 ---- a/fs/smb/server/smb_common.h -+++ b/fs/smb/server/smb_common.h -@@ -200,7 +200,7 @@ struct smb_hdr { - struct smb_negotiate_req { - struct smb_hdr hdr; /* wct = 0 */ - __le16 ByteCount; -- unsigned char DialectsArray[1]; -+ unsigned char DialectsArray[]; - } __packed; - - struct smb_negotiate_rsp { -@@ -263,14 +263,14 @@ struct file_directory_info { - __le64 AllocationSize; - __le32 ExtFileAttributes; - __le32 FileNameLength; -- char FileName[1]; -+ char FileName[]; - } __packed; /* level 0x101 FF resp data */ - - struct file_names_info { - __le32 NextEntryOffset; - __u32 FileIndex; - __le32 FileNameLength; -- char FileName[1]; -+ char FileName[]; - } __packed; /* level 0xc FF resp data */ - - struct file_full_directory_info { -@@ -285,7 +285,7 @@ struct file_full_directory_info { - __le32 ExtFileAttributes; - __le32 FileNameLength; - __le32 EaSize; -- char FileName[1]; -+ char FileName[]; - } __packed; /* level 0x102 FF resp */ - - struct file_both_directory_info { -@@ -303,7 +303,7 @@ struct file_both_directory_info { - __u8 ShortNameLength; - __u8 Reserved; - __u8 ShortName[24]; -- char FileName[1]; -+ char FileName[]; - } __packed; /* level 0x104 FFrsp data */ - - struct file_id_both_directory_info { -@@ -323,7 +323,7 @@ struct file_id_both_directory_info { - __u8 ShortName[24]; - __le16 Reserved2; - __le64 UniqueId; -- char FileName[1]; -+ char FileName[]; - } __packed; - - struct file_id_full_dir_info { -@@ -340,7 +340,7 @@ struct file_id_full_dir_info { - __le32 EaSize; /* EA size */ - __le32 Reserved; - __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/ -- char FileName[1]; -+ char FileName[]; - } __packed; /* level 0x105 FF rsp data */ - - struct smb_version_values { -diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c -index c24df86eb112b..d9bbd2eb89c35 100644 ---- a/fs/smb/server/smbacl.c -+++ b/fs/smb/server/smbacl.c -@@ -97,7 +97,7 @@ int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid) - /* compare all of the subauth values if any */ - num_sat = ctsid->num_subauth; - num_saw = cwsid->num_subauth; -- num_subauth = num_sat < num_saw ? num_sat : num_saw; -+ num_subauth = min(num_sat, num_saw); - if (num_subauth) { - for (i = 0; i < num_subauth; ++i) { - if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) { -@@ -1185,8 +1185,7 @@ pass: - pntsd_size += sizeof(struct smb_acl) + nt_size; - } - -- ksmbd_vfs_set_sd_xattr(conn, user_ns, -- path->dentry, pntsd, pntsd_size); -+ ksmbd_vfs_set_sd_xattr(conn, user_ns, path, pntsd, pntsd_size, false); - kfree(pntsd); - } - -@@ -1313,7 +1312,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, - - if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) { - posix_acls = get_acl(d_inode(path->dentry), ACL_TYPE_ACCESS); -- if (posix_acls && !found) { -+ if (!IS_ERR_OR_NULL(posix_acls) && !found) { - unsigned int id = -1; - - pa_entry = posix_acls->a_entries; -@@ -1337,7 +1336,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, - } - } - } -- if (posix_acls) -+ if (!IS_ERR_OR_NULL(posix_acls)) - posix_acl_release(posix_acls); - } - -@@ -1378,7 +1377,7 @@ err_out: - - int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon, - const struct path *path, struct smb_ntsd *pntsd, int ntsd_len, -- bool type_check) -+ bool type_check, bool get_write) - { - int rc; - struct smb_fattr fattr = {{0}}; -@@ -1406,7 +1405,7 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon, - newattrs.ia_valid |= ATTR_MODE; - newattrs.ia_mode = (inode->i_mode & ~0777) | (fattr.cf_mode & 0777); - -- ksmbd_vfs_remove_acl_xattrs(user_ns, path->dentry); -+ ksmbd_vfs_remove_acl_xattrs(user_ns, path); - /* Update posix acls */ - if (IS_ENABLED(CONFIG_FS_POSIX_ACL) && fattr.cf_dacls) { - rc = set_posix_acl(user_ns, inode, -@@ -1437,15 +1436,14 @@ int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon, - - if (test_share_config_flag(tcon->share_conf, KSMBD_SHARE_FLAG_ACL_XATTR)) { - /* Update WinACL in xattr */ -- ksmbd_vfs_remove_sd_xattrs(user_ns, path->dentry); -- ksmbd_vfs_set_sd_xattr(conn, user_ns, -- path->dentry, pntsd, ntsd_len); -+ ksmbd_vfs_remove_sd_xattrs(user_ns, path); -+ ksmbd_vfs_set_sd_xattr(conn, user_ns, path, pntsd, ntsd_len, -+ get_write); - } - - out: - posix_acl_release(fattr.cf_acls); - posix_acl_release(fattr.cf_dacls); -- mark_inode_dirty(inode); - return rc; - } - -diff --git a/fs/smb/server/smbacl.h b/fs/smb/server/smbacl.h -index 618f2e0236b31..9651a25518881 100644 ---- a/fs/smb/server/smbacl.h -+++ b/fs/smb/server/smbacl.h -@@ -207,7 +207,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, - __le32 *pdaccess, int uid); - int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon, - const struct path *path, struct smb_ntsd *pntsd, int ntsd_len, -- bool type_check); -+ bool type_check, bool get_write); - void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid); - void ksmbd_init_domain(u32 *sub_auth); - -diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c -index 40c721f9227e4..b49d47bdafc94 100644 ---- a/fs/smb/server/transport_ipc.c -+++ b/fs/smb/server/transport_ipc.c -@@ -229,7 +229,7 @@ static struct ksmbd_ipc_msg *ipc_msg_alloc(size_t sz) - struct ksmbd_ipc_msg *msg; - size_t msg_sz = sz + sizeof(struct ksmbd_ipc_msg); - -- msg = kvmalloc(msg_sz, GFP_KERNEL | __GFP_ZERO); -+ msg = kvzalloc(msg_sz, GFP_KERNEL); - if (msg) - msg->sz = sz; - return msg; -@@ -268,7 +268,7 @@ static int handle_response(int type, void *payload, size_t sz) - entry->type + 1, type); - } - -- entry->response = kvmalloc(sz, GFP_KERNEL | __GFP_ZERO); -+ entry->response = kvzalloc(sz, GFP_KERNEL); - if (!entry->response) { - ret = -ENOMEM; - break; -diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c -index 7578200f63b1d..c5629a68c8b73 100644 ---- a/fs/smb/server/transport_rdma.c -+++ b/fs/smb/server/transport_rdma.c -@@ -1241,14 +1241,12 @@ static int smb_direct_writev(struct ksmbd_transport *t, - - //FIXME: skip RFC1002 header.. - buflen -= 4; -- iov[0].iov_base += 4; -- iov[0].iov_len -= 4; - - remaining_data_length = buflen; - ksmbd_debug(RDMA, "Sending smb (RDMA): smb_len=%u\n", buflen); - - smb_direct_send_ctx_init(st, &send_ctx, need_invalidate, remote_key); -- start = i = 0; -+ start = i = 1; - buflen = 0; - while (true) { - buflen += iov[i].iov_len; -@@ -2142,8 +2140,7 @@ static int smb_direct_ib_client_add(struct ib_device *ib_dev) - if (ib_dev->node_type != RDMA_NODE_IB_CA) - smb_direct_port = SMB_DIRECT_PORT_IWARP; - -- if (!ib_dev->ops.get_netdev || -- !rdma_frwr_is_supported(&ib_dev->attrs)) -+ if (!rdma_frwr_is_supported(&ib_dev->attrs)) - return 0; - - smb_dev = kzalloc(sizeof(*smb_dev), GFP_KERNEL); -@@ -2243,17 +2240,38 @@ bool ksmbd_rdma_capable_netdev(struct net_device *netdev) - for (i = 0; i < smb_dev->ib_dev->phys_port_cnt; i++) { - struct net_device *ndev; - -- ndev = smb_dev->ib_dev->ops.get_netdev(smb_dev->ib_dev, -- i + 1); -- if (!ndev) -- continue; -+ if (smb_dev->ib_dev->ops.get_netdev) { -+ ndev = smb_dev->ib_dev->ops.get_netdev( -+ smb_dev->ib_dev, i + 1); -+ if (!ndev) -+ continue; - -- if (ndev == netdev) { -+ if (ndev == netdev) { -+ dev_put(ndev); -+ rdma_capable = true; -+ goto out; -+ } - dev_put(ndev); -- rdma_capable = true; -- goto out; -+ /* if ib_dev does not implement ops.get_netdev -+ * check for matching infiniband GUID in hw_addr -+ */ -+ } else if (netdev->type == ARPHRD_INFINIBAND) { -+ struct netdev_hw_addr *ha; -+ union ib_gid gid; -+ u32 port_num; -+ int ret; -+ -+ netdev_hw_addr_list_for_each( -+ ha, &netdev->dev_addrs) { -+ memcpy(&gid, ha->addr + 4, sizeof(gid)); -+ ret = ib_find_gid(smb_dev->ib_dev, &gid, -+ &port_num, NULL); -+ if (!ret) { -+ rdma_capable = true; -+ goto out; -+ } -+ } - } -- dev_put(ndev); - } - } - out: -diff --git a/fs/smb/server/unicode.c b/fs/smb/server/unicode.c -index a0db699ddafda..33fc6d45c0f38 100644 ---- a/fs/smb/server/unicode.c -+++ b/fs/smb/server/unicode.c -@@ -14,46 +14,10 @@ - #include "uniupr.h" - #include "smb_common.h" - --/* -- * smb_utf16_bytes() - how long will a string be after conversion? -- * @from: pointer to input string -- * @maxbytes: don't go past this many bytes of input string -- * @codepage: destination codepage -- * -- * Walk a utf16le string and return the number of bytes that the string will -- * be after being converted to the given charset, not including any null -- * termination required. Don't walk past maxbytes in the source buffer. -- * -- * Return: string length after conversion -- */ --static int smb_utf16_bytes(const __le16 *from, int maxbytes, -- const struct nls_table *codepage) --{ -- int i; -- int charlen, outlen = 0; -- int maxwords = maxbytes / 2; -- char tmp[NLS_MAX_CHARSET_SIZE]; -- __u16 ftmp; -- -- for (i = 0; i < maxwords; i++) { -- ftmp = get_unaligned_le16(&from[i]); -- if (ftmp == 0) -- break; -- -- charlen = codepage->uni2char(ftmp, tmp, NLS_MAX_CHARSET_SIZE); -- if (charlen > 0) -- outlen += charlen; -- else -- outlen++; -- } -- -- return outlen; --} -- - /* - * cifs_mapchar() - convert a host-endian char to proper char in codepage - * @target: where converted character should be copied -- * @src_char: 2 byte host-endian source character -+ * @from: host-endian source string - * @cp: codepage to which character should be converted - * @mapchar: should character be mapped according to mapchars mount option? - * -@@ -64,10 +28,13 @@ static int smb_utf16_bytes(const __le16 *from, int maxbytes, - * Return: string length after conversion - */ - static int --cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp, -+cifs_mapchar(char *target, const __u16 *from, const struct nls_table *cp, - bool mapchar) - { - int len = 1; -+ __u16 src_char; -+ -+ src_char = *from; - - if (!mapchar) - goto cp_convert; -@@ -105,30 +72,66 @@ out: - - cp_convert: - len = cp->uni2char(src_char, target, NLS_MAX_CHARSET_SIZE); -- if (len <= 0) { -- *target = '?'; -- len = 1; -- } -+ if (len <= 0) -+ goto surrogate_pair; -+ -+ goto out; -+ -+surrogate_pair: -+ /* convert SURROGATE_PAIR and IVS */ -+ if (strcmp(cp->charset, "utf8")) -+ goto unknown; -+ len = utf16s_to_utf8s(from, 3, UTF16_LITTLE_ENDIAN, target, 6); -+ if (len <= 0) -+ goto unknown; -+ return len; - -+unknown: -+ *target = '?'; -+ len = 1; - goto out; - } - - /* -- * is_char_allowed() - check for valid character -- * @ch: input character to be checked -+ * smb_utf16_bytes() - compute converted string length -+ * @from: pointer to input string -+ * @maxbytes: input string length -+ * @codepage: destination codepage -+ * -+ * Walk a utf16le string and return the number of bytes that the string will -+ * be after being converted to the given charset, not including any null -+ * termination required. Don't walk past maxbytes in the source buffer. - * -- * Return: 1 if char is allowed, otherwise 0 -+ * Return: string length after conversion - */ --static inline int is_char_allowed(char *ch) -+static int smb_utf16_bytes(const __le16 *from, int maxbytes, -+ const struct nls_table *codepage) - { -- /* check for control chars, wildcards etc. */ -- if (!(*ch & 0x80) && -- (*ch <= 0x1f || -- *ch == '?' || *ch == '"' || *ch == '<' || -- *ch == '>' || *ch == '|')) -- return 0; -- -- return 1; -+ int i, j; -+ int charlen, outlen = 0; -+ int maxwords = maxbytes / 2; -+ char tmp[NLS_MAX_CHARSET_SIZE]; -+ __u16 ftmp[3]; -+ -+ for (i = 0; i < maxwords; i++) { -+ ftmp[0] = get_unaligned_le16(&from[i]); -+ if (ftmp[0] == 0) -+ break; -+ for (j = 1; j <= 2; j++) { -+ if (i + j < maxwords) -+ ftmp[j] = get_unaligned_le16(&from[i + j]); -+ else -+ ftmp[j] = 0; -+ } -+ -+ charlen = cifs_mapchar(tmp, ftmp, codepage, 0); -+ if (charlen > 0) -+ outlen += charlen; -+ else -+ outlen++; -+ } -+ -+ return outlen; - } - - /* -@@ -158,12 +161,12 @@ static inline int is_char_allowed(char *ch) - static int smb_from_utf16(char *to, const __le16 *from, int tolen, int fromlen, - const struct nls_table *codepage, bool mapchar) - { -- int i, charlen, safelen; -+ int i, j, charlen, safelen; - int outlen = 0; - int nullsize = nls_nullsize(codepage); - int fromwords = fromlen / 2; - char tmp[NLS_MAX_CHARSET_SIZE]; -- __u16 ftmp; -+ __u16 ftmp[3]; /* ftmp[3] = 3array x 2bytes = 6bytes UTF-16 */ - - /* - * because the chars can be of varying widths, we need to take care -@@ -174,9 +177,15 @@ static int smb_from_utf16(char *to, const __le16 *from, int tolen, int fromlen, - safelen = tolen - (NLS_MAX_CHARSET_SIZE + nullsize); - - for (i = 0; i < fromwords; i++) { -- ftmp = get_unaligned_le16(&from[i]); -- if (ftmp == 0) -+ ftmp[0] = get_unaligned_le16(&from[i]); -+ if (ftmp[0] == 0) - break; -+ for (j = 1; j <= 2; j++) { -+ if (i + j < fromwords) -+ ftmp[j] = get_unaligned_le16(&from[i + j]); -+ else -+ ftmp[j] = 0; -+ } - - /* - * check to see if converting this character might make the -@@ -191,6 +200,19 @@ static int smb_from_utf16(char *to, const __le16 *from, int tolen, int fromlen, - /* put converted char into 'to' buffer */ - charlen = cifs_mapchar(&to[outlen], ftmp, codepage, mapchar); - outlen += charlen; -+ -+ /* -+ * charlen (=bytes of UTF-8 for 1 character) -+ * 4bytes UTF-8(surrogate pair) is charlen=4 -+ * (4bytes UTF-16 code) -+ * 7-8bytes UTF-8(IVS) is charlen=3+4 or 4+4 -+ * (2 UTF-8 pairs divided to 2 UTF-16 pairs) -+ */ -+ if (charlen == 4) -+ i++; -+ else if (charlen >= 5) -+ /* 5-6bytes UTF-8 */ -+ i += 2; - } - - /* properly null-terminate string */ -@@ -325,6 +347,9 @@ int smbConvertToUTF16(__le16 *target, const char *source, int srclen, - char src_char; - __le16 dst_char; - wchar_t tmp; -+ wchar_t wchar_to[6]; /* UTF-16 */ -+ int ret; -+ unicode_t u; - - if (!mapchars) - return smb_strtoUTF16(target, source, srclen, cp); -@@ -367,11 +392,57 @@ int smbConvertToUTF16(__le16 *target, const char *source, int srclen, - * if no match, use question mark, which at least in - * some cases serves as wild card - */ -- if (charlen < 1) { -- dst_char = cpu_to_le16(0x003f); -- charlen = 1; -+ if (charlen > 0) -+ goto ctoUTF16; -+ -+ /* convert SURROGATE_PAIR */ -+ if (strcmp(cp->charset, "utf8")) -+ goto unknown; -+ if (*(source + i) & 0x80) { -+ charlen = utf8_to_utf32(source + i, 6, &u); -+ if (charlen < 0) -+ goto unknown; -+ } else -+ goto unknown; -+ ret = utf8s_to_utf16s(source + i, charlen, -+ UTF16_LITTLE_ENDIAN, -+ wchar_to, 6); -+ if (ret < 0) -+ goto unknown; -+ -+ i += charlen; -+ dst_char = cpu_to_le16(*wchar_to); -+ if (charlen <= 3) -+ /* 1-3bytes UTF-8 to 2bytes UTF-16 */ -+ put_unaligned(dst_char, &target[j]); -+ else if (charlen == 4) { -+ /* -+ * 4bytes UTF-8(surrogate pair) to 4bytes UTF-16 -+ * 7-8bytes UTF-8(IVS) divided to 2 UTF-16 -+ * (charlen=3+4 or 4+4) -+ */ -+ put_unaligned(dst_char, &target[j]); -+ dst_char = cpu_to_le16(*(wchar_to + 1)); -+ j++; -+ put_unaligned(dst_char, &target[j]); -+ } else if (charlen >= 5) { -+ /* 5-6bytes UTF-8 to 6bytes UTF-16 */ -+ put_unaligned(dst_char, &target[j]); -+ dst_char = cpu_to_le16(*(wchar_to + 1)); -+ j++; -+ put_unaligned(dst_char, &target[j]); -+ dst_char = cpu_to_le16(*(wchar_to + 2)); -+ j++; -+ put_unaligned(dst_char, &target[j]); - } -+ continue; -+ -+unknown: -+ dst_char = cpu_to_le16(0x003f); -+ charlen = 1; - } -+ -+ctoUTF16: - /* - * character may take more than one byte in the source string, - * but will take exactly two bytes in the target string -diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c -index 36914db8b6616..fe2c80ea2e47e 100644 ---- a/fs/smb/server/vfs.c -+++ b/fs/smb/server/vfs.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include "../../internal.h" /* for vfs_path_lookup */ - -@@ -36,19 +37,6 @@ - #include "mgmt/user_session.h" - #include "mgmt/user_config.h" - --static char *extract_last_component(char *path) --{ -- char *p = strrchr(path, '/'); -- -- if (p && p[1] != '\0') { -- *p = '\0'; -- p++; -- } else { -- p = NULL; -- } -- return p; --} -- - static void ksmbd_vfs_inherit_owner(struct ksmbd_work *work, - struct inode *parent_inode, - struct inode *inode) -@@ -62,67 +50,96 @@ static void ksmbd_vfs_inherit_owner(struct ksmbd_work *work, - - /** - * ksmbd_vfs_lock_parent() - lock parent dentry if it is stable -- * -- * the parent dentry got by dget_parent or @parent could be -- * unstable, we try to lock a parent inode and lookup the -- * child dentry again. -- * -- * the reference count of @parent isn't incremented. - */ --int ksmbd_vfs_lock_parent(struct user_namespace *user_ns, struct dentry *parent, -- struct dentry *child) -+int ksmbd_vfs_lock_parent(struct dentry *parent, struct dentry *child) - { -- struct dentry *dentry; -- int ret = 0; -- - inode_lock_nested(d_inode(parent), I_MUTEX_PARENT); -- dentry = lookup_one(user_ns, child->d_name.name, parent, -- child->d_name.len); -- if (IS_ERR(dentry)) { -- ret = PTR_ERR(dentry); -- goto out_err; -- } -- -- if (dentry != child) { -- ret = -ESTALE; -- dput(dentry); -- goto out_err; -+ if (child->d_parent != parent) { -+ inode_unlock(d_inode(parent)); -+ return -ENOENT; - } - -- dput(dentry); - return 0; --out_err: -- inode_unlock(d_inode(parent)); -- return ret; - } - --int ksmbd_vfs_may_delete(struct user_namespace *user_ns, -- struct dentry *dentry) -+static int ksmbd_vfs_path_lookup_locked(struct ksmbd_share_config *share_conf, -+ char *pathname, unsigned int flags, -+ struct path *parent_path, -+ struct path *path) - { -- struct dentry *parent; -- int ret; -+ struct qstr last; -+ struct filename *filename; -+ struct path *root_share_path = &share_conf->vfs_path; -+ int err, type; -+ struct dentry *d; -+ -+ if (pathname[0] == '\0') { -+ pathname = share_conf->path; -+ root_share_path = NULL; -+ } else { -+ flags |= LOOKUP_BENEATH; -+ } -+ -+ filename = getname_kernel(pathname); -+ if (IS_ERR(filename)) -+ return PTR_ERR(filename); - -- parent = dget_parent(dentry); -- ret = ksmbd_vfs_lock_parent(user_ns, parent, dentry); -- if (ret) { -- dput(parent); -- return ret; -+ err = vfs_path_parent_lookup(filename, flags, -+ parent_path, &last, &type, -+ root_share_path); -+ if (err) { -+ putname(filename); -+ return err; - } - -- ret = inode_permission(user_ns, d_inode(parent), -- MAY_EXEC | MAY_WRITE); -+ if (unlikely(type != LAST_NORM)) { -+ path_put(parent_path); -+ putname(filename); -+ return -ENOENT; -+ } - -- inode_unlock(d_inode(parent)); -- dput(parent); -- return ret; -+ err = mnt_want_write(parent_path->mnt); -+ if (err) { -+ path_put(parent_path); -+ putname(filename); -+ return -ENOENT; -+ } -+ -+ inode_lock_nested(parent_path->dentry->d_inode, I_MUTEX_PARENT); -+ d = lookup_one_qstr_excl(&last, parent_path->dentry, 0); -+ if (IS_ERR(d)) -+ goto err_out; -+ -+ if (d_is_negative(d)) { -+ dput(d); -+ goto err_out; -+ } -+ -+ path->dentry = d; -+ path->mnt = mntget(parent_path->mnt); -+ -+ if (test_share_config_flag(share_conf, KSMBD_SHARE_FLAG_CROSSMNT)) { -+ err = follow_down(path); -+ if (err < 0) { -+ path_put(path); -+ goto err_out; -+ } -+ } -+ -+ putname(filename); -+ return 0; -+ -+err_out: -+ inode_unlock(d_inode(parent_path->dentry)); -+ mnt_drop_write(parent_path->mnt); -+ path_put(parent_path); -+ putname(filename); -+ return -ENOENT; - } - --int ksmbd_vfs_query_maximal_access(struct user_namespace *user_ns, -+void ksmbd_vfs_query_maximal_access(struct user_namespace *user_ns, - struct dentry *dentry, __le32 *daccess) - { -- struct dentry *parent; -- int ret = 0; -- - *daccess = cpu_to_le32(FILE_READ_ATTRIBUTES | READ_CONTROL); - - if (!inode_permission(user_ns, d_inode(dentry), MAY_OPEN | MAY_WRITE)) -@@ -137,19 +154,8 @@ int ksmbd_vfs_query_maximal_access(struct user_namespace *user_ns, - if (!inode_permission(user_ns, d_inode(dentry), MAY_OPEN | MAY_EXEC)) - *daccess |= FILE_EXECUTE_LE; - -- parent = dget_parent(dentry); -- ret = ksmbd_vfs_lock_parent(user_ns, parent, dentry); -- if (ret) { -- dput(parent); -- return ret; -- } -- -- if (!inode_permission(user_ns, d_inode(parent), MAY_EXEC | MAY_WRITE)) -+ if (!inode_permission(user_ns, d_inode(dentry->d_parent), MAY_EXEC | MAY_WRITE)) - *daccess |= FILE_DELETE_LE; -- -- inode_unlock(d_inode(parent)); -- dput(parent); -- return ret; - } - - /** -@@ -185,6 +191,7 @@ int ksmbd_vfs_create(struct ksmbd_work *work, const char *name, umode_t mode) - } else { - pr_err("File(%s): creation failed (err:%d)\n", name, err); - } -+ - done_path_create(&path, dentry); - return err; - } -@@ -218,27 +225,26 @@ int ksmbd_vfs_mkdir(struct ksmbd_work *work, const char *name, umode_t mode) - user_ns = mnt_user_ns(path.mnt); - mode |= S_IFDIR; - err = vfs_mkdir(user_ns, d_inode(path.dentry), dentry, mode); -- if (err) { -- goto out; -- } else if (d_unhashed(dentry)) { -+ if (!err && d_unhashed(dentry)) { - struct dentry *d; - - d = lookup_one(user_ns, dentry->d_name.name, dentry->d_parent, - dentry->d_name.len); - if (IS_ERR(d)) { - err = PTR_ERR(d); -- goto out; -+ goto out_err; - } - if (unlikely(d_is_negative(d))) { - dput(d); - err = -ENOENT; -- goto out; -+ goto out_err; - } - - ksmbd_vfs_inherit_owner(work, d_inode(path.dentry), d_inode(d)); - dput(d); - } --out: -+ -+out_err: - done_path_create(&path, dentry); - if (err) - pr_err("mkdir(%s): creation failed (err:%d)\n", name, err); -@@ -358,15 +364,15 @@ out: - * @fid: file id of open file - * @count: read byte count - * @pos: file pos -+ * @rbuf: read data buffer - * - * Return: number of read bytes on success, otherwise error - */ - int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count, -- loff_t *pos) -+ loff_t *pos, char *rbuf) - { - struct file *filp = fp->filp; - ssize_t nbytes = 0; -- char *rbuf = work->aux_payload_buf; - struct inode *inode = file_inode(filp); - - if (S_ISDIR(inode->i_mode)) -@@ -410,7 +416,8 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, - { - char *stream_buf = NULL, *wbuf; - struct user_namespace *user_ns = file_mnt_user_ns(fp->filp); -- size_t size, v_len; -+ size_t size; -+ ssize_t v_len; - int err = 0; - - ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n", -@@ -427,14 +434,14 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, - fp->stream.name, - fp->stream.size, - &stream_buf); -- if ((int)v_len < 0) { -+ if (v_len < 0) { - pr_err("not found stream in xattr : %zd\n", v_len); -- err = (int)v_len; -+ err = v_len; - goto out; - } - - if (v_len < size) { -- wbuf = kvmalloc(size, GFP_KERNEL | __GFP_ZERO); -+ wbuf = kvzalloc(size, GFP_KERNEL); - if (!wbuf) { - err = -ENOMEM; - goto out; -@@ -449,11 +456,12 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, - memcpy(&stream_buf[*pos], buf, count); - - err = ksmbd_vfs_setxattr(user_ns, -- fp->filp->f_path.dentry, -+ &fp->filp->f_path, - fp->stream.name, - (void *)stream_buf, - size, -- 0); -+ 0, -+ true); - if (err < 0) - goto out; - -@@ -510,6 +518,9 @@ int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp, - } - } - -+ /* Reserve lease break for parent dir at closing time */ -+ fp->reserve_lease_break = true; -+ - /* Do we need to break any of a levelII oplock? */ - smb_break_all_levII_oplock(work, fp, 1); - -@@ -581,54 +592,32 @@ int ksmbd_vfs_fsync(struct ksmbd_work *work, u64 fid, u64 p_id) - * - * Return: 0 on success, otherwise error - */ --int ksmbd_vfs_remove_file(struct ksmbd_work *work, char *name) -+int ksmbd_vfs_remove_file(struct ksmbd_work *work, const struct path *path) - { - struct user_namespace *user_ns; -- struct path path; -- struct dentry *parent; -+ struct dentry *parent = path->dentry->d_parent; - int err; - - if (ksmbd_override_fsids(work)) - return -ENOMEM; - -- err = ksmbd_vfs_kern_path(work, name, LOOKUP_NO_SYMLINKS, &path, false); -- if (err) { -- ksmbd_debug(VFS, "can't get %s, err %d\n", name, err); -- ksmbd_revert_fsids(work); -- return err; -- } -- -- user_ns = mnt_user_ns(path.mnt); -- parent = dget_parent(path.dentry); -- err = ksmbd_vfs_lock_parent(user_ns, parent, path.dentry); -- if (err) { -- dput(parent); -- path_put(&path); -- ksmbd_revert_fsids(work); -- return err; -- } -- -- if (!d_inode(path.dentry)->i_nlink) { -+ if (!d_inode(path->dentry)->i_nlink) { - err = -ENOENT; - goto out_err; - } - -- if (S_ISDIR(d_inode(path.dentry)->i_mode)) { -- err = vfs_rmdir(user_ns, d_inode(parent), path.dentry); -+ user_ns = mnt_user_ns(path->mnt); -+ if (S_ISDIR(d_inode(path->dentry)->i_mode)) { -+ err = vfs_rmdir(user_ns, d_inode(parent), path->dentry); - if (err && err != -ENOTEMPTY) -- ksmbd_debug(VFS, "%s: rmdir failed, err %d\n", name, -- err); -+ ksmbd_debug(VFS, "rmdir failed, err %d\n", err); - } else { -- err = vfs_unlink(user_ns, d_inode(parent), path.dentry, NULL); -+ err = vfs_unlink(user_ns, d_inode(parent), path->dentry, NULL); - if (err) -- ksmbd_debug(VFS, "%s: unlink failed, err %d\n", name, -- err); -+ ksmbd_debug(VFS, "unlink failed, err %d\n", err); - } - - out_err: -- inode_unlock(d_inode(parent)); -- dput(parent); -- path_put(&path); - ksmbd_revert_fsids(work); - return err; - } -@@ -687,149 +676,120 @@ out1: - return err; - } - --static int ksmbd_validate_entry_in_use(struct dentry *src_dent) -+int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, -+ char *newname, int flags) - { -- struct dentry *dst_dent; -+ struct dentry *old_parent, *new_dentry, *trap; -+ struct dentry *old_child = old_path->dentry; -+ struct path new_path; -+ struct qstr new_last; -+ struct renamedata rd; -+ struct filename *to; -+ struct ksmbd_share_config *share_conf = work->tcon->share_conf; -+ struct ksmbd_file *parent_fp; -+ int new_type; -+ int err, lookup_flags = LOOKUP_NO_SYMLINKS; -+ -+ if (ksmbd_override_fsids(work)) -+ return -ENOMEM; - -- spin_lock(&src_dent->d_lock); -- list_for_each_entry(dst_dent, &src_dent->d_subdirs, d_child) { -- struct ksmbd_file *child_fp; -+ to = getname_kernel(newname); -+ if (IS_ERR(to)) { -+ err = PTR_ERR(to); -+ goto revert_fsids; -+ } - -- if (d_really_is_negative(dst_dent)) -- continue; -+retry: -+ err = vfs_path_parent_lookup(to, lookup_flags | LOOKUP_BENEATH, -+ &new_path, &new_last, &new_type, -+ &share_conf->vfs_path); -+ if (err) -+ goto out1; - -- child_fp = ksmbd_lookup_fd_inode(d_inode(dst_dent)); -- if (child_fp) { -- spin_unlock(&src_dent->d_lock); -- ksmbd_debug(VFS, "Forbid rename, sub file/dir is in use\n"); -- return -EACCES; -- } -+ if (old_path->mnt != new_path.mnt) { -+ err = -EXDEV; -+ goto out2; - } -- spin_unlock(&src_dent->d_lock); - -- return 0; --} -+ err = mnt_want_write(old_path->mnt); -+ if (err) -+ goto out2; - --static int __ksmbd_vfs_rename(struct ksmbd_work *work, -- struct user_namespace *src_user_ns, -- struct dentry *src_dent_parent, -- struct dentry *src_dent, -- struct user_namespace *dst_user_ns, -- struct dentry *dst_dent_parent, -- struct dentry *trap_dent, -- char *dst_name) --{ -- struct dentry *dst_dent; -- int err; -+ trap = lock_rename_child(old_child, new_path.dentry); - -- if (!work->tcon->posix_extensions) { -- err = ksmbd_validate_entry_in_use(src_dent); -- if (err) -- return err; -+ old_parent = dget(old_child->d_parent); -+ if (d_unhashed(old_child)) { -+ err = -EINVAL; -+ goto out3; - } - -- if (d_really_is_negative(src_dent_parent)) -- return -ENOENT; -- if (d_really_is_negative(dst_dent_parent)) -- return -ENOENT; -- if (d_really_is_negative(src_dent)) -- return -ENOENT; -- if (src_dent == trap_dent) -- return -EINVAL; -- -- if (ksmbd_override_fsids(work)) -- return -ENOMEM; -+ parent_fp = ksmbd_lookup_fd_inode(old_child->d_parent); -+ if (parent_fp) { -+ if (parent_fp->daccess & FILE_DELETE_LE) { -+ pr_err("parent dir is opened with delete access\n"); -+ err = -ESHARE; -+ ksmbd_fd_put(work, parent_fp); -+ goto out3; -+ } -+ ksmbd_fd_put(work, parent_fp); -+ } - -- dst_dent = lookup_one(dst_user_ns, dst_name, dst_dent_parent, -- strlen(dst_name)); -- err = PTR_ERR(dst_dent); -- if (IS_ERR(dst_dent)) { -- pr_err("lookup failed %s [%d]\n", dst_name, err); -- goto out; -+ new_dentry = lookup_one_qstr_excl(&new_last, new_path.dentry, -+ lookup_flags | LOOKUP_RENAME_TARGET); -+ if (IS_ERR(new_dentry)) { -+ err = PTR_ERR(new_dentry); -+ goto out3; - } - -- err = -ENOTEMPTY; -- if (dst_dent != trap_dent && !d_really_is_positive(dst_dent)) { -- struct renamedata rd = { -- .old_mnt_userns = src_user_ns, -- .old_dir = d_inode(src_dent_parent), -- .old_dentry = src_dent, -- .new_mnt_userns = dst_user_ns, -- .new_dir = d_inode(dst_dent_parent), -- .new_dentry = dst_dent, -- }; -- err = vfs_rename(&rd); -+ if (d_is_symlink(new_dentry)) { -+ err = -EACCES; -+ goto out4; - } -- if (err) -- pr_err("vfs_rename failed err %d\n", err); -- if (dst_dent) -- dput(dst_dent); --out: -- ksmbd_revert_fsids(work); -- return err; --} - --int ksmbd_vfs_fp_rename(struct ksmbd_work *work, struct ksmbd_file *fp, -- char *newname) --{ -- struct user_namespace *user_ns; -- struct path dst_path; -- struct dentry *src_dent_parent, *dst_dent_parent; -- struct dentry *src_dent, *trap_dent, *src_child; -- char *dst_name; -- int err; -+ if ((flags & RENAME_NOREPLACE) && d_is_positive(new_dentry)) { -+ err = -EEXIST; -+ goto out4; -+ } - -- dst_name = extract_last_component(newname); -- if (!dst_name) { -- dst_name = newname; -- newname = ""; -+ if (old_child == trap) { -+ err = -EINVAL; -+ goto out4; - } - -- src_dent_parent = dget_parent(fp->filp->f_path.dentry); -- src_dent = fp->filp->f_path.dentry; -+ if (new_dentry == trap) { -+ err = -ENOTEMPTY; -+ goto out4; -+ } -+ -+ rd.old_mnt_userns = mnt_user_ns(old_path->mnt), -+ rd.old_dir = d_inode(old_parent), -+ rd.old_dentry = old_child, -+ rd.new_mnt_userns = mnt_user_ns(new_path.mnt), -+ rd.new_dir = new_path.dentry->d_inode, -+ rd.new_dentry = new_dentry, -+ rd.flags = flags, -+ rd.delegated_inode = NULL, -+ err = vfs_rename(&rd); -+ if (err) -+ ksmbd_debug(VFS, "vfs_rename failed err %d\n", err); - -- err = ksmbd_vfs_kern_path(work, newname, -- LOOKUP_NO_SYMLINKS | LOOKUP_DIRECTORY, -- &dst_path, false); -- if (err) { -- ksmbd_debug(VFS, "Cannot get path for %s [%d]\n", newname, err); -- goto out; -+out4: -+ dput(new_dentry); -+out3: -+ dput(old_parent); -+ unlock_rename(old_parent, new_path.dentry); -+ mnt_drop_write(old_path->mnt); -+out2: -+ path_put(&new_path); -+ -+ if (retry_estale(err, lookup_flags)) { -+ lookup_flags |= LOOKUP_REVAL; -+ goto retry; - } -- dst_dent_parent = dst_path.dentry; -- -- trap_dent = lock_rename(src_dent_parent, dst_dent_parent); -- dget(src_dent); -- dget(dst_dent_parent); -- user_ns = file_mnt_user_ns(fp->filp); -- src_child = lookup_one(user_ns, src_dent->d_name.name, src_dent_parent, -- src_dent->d_name.len); -- if (IS_ERR(src_child)) { -- err = PTR_ERR(src_child); -- goto out_lock; -- } -- -- if (src_child != src_dent) { -- err = -ESTALE; -- dput(src_child); -- goto out_lock; -- } -- dput(src_child); -- -- err = __ksmbd_vfs_rename(work, -- user_ns, -- src_dent_parent, -- src_dent, -- mnt_user_ns(dst_path.mnt), -- dst_dent_parent, -- trap_dent, -- dst_name); --out_lock: -- dput(src_dent); -- dput(dst_dent_parent); -- unlock_rename(src_dent_parent, dst_dent_parent); -- path_put(&dst_path); --out: -- dput(src_dent_parent); -+out1: -+ putname(to); -+revert_fsids: -+ ksmbd_revert_fsids(work); - return err; - } - -@@ -892,7 +852,7 @@ ssize_t ksmbd_vfs_listxattr(struct dentry *dentry, char **list) - if (size <= 0) - return size; - -- vlist = kvmalloc(size, GFP_KERNEL | __GFP_ZERO); -+ vlist = kvzalloc(size, GFP_KERNEL); - if (!vlist) - return -ENOMEM; - -@@ -950,28 +910,38 @@ ssize_t ksmbd_vfs_getxattr(struct user_namespace *user_ns, - /** - * ksmbd_vfs_setxattr() - vfs helper for smb set extended attributes value - * @user_ns: user namespace -- * @dentry: dentry to set XATTR at -- * @name: xattr name for setxattr -- * @value: xattr value to set -- * @size: size of xattr value -+ * @path: path of dentry to set XATTR at -+ * @attr_name: xattr name for setxattr -+ * @attr_value: xattr value to set -+ * @attr_size: size of xattr value - * @flags: destination buffer length -+ * @get_write: get write access to a mount - * - * Return: 0 on success, otherwise error - */ - int ksmbd_vfs_setxattr(struct user_namespace *user_ns, -- struct dentry *dentry, const char *attr_name, -- void *attr_value, size_t attr_size, int flags) -+ const struct path *path, const char *attr_name, -+ void *attr_value, size_t attr_size, int flags, -+ bool get_write) - { - int err; - -+ if (get_write == true) { -+ err = mnt_want_write(path->mnt); -+ if (err) -+ return err; -+ } -+ - err = vfs_setxattr(user_ns, -- dentry, -+ path->dentry, - attr_name, - attr_value, - attr_size, - flags); - if (err) - ksmbd_debug(VFS, "setxattr failed, err %d\n", err); -+ if (get_write == true) -+ mnt_drop_write(path->mnt); - return err; - } - -@@ -1075,19 +1045,34 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length, - } - - int ksmbd_vfs_remove_xattr(struct user_namespace *user_ns, -- struct dentry *dentry, char *attr_name) -+ const struct path *path, char *attr_name) - { -- return vfs_removexattr(user_ns, dentry, attr_name); -+ int err; -+ -+ err = mnt_want_write(path->mnt); -+ if (err) -+ return err; -+ -+ err = vfs_removexattr(user_ns, path->dentry, attr_name); -+ mnt_drop_write(path->mnt); -+ -+ return err; - } - --int ksmbd_vfs_unlink(struct user_namespace *user_ns, -- struct dentry *dir, struct dentry *dentry) -+int ksmbd_vfs_unlink(struct file *filp) - { - int err = 0; -+ struct dentry *dir, *dentry = filp->f_path.dentry; -+ struct user_namespace *user_ns = file_mnt_user_ns(filp); - -- err = ksmbd_vfs_lock_parent(user_ns, dir, dentry); -+ err = mnt_want_write(filp->f_path.mnt); - if (err) - return err; -+ -+ dir = dget_parent(dentry); -+ err = ksmbd_vfs_lock_parent(dir, dentry); -+ if (err) -+ goto out; - dget(dentry); - - if (S_ISDIR(d_inode(dentry)->i_mode)) -@@ -1099,6 +1084,9 @@ int ksmbd_vfs_unlink(struct user_namespace *user_ns, - inode_unlock(d_inode(dir)); - if (err) - ksmbd_debug(VFS, "failed to delete, err %d\n", err); -+out: -+ dput(dir); -+ mnt_drop_write(filp->f_path.mnt); - - return err; - } -@@ -1201,32 +1189,29 @@ static int ksmbd_vfs_lookup_in_dir(const struct path *dir, char *name, - } - - /** -- * ksmbd_vfs_kern_path() - lookup a file and get path info -- * @name: file path that is relative to share -- * @flags: lookup flags -- * @path: if lookup succeed, return path info -+ * ksmbd_vfs_kern_path_locked() - lookup a file and get path info -+ * @name: file path that is relative to share -+ * @flags: lookup flags -+ * @parent_path: if lookup succeed, return parent_path info -+ * @path: if lookup succeed, return path info - * @caseless: caseless filename lookup - * - * Return: 0 on success, otherwise error - */ --int ksmbd_vfs_kern_path(struct ksmbd_work *work, char *name, -- unsigned int flags, struct path *path, bool caseless) -+int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, -+ unsigned int flags, struct path *parent_path, -+ struct path *path, bool caseless) - { - struct ksmbd_share_config *share_conf = work->tcon->share_conf; - int err; - -- flags |= LOOKUP_BENEATH; -- err = vfs_path_lookup(share_conf->vfs_path.dentry, -- share_conf->vfs_path.mnt, -- name, -- flags, -- path); -+ err = ksmbd_vfs_path_lookup_locked(share_conf, name, flags, parent_path, -+ path); - if (!err) - return 0; - - if (caseless) { - char *filepath; -- struct path parent; - size_t path_len, remain_len; - - filepath = kstrdup(name, GFP_KERNEL); -@@ -1236,10 +1221,10 @@ int ksmbd_vfs_kern_path(struct ksmbd_work *work, char *name, - path_len = strlen(filepath); - remain_len = path_len; - -- parent = share_conf->vfs_path; -- path_get(&parent); -+ *parent_path = share_conf->vfs_path; -+ path_get(parent_path); - -- while (d_can_lookup(parent.dentry)) { -+ while (d_can_lookup(parent_path->dentry)) { - char *filename = filepath + path_len - remain_len; - char *next = strchrnul(filename, '/'); - size_t filename_len = next - filename; -@@ -1248,12 +1233,11 @@ int ksmbd_vfs_kern_path(struct ksmbd_work *work, char *name, - if (filename_len == 0) - break; - -- err = ksmbd_vfs_lookup_in_dir(&parent, filename, -+ err = ksmbd_vfs_lookup_in_dir(parent_path, filename, - filename_len, - work->conn->um); -- path_put(&parent); - if (err) -- goto out; -+ goto out2; - - next[0] = '\0'; - -@@ -1261,26 +1245,50 @@ int ksmbd_vfs_kern_path(struct ksmbd_work *work, char *name, - share_conf->vfs_path.mnt, - filepath, - flags, -- &parent); -+ path); - if (err) -- goto out; -- else if (is_last) { -- *path = parent; -- goto out; -- } -+ goto out2; -+ else if (is_last) -+ goto out1; -+ path_put(parent_path); -+ *parent_path = *path; - - next[0] = '/'; - remain_len -= filename_len + 1; - } - -- path_put(&parent); - err = -EINVAL; --out: -+out2: -+ path_put(parent_path); -+out1: - kfree(filepath); - } -+ -+ if (!err) { -+ err = mnt_want_write(parent_path->mnt); -+ if (err) { -+ path_put(path); -+ path_put(parent_path); -+ return err; -+ } -+ -+ err = ksmbd_vfs_lock_parent(parent_path->dentry, path->dentry); -+ if (err) { -+ path_put(path); -+ path_put(parent_path); -+ } -+ } - return err; - } - -+void ksmbd_vfs_kern_path_unlock(struct path *parent_path, struct path *path) -+{ -+ inode_unlock(d_inode(parent_path->dentry)); -+ mnt_drop_write(parent_path->mnt); -+ path_put(path); -+ path_put(parent_path); -+} -+ - struct dentry *ksmbd_vfs_kern_path_create(struct ksmbd_work *work, - const char *name, - unsigned int flags, -@@ -1299,13 +1307,13 @@ struct dentry *ksmbd_vfs_kern_path_create(struct ksmbd_work *work, - } - - int ksmbd_vfs_remove_acl_xattrs(struct user_namespace *user_ns, -- struct dentry *dentry) -+ const struct path *path) - { - char *name, *xattr_list = NULL; - ssize_t xattr_list_len; - int err = 0; - -- xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list); -+ xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list); - if (xattr_list_len < 0) { - goto out; - } else if (!xattr_list_len) { -@@ -1321,25 +1329,25 @@ int ksmbd_vfs_remove_acl_xattrs(struct user_namespace *user_ns, - sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1) || - !strncmp(name, XATTR_NAME_POSIX_ACL_DEFAULT, - sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1)) { -- err = ksmbd_vfs_remove_xattr(user_ns, dentry, name); -+ err = ksmbd_vfs_remove_xattr(user_ns, path, name); - if (err) - ksmbd_debug(SMB, - "remove acl xattr failed : %s\n", name); - } - } -+ - out: - kvfree(xattr_list); - return err; - } - --int ksmbd_vfs_remove_sd_xattrs(struct user_namespace *user_ns, -- struct dentry *dentry) -+int ksmbd_vfs_remove_sd_xattrs(struct user_namespace *user_ns, const struct path *path) - { - char *name, *xattr_list = NULL; - ssize_t xattr_list_len; - int err = 0; - -- xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list); -+ xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list); - if (xattr_list_len < 0) { - goto out; - } else if (!xattr_list_len) { -@@ -1352,7 +1360,7 @@ int ksmbd_vfs_remove_sd_xattrs(struct user_namespace *user_ns, - ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name)); - - if (!strncmp(name, XATTR_NAME_SD, XATTR_NAME_SD_LEN)) { -- err = ksmbd_vfs_remove_xattr(user_ns, dentry, name); -+ err = ksmbd_vfs_remove_xattr(user_ns, path, name); - if (err) - ksmbd_debug(SMB, "remove xattr failed : %s\n", name); - } -@@ -1376,7 +1384,7 @@ static struct xattr_smb_acl *ksmbd_vfs_make_xattr_posix_acl(struct user_namespac - return NULL; - - posix_acls = get_acl(inode, acl_type); -- if (!posix_acls) -+ if (IS_ERR_OR_NULL(posix_acls)) - return NULL; - - smb_acl = kzalloc(sizeof(struct xattr_smb_acl) + -@@ -1429,13 +1437,15 @@ out: - - int ksmbd_vfs_set_sd_xattr(struct ksmbd_conn *conn, - struct user_namespace *user_ns, -- struct dentry *dentry, -- struct smb_ntsd *pntsd, int len) -+ const struct path *path, -+ struct smb_ntsd *pntsd, int len, -+ bool get_write) - { - int rc; - struct ndr sd_ndr = {0}, acl_ndr = {0}; - struct xattr_ntacl acl = {0}; - struct xattr_smb_acl *smb_acl, *def_smb_acl = NULL; -+ struct dentry *dentry = path->dentry; - struct inode *inode = d_inode(dentry); - - acl.version = 4; -@@ -1487,9 +1497,9 @@ int ksmbd_vfs_set_sd_xattr(struct ksmbd_conn *conn, - goto out; - } - -- rc = ksmbd_vfs_setxattr(user_ns, dentry, -+ rc = ksmbd_vfs_setxattr(user_ns, path, - XATTR_NAME_SD, sd_ndr.data, -- sd_ndr.offset, 0); -+ sd_ndr.offset, 0, get_write); - if (rc < 0) - pr_err("Failed to store XATTR ntacl :%d\n", rc); - -@@ -1577,8 +1587,9 @@ free_n_data: - } - - int ksmbd_vfs_set_dos_attrib_xattr(struct user_namespace *user_ns, -- struct dentry *dentry, -- struct xattr_dos_attrib *da) -+ const struct path *path, -+ struct xattr_dos_attrib *da, -+ bool get_write) - { - struct ndr n; - int err; -@@ -1587,8 +1598,8 @@ int ksmbd_vfs_set_dos_attrib_xattr(struct user_namespace *user_ns, - if (err) - return err; - -- err = ksmbd_vfs_setxattr(user_ns, dentry, XATTR_NAME_DOS_ATTRIBUTE, -- (void *)n.data, n.offset, 0); -+ err = ksmbd_vfs_setxattr(user_ns, path, XATTR_NAME_DOS_ATTRIBUTE, -+ (void *)n.data, n.offset, 0, get_write); - if (err) - ksmbd_debug(SMB, "failed to store dos attribute in xattr\n"); - kfree(n.data); -@@ -1824,10 +1835,11 @@ void ksmbd_vfs_posix_lock_unblock(struct file_lock *flock) - } - - int ksmbd_vfs_set_init_posix_acl(struct user_namespace *user_ns, -- struct inode *inode) -+ struct path *path) - { - struct posix_acl_state acl_state; - struct posix_acl *acls; -+ struct inode *inode = d_inode(path->dentry); - int rc; - - if (!IS_ENABLED(CONFIG_FS_POSIX_ACL)) -@@ -1856,6 +1868,7 @@ int ksmbd_vfs_set_init_posix_acl(struct user_namespace *user_ns, - return -ENOMEM; - } - posix_state_to_acl(&acl_state, acls->a_entries); -+ - rc = set_posix_acl(user_ns, inode, ACL_TYPE_ACCESS, acls); - if (rc < 0) - ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n", -@@ -1868,23 +1881,25 @@ int ksmbd_vfs_set_init_posix_acl(struct user_namespace *user_ns, - ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n", - rc); - } -+ - free_acl_state(&acl_state); - posix_acl_release(acls); - return rc; - } - - int ksmbd_vfs_inherit_posix_acl(struct user_namespace *user_ns, -- struct inode *inode, struct inode *parent_inode) -+ struct path *path, struct inode *parent_inode) - { - struct posix_acl *acls; - struct posix_acl_entry *pace; -+ struct inode *inode = d_inode(path->dentry); - int rc, i; - - if (!IS_ENABLED(CONFIG_FS_POSIX_ACL)) - return -EOPNOTSUPP; - - acls = get_acl(parent_inode, ACL_TYPE_DEFAULT); -- if (!acls) -+ if (IS_ERR_OR_NULL(acls)) - return -ENOENT; - pace = acls->a_entries; - -@@ -1906,6 +1921,7 @@ int ksmbd_vfs_inherit_posix_acl(struct user_namespace *user_ns, - ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n", - rc); - } -+ - posix_acl_release(acls); - return rc; - } -diff --git a/fs/smb/server/vfs.h b/fs/smb/server/vfs.h -index 593059ca85112..e761dde2443e2 100644 ---- a/fs/smb/server/vfs.h -+++ b/fs/smb/server/vfs.h -@@ -71,25 +71,23 @@ struct ksmbd_kstat { - __le32 file_attributes; - }; - --int ksmbd_vfs_lock_parent(struct user_namespace *user_ns, struct dentry *parent, -- struct dentry *child); --int ksmbd_vfs_may_delete(struct user_namespace *user_ns, struct dentry *dentry); --int ksmbd_vfs_query_maximal_access(struct user_namespace *user_ns, -+int ksmbd_vfs_lock_parent(struct dentry *parent, struct dentry *child); -+void ksmbd_vfs_query_maximal_access(struct user_namespace *user_ns, - struct dentry *dentry, __le32 *daccess); - int ksmbd_vfs_create(struct ksmbd_work *work, const char *name, umode_t mode); - int ksmbd_vfs_mkdir(struct ksmbd_work *work, const char *name, umode_t mode); --int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, -- size_t count, loff_t *pos); -+int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count, -+ loff_t *pos, char *rbuf); - int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp, - char *buf, size_t count, loff_t *pos, bool sync, - ssize_t *written); - int ksmbd_vfs_fsync(struct ksmbd_work *work, u64 fid, u64 p_id); --int ksmbd_vfs_remove_file(struct ksmbd_work *work, char *name); -+int ksmbd_vfs_remove_file(struct ksmbd_work *work, const struct path *path); - int ksmbd_vfs_link(struct ksmbd_work *work, - const char *oldname, const char *newname); - int ksmbd_vfs_getattr(const struct path *path, struct kstat *stat); --int ksmbd_vfs_fp_rename(struct ksmbd_work *work, struct ksmbd_file *fp, -- char *newname); -+int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, -+ char *newname, int flags); - int ksmbd_vfs_truncate(struct ksmbd_work *work, - struct ksmbd_file *fp, loff_t size); - struct srv_copychunk; -@@ -110,15 +108,17 @@ ssize_t ksmbd_vfs_casexattr_len(struct user_namespace *user_ns, - struct dentry *dentry, char *attr_name, - int attr_name_len); - int ksmbd_vfs_setxattr(struct user_namespace *user_ns, -- struct dentry *dentry, const char *attr_name, -- void *attr_value, size_t attr_size, int flags); -+ const struct path *path, const char *attr_name, -+ void *attr_value, size_t attr_size, int flags, -+ bool get_write); - int ksmbd_vfs_xattr_stream_name(char *stream_name, char **xattr_stream_name, - size_t *xattr_stream_name_size, int s_type); - int ksmbd_vfs_remove_xattr(struct user_namespace *user_ns, -- struct dentry *dentry, char *attr_name); --int ksmbd_vfs_kern_path(struct ksmbd_work *work, -- char *name, unsigned int flags, struct path *path, -- bool caseless); -+ const struct path *path, char *attr_name); -+int ksmbd_vfs_kern_path_locked(struct ksmbd_work *work, char *name, -+ unsigned int flags, struct path *parent_path, -+ struct path *path, bool caseless); -+void ksmbd_vfs_kern_path_unlock(struct path *parent_path, struct path *path); - struct dentry *ksmbd_vfs_kern_path_create(struct ksmbd_work *work, - const char *name, - unsigned int flags, -@@ -131,8 +131,7 @@ struct file_allocated_range_buffer; - int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length, - struct file_allocated_range_buffer *ranges, - unsigned int in_count, unsigned int *out_count); --int ksmbd_vfs_unlink(struct user_namespace *user_ns, -- struct dentry *dir, struct dentry *dentry); -+int ksmbd_vfs_unlink(struct file *filp); - void *ksmbd_vfs_init_kstat(char **p, struct ksmbd_kstat *ksmbd_kstat); - int ksmbd_vfs_fill_dentry_attrs(struct ksmbd_work *work, - struct user_namespace *user_ns, -@@ -142,26 +141,27 @@ void ksmbd_vfs_posix_lock_wait(struct file_lock *flock); - int ksmbd_vfs_posix_lock_wait_timeout(struct file_lock *flock, long timeout); - void ksmbd_vfs_posix_lock_unblock(struct file_lock *flock); - int ksmbd_vfs_remove_acl_xattrs(struct user_namespace *user_ns, -- struct dentry *dentry); --int ksmbd_vfs_remove_sd_xattrs(struct user_namespace *user_ns, -- struct dentry *dentry); -+ const struct path *path); -+int ksmbd_vfs_remove_sd_xattrs(struct user_namespace *user_ns, const struct path *path); - int ksmbd_vfs_set_sd_xattr(struct ksmbd_conn *conn, - struct user_namespace *user_ns, -- struct dentry *dentry, -- struct smb_ntsd *pntsd, int len); -+ const struct path *path, -+ struct smb_ntsd *pntsd, int len, -+ bool get_write); - int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn, - struct user_namespace *user_ns, - struct dentry *dentry, - struct smb_ntsd **pntsd); - int ksmbd_vfs_set_dos_attrib_xattr(struct user_namespace *user_ns, -- struct dentry *dentry, -- struct xattr_dos_attrib *da); -+ const struct path *path, -+ struct xattr_dos_attrib *da, -+ bool get_write); - int ksmbd_vfs_get_dos_attrib_xattr(struct user_namespace *user_ns, - struct dentry *dentry, - struct xattr_dos_attrib *da); - int ksmbd_vfs_set_init_posix_acl(struct user_namespace *user_ns, -- struct inode *inode); -+ struct path *path); - int ksmbd_vfs_inherit_posix_acl(struct user_namespace *user_ns, -- struct inode *inode, -+ struct path *path, - struct inode *parent_inode); - #endif /* __KSMBD_VFS_H__ */ -diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c -index 6ec6c129465d3..2528ce8aeebbe 100644 ---- a/fs/smb/server/vfs_cache.c -+++ b/fs/smb/server/vfs_cache.c -@@ -65,14 +65,14 @@ static unsigned long inode_hash(struct super_block *sb, unsigned long hashval) - return tmp & inode_hash_mask; - } - --static struct ksmbd_inode *__ksmbd_inode_lookup(struct inode *inode) -+static struct ksmbd_inode *__ksmbd_inode_lookup(struct dentry *de) - { - struct hlist_head *head = inode_hashtable + -- inode_hash(inode->i_sb, inode->i_ino); -+ inode_hash(d_inode(de)->i_sb, (unsigned long)de); - struct ksmbd_inode *ci = NULL, *ret_ci = NULL; - - hlist_for_each_entry(ci, head, m_hash) { -- if (ci->m_inode == inode) { -+ if (ci->m_de == de) { - if (atomic_inc_not_zero(&ci->m_count)) - ret_ci = ci; - break; -@@ -83,26 +83,27 @@ static struct ksmbd_inode *__ksmbd_inode_lookup(struct inode *inode) - - static struct ksmbd_inode *ksmbd_inode_lookup(struct ksmbd_file *fp) - { -- return __ksmbd_inode_lookup(file_inode(fp->filp)); -+ return __ksmbd_inode_lookup(fp->filp->f_path.dentry); - } - --static struct ksmbd_inode *ksmbd_inode_lookup_by_vfsinode(struct inode *inode) -+struct ksmbd_inode *ksmbd_inode_lookup_lock(struct dentry *d) - { - struct ksmbd_inode *ci; - - read_lock(&inode_hash_lock); -- ci = __ksmbd_inode_lookup(inode); -+ ci = __ksmbd_inode_lookup(d); - read_unlock(&inode_hash_lock); -+ - return ci; - } - --int ksmbd_query_inode_status(struct inode *inode) -+int ksmbd_query_inode_status(struct dentry *dentry) - { - struct ksmbd_inode *ci; - int ret = KSMBD_INODE_STATUS_UNKNOWN; - - read_lock(&inode_hash_lock); -- ci = __ksmbd_inode_lookup(inode); -+ ci = __ksmbd_inode_lookup(dentry); - if (ci) { - ret = KSMBD_INODE_STATUS_OK; - if (ci->m_flags & (S_DEL_PENDING | S_DEL_ON_CLS)) -@@ -142,7 +143,7 @@ void ksmbd_fd_set_delete_on_close(struct ksmbd_file *fp, - static void ksmbd_inode_hash(struct ksmbd_inode *ci) - { - struct hlist_head *b = inode_hashtable + -- inode_hash(ci->m_inode->i_sb, ci->m_inode->i_ino); -+ inode_hash(d_inode(ci->m_de)->i_sb, (unsigned long)ci->m_de); - - hlist_add_head(&ci->m_hash, b); - } -@@ -156,7 +157,6 @@ static void ksmbd_inode_unhash(struct ksmbd_inode *ci) - - static int ksmbd_inode_init(struct ksmbd_inode *ci, struct ksmbd_file *fp) - { -- ci->m_inode = file_inode(fp->filp); - atomic_set(&ci->m_count, 1); - atomic_set(&ci->op_count, 0); - atomic_set(&ci->sop_count, 0); -@@ -165,6 +165,7 @@ static int ksmbd_inode_init(struct ksmbd_inode *ci, struct ksmbd_file *fp) - INIT_LIST_HEAD(&ci->m_fp_list); - INIT_LIST_HEAD(&ci->m_op_list); - rwlock_init(&ci->m_lock); -+ ci->m_de = fp->filp->f_path.dentry; - return 0; - } - -@@ -208,7 +209,7 @@ static void ksmbd_inode_free(struct ksmbd_inode *ci) - kfree(ci); - } - --static void ksmbd_inode_put(struct ksmbd_inode *ci) -+void ksmbd_inode_put(struct ksmbd_inode *ci) - { - if (atomic_dec_and_test(&ci->m_count)) - ksmbd_inode_free(ci); -@@ -243,7 +244,6 @@ void ksmbd_release_inode_hash(void) - - static void __ksmbd_inode_close(struct ksmbd_file *fp) - { -- struct dentry *dir, *dentry; - struct ksmbd_inode *ci = fp->f_ci; - int err; - struct file *filp; -@@ -252,7 +252,7 @@ static void __ksmbd_inode_close(struct ksmbd_file *fp) - if (ksmbd_stream_fd(fp) && (ci->m_flags & S_DEL_ON_CLS_STREAM)) { - ci->m_flags &= ~S_DEL_ON_CLS_STREAM; - err = ksmbd_vfs_remove_xattr(file_mnt_user_ns(filp), -- filp->f_path.dentry, -+ &filp->f_path, - fp->stream.name); - if (err) - pr_err("remove xattr failed : %s\n", -@@ -262,11 +262,9 @@ static void __ksmbd_inode_close(struct ksmbd_file *fp) - if (atomic_dec_and_test(&ci->m_count)) { - write_lock(&ci->m_lock); - if (ci->m_flags & (S_DEL_ON_CLS | S_DEL_PENDING)) { -- dentry = filp->f_path.dentry; -- dir = dentry->d_parent; - ci->m_flags &= ~(S_DEL_ON_CLS | S_DEL_PENDING); - write_unlock(&ci->m_lock); -- ksmbd_vfs_unlink(file_mnt_user_ns(filp), dir, dentry); -+ ksmbd_vfs_unlink(filp); - write_lock(&ci->m_lock); - } - write_unlock(&ci->m_lock); -@@ -335,6 +333,9 @@ static void __ksmbd_close_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp) - - static struct ksmbd_file *ksmbd_fp_get(struct ksmbd_file *fp) - { -+ if (fp->f_state != FP_INITED) -+ return NULL; -+ - if (!atomic_inc_not_zero(&fp->refcount)) - return NULL; - return fp; -@@ -384,15 +385,20 @@ int ksmbd_close_fd(struct ksmbd_work *work, u64 id) - return 0; - - ft = &work->sess->file_table; -- read_lock(&ft->lock); -+ write_lock(&ft->lock); - fp = idr_find(ft->idr, id); - if (fp) { - set_close_state_blocked_works(fp); - -- if (!atomic_dec_and_test(&fp->refcount)) -+ if (fp->f_state != FP_INITED) - fp = NULL; -+ else { -+ fp->f_state = FP_CLOSED; -+ if (!atomic_dec_and_test(&fp->refcount)) -+ fp = NULL; -+ } - } -- read_unlock(&ft->lock); -+ write_unlock(&ft->lock); - - if (!fp) - return -EINVAL; -@@ -482,12 +488,15 @@ struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid) - return fp; - } - --struct ksmbd_file *ksmbd_lookup_fd_inode(struct inode *inode) -+struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry) - { - struct ksmbd_file *lfp; - struct ksmbd_inode *ci; -+ struct inode *inode = d_inode(dentry); - -- ci = ksmbd_inode_lookup_by_vfsinode(inode); -+ read_lock(&inode_hash_lock); -+ ci = __ksmbd_inode_lookup(dentry); -+ read_unlock(&inode_hash_lock); - if (!ci) - return NULL; - -@@ -572,6 +581,7 @@ struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp) - fp->tcon = work->tcon; - fp->volatile_id = KSMBD_NO_FID; - fp->persistent_id = KSMBD_NO_FID; -+ fp->f_state = FP_NEW; - fp->f_ci = ksmbd_inode_get(fp); - - if (!fp->f_ci) { -@@ -593,6 +603,17 @@ err_out: - return ERR_PTR(ret); - } - -+void ksmbd_update_fstate(struct ksmbd_file_table *ft, struct ksmbd_file *fp, -+ unsigned int state) -+{ -+ if (!fp) -+ return; -+ -+ write_lock(&ft->lock); -+ fp->f_state = state; -+ write_unlock(&ft->lock); -+} -+ - static int - __close_file_table_ids(struct ksmbd_file_table *ft, - struct ksmbd_tree_connect *tcon, -diff --git a/fs/smb/server/vfs_cache.h b/fs/smb/server/vfs_cache.h -index fcb13413fa8d9..a528f0cc775ae 100644 ---- a/fs/smb/server/vfs_cache.h -+++ b/fs/smb/server/vfs_cache.h -@@ -51,7 +51,7 @@ struct ksmbd_inode { - atomic_t op_count; - /* opinfo count for streams */ - atomic_t sop_count; -- struct inode *m_inode; -+ struct dentry *m_de; - unsigned int m_flags; - struct hlist_node m_hash; - struct list_head m_fp_list; -@@ -60,6 +60,12 @@ struct ksmbd_inode { - __le32 m_fattr; - }; - -+enum { -+ FP_NEW = 0, -+ FP_INITED, -+ FP_CLOSED -+}; -+ - struct ksmbd_file { - struct file *filp; - u64 persistent_id; -@@ -98,6 +104,8 @@ struct ksmbd_file { - /* if ls is happening on directory, below is valid*/ - struct ksmbd_readdir_data readdir_data; - int dot_dotdot[2]; -+ unsigned int f_state; -+ bool reserve_lease_break; - }; - - static inline void set_ctx_actor(struct dir_context *ctx, -@@ -131,9 +139,11 @@ struct ksmbd_file *ksmbd_lookup_foreign_fd(struct ksmbd_work *work, u64 id); - struct ksmbd_file *ksmbd_lookup_fd_slow(struct ksmbd_work *work, u64 id, - u64 pid); - void ksmbd_fd_put(struct ksmbd_work *work, struct ksmbd_file *fp); -+struct ksmbd_inode *ksmbd_inode_lookup_lock(struct dentry *d); -+void ksmbd_inode_put(struct ksmbd_inode *ci); - struct ksmbd_file *ksmbd_lookup_durable_fd(unsigned long long id); - struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid); --struct ksmbd_file *ksmbd_lookup_fd_inode(struct inode *inode); -+struct ksmbd_file *ksmbd_lookup_fd_inode(struct dentry *dentry); - unsigned int ksmbd_open_durable_fd(struct ksmbd_file *fp); - struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp); - void ksmbd_close_tree_conn_fds(struct ksmbd_work *work); -@@ -142,6 +152,8 @@ int ksmbd_close_inode_fds(struct ksmbd_work *work, struct inode *inode); - int ksmbd_init_global_file_table(void); - void ksmbd_free_global_file_table(void); - void ksmbd_set_fd_limit(unsigned long limit); -+void ksmbd_update_fstate(struct ksmbd_file_table *ft, struct ksmbd_file *fp, -+ unsigned int state); - - /* - * INODE hash -@@ -155,7 +167,7 @@ enum KSMBD_INODE_STATUS { - KSMBD_INODE_STATUS_PENDING_DELETE, - }; - --int ksmbd_query_inode_status(struct inode *inode); -+int ksmbd_query_inode_status(struct dentry *dentry); - bool ksmbd_inode_pending_delete(struct ksmbd_file *fp); - void ksmbd_set_inode_pending_delete(struct ksmbd_file *fp); - void ksmbd_clear_inode_pending_delete(struct ksmbd_file *fp); -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 57674b3c58774..07a7eeef47d39 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -565,7 +565,7 @@ struct request_queue { - #define QUEUE_FLAG_NOXMERGES 9 /* No extended merges */ - #define QUEUE_FLAG_ADD_RANDOM 10 /* Contributes to random pool */ - #define QUEUE_FLAG_SAME_FORCE 12 /* force complete on same CPU */ --#define QUEUE_FLAG_HW_WC 18 /* Write back caching supported */ -+#define QUEUE_FLAG_HW_WC 13 /* Write back caching supported */ - #define QUEUE_FLAG_INIT_DONE 14 /* queue is initialized */ - #define QUEUE_FLAG_STABLE_WRITES 15 /* don't modify blks until WB is done */ - #define QUEUE_FLAG_POLL 16 /* IO polling enabled if set */ -diff --git a/include/linux/export-internal.h b/include/linux/export-internal.h -index fe7e6ba918f10..29de29af9546c 100644 ---- a/include/linux/export-internal.h -+++ b/include/linux/export-internal.h -@@ -12,6 +12,7 @@ - - #define SYMBOL_CRC(sym, crc, sec) \ - asm(".section \"___kcrctab" sec "+" #sym "\",\"a\"" "\n" \ -+ ".balign 4" "\n" \ - "__crc_" #sym ":" "\n" \ - ".long " #crc "\n" \ - ".previous" "\n") -diff --git a/include/linux/module.h b/include/linux/module.h -index ec61fb53979a9..35876e89eb93f 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -879,8 +879,17 @@ static inline bool module_sig_ok(struct module *module) - } - #endif /* CONFIG_MODULE_SIG */ - -+#if defined(CONFIG_MODULES) && defined(CONFIG_KALLSYMS) - int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, - struct module *, unsigned long), - void *data); -+#else -+static inline int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, -+ struct module *, unsigned long), -+ void *data) -+{ -+ return -EOPNOTSUPP; -+} -+#endif /* CONFIG_MODULES && CONFIG_KALLSYMS */ - - #endif /* _LINUX_MODULE_H */ -diff --git a/include/linux/namei.h b/include/linux/namei.h -index 00fee52df8423..5c0149603dc3d 100644 ---- a/include/linux/namei.h -+++ b/include/linux/namei.h -@@ -57,12 +57,18 @@ static inline int user_path_at(int dfd, const char __user *name, unsigned flags, - return user_path_at_empty(dfd, name, flags, path, NULL); - } - -+struct dentry *lookup_one_qstr_excl(const struct qstr *name, -+ struct dentry *base, -+ unsigned int flags); - extern int kern_path(const char *, unsigned, struct path *); - - extern struct dentry *kern_path_create(int, const char *, struct path *, unsigned int); - extern struct dentry *user_path_create(int, const char __user *, struct path *, unsigned int); - extern void done_path_create(struct path *, struct dentry *); - extern struct dentry *kern_path_locked(const char *, struct path *); -+int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, -+ struct path *parent, struct qstr *last, int *type, -+ const struct path *root); - - extern struct dentry *try_lookup_one_len(const char *, struct dentry *, int); - extern struct dentry *lookup_one_len(const char *, struct dentry *, int); -@@ -81,6 +87,7 @@ extern int follow_down(struct path *); - extern int follow_up(struct path *); - - extern struct dentry *lock_rename(struct dentry *, struct dentry *); -+extern struct dentry *lock_rename_child(struct dentry *, struct dentry *); - extern void unlock_rename(struct dentry *, struct dentry *); - - extern int __must_check nd_jump_link(const struct path *path); -diff --git a/include/linux/property.h b/include/linux/property.h -index 117cc200c656d..587b5b666b5bb 100644 ---- a/include/linux/property.h -+++ b/include/linux/property.h -@@ -32,7 +32,12 @@ enum dev_dma_attr { - DEV_DMA_COHERENT, - }; - --struct fwnode_handle *dev_fwnode(const struct device *dev); -+const struct fwnode_handle *__dev_fwnode_const(const struct device *dev); -+struct fwnode_handle *__dev_fwnode(struct device *dev); -+#define dev_fwnode(dev) \ -+ _Generic((dev), \ -+ const struct device *: __dev_fwnode_const, \ -+ struct device *: __dev_fwnode)(dev) - - bool device_property_present(struct device *dev, const char *propname); - int device_property_read_u8_array(struct device *dev, const char *propname, -diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h -index 877395e075afe..8e9054d9f6df0 100644 ---- a/include/linux/spi/spi.h -+++ b/include/linux/spi/spi.h -@@ -263,6 +263,26 @@ static inline void *spi_get_drvdata(struct spi_device *spi) - return dev_get_drvdata(&spi->dev); - } - -+static inline u8 spi_get_chipselect(const struct spi_device *spi, u8 idx) -+{ -+ return spi->chip_select; -+} -+ -+static inline void spi_set_chipselect(struct spi_device *spi, u8 idx, u8 chipselect) -+{ -+ spi->chip_select = chipselect; -+} -+ -+static inline struct gpio_desc *spi_get_csgpiod(const struct spi_device *spi, u8 idx) -+{ -+ return spi->cs_gpiod; -+} -+ -+static inline void spi_set_csgpiod(struct spi_device *spi, u8 idx, struct gpio_desc *csgpiod) -+{ -+ spi->cs_gpiod = csgpiod; -+} -+ - struct spi_message; - - /** -@@ -1515,6 +1535,9 @@ extern void spi_unregister_device(struct spi_device *spi); - extern const struct spi_device_id * - spi_get_device_id(const struct spi_device *sdev); - -+extern const void * -+spi_get_device_match_data(const struct spi_device *sdev); -+ - static inline bool - spi_transfer_is_last(struct spi_controller *ctlr, struct spi_transfer *xfer) - { -diff --git a/kernel/module/kallsyms.c b/kernel/module/kallsyms.c -index f5c5c9175333d..4523f99b03589 100644 ---- a/kernel/module/kallsyms.c -+++ b/kernel/module/kallsyms.c -@@ -494,7 +494,6 @@ unsigned long module_kallsyms_lookup_name(const char *name) - return ret; - } - --#ifdef CONFIG_LIVEPATCH - int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, - struct module *, unsigned long), - void *data) -@@ -531,4 +530,3 @@ out: - mutex_unlock(&module_mutex); - return ret; - } --#endif /* CONFIG_LIVEPATCH */ -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 61803208706a5..06d52525407b8 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -705,48 +705,6 @@ rb_time_read_cmpxchg(local_t *l, unsigned long expect, unsigned long set) - return ret == expect; - } - --static int rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) --{ -- unsigned long cnt, top, bottom, msb; -- unsigned long cnt2, top2, bottom2, msb2; -- u64 val; -- -- /* Any interruptions in this function should cause a failure */ -- cnt = local_read(&t->cnt); -- -- /* The cmpxchg always fails if it interrupted an update */ -- if (!__rb_time_read(t, &val, &cnt2)) -- return false; -- -- if (val != expect) -- return false; -- -- if ((cnt & 3) != cnt2) -- return false; -- -- cnt2 = cnt + 1; -- -- rb_time_split(val, &top, &bottom, &msb); -- msb = rb_time_val_cnt(msb, cnt); -- top = rb_time_val_cnt(top, cnt); -- bottom = rb_time_val_cnt(bottom, cnt); -- -- rb_time_split(set, &top2, &bottom2, &msb2); -- msb2 = rb_time_val_cnt(msb2, cnt); -- top2 = rb_time_val_cnt(top2, cnt2); -- bottom2 = rb_time_val_cnt(bottom2, cnt2); -- -- if (!rb_time_read_cmpxchg(&t->cnt, cnt, cnt2)) -- return false; -- if (!rb_time_read_cmpxchg(&t->msb, msb, msb2)) -- return false; -- if (!rb_time_read_cmpxchg(&t->top, top, top2)) -- return false; -- if (!rb_time_read_cmpxchg(&t->bottom, bottom, bottom2)) -- return false; -- return true; --} -- - #else /* 64 bits */ - - /* local64_t always succeeds */ -@@ -760,13 +718,6 @@ static void rb_time_set(rb_time_t *t, u64 val) - { - local64_set(&t->time, val); - } -- --static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set) --{ -- u64 val; -- val = local64_cmpxchg(&t->time, expect, set); -- return val == expect; --} - #endif - - /* -@@ -935,9 +886,14 @@ static __always_inline bool full_hit(struct trace_buffer *buffer, int cpu, int f - if (!nr_pages || !full) - return true; - -- dirty = ring_buffer_nr_dirty_pages(buffer, cpu); -+ /* -+ * Add one as dirty will never equal nr_pages, as the sub-buffer -+ * that the writer is on is not counted as dirty. -+ * This is needed if "buffer_percent" is set to 100. -+ */ -+ dirty = ring_buffer_nr_dirty_pages(buffer, cpu) + 1; - -- return (dirty * 100) > (full * nr_pages); -+ return (dirty * 100) >= (full * nr_pages); - } - - /* -@@ -997,7 +953,8 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) - /* make sure the waiters see the new index */ - smp_wmb(); - -- rb_wake_up_waiters(&rbwork->work); -+ /* This can be called in any context */ -+ irq_work_queue(&rbwork->work); - } - - /** -@@ -2981,25 +2938,6 @@ static unsigned rb_calculate_event_length(unsigned length) - return length; - } - --static u64 rb_time_delta(struct ring_buffer_event *event) --{ -- switch (event->type_len) { -- case RINGBUF_TYPE_PADDING: -- return 0; -- -- case RINGBUF_TYPE_TIME_EXTEND: -- return rb_event_time_stamp(event); -- -- case RINGBUF_TYPE_TIME_STAMP: -- return 0; -- -- case RINGBUF_TYPE_DATA: -- return event->time_delta; -- default: -- return 0; -- } --} -- - static inline int - rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, - struct ring_buffer_event *event) -@@ -3008,8 +2946,6 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, - struct buffer_page *bpage; - unsigned long index; - unsigned long addr; -- u64 write_stamp; -- u64 delta; - - new_index = rb_event_index(event); - old_index = new_index + rb_event_ts_length(event); -@@ -3018,14 +2954,10 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, - - bpage = READ_ONCE(cpu_buffer->tail_page); - -- delta = rb_time_delta(event); -- -- if (!rb_time_read(&cpu_buffer->write_stamp, &write_stamp)) -- return 0; -- -- /* Make sure the write stamp is read before testing the location */ -- barrier(); -- -+ /* -+ * Make sure the tail_page is still the same and -+ * the next write location is the end of this event -+ */ - if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) { - unsigned long write_mask = - local_read(&bpage->write) & ~RB_WRITE_MASK; -@@ -3036,20 +2968,20 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, - * to make sure that the next event adds an absolute - * value and does not rely on the saved write stamp, which - * is now going to be bogus. -+ * -+ * By setting the before_stamp to zero, the next event -+ * is not going to use the write_stamp and will instead -+ * create an absolute timestamp. This means there's no -+ * reason to update the wirte_stamp! - */ - rb_time_set(&cpu_buffer->before_stamp, 0); - -- /* Something came in, can't discard */ -- if (!rb_time_cmpxchg(&cpu_buffer->write_stamp, -- write_stamp, write_stamp - delta)) -- return 0; -- - /* - * If an event were to come in now, it would see that the - * write_stamp and the before_stamp are different, and assume - * that this event just added itself before updating - * the write stamp. The interrupting event will fix the -- * write stamp for us, and use the before stamp as its delta. -+ * write stamp for us, and use an absolute timestamp. - */ - - /* -@@ -3488,7 +3420,7 @@ static void check_buffer(struct ring_buffer_per_cpu *cpu_buffer, - return; - - /* -- * If this interrupted another event, -+ * If this interrupted another event, - */ - if (atomic_inc_return(this_cpu_ptr(&checking)) != 1) - goto out; -@@ -3632,20 +3564,36 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer, - } else { - u64 ts; - /* SLOW PATH - Interrupted between A and C */ -- a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after); -- /* Was interrupted before here, write_stamp must be valid */ -+ -+ /* Save the old before_stamp */ -+ a_ok = rb_time_read(&cpu_buffer->before_stamp, &info->before); - RB_WARN_ON(cpu_buffer, !a_ok); -+ -+ /* -+ * Read a new timestamp and update the before_stamp to make -+ * the next event after this one force using an absolute -+ * timestamp. This is in case an interrupt were to come in -+ * between E and F. -+ */ - ts = rb_time_stamp(cpu_buffer->buffer); -+ rb_time_set(&cpu_buffer->before_stamp, ts); -+ - barrier(); -- /*E*/ if (write == (local_read(&tail_page->write) & RB_WRITE_MASK) && -- info->after < ts && -- rb_time_cmpxchg(&cpu_buffer->write_stamp, -- info->after, ts)) { -- /* Nothing came after this event between C and E */ -+ /*E*/ a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after); -+ /* Was interrupted before here, write_stamp must be valid */ -+ RB_WARN_ON(cpu_buffer, !a_ok); -+ barrier(); -+ /*F*/ if (write == (local_read(&tail_page->write) & RB_WRITE_MASK) && -+ info->after == info->before && info->after < ts) { -+ /* -+ * Nothing came after this event between C and F, it is -+ * safe to use info->after for the delta as it -+ * matched info->before and is still valid. -+ */ - info->delta = ts - info->after; - } else { - /* -- * Interrupted between C and E: -+ * Interrupted between C and F: - * Lost the previous events time stamp. Just set the - * delta to zero, and this will be the same time as - * the event this event interrupted. And the events that -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 87eca95b57fb3..deae65af76ecf 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -1850,6 +1850,9 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu, - __update_max_tr(tr, tsk, cpu); - - arch_spin_unlock(&tr->max_lock); -+ -+ /* Any waiters on the old snapshot buffer need to wake up */ -+ ring_buffer_wake_waiters(tr->array_buffer.buffer, RING_BUFFER_ALL_CPUS); - } - - /** -@@ -1901,12 +1904,23 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu) - - static int wait_on_pipe(struct trace_iterator *iter, int full) - { -+ int ret; -+ - /* Iterators are static, they should be filled or empty */ - if (trace_buffer_iter(iter, iter->cpu_file)) - return 0; - -- return ring_buffer_wait(iter->array_buffer->buffer, iter->cpu_file, -- full); -+ ret = ring_buffer_wait(iter->array_buffer->buffer, iter->cpu_file, full); -+ -+#ifdef CONFIG_TRACER_MAX_TRACE -+ /* -+ * Make sure this is still the snapshot buffer, as if a snapshot were -+ * to happen, this would now be the main buffer. -+ */ -+ if (iter->snapshot) -+ iter->array_buffer = &iter->tr->max_buffer; -+#endif -+ return ret; - } - - #ifdef CONFIG_FTRACE_STARTUP_TEST -@@ -8433,7 +8447,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, - - wait_index = READ_ONCE(iter->wait_index); - -- ret = wait_on_pipe(iter, iter->tr->buffer_percent); -+ ret = wait_on_pipe(iter, iter->snapshot ? 0 : iter->tr->buffer_percent); - if (ret) - goto out; - -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index a34a4fcdab7b1..e3993d19687db 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -714,14 +714,31 @@ static int count_symbols(void *data, unsigned long unused) - return 0; - } - -+struct sym_count_ctx { -+ unsigned int count; -+ const char *name; -+}; -+ -+static int count_mod_symbols(void *data, const char *name, -+ struct module *module, unsigned long unused) -+{ -+ struct sym_count_ctx *ctx = data; -+ -+ if (strcmp(name, ctx->name) == 0) -+ ctx->count++; -+ -+ return 0; -+} -+ - static unsigned int number_of_same_symbols(char *func_name) - { -- unsigned int count; -+ struct sym_count_ctx ctx = { .count = 0, .name = func_name }; -+ -+ kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count); - -- count = 0; -- kallsyms_on_each_match_symbol(count_symbols, func_name, &count); -+ module_kallsyms_on_each_symbol(count_mod_symbols, &ctx); - -- return count; -+ return ctx.count; - } - - static int __trace_kprobe_create(int argc, const char *argv[]) -diff --git a/mm/filemap.c b/mm/filemap.c -index d633ab8cd56f1..10fe6430693bd 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -2744,6 +2744,15 @@ ssize_t filemap_read(struct kiocb *iocb, struct iov_iter *iter, - goto put_folios; - end_offset = min_t(loff_t, isize, iocb->ki_pos + iter->count); - -+ /* -+ * Pairs with a barrier in -+ * block_write_end()->mark_buffer_dirty() or other page -+ * dirtying routines like iomap_write_end() to ensure -+ * changes to page contents are visible before we see -+ * increased inode size. -+ */ -+ smp_rmb(); -+ - /* - * Once we start copying data, we don't want to be touching any - * cachelines that might be contended: -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 99de0328d1bed..ebd717157c813 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1421,7 +1421,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, - * This check implies we don't kill processes if their pages - * are in the swap cache early. Those are always late kills. - */ -- if (!page_mapped(hpage)) -+ if (!page_mapped(p)) - return true; - - if (PageKsm(p)) { -@@ -1477,10 +1477,10 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, - try_to_unmap(folio, ttu); - } - -- unmap_success = !page_mapped(hpage); -+ unmap_success = !page_mapped(p); - if (!unmap_success) - pr_err("%#lx: failed to unmap page (mapcount=%d)\n", -- pfn, page_mapcount(hpage)); -+ pfn, page_mapcount(p)); - - /* - * try_to_unmap() might put mlocked page in lru cache, so call -@@ -1560,7 +1560,7 @@ static void unmap_and_kill(struct list_head *to_kill, unsigned long pfn, - * mapping being torn down is communicated in siginfo, see - * kill_proc() - */ -- loff_t start = (index << PAGE_SHIFT) & ~(size - 1); -+ loff_t start = ((loff_t)index << PAGE_SHIFT) & ~(size - 1); - - unmap_mapping_range(mapping, start, size, 0); - } -diff --git a/mm/migrate.c b/mm/migrate.c -index 9372a826e6d08..91bd69c61148e 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -388,6 +388,7 @@ int folio_migrate_mapping(struct address_space *mapping, - int dirty; - int expected_count = folio_expected_refs(mapping, folio) + extra_count; - long nr = folio_nr_pages(folio); -+ long entries, i; - - if (!mapping) { - /* Anonymous page without mapping */ -@@ -425,8 +426,10 @@ int folio_migrate_mapping(struct address_space *mapping, - folio_set_swapcache(newfolio); - newfolio->private = folio_get_private(folio); - } -+ entries = nr; - } else { - VM_BUG_ON_FOLIO(folio_test_swapcache(folio), folio); -+ entries = 1; - } - - /* Move dirty while page refs frozen and newpage not yet exposed */ -@@ -436,7 +439,11 @@ int folio_migrate_mapping(struct address_space *mapping, - folio_set_dirty(newfolio); - } - -- xas_store(&xas, newfolio); -+ /* Swap cache still stores N entries instead of a high-order entry */ -+ for (i = 0; i < entries; i++) { -+ xas_store(&xas, newfolio); -+ xas_next(&xas); -+ } - - /* - * Drop cache reference from old page by unfreezing -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 05fa5141af516..3d6ebb9877a4e 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -9480,7 +9480,7 @@ static void nft_set_commit_update(struct list_head *set_update_list) - list_for_each_entry_safe(set, next, set_update_list, pending_update) { - list_del_init(&set->pending_update); - -- if (!set->ops->commit) -+ if (!set->ops->commit || set->dead) - continue; - - set->ops->commit(set); diff --git a/patch/kernel/odroidxu4-current/patch-6.1.71-72.patch b/patch/kernel/odroidxu4-current/patch-6.1.71-72.patch deleted file mode 100644 index 2496793b28..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.71-72.patch +++ /dev/null @@ -1,9332 +0,0 @@ -diff --git a/MAINTAINERS b/MAINTAINERS -index 07a9c274c0e29..13d1078808bb5 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -10803,6 +10803,8 @@ L: linux-kernel@vger.kernel.org - S: Maintained - T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core - F: kernel/irq/ -+F: include/linux/group_cpus.h -+F: lib/group_cpus.c - - IRQCHIP DRIVERS - M: Thomas Gleixner -diff --git a/Makefile b/Makefile -index 2840e36fd5596..bad3387b3251c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 71 -+SUBLEVEL = 72 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/Kconfig b/arch/Kconfig -index b60d271bf76a9..14273a6203dfc 100644 ---- a/arch/Kconfig -+++ b/arch/Kconfig -@@ -34,6 +34,9 @@ config ARCH_HAS_SUBPAGE_FAULTS - config HOTPLUG_SMT - bool - -+config SMT_NUM_THREADS_DYNAMIC -+ bool -+ - config GENERIC_ENTRY - bool - -diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c -index 26cbce1353387..b2f5f4f28705f 100644 ---- a/arch/arm/mach-sunxi/mc_smp.c -+++ b/arch/arm/mach-sunxi/mc_smp.c -@@ -808,12 +808,12 @@ static int __init sunxi_mc_smp_init(void) - break; - } - -- is_a83t = sunxi_mc_smp_data[i].is_a83t; -- - of_node_put(node); - if (ret) - return -ENODEV; - -+ is_a83t = sunxi_mc_smp_data[i].is_a83t; -+ - if (!sunxi_mc_smp_cpu_table_init()) - return -EINVAL; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi -index a5c0c788969fb..43ee28db61aa8 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi -@@ -150,15 +150,15 @@ - }; - - &psci { -- /delete-node/ cpu0; -- /delete-node/ cpu1; -- /delete-node/ cpu2; -- /delete-node/ cpu3; -- /delete-node/ cpu4; -- /delete-node/ cpu5; -- /delete-node/ cpu6; -- /delete-node/ cpu7; -- /delete-node/ cpu-cluster0; -+ /delete-node/ power-domain-cpu0; -+ /delete-node/ power-domain-cpu1; -+ /delete-node/ power-domain-cpu2; -+ /delete-node/ power-domain-cpu3; -+ /delete-node/ power-domain-cpu4; -+ /delete-node/ power-domain-cpu5; -+ /delete-node/ power-domain-cpu6; -+ /delete-node/ power-domain-cpu7; -+ /delete-node/ power-domain-cluster; - }; - - &cpus { -@@ -351,7 +351,9 @@ - - - &apps_rsc { -- pm8998-rpmh-regulators { -+ /delete-property/ power-domains; -+ -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -633,7 +635,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts -index c9efcb894a52f..8c9ccf5b4ea41 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts -@@ -271,7 +271,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - vdd-s1-supply = <&vph_pwr>; -@@ -396,7 +396,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi -index 20f275f8694dc..e2921640880a1 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi -@@ -166,7 +166,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -419,7 +419,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -@@ -433,7 +433,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-2 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts -index 64958dee17d8b..b47e333aa3510 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts -@@ -117,7 +117,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -382,7 +382,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -@@ -396,7 +396,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-2 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi -index 392461c29e76e..0713b774a97be 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi -@@ -144,7 +144,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -280,7 +280,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -@@ -294,7 +294,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-2 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts -index 83261c9bb4f23..b65c35865dab9 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts -@@ -110,7 +110,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -375,7 +375,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -@@ -389,7 +389,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-2 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi -index d6918e6d19799..249a715d5aae1 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi -@@ -78,7 +78,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -308,7 +308,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -@@ -319,7 +319,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-2 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts -index 0f470cf1ed1c1..6d6b3dd699475 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts -@@ -125,7 +125,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts -index 093b04359ec39..ffbe45a99b74a 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts -@@ -143,7 +143,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -@@ -343,7 +343,7 @@ - }; - }; - -- pmi8998-rpmh-regulators { -+ regulators-1 { - compatible = "qcom,pmi8998-rpmh-regulators"; - qcom,pmic-id = "b"; - -@@ -355,7 +355,7 @@ - }; - }; - -- pm8005-rpmh-regulators { -+ regulators-2 { - compatible = "qcom,pm8005-rpmh-regulators"; - qcom,pmic-id = "c"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts -index 74f43da51fa50..48a41ace8fc58 100644 ---- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts -+++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts -@@ -99,7 +99,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -diff --git a/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts b/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts -index d028a7eb364a6..c169d2870bdf4 100644 ---- a/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts -+++ b/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts -@@ -129,7 +129,7 @@ - }; - - &apps_rsc { -- pm8998-rpmh-regulators { -+ regulators-0 { - compatible = "qcom,pm8998-rpmh-regulators"; - qcom,pmic-id = "a"; - -diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c -index f043a7ff220b7..28fa80fd69fa0 100644 ---- a/arch/s390/kernel/perf_cpum_cf.c -+++ b/arch/s390/kernel/perf_cpum_cf.c -@@ -2,7 +2,7 @@ - /* - * Performance event support for s390x - CPU-measurement Counter Facility - * -- * Copyright IBM Corp. 2012, 2021 -+ * Copyright IBM Corp. 2012, 2022 - * Author(s): Hendrik Brueckner - * Thomas Richter - */ -@@ -434,6 +434,12 @@ static void cpumf_hw_inuse(void) - mutex_unlock(&pmc_reserve_mutex); - } - -+static int is_userspace_event(u64 ev) -+{ -+ return cpumf_generic_events_user[PERF_COUNT_HW_CPU_CYCLES] == ev || -+ cpumf_generic_events_user[PERF_COUNT_HW_INSTRUCTIONS] == ev; -+} -+ - static int __hw_perf_event_init(struct perf_event *event, unsigned int type) - { - struct perf_event_attr *attr = &event->attr; -@@ -456,19 +462,26 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type) - if (is_sampling_event(event)) /* No sampling support */ - return -ENOENT; - ev = attr->config; -- /* Count user space (problem-state) only */ - if (!attr->exclude_user && attr->exclude_kernel) { -- if (ev >= ARRAY_SIZE(cpumf_generic_events_user)) -- return -EOPNOTSUPP; -- ev = cpumf_generic_events_user[ev]; -- -- /* No support for kernel space counters only */ -+ /* -+ * Count user space (problem-state) only -+ * Handle events 32 and 33 as 0:u and 1:u -+ */ -+ if (!is_userspace_event(ev)) { -+ if (ev >= ARRAY_SIZE(cpumf_generic_events_user)) -+ return -EOPNOTSUPP; -+ ev = cpumf_generic_events_user[ev]; -+ } - } else if (!attr->exclude_kernel && attr->exclude_user) { -+ /* No support for kernel space counters only */ - return -EOPNOTSUPP; -- } else { /* Count user and kernel space */ -- if (ev >= ARRAY_SIZE(cpumf_generic_events_basic)) -- return -EOPNOTSUPP; -- ev = cpumf_generic_events_basic[ev]; -+ } else { -+ /* Count user and kernel space, incl. events 32 + 33 */ -+ if (!is_userspace_event(ev)) { -+ if (ev >= ARRAY_SIZE(cpumf_generic_events_basic)) -+ return -EOPNOTSUPP; -+ ev = cpumf_generic_events_basic[ev]; -+ } - } - break; - -diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c -index 9a0ce5315f36d..3cbb461820666 100644 ---- a/arch/s390/mm/vmem.c -+++ b/arch/s390/mm/vmem.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -44,8 +45,11 @@ void *vmem_crst_alloc(unsigned long val) - unsigned long *table; - - table = vmem_alloc_pages(CRST_ALLOC_ORDER); -- if (table) -- crst_table_init(table, val); -+ if (!table) -+ return NULL; -+ crst_table_init(table, val); -+ if (slab_is_available()) -+ arch_set_page_dat(virt_to_page(table), CRST_ALLOC_ORDER); - return table; - } - -diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c -index 2fb5e1541efc1..949129443b1c0 100644 ---- a/arch/x86/events/intel/core.c -+++ b/arch/x86/events/intel/core.c -@@ -4033,12 +4033,17 @@ static struct perf_guest_switch_msr *intel_guest_get_msrs(int *nr, void *data) - u64 pebs_mask = cpuc->pebs_enabled & x86_pmu.pebs_capable; - int global_ctrl, pebs_enable; - -+ /* -+ * In addition to obeying exclude_guest/exclude_host, remove bits being -+ * used for PEBS when running a guest, because PEBS writes to virtual -+ * addresses (not physical addresses). -+ */ - *nr = 0; - global_ctrl = (*nr)++; - arr[global_ctrl] = (struct perf_guest_switch_msr){ - .msr = MSR_CORE_PERF_GLOBAL_CTRL, - .host = intel_ctrl & ~cpuc->intel_ctrl_guest_mask, -- .guest = intel_ctrl & (~cpuc->intel_ctrl_host_mask | ~pebs_mask), -+ .guest = intel_ctrl & ~cpuc->intel_ctrl_host_mask & ~pebs_mask, - }; - - if (!x86_pmu.pebs) -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index ea155f0cf545c..6120f25b0d5cc 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -549,7 +549,8 @@ static void kprobe_emulate_call_indirect(struct kprobe *p, struct pt_regs *regs) - { - unsigned long offs = addrmode_regoffs[p->ainsn.indirect.reg]; - -- int3_emulate_call(regs, regs_get_register(regs, offs)); -+ int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + p->ainsn.size); -+ int3_emulate_jmp(regs, regs_get_register(regs, offs)); - } - NOKPROBE_SYMBOL(kprobe_emulate_call_indirect); - -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 4686c1d9d0cfd..b69aee6245e4a 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -893,6 +893,10 @@ static void emit_nops(u8 **pprog, int len) - - #define INSN_SZ_DIFF (((addrs[i] - addrs[i - 1]) - (prog - temp))) - -+/* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */ -+#define RESTORE_TAIL_CALL_CNT(stack) \ -+ EMIT3_off32(0x48, 0x8B, 0x85, -round_up(stack, 8) - 8) -+ - static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, u8 *rw_image, - int oldproglen, struct jit_context *ctx, bool jmp_padding) - { -@@ -1436,9 +1440,7 @@ st: if (is_imm8(insn->off)) - case BPF_JMP | BPF_CALL: - func = (u8 *) __bpf_call_base + imm32; - if (tail_call_reachable) { -- /* mov rax, qword ptr [rbp - rounded_stack_depth - 8] */ -- EMIT3_off32(0x48, 0x8B, 0x85, -- -round_up(bpf_prog->aux->stack_depth, 8) - 8); -+ RESTORE_TAIL_CALL_CNT(bpf_prog->aux->stack_depth); - if (!imm32 || emit_call(&prog, func, image + addrs[i - 1] + 7)) - return -EINVAL; - } else { -@@ -1623,16 +1625,24 @@ emit_cond_jmp: /* Convert BPF opcode to x86 */ - break; - - case BPF_JMP | BPF_JA: -- if (insn->off == -1) -- /* -1 jmp instructions will always jump -- * backwards two bytes. Explicitly handling -- * this case avoids wasting too many passes -- * when there are long sequences of replaced -- * dead code. -- */ -- jmp_offset = -2; -- else -- jmp_offset = addrs[i + insn->off] - addrs[i]; -+ case BPF_JMP32 | BPF_JA: -+ if (BPF_CLASS(insn->code) == BPF_JMP) { -+ if (insn->off == -1) -+ /* -1 jmp instructions will always jump -+ * backwards two bytes. Explicitly handling -+ * this case avoids wasting too many passes -+ * when there are long sequences of replaced -+ * dead code. -+ */ -+ jmp_offset = -2; -+ else -+ jmp_offset = addrs[i + insn->off] - addrs[i]; -+ } else { -+ if (insn->imm == -1) -+ jmp_offset = -2; -+ else -+ jmp_offset = addrs[i + insn->imm] - addrs[i]; -+ } - - if (!jmp_offset) { - /* -@@ -1750,63 +1760,37 @@ emit_jmp: - return proglen; - } - --static void save_regs(const struct btf_func_model *m, u8 **prog, int nr_args, -+static void save_regs(const struct btf_func_model *m, u8 **prog, int nr_regs, - int stack_size) - { -- int i, j, arg_size, nr_regs; -+ int i; -+ - /* Store function arguments to stack. - * For a function that accepts two pointers the sequence will be: - * mov QWORD PTR [rbp-0x10],rdi - * mov QWORD PTR [rbp-0x8],rsi - */ -- for (i = 0, j = 0; i < min(nr_args, 6); i++) { -- if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) { -- nr_regs = (m->arg_size[i] + 7) / 8; -- arg_size = 8; -- } else { -- nr_regs = 1; -- arg_size = m->arg_size[i]; -- } -- -- while (nr_regs) { -- emit_stx(prog, bytes_to_bpf_size(arg_size), -- BPF_REG_FP, -- j == 5 ? X86_REG_R9 : BPF_REG_1 + j, -- -(stack_size - j * 8)); -- nr_regs--; -- j++; -- } -- } -+ for (i = 0; i < min(nr_regs, 6); i++) -+ emit_stx(prog, BPF_DW, BPF_REG_FP, -+ i == 5 ? X86_REG_R9 : BPF_REG_1 + i, -+ -(stack_size - i * 8)); - } - --static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_args, -+static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_regs, - int stack_size) - { -- int i, j, arg_size, nr_regs; -+ int i; - - /* Restore function arguments from stack. - * For a function that accepts two pointers the sequence will be: - * EMIT4(0x48, 0x8B, 0x7D, 0xF0); mov rdi,QWORD PTR [rbp-0x10] - * EMIT4(0x48, 0x8B, 0x75, 0xF8); mov rsi,QWORD PTR [rbp-0x8] - */ -- for (i = 0, j = 0; i < min(nr_args, 6); i++) { -- if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) { -- nr_regs = (m->arg_size[i] + 7) / 8; -- arg_size = 8; -- } else { -- nr_regs = 1; -- arg_size = m->arg_size[i]; -- } -- -- while (nr_regs) { -- emit_ldx(prog, bytes_to_bpf_size(arg_size), -- j == 5 ? X86_REG_R9 : BPF_REG_1 + j, -- BPF_REG_FP, -- -(stack_size - j * 8)); -- nr_regs--; -- j++; -- } -- } -+ for (i = 0; i < min(nr_regs, 6); i++) -+ emit_ldx(prog, BPF_DW, -+ i == 5 ? X86_REG_R9 : BPF_REG_1 + i, -+ BPF_REG_FP, -+ -(stack_size - i * 8)); - } - - static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog, -@@ -2031,8 +2015,8 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - struct bpf_tramp_links *tlinks, - void *func_addr) - { -- int ret, i, nr_args = m->nr_args, extra_nregs = 0; -- int regs_off, ip_off, args_off, stack_size = nr_args * 8, run_ctx_off; -+ int i, ret, nr_regs = m->nr_args, stack_size = 0; -+ int regs_off, nregs_off, ip_off, run_ctx_off; - struct bpf_tramp_links *fentry = &tlinks[BPF_TRAMP_FENTRY]; - struct bpf_tramp_links *fexit = &tlinks[BPF_TRAMP_FEXIT]; - struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN]; -@@ -2041,17 +2025,14 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - u8 *prog; - bool save_ret; - -- /* x86-64 supports up to 6 arguments. 7+ can be added in the future */ -- if (nr_args > 6) -- return -ENOTSUPP; -- -- for (i = 0; i < MAX_BPF_FUNC_ARGS; i++) { -+ /* extra registers for struct arguments */ -+ for (i = 0; i < m->nr_args; i++) - if (m->arg_flags[i] & BTF_FMODEL_STRUCT_ARG) -- extra_nregs += (m->arg_size[i] + 7) / 8 - 1; -- } -- if (nr_args + extra_nregs > 6) -+ nr_regs += (m->arg_size[i] + 7) / 8 - 1; -+ -+ /* x86-64 supports up to 6 arguments. 7+ can be added in the future */ -+ if (nr_regs > 6) - return -ENOTSUPP; -- stack_size += extra_nregs * 8; - - /* Generated trampoline stack layout: - * -@@ -2065,11 +2046,12 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - * [ ... ] - * RBP - regs_off [ reg_arg1 ] program's ctx pointer - * -- * RBP - args_off [ arg regs count ] always -+ * RBP - nregs_off [ regs count ] always - * - * RBP - ip_off [ traced function ] BPF_TRAMP_F_IP_ARG flag - * - * RBP - run_ctx_off [ bpf_tramp_run_ctx ] -+ * RSP [ tail_call_cnt ] BPF_TRAMP_F_TAIL_CALL_CTX - */ - - /* room for return value of orig_call or fentry prog */ -@@ -2077,11 +2059,12 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - if (save_ret) - stack_size += 8; - -+ stack_size += nr_regs * 8; - regs_off = stack_size; - -- /* args count */ -+ /* regs count */ - stack_size += 8; -- args_off = stack_size; -+ nregs_off = stack_size; - - if (flags & BPF_TRAMP_F_IP_ARG) - stack_size += 8; /* room for IP address argument */ -@@ -2106,14 +2089,16 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - EMIT1(0x55); /* push rbp */ - EMIT3(0x48, 0x89, 0xE5); /* mov rbp, rsp */ - EMIT4(0x48, 0x83, 0xEC, stack_size); /* sub rsp, stack_size */ -+ if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) -+ EMIT1(0x50); /* push rax */ - EMIT1(0x53); /* push rbx */ - - /* Store number of argument registers of the traced function: -- * mov rax, nr_args + extra_nregs -- * mov QWORD PTR [rbp - args_off], rax -+ * mov rax, nr_regs -+ * mov QWORD PTR [rbp - nregs_off], rax - */ -- emit_mov_imm64(&prog, BPF_REG_0, 0, (u32) nr_args + extra_nregs); -- emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -args_off); -+ emit_mov_imm64(&prog, BPF_REG_0, 0, (u32) nr_regs); -+ emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -nregs_off); - - if (flags & BPF_TRAMP_F_IP_ARG) { - /* Store IP address of the traced function: -@@ -2124,7 +2109,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -ip_off); - } - -- save_regs(m, &prog, nr_args, regs_off); -+ save_regs(m, &prog, nr_regs, regs_off); - - if (flags & BPF_TRAMP_F_CALL_ORIG) { - /* arg1: mov rdi, im */ -@@ -2154,11 +2139,17 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - } - - if (flags & BPF_TRAMP_F_CALL_ORIG) { -- restore_regs(m, &prog, nr_args, regs_off); -+ restore_regs(m, &prog, nr_regs, regs_off); -+ -+ if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) -+ /* Before calling the original function, restore the -+ * tail_call_cnt from stack to rax. -+ */ -+ RESTORE_TAIL_CALL_CNT(stack_size); - - if (flags & BPF_TRAMP_F_ORIG_STACK) { -- emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, 8); -- EMIT2(0xff, 0xd0); /* call *rax */ -+ emit_ldx(&prog, BPF_DW, BPF_REG_6, BPF_REG_FP, 8); -+ EMIT2(0xff, 0xd3); /* call *rbx */ - } else { - /* call original function */ - if (emit_call(&prog, orig_call, prog)) { -@@ -2195,7 +2186,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - } - - if (flags & BPF_TRAMP_F_RESTORE_REGS) -- restore_regs(m, &prog, nr_args, regs_off); -+ restore_regs(m, &prog, nr_regs, regs_off); - - /* This needs to be done regardless. If there were fmod_ret programs, - * the return value is only updated on the stack and still needs to be -@@ -2209,7 +2200,12 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i - ret = -EINVAL; - goto cleanup; - } -- } -+ } else if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) -+ /* Before running the original function, restore the -+ * tail_call_cnt from stack to rax. -+ */ -+ RESTORE_TAIL_CALL_CNT(stack_size); -+ - /* restore return value of orig_call or fentry prog back into RAX */ - if (save_ret) - emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8); -diff --git a/block/bdev.c b/block/bdev.c -index d699ecdb32604..b61502ec8da06 100644 ---- a/block/bdev.c -+++ b/block/bdev.c -@@ -507,6 +507,8 @@ struct block_device *bdev_alloc(struct gendisk *disk, u8 partno) - - void bdev_add(struct block_device *bdev, dev_t dev) - { -+ if (bdev_stable_writes(bdev)) -+ mapping_set_stable_writes(bdev->bd_inode->i_mapping); - bdev->bd_dev = dev; - bdev->bd_inode->i_rdev = dev; - bdev->bd_inode->i_ino = dev; -diff --git a/block/blk-mq.c b/block/blk-mq.c -index 100fb0c3114f8..383d94615e502 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -2855,11 +2855,8 @@ static struct request *blk_mq_get_new_requests(struct request_queue *q, - }; - struct request *rq; - -- if (unlikely(bio_queue_enter(bio))) -- return NULL; -- - if (blk_mq_attempt_bio_merge(q, bio, nsegs)) -- goto queue_exit; -+ return NULL; - - rq_qos_throttle(q, bio); - -@@ -2875,35 +2872,23 @@ static struct request *blk_mq_get_new_requests(struct request_queue *q, - rq_qos_cleanup(q, bio); - if (bio->bi_opf & REQ_NOWAIT) - bio_wouldblock_error(bio); --queue_exit: -- blk_queue_exit(q); - return NULL; - } - --static inline struct request *blk_mq_get_cached_request(struct request_queue *q, -- struct blk_plug *plug, struct bio **bio, unsigned int nsegs) -+/* return true if this @rq can be used for @bio */ -+static bool blk_mq_can_use_cached_rq(struct request *rq, struct blk_plug *plug, -+ struct bio *bio) - { -- struct request *rq; -- enum hctx_type type, hctx_type; -+ enum hctx_type type = blk_mq_get_hctx_type(bio->bi_opf); -+ enum hctx_type hctx_type = rq->mq_hctx->type; - -- if (!plug) -- return NULL; -- rq = rq_list_peek(&plug->cached_rq); -- if (!rq || rq->q != q) -- return NULL; -- -- if (blk_mq_attempt_bio_merge(q, *bio, nsegs)) { -- *bio = NULL; -- return NULL; -- } -+ WARN_ON_ONCE(rq_list_peek(&plug->cached_rq) != rq); - -- type = blk_mq_get_hctx_type((*bio)->bi_opf); -- hctx_type = rq->mq_hctx->type; - if (type != hctx_type && - !(type == HCTX_TYPE_READ && hctx_type == HCTX_TYPE_DEFAULT)) -- return NULL; -- if (op_is_flush(rq->cmd_flags) != op_is_flush((*bio)->bi_opf)) -- return NULL; -+ return false; -+ if (op_is_flush(rq->cmd_flags) != op_is_flush(bio->bi_opf)) -+ return false; - - /* - * If any qos ->throttle() end up blocking, we will have flushed the -@@ -2911,11 +2896,11 @@ static inline struct request *blk_mq_get_cached_request(struct request_queue *q, - * before we throttle. - */ - plug->cached_rq = rq_list_next(rq); -- rq_qos_throttle(q, *bio); -+ rq_qos_throttle(rq->q, bio); - -- rq->cmd_flags = (*bio)->bi_opf; -+ rq->cmd_flags = bio->bi_opf; - INIT_LIST_HEAD(&rq->queuelist); -- return rq; -+ return true; - } - - static void bio_set_ioprio(struct bio *bio) -@@ -2944,7 +2929,7 @@ void blk_mq_submit_bio(struct bio *bio) - struct request_queue *q = bdev_get_queue(bio->bi_bdev); - struct blk_plug *plug = blk_mq_plug(bio); - const int is_sync = op_is_sync(bio->bi_opf); -- struct request *rq; -+ struct request *rq = NULL; - unsigned int nr_segs = 1; - blk_status_t ret; - -@@ -2955,20 +2940,36 @@ void blk_mq_submit_bio(struct bio *bio) - return; - } - -- if (!bio_integrity_prep(bio)) -- return; -- - bio_set_ioprio(bio); - -- rq = blk_mq_get_cached_request(q, plug, &bio, nr_segs); -- if (!rq) { -- if (!bio) -+ if (plug) { -+ rq = rq_list_peek(&plug->cached_rq); -+ if (rq && rq->q != q) -+ rq = NULL; -+ } -+ if (rq) { -+ if (!bio_integrity_prep(bio)) - return; -- rq = blk_mq_get_new_requests(q, plug, bio, nr_segs); -- if (unlikely(!rq)) -+ if (blk_mq_attempt_bio_merge(q, bio, nr_segs)) - return; -+ if (blk_mq_can_use_cached_rq(rq, plug, bio)) -+ goto done; -+ percpu_ref_get(&q->q_usage_counter); -+ } else { -+ if (unlikely(bio_queue_enter(bio))) -+ return; -+ if (!bio_integrity_prep(bio)) -+ goto fail; -+ } -+ -+ rq = blk_mq_get_new_requests(q, plug, bio, nr_segs); -+ if (unlikely(!rq)) { -+fail: -+ blk_queue_exit(q); -+ return; - } - -+done: - trace_block_getrq(bio); - - rq_qos_track(q, rq, bio); -diff --git a/block/fops.c b/block/fops.c -index 6197d1c41652d..01cb6260fa24d 100644 ---- a/block/fops.c -+++ b/block/fops.c -@@ -655,24 +655,35 @@ static long blkdev_fallocate(struct file *file, int mode, loff_t start, - - filemap_invalidate_lock(inode->i_mapping); - -- /* Invalidate the page cache, including dirty pages. */ -- error = truncate_bdev_range(bdev, file->f_mode, start, end); -- if (error) -- goto fail; -- -+ /* -+ * Invalidate the page cache, including dirty pages, for valid -+ * de-allocate mode calls to fallocate(). -+ */ - switch (mode) { - case FALLOC_FL_ZERO_RANGE: - case FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE: -+ error = truncate_bdev_range(bdev, file->f_mode, start, end); -+ if (error) -+ goto fail; -+ - error = blkdev_issue_zeroout(bdev, start >> SECTOR_SHIFT, - len >> SECTOR_SHIFT, GFP_KERNEL, - BLKDEV_ZERO_NOUNMAP); - break; - case FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE: -+ error = truncate_bdev_range(bdev, file->f_mode, start, end); -+ if (error) -+ goto fail; -+ - error = blkdev_issue_zeroout(bdev, start >> SECTOR_SHIFT, - len >> SECTOR_SHIFT, GFP_KERNEL, - BLKDEV_ZERO_NOFALLBACK); - break; - case FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE | FALLOC_FL_NO_HIDE_STALE: -+ error = truncate_bdev_range(bdev, file->f_mode, start, end); -+ if (error) -+ goto fail; -+ - error = blkdev_issue_discard(bdev, start >> SECTOR_SHIFT, - len >> SECTOR_SHIFT, GFP_KERNEL); - break; -diff --git a/drivers/base/memory.c b/drivers/base/memory.c -index 9aa0da991cfb9..5d39f3e374dae 100644 ---- a/drivers/base/memory.c -+++ b/drivers/base/memory.c -@@ -175,6 +175,9 @@ int memory_notify(unsigned long val, void *v) - return blocking_notifier_call_chain(&memory_chain, val, v); - } - -+/* -+ * Must acquire mem_hotplug_lock in write mode. -+ */ - static int memory_block_online(struct memory_block *mem) - { - unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr); -@@ -193,10 +196,11 @@ static int memory_block_online(struct memory_block *mem) - * stage helps to keep accounting easier to follow - e.g vmemmaps - * belong to the same zone as the memory they backed. - */ -+ mem_hotplug_begin(); - if (nr_vmemmap_pages) { - ret = mhp_init_memmap_on_memory(start_pfn, nr_vmemmap_pages, zone); - if (ret) -- return ret; -+ goto out; - } - - ret = online_pages(start_pfn + nr_vmemmap_pages, -@@ -204,7 +208,7 @@ static int memory_block_online(struct memory_block *mem) - if (ret) { - if (nr_vmemmap_pages) - mhp_deinit_memmap_on_memory(start_pfn, nr_vmemmap_pages); -- return ret; -+ goto out; - } - - /* -@@ -216,9 +220,14 @@ static int memory_block_online(struct memory_block *mem) - nr_vmemmap_pages); - - mem->zone = zone; -+out: -+ mem_hotplug_done(); - return ret; - } - -+/* -+ * Must acquire mem_hotplug_lock in write mode. -+ */ - static int memory_block_offline(struct memory_block *mem) - { - unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr); -@@ -233,6 +242,7 @@ static int memory_block_offline(struct memory_block *mem) - * Unaccount before offlining, such that unpopulated zone and kthreads - * can properly be torn down in offline_pages(). - */ -+ mem_hotplug_begin(); - if (nr_vmemmap_pages) - adjust_present_page_count(pfn_to_page(start_pfn), mem->group, - -nr_vmemmap_pages); -@@ -244,13 +254,15 @@ static int memory_block_offline(struct memory_block *mem) - if (nr_vmemmap_pages) - adjust_present_page_count(pfn_to_page(start_pfn), - mem->group, nr_vmemmap_pages); -- return ret; -+ goto out; - } - - if (nr_vmemmap_pages) - mhp_deinit_memmap_on_memory(start_pfn, nr_vmemmap_pages); - - mem->zone = NULL; -+out: -+ mem_hotplug_done(); - return ret; - } - -diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c -index 17c9d825188bb..667ff40f39353 100644 ---- a/drivers/firewire/ohci.c -+++ b/drivers/firewire/ohci.c -@@ -279,6 +279,51 @@ static char ohci_driver_name[] = KBUILD_MODNAME; - #define QUIRK_TI_SLLZ059 0x20 - #define QUIRK_IR_WAKE 0x40 - -+// On PCI Express Root Complex in any type of AMD Ryzen machine, VIA VT6306/6307/6308 with Asmedia -+// ASM1083/1085 brings an inconvenience that the read accesses to 'Isochronous Cycle Timer' register -+// (at offset 0xf0 in PCI I/O space) often causes unexpected system reboot. The mechanism is not -+// clear, since the read access to the other registers is enough safe; e.g. 'Node ID' register, -+// while it is probable due to detection of any type of PCIe error. -+#define QUIRK_REBOOT_BY_CYCLE_TIMER_READ 0x80000000 -+ -+#if IS_ENABLED(CONFIG_X86) -+ -+static bool has_reboot_by_cycle_timer_read_quirk(const struct fw_ohci *ohci) -+{ -+ return !!(ohci->quirks & QUIRK_REBOOT_BY_CYCLE_TIMER_READ); -+} -+ -+#define PCI_DEVICE_ID_ASMEDIA_ASM108X 0x1080 -+ -+static bool detect_vt630x_with_asm1083_on_amd_ryzen_machine(const struct pci_dev *pdev) -+{ -+ const struct pci_dev *pcie_to_pci_bridge; -+ -+ // Detect any type of AMD Ryzen machine. -+ if (!static_cpu_has(X86_FEATURE_ZEN)) -+ return false; -+ -+ // Detect VIA VT6306/6307/6308. -+ if (pdev->vendor != PCI_VENDOR_ID_VIA) -+ return false; -+ if (pdev->device != PCI_DEVICE_ID_VIA_VT630X) -+ return false; -+ -+ // Detect Asmedia ASM1083/1085. -+ pcie_to_pci_bridge = pdev->bus->self; -+ if (pcie_to_pci_bridge->vendor != PCI_VENDOR_ID_ASMEDIA) -+ return false; -+ if (pcie_to_pci_bridge->device != PCI_DEVICE_ID_ASMEDIA_ASM108X) -+ return false; -+ -+ return true; -+} -+ -+#else -+#define has_reboot_by_cycle_timer_read_quirk(ohci) false -+#define detect_vt630x_with_asm1083_on_amd_ryzen_machine(pdev) false -+#endif -+ - /* In case of multiple matches in ohci_quirks[], only the first one is used. */ - static const struct { - unsigned short vendor, device, revision, flags; -@@ -1713,6 +1758,9 @@ static u32 get_cycle_time(struct fw_ohci *ohci) - s32 diff01, diff12; - int i; - -+ if (has_reboot_by_cycle_timer_read_quirk(ohci)) -+ return 0; -+ - c2 = reg_read(ohci, OHCI1394_IsochronousCycleTimer); - - if (ohci->quirks & QUIRK_CYCLE_TIMER) { -@@ -3615,6 +3663,9 @@ static int pci_probe(struct pci_dev *dev, - if (param_quirks) - ohci->quirks = param_quirks; - -+ if (detect_vt630x_with_asm1083_on_amd_ryzen_machine(dev)) -+ ohci->quirks |= QUIRK_REBOOT_BY_CYCLE_TIMER_READ; -+ - /* - * Because dma_alloc_coherent() allocates at least one page, - * we save space by using a common buffer for the AR request/ -diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c -index 431bda9165c3d..2775bcafe40f6 100644 ---- a/drivers/firmware/arm_scmi/perf.c -+++ b/drivers/firmware/arm_scmi/perf.c -@@ -131,7 +131,7 @@ struct perf_dom_info { - u32 opp_count; - u32 sustained_freq_khz; - u32 sustained_perf_level; -- u32 mult_factor; -+ unsigned long mult_factor; - char name[SCMI_MAX_STR_SIZE]; - struct scmi_opp opp[MAX_OPPS]; - struct scmi_fc_info *fc_info; -@@ -223,8 +223,8 @@ scmi_perf_domain_attributes_get(const struct scmi_protocol_handle *ph, - dom_info->mult_factor = 1000; - else - dom_info->mult_factor = -- (dom_info->sustained_freq_khz * 1000) / -- dom_info->sustained_perf_level; -+ (dom_info->sustained_freq_khz * 1000UL) -+ / dom_info->sustained_perf_level; - strscpy(dom_info->name, attr->name, SCMI_SHORT_NAME_MAX_SIZE); - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 8a1b84aaaf717..a5352e5e2bd47 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1976,15 +1976,8 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev) - - adev->firmware.gpu_info_fw = NULL; - -- if (adev->mman.discovery_bin) { -- /* -- * FIXME: The bounding box is still needed by Navi12, so -- * temporarily read it from gpu_info firmware. Should be dropped -- * when DAL no longer needs it. -- */ -- if (adev->asic_type != CHIP_NAVI12) -- return 0; -- } -+ if (adev->mman.discovery_bin) -+ return 0; - - switch (adev->asic_type) { - default: -diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c -index 9d224bb2b3df6..ce893fe1c69f4 100644 ---- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c -+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c -@@ -438,7 +438,115 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv14_soc = { - .use_urgent_burst_bw = 0 - }; - --struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv12_soc = { 0 }; -+struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv12_soc = { -+ .clock_limits = { -+ { -+ .state = 0, -+ .dcfclk_mhz = 560.0, -+ .fabricclk_mhz = 560.0, -+ .dispclk_mhz = 513.0, -+ .dppclk_mhz = 513.0, -+ .phyclk_mhz = 540.0, -+ .socclk_mhz = 560.0, -+ .dscclk_mhz = 171.0, -+ .dram_speed_mts = 1069.0, -+ }, -+ { -+ .state = 1, -+ .dcfclk_mhz = 694.0, -+ .fabricclk_mhz = 694.0, -+ .dispclk_mhz = 642.0, -+ .dppclk_mhz = 642.0, -+ .phyclk_mhz = 600.0, -+ .socclk_mhz = 694.0, -+ .dscclk_mhz = 214.0, -+ .dram_speed_mts = 1324.0, -+ }, -+ { -+ .state = 2, -+ .dcfclk_mhz = 875.0, -+ .fabricclk_mhz = 875.0, -+ .dispclk_mhz = 734.0, -+ .dppclk_mhz = 734.0, -+ .phyclk_mhz = 810.0, -+ .socclk_mhz = 875.0, -+ .dscclk_mhz = 245.0, -+ .dram_speed_mts = 1670.0, -+ }, -+ { -+ .state = 3, -+ .dcfclk_mhz = 1000.0, -+ .fabricclk_mhz = 1000.0, -+ .dispclk_mhz = 1100.0, -+ .dppclk_mhz = 1100.0, -+ .phyclk_mhz = 810.0, -+ .socclk_mhz = 1000.0, -+ .dscclk_mhz = 367.0, -+ .dram_speed_mts = 2000.0, -+ }, -+ { -+ .state = 4, -+ .dcfclk_mhz = 1200.0, -+ .fabricclk_mhz = 1200.0, -+ .dispclk_mhz = 1284.0, -+ .dppclk_mhz = 1284.0, -+ .phyclk_mhz = 810.0, -+ .socclk_mhz = 1200.0, -+ .dscclk_mhz = 428.0, -+ .dram_speed_mts = 2000.0, -+ }, -+ { -+ .state = 5, -+ .dcfclk_mhz = 1200.0, -+ .fabricclk_mhz = 1200.0, -+ .dispclk_mhz = 1284.0, -+ .dppclk_mhz = 1284.0, -+ .phyclk_mhz = 810.0, -+ .socclk_mhz = 1200.0, -+ .dscclk_mhz = 428.0, -+ .dram_speed_mts = 2000.0, -+ }, -+ }, -+ -+ .num_states = 5, -+ .sr_exit_time_us = 1.9, -+ .sr_enter_plus_exit_time_us = 4.4, -+ .urgent_latency_us = 3.0, -+ .urgent_latency_pixel_data_only_us = 4.0, -+ .urgent_latency_pixel_mixed_with_vm_data_us = 4.0, -+ .urgent_latency_vm_data_only_us = 4.0, -+ .urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096, -+ .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096, -+ .urgent_out_of_order_return_per_channel_vm_only_bytes = 4096, -+ .pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 40.0, -+ .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 40.0, -+ .pct_ideal_dram_sdp_bw_after_urgent_vm_only = 40.0, -+ .max_avg_sdp_bw_use_normal_percent = 40.0, -+ .max_avg_dram_bw_use_normal_percent = 40.0, -+ .writeback_latency_us = 12.0, -+ .ideal_dram_bw_after_urgent_percent = 40.0, -+ .max_request_size_bytes = 256, -+ .dram_channel_width_bytes = 16, -+ .fabric_datapath_to_dcn_data_return_bytes = 64, -+ .dcn_downspread_percent = 0.5, -+ .downspread_percent = 0.5, -+ .dram_page_open_time_ns = 50.0, -+ .dram_rw_turnaround_time_ns = 17.5, -+ .dram_return_buffer_per_channel_bytes = 8192, -+ .round_trip_ping_latency_dcfclk_cycles = 131, -+ .urgent_out_of_order_return_per_channel_bytes = 4096, -+ .channel_interleave_bytes = 256, -+ .num_banks = 8, -+ .num_chans = 16, -+ .vmm_page_size_bytes = 4096, -+ .dram_clock_change_latency_us = 45.0, -+ .writeback_dram_clock_change_latency_us = 23.0, -+ .return_bus_width_bytes = 64, -+ .dispclk_dppclk_vco_speed_mhz = 3850, -+ .xfc_bus_transport_time_us = 20, -+ .xfc_xbuf_latency_tolerance_us = 50, -+ .use_urgent_burst_bw = 0, -+}; - - struct _vcs_dpi_ip_params_st dcn2_1_ip = { - .odm_capable = 1, -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index 1b5c27ed27370..ff4d0564122a3 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -527,6 +527,7 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, - u32 request_val = AUX_CMD_REQ(msg->request); - u8 *buf = msg->buffer; - unsigned int len = msg->size; -+ unsigned int short_len; - unsigned int val; - int ret; - u8 addr_len[SN_AUX_LENGTH_REG + 1 - SN_AUX_ADDR_19_16_REG]; -@@ -600,7 +601,8 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, - } - - if (val & AUX_IRQ_STATUS_AUX_SHORT) { -- ret = regmap_read(pdata->regmap, SN_AUX_LENGTH_REG, &len); -+ ret = regmap_read(pdata->regmap, SN_AUX_LENGTH_REG, &short_len); -+ len = min(len, short_len); - if (ret) - goto exit; - } else if (val & AUX_IRQ_STATUS_NAT_I2C_FAIL) { -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 5970f4149090f..4699c21102261 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -3707,7 +3707,7 @@ static void intel_dp_process_phy_request(struct intel_dp *intel_dp, - intel_dp->train_set, crtc_state->lane_count); - - drm_dp_set_phy_test_pattern(&intel_dp->aux, data, -- link_status[DP_DPCD_REV]); -+ intel_dp->dpcd[DP_DPCD_REV]); - } - - static u8 intel_dp_autotest_phy_pattern(struct intel_dp *intel_dp) -diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h -index f0c2349404b46..aebd09e2d4087 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_drv.h -+++ b/drivers/gpu/drm/mgag200/mgag200_drv.h -@@ -390,6 +390,11 @@ void mgag200_primary_plane_helper_atomic_disable(struct drm_plane *plane, - .destroy = drm_plane_cleanup, \ - DRM_GEM_SHADOW_PLANE_FUNCS - -+void mgag200_crtc_set_gamma_linear(struct mga_device *mdev, const struct drm_format_info *format); -+void mgag200_crtc_set_gamma(struct mga_device *mdev, -+ const struct drm_format_info *format, -+ struct drm_color_lut *lut); -+ - enum drm_mode_status mgag200_crtc_helper_mode_valid(struct drm_crtc *crtc, - const struct drm_display_mode *mode); - int mgag200_crtc_helper_atomic_check(struct drm_crtc *crtc, struct drm_atomic_state *new_state); -diff --git a/drivers/gpu/drm/mgag200/mgag200_g200er.c b/drivers/gpu/drm/mgag200/mgag200_g200er.c -index bce267e0f7de3..8d4538b710477 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_g200er.c -+++ b/drivers/gpu/drm/mgag200/mgag200_g200er.c -@@ -202,6 +202,11 @@ static void mgag200_g200er_crtc_helper_atomic_enable(struct drm_crtc *crtc, - - mgag200_g200er_reset_tagfifo(mdev); - -+ if (crtc_state->gamma_lut) -+ mgag200_crtc_set_gamma(mdev, format, crtc_state->gamma_lut->data); -+ else -+ mgag200_crtc_set_gamma_linear(mdev, format); -+ - mgag200_enable_display(mdev); - - if (funcs->enable_vidrst) -diff --git a/drivers/gpu/drm/mgag200/mgag200_g200ev.c b/drivers/gpu/drm/mgag200/mgag200_g200ev.c -index ac957f42abe18..56e6f986bff31 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_g200ev.c -+++ b/drivers/gpu/drm/mgag200/mgag200_g200ev.c -@@ -203,6 +203,11 @@ static void mgag200_g200ev_crtc_helper_atomic_enable(struct drm_crtc *crtc, - - mgag200_g200ev_set_hiprilvl(mdev); - -+ if (crtc_state->gamma_lut) -+ mgag200_crtc_set_gamma(mdev, format, crtc_state->gamma_lut->data); -+ else -+ mgag200_crtc_set_gamma_linear(mdev, format); -+ - mgag200_enable_display(mdev); - - if (funcs->enable_vidrst) -diff --git a/drivers/gpu/drm/mgag200/mgag200_g200se.c b/drivers/gpu/drm/mgag200/mgag200_g200se.c -index bd6e573c9a1a3..ff2b3c6622e7a 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_g200se.c -+++ b/drivers/gpu/drm/mgag200/mgag200_g200se.c -@@ -334,6 +334,11 @@ static void mgag200_g200se_crtc_helper_atomic_enable(struct drm_crtc *crtc, - - mgag200_g200se_set_hiprilvl(mdev, adjusted_mode, format); - -+ if (crtc_state->gamma_lut) -+ mgag200_crtc_set_gamma(mdev, format, crtc_state->gamma_lut->data); -+ else -+ mgag200_crtc_set_gamma_linear(mdev, format); -+ - mgag200_enable_display(mdev); - - if (funcs->enable_vidrst) -diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c -index ae90b260312a5..554adf05e0734 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_mode.c -+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c -@@ -28,8 +28,8 @@ - * This file contains setup code for the CRTC. - */ - --static void mgag200_crtc_set_gamma_linear(struct mga_device *mdev, -- const struct drm_format_info *format) -+void mgag200_crtc_set_gamma_linear(struct mga_device *mdev, -+ const struct drm_format_info *format) - { - int i; - -@@ -65,9 +65,9 @@ static void mgag200_crtc_set_gamma_linear(struct mga_device *mdev, - } - } - --static void mgag200_crtc_set_gamma(struct mga_device *mdev, -- const struct drm_format_info *format, -- struct drm_color_lut *lut) -+void mgag200_crtc_set_gamma(struct mga_device *mdev, -+ const struct drm_format_info *format, -+ struct drm_color_lut *lut) - { - int i; - -diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h -index 05b8b8dfa9bdd..36587f38dff3d 100644 ---- a/drivers/i2c/i2c-core.h -+++ b/drivers/i2c/i2c-core.h -@@ -3,6 +3,7 @@ - * i2c-core.h - interfaces internal to the I2C framework - */ - -+#include - #include - - struct i2c_devinfo { -@@ -29,7 +30,8 @@ int i2c_dev_irq_from_resources(const struct resource *resources, - */ - static inline bool i2c_in_atomic_xfer_mode(void) - { -- return system_state > SYSTEM_RUNNING && !preemptible(); -+ return system_state > SYSTEM_RUNNING && -+ (IS_ENABLED(CONFIG_PREEMPT_COUNT) ? !preemptible() : irqs_disabled()); - } - - static inline int __i2c_lock_bus_helper(struct i2c_adapter *adap) -diff --git a/drivers/interconnect/qcom/sm8250.c b/drivers/interconnect/qcom/sm8250.c -index 9c2dd40d9a559..5cdb058fa0959 100644 ---- a/drivers/interconnect/qcom/sm8250.c -+++ b/drivers/interconnect/qcom/sm8250.c -@@ -551,7 +551,6 @@ static struct platform_driver qnoc_driver = { - .driver = { - .name = "qnoc-sm8250", - .of_match_table = qnoc_of_match, -- .sync_state = icc_sync_state, - }, - }; - module_platform_driver(qnoc_driver); -diff --git a/drivers/media/platform/qcom/camss/camss-csid-gen2.c b/drivers/media/platform/qcom/camss/camss-csid-gen2.c -index 904208f6f9546..0147cc062e1ae 100644 ---- a/drivers/media/platform/qcom/camss/camss-csid-gen2.c -+++ b/drivers/media/platform/qcom/camss/camss-csid-gen2.c -@@ -334,13 +334,14 @@ static const struct csid_format csid_formats[] = { - }, - }; - --static void csid_configure_stream(struct csid_device *csid, u8 enable) -+static void __csid_configure_stream(struct csid_device *csid, u8 enable, u8 vc) - { - struct csid_testgen_config *tg = &csid->testgen; - u32 val; - u32 phy_sel = 0; - u8 lane_cnt = csid->phy.lane_cnt; -- struct v4l2_mbus_framefmt *input_format = &csid->fmt[MSM_CSID_PAD_SRC]; -+ /* Source pads matching RDI channels on hardware. Pad 1 -> RDI0, Pad 2 -> RDI1, etc. */ -+ struct v4l2_mbus_framefmt *input_format = &csid->fmt[MSM_CSID_PAD_FIRST_SRC + vc]; - const struct csid_format *format = csid_get_fmt_entry(csid->formats, csid->nformats, - input_format->code); - -@@ -351,8 +352,19 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable) - phy_sel = csid->phy.csiphy_id; - - if (enable) { -- u8 vc = 0; /* Virtual Channel 0 */ -- u8 dt_id = vc * 4; -+ /* -+ * DT_ID is a two bit bitfield that is concatenated with -+ * the four least significant bits of the five bit VC -+ * bitfield to generate an internal CID value. -+ * -+ * CSID_RDI_CFG0(vc) -+ * DT_ID : 28:27 -+ * VC : 26:22 -+ * DT : 21:16 -+ * -+ * CID : VC 3:0 << 2 | DT_ID 1:0 -+ */ -+ u8 dt_id = vc & 0x03; - - if (tg->enabled) { - /* configure one DT, infinite frames */ -@@ -392,42 +404,42 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable) - val |= format->data_type << RDI_CFG0_DATA_TYPE; - val |= vc << RDI_CFG0_VIRTUAL_CHANNEL; - val |= dt_id << RDI_CFG0_DT_ID; -- writel_relaxed(val, csid->base + CSID_RDI_CFG0(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_CFG0(vc)); - - /* CSID_TIMESTAMP_STB_POST_IRQ */ - val = 2 << RDI_CFG1_TIMESTAMP_STB_SEL; -- writel_relaxed(val, csid->base + CSID_RDI_CFG1(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_CFG1(vc)); - - val = 1; -- writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PERIOD(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PERIOD(vc)); - - val = 0; -- writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PATTERN(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_FRM_DROP_PATTERN(vc)); - - val = 1; -- writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PERIOD(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PERIOD(vc)); - - val = 0; -- writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PATTERN(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_IRQ_SUBSAMPLE_PATTERN(vc)); - - val = 1; -- writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PERIOD(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PERIOD(vc)); - - val = 0; -- writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PATTERN(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_RPP_PIX_DROP_PATTERN(vc)); - - val = 1; -- writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PERIOD(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PERIOD(vc)); - - val = 0; -- writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PATTERN(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_RPP_LINE_DROP_PATTERN(vc)); - - val = 0; -- writel_relaxed(val, csid->base + CSID_RDI_CTRL(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_CTRL(vc)); - -- val = readl_relaxed(csid->base + CSID_RDI_CFG0(0)); -+ val = readl_relaxed(csid->base + CSID_RDI_CFG0(vc)); - val |= 1 << RDI_CFG0_ENABLE; -- writel_relaxed(val, csid->base + CSID_RDI_CFG0(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_CFG0(vc)); - } - - if (tg->enabled) { -@@ -446,6 +458,8 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable) - writel_relaxed(val, csid->base + CSID_CSI2_RX_CFG0); - - val = 1 << CSI2_RX_CFG1_PACKET_ECC_CORRECTION_EN; -+ if (vc > 3) -+ val |= 1 << CSI2_RX_CFG1_VC_MODE; - val |= 1 << CSI2_RX_CFG1_MISR_EN; - writel_relaxed(val, csid->base + CSID_CSI2_RX_CFG1); - -@@ -453,7 +467,16 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable) - val = HALT_CMD_RESUME_AT_FRAME_BOUNDARY << RDI_CTRL_HALT_CMD; - else - val = HALT_CMD_HALT_AT_FRAME_BOUNDARY << RDI_CTRL_HALT_CMD; -- writel_relaxed(val, csid->base + CSID_RDI_CTRL(0)); -+ writel_relaxed(val, csid->base + CSID_RDI_CTRL(vc)); -+} -+ -+static void csid_configure_stream(struct csid_device *csid, u8 enable) -+{ -+ u8 i; -+ /* Loop through all enabled VCs and configure stream for each */ -+ for (i = 0; i < MSM_CSID_MAX_SRC_STREAMS; i++) -+ if (csid->phy.en_vc & BIT(i)) -+ __csid_configure_stream(csid, enable, i); - } - - static int csid_configure_testgen_pattern(struct csid_device *csid, s32 val) -@@ -499,6 +522,7 @@ static irqreturn_t csid_isr(int irq, void *dev) - struct csid_device *csid = dev; - u32 val; - u8 reset_done; -+ int i; - - val = readl_relaxed(csid->base + CSID_TOP_IRQ_STATUS); - writel_relaxed(val, csid->base + CSID_TOP_IRQ_CLEAR); -@@ -507,8 +531,12 @@ static irqreturn_t csid_isr(int irq, void *dev) - val = readl_relaxed(csid->base + CSID_CSI2_RX_IRQ_STATUS); - writel_relaxed(val, csid->base + CSID_CSI2_RX_IRQ_CLEAR); - -- val = readl_relaxed(csid->base + CSID_CSI2_RDIN_IRQ_STATUS(0)); -- writel_relaxed(val, csid->base + CSID_CSI2_RDIN_IRQ_CLEAR(0)); -+ /* Read and clear IRQ status for each enabled RDI channel */ -+ for (i = 0; i < MSM_CSID_MAX_SRC_STREAMS; i++) -+ if (csid->phy.en_vc & BIT(i)) { -+ val = readl_relaxed(csid->base + CSID_CSI2_RDIN_IRQ_STATUS(i)); -+ writel_relaxed(val, csid->base + CSID_CSI2_RDIN_IRQ_CLEAR(i)); -+ } - - val = 1 << IRQ_CMD_CLEAR; - writel_relaxed(val, csid->base + CSID_IRQ_CMD); -diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c -index 88f188e0f7501..6360314f04a63 100644 ---- a/drivers/media/platform/qcom/camss/camss-csid.c -+++ b/drivers/media/platform/qcom/camss/camss-csid.c -@@ -196,6 +196,8 @@ static int csid_set_power(struct v4l2_subdev *sd, int on) - return ret; - } - -+ csid->phy.need_vc_update = true; -+ - enable_irq(csid->irq); - - ret = csid->ops->reset(csid); -@@ -249,7 +251,10 @@ static int csid_set_stream(struct v4l2_subdev *sd, int enable) - return -ENOLINK; - } - -- csid->ops->configure_stream(csid, enable); -+ if (csid->phy.need_vc_update) { -+ csid->ops->configure_stream(csid, enable); -+ csid->phy.need_vc_update = false; -+ } - - return 0; - } -@@ -460,6 +465,7 @@ static int csid_set_format(struct v4l2_subdev *sd, - { - struct csid_device *csid = v4l2_get_subdevdata(sd); - struct v4l2_mbus_framefmt *format; -+ int i; - - format = __csid_get_format(csid, sd_state, fmt->pad, fmt->which); - if (format == NULL) -@@ -468,14 +474,14 @@ static int csid_set_format(struct v4l2_subdev *sd, - csid_try_format(csid, sd_state, fmt->pad, &fmt->format, fmt->which); - *format = fmt->format; - -- /* Propagate the format from sink to source */ -+ /* Propagate the format from sink to source pads */ - if (fmt->pad == MSM_CSID_PAD_SINK) { -- format = __csid_get_format(csid, sd_state, MSM_CSID_PAD_SRC, -- fmt->which); -+ for (i = MSM_CSID_PAD_FIRST_SRC; i < MSM_CSID_PADS_NUM; ++i) { -+ format = __csid_get_format(csid, sd_state, i, fmt->which); - -- *format = fmt->format; -- csid_try_format(csid, sd_state, MSM_CSID_PAD_SRC, format, -- fmt->which); -+ *format = fmt->format; -+ csid_try_format(csid, sd_state, i, format, fmt->which); -+ } - } - - return 0; -@@ -738,7 +744,6 @@ static int csid_link_setup(struct media_entity *entity, - struct csid_device *csid; - struct csiphy_device *csiphy; - struct csiphy_lanes_cfg *lane_cfg; -- struct v4l2_subdev_format format = { 0 }; - - sd = media_entity_to_v4l2_subdev(entity); - csid = v4l2_get_subdevdata(sd); -@@ -761,11 +766,22 @@ static int csid_link_setup(struct media_entity *entity, - lane_cfg = &csiphy->cfg.csi2->lane_cfg; - csid->phy.lane_cnt = lane_cfg->num_data; - csid->phy.lane_assign = csid_get_lane_assign(lane_cfg); -+ } -+ /* Decide which virtual channels to enable based on which source pads are enabled */ -+ if (local->flags & MEDIA_PAD_FL_SOURCE) { -+ struct v4l2_subdev *sd = media_entity_to_v4l2_subdev(entity); -+ struct csid_device *csid = v4l2_get_subdevdata(sd); -+ struct device *dev = csid->camss->dev; -+ -+ if (flags & MEDIA_LNK_FL_ENABLED) -+ csid->phy.en_vc |= BIT(local->index - 1); -+ else -+ csid->phy.en_vc &= ~BIT(local->index - 1); - -- /* Reset format on source pad to sink pad format */ -- format.pad = MSM_CSID_PAD_SRC; -- format.which = V4L2_SUBDEV_FORMAT_ACTIVE; -- csid_set_format(&csid->subdev, NULL, &format); -+ csid->phy.need_vc_update = true; -+ -+ dev_dbg(dev, "%s: Enabled CSID virtual channels mask 0x%x\n", -+ __func__, csid->phy.en_vc); - } - - return 0; -@@ -816,6 +832,7 @@ int msm_csid_register_entity(struct csid_device *csid, - struct v4l2_subdev *sd = &csid->subdev; - struct media_pad *pads = csid->pads; - struct device *dev = csid->camss->dev; -+ int i; - int ret; - - v4l2_subdev_init(sd, &csid_v4l2_ops); -@@ -852,7 +869,8 @@ int msm_csid_register_entity(struct csid_device *csid, - } - - pads[MSM_CSID_PAD_SINK].flags = MEDIA_PAD_FL_SINK; -- pads[MSM_CSID_PAD_SRC].flags = MEDIA_PAD_FL_SOURCE; -+ for (i = MSM_CSID_PAD_FIRST_SRC; i < MSM_CSID_PADS_NUM; ++i) -+ pads[i].flags = MEDIA_PAD_FL_SOURCE; - - sd->entity.function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER; - sd->entity.ops = &csid_media_ops; -diff --git a/drivers/media/platform/qcom/camss/camss-csid.h b/drivers/media/platform/qcom/camss/camss-csid.h -index f06040e44c515..d4b48432a0973 100644 ---- a/drivers/media/platform/qcom/camss/camss-csid.h -+++ b/drivers/media/platform/qcom/camss/camss-csid.h -@@ -19,8 +19,13 @@ - #include - - #define MSM_CSID_PAD_SINK 0 --#define MSM_CSID_PAD_SRC 1 --#define MSM_CSID_PADS_NUM 2 -+#define MSM_CSID_PAD_FIRST_SRC 1 -+#define MSM_CSID_PADS_NUM 5 -+ -+#define MSM_CSID_PAD_SRC (MSM_CSID_PAD_FIRST_SRC) -+ -+/* CSID hardware can demultiplex up to 4 outputs */ -+#define MSM_CSID_MAX_SRC_STREAMS 4 - - #define DATA_TYPE_EMBEDDED_DATA_8BIT 0x12 - #define DATA_TYPE_YUV420_8BIT 0x18 -@@ -81,6 +86,8 @@ struct csid_phy_config { - u8 csiphy_id; - u8 lane_cnt; - u32 lane_assign; -+ u32 en_vc; -+ u8 need_vc_update; - }; - - struct csid_device; -diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c -index 770490234c872..e9ce53d200bc1 100644 ---- a/drivers/mmc/core/block.c -+++ b/drivers/mmc/core/block.c -@@ -866,9 +866,10 @@ static const struct block_device_operations mmc_bdops = { - static int mmc_blk_part_switch_pre(struct mmc_card *card, - unsigned int part_type) - { -+ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; - int ret = 0; - -- if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) { -+ if ((part_type & mask) == mask) { - if (card->ext_csd.cmdq_en) { - ret = mmc_cmdq_disable(card); - if (ret) -@@ -883,9 +884,10 @@ static int mmc_blk_part_switch_pre(struct mmc_card *card, - static int mmc_blk_part_switch_post(struct mmc_card *card, - unsigned int part_type) - { -+ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; - int ret = 0; - -- if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) { -+ if ((part_type & mask) == mask) { - mmc_retune_unpause(card->host); - if (card->reenable_cmdq && !card->ext_csd.cmdq_en) - ret = mmc_cmdq_enable(card); -@@ -3180,4 +3182,3 @@ module_exit(mmc_blk_exit); - - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Multimedia Card (MMC) block device driver"); -- -diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c -index b89dca1f15e9c..25c152ef5d60e 100644 ---- a/drivers/mmc/core/host.c -+++ b/drivers/mmc/core/host.c -@@ -670,6 +670,7 @@ EXPORT_SYMBOL(mmc_remove_host); - */ - void mmc_free_host(struct mmc_host *host) - { -+ cancel_delayed_work_sync(&host->detect); - mmc_pwrseq_free(host); - put_device(&host->class_dev); - } -diff --git a/drivers/mmc/host/meson-mx-sdhc-mmc.c b/drivers/mmc/host/meson-mx-sdhc-mmc.c -index da85c2f2acb83..c0e3b1634a88a 100644 ---- a/drivers/mmc/host/meson-mx-sdhc-mmc.c -+++ b/drivers/mmc/host/meson-mx-sdhc-mmc.c -@@ -269,7 +269,7 @@ static int meson_mx_sdhc_enable_clks(struct mmc_host *mmc) - static int meson_mx_sdhc_set_clk(struct mmc_host *mmc, struct mmc_ios *ios) - { - struct meson_mx_sdhc_host *host = mmc_priv(mmc); -- u32 rx_clk_phase; -+ u32 val, rx_clk_phase; - int ret; - - meson_mx_sdhc_disable_clks(mmc); -@@ -290,27 +290,11 @@ static int meson_mx_sdhc_set_clk(struct mmc_host *mmc, struct mmc_ios *ios) - mmc->actual_clock = clk_get_rate(host->sd_clk); - - /* -- * according to Amlogic the following latching points are -- * selected with empirical values, there is no (known) formula -- * to calculate these. -+ * Phase 90 should work in most cases. For data transmission, -+ * meson_mx_sdhc_execute_tuning() will find a accurate value - */ -- if (mmc->actual_clock > 100000000) { -- rx_clk_phase = 1; -- } else if (mmc->actual_clock > 45000000) { -- if (ios->signal_voltage == MMC_SIGNAL_VOLTAGE_330) -- rx_clk_phase = 15; -- else -- rx_clk_phase = 11; -- } else if (mmc->actual_clock >= 25000000) { -- rx_clk_phase = 15; -- } else if (mmc->actual_clock > 5000000) { -- rx_clk_phase = 23; -- } else if (mmc->actual_clock > 1000000) { -- rx_clk_phase = 55; -- } else { -- rx_clk_phase = 1061; -- } -- -+ regmap_read(host->regmap, MESON_SDHC_CLKC, &val); -+ rx_clk_phase = FIELD_GET(MESON_SDHC_CLKC_CLK_DIV, val) / 4; - regmap_update_bits(host->regmap, MESON_SDHC_CLK2, - MESON_SDHC_CLK2_RX_CLK_PHASE, - FIELD_PREP(MESON_SDHC_CLK2_RX_CLK_PHASE, -diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c -index 2101b6e794c0e..66c1782823d89 100644 ---- a/drivers/mmc/host/sdhci-sprd.c -+++ b/drivers/mmc/host/sdhci-sprd.c -@@ -228,15 +228,19 @@ static inline void _sdhci_sprd_set_clock(struct sdhci_host *host, - div = ((div & 0x300) >> 2) | ((div & 0xFF) << 8); - sdhci_enable_clk(host, div); - -+ val = sdhci_readl(host, SDHCI_SPRD_REG_32_BUSY_POSI); -+ mask = SDHCI_SPRD_BIT_OUTR_CLK_AUTO_EN | SDHCI_SPRD_BIT_INNR_CLK_AUTO_EN; - /* Enable CLK_AUTO when the clock is greater than 400K. */ - if (clk > 400000) { -- val = sdhci_readl(host, SDHCI_SPRD_REG_32_BUSY_POSI); -- mask = SDHCI_SPRD_BIT_OUTR_CLK_AUTO_EN | -- SDHCI_SPRD_BIT_INNR_CLK_AUTO_EN; - if (mask != (val & mask)) { - val |= mask; - sdhci_writel(host, val, SDHCI_SPRD_REG_32_BUSY_POSI); - } -+ } else { -+ if (val & mask) { -+ val &= ~mask; -+ sdhci_writel(host, val, SDHCI_SPRD_REG_32_BUSY_POSI); -+ } - } - } - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 623cdeb29ed90..df4d88d35701b 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -12081,6 +12081,8 @@ static void bnxt_sp_task(struct work_struct *work) - bnxt_cfg_ntp_filters(bp); - if (test_and_clear_bit(BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT, &bp->sp_event)) - bnxt_hwrm_exec_fwd_req(bp); -+ if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event)) -+ netdev_info(bp->dev, "Receive PF driver unload event!\n"); - if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event)) { - bnxt_hwrm_port_qstats(bp, 0); - bnxt_hwrm_port_qstats_ext(bp, 0); -@@ -13059,8 +13061,6 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp) - } - } - } -- if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event)) -- netdev_info(bp->dev, "Receive PF driver unload event!\n"); - } - - #else -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index 1ae082eb9e905..c2a9913082153 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -2131,8 +2131,10 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev) - /* Note: if we ever change from DMA_TX_APPEND_CRC below we - * will need to restore software padding of "runt" packets - */ -+ len_stat |= DMA_TX_APPEND_CRC; -+ - if (!i) { -- len_stat |= DMA_TX_APPEND_CRC | DMA_SOP; -+ len_stat |= DMA_SOP; - if (skb->ip_summed == CHECKSUM_PARTIAL) - len_stat |= DMA_TX_DO_CSUM; - } -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -index b58162ce81d87..de62eee58a00e 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -@@ -509,8 +509,6 @@ static struct sk_buff *dpaa2_eth_copybreak(struct dpaa2_eth_channel *ch, - - memcpy(skb->data, fd_vaddr + fd_offset, fd_length); - -- dpaa2_eth_recycle_buf(priv, ch, dpaa2_fd_get_addr(fd)); -- - return skb; - } - -@@ -528,6 +526,7 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, - struct dpaa2_eth_drv_stats *percpu_extras; - struct device *dev = priv->net_dev->dev.parent; - struct dpaa2_fas *fas; -+ bool recycle_rx_buf = false; - void *buf_data; - u32 status = 0; - u32 xdp_act; -@@ -560,6 +559,8 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, - dma_unmap_page(dev, addr, priv->rx_buf_size, - DMA_BIDIRECTIONAL); - skb = dpaa2_eth_build_linear_skb(ch, fd, vaddr); -+ } else { -+ recycle_rx_buf = true; - } - } else if (fd_format == dpaa2_fd_sg) { - WARN_ON(priv->xdp_prog); -@@ -607,6 +608,8 @@ static void dpaa2_eth_rx(struct dpaa2_eth_priv *priv, - - list_add_tail(&skb->list, ch->rx_list); - -+ if (recycle_rx_buf) -+ dpaa2_eth_recycle_buf(priv, ch, dpaa2_fd_get_addr(fd)); - return; - - err_build_skb: -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c -index eea7d7a07c007..59888826469b9 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c -@@ -227,17 +227,8 @@ static void dpaa2_eth_get_ethtool_stats(struct net_device *net_dev, - struct ethtool_stats *stats, - u64 *data) - { -- int i = 0; -- int j, k, err; -- int num_cnt; -- union dpni_statistics dpni_stats; -- u32 fcnt, bcnt; -- u32 fcnt_rx_total = 0, fcnt_tx_total = 0; -- u32 bcnt_rx_total = 0, bcnt_tx_total = 0; -- u32 buf_cnt; - struct dpaa2_eth_priv *priv = netdev_priv(net_dev); -- struct dpaa2_eth_drv_stats *extras; -- struct dpaa2_eth_ch_stats *ch_stats; -+ union dpni_statistics dpni_stats; - int dpni_stats_page_size[DPNI_STATISTICS_CNT] = { - sizeof(dpni_stats.page_0), - sizeof(dpni_stats.page_1), -@@ -247,6 +238,13 @@ static void dpaa2_eth_get_ethtool_stats(struct net_device *net_dev, - sizeof(dpni_stats.page_5), - sizeof(dpni_stats.page_6), - }; -+ u32 fcnt_rx_total = 0, fcnt_tx_total = 0; -+ u32 bcnt_rx_total = 0, bcnt_tx_total = 0; -+ struct dpaa2_eth_ch_stats *ch_stats; -+ struct dpaa2_eth_drv_stats *extras; -+ int j, k, err, num_cnt, i = 0; -+ u32 fcnt, bcnt; -+ u32 buf_cnt; - - memset(data, 0, - sizeof(u64) * (DPAA2_ETH_NUM_STATS + DPAA2_ETH_NUM_EXTRA_STATS)); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index b4157ff370a31..63d43ef86f9b9 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -104,12 +104,18 @@ static struct workqueue_struct *i40e_wq; - static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, - struct net_device *netdev, int delta) - { -+ struct netdev_hw_addr_list *ha_list; - struct netdev_hw_addr *ha; - - if (!f || !netdev) - return; - -- netdev_for_each_mc_addr(ha, netdev) { -+ if (is_unicast_ether_addr(f->macaddr) || is_link_local_ether_addr(f->macaddr)) -+ ha_list = &netdev->uc; -+ else -+ ha_list = &netdev->mc; -+ -+ netdev_hw_addr_list_for_each(ha, ha_list) { - if (ether_addr_equal(ha->addr, f->macaddr)) { - ha->refcount += delta; - if (ha->refcount <= 0) -@@ -16444,6 +16450,9 @@ static void i40e_pci_error_reset_done(struct pci_dev *pdev) - return; - - i40e_reset_and_rebuild(pf, false, false); -+#ifdef CONFIG_PCI_IOV -+ i40e_restore_all_vfs_msi_state(pdev); -+#endif /* CONFIG_PCI_IOV */ - } - - /** -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index cb925baf72ce0..c7d761426d6ce 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -152,6 +152,32 @@ void i40e_vc_notify_reset(struct i40e_pf *pf) - (u8 *)&pfe, sizeof(struct virtchnl_pf_event)); - } - -+#ifdef CONFIG_PCI_IOV -+void i40e_restore_all_vfs_msi_state(struct pci_dev *pdev) -+{ -+ u16 vf_id; -+ u16 pos; -+ -+ /* Continue only if this is a PF */ -+ if (!pdev->is_physfn) -+ return; -+ -+ if (!pci_num_vf(pdev)) -+ return; -+ -+ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV); -+ if (pos) { -+ struct pci_dev *vf_dev = NULL; -+ -+ pci_read_config_word(pdev, pos + PCI_SRIOV_VF_DID, &vf_id); -+ while ((vf_dev = pci_get_device(pdev->vendor, vf_id, vf_dev))) { -+ if (vf_dev->is_virtfn && vf_dev->physfn == pdev) -+ pci_restore_msi_state(vf_dev); -+ } -+ } -+} -+#endif /* CONFIG_PCI_IOV */ -+ - /** - * i40e_vc_notify_vf_reset - * @vf: pointer to the VF structure -@@ -3451,16 +3477,16 @@ static int i40e_validate_cloud_filter(struct i40e_vf *vf, - bool found = false; - int bkt; - -- if (!tc_filter->action) { -+ if (tc_filter->action != VIRTCHNL_ACTION_TC_REDIRECT) { - dev_info(&pf->pdev->dev, -- "VF %d: Currently ADq doesn't support Drop Action\n", -- vf->vf_id); -+ "VF %d: ADQ doesn't support this action (%d)\n", -+ vf->vf_id, tc_filter->action); - goto err; - } - - /* action_meta is TC number here to which the filter is applied */ - if (!tc_filter->action_meta || -- tc_filter->action_meta > I40E_MAX_VF_VSI) { -+ tc_filter->action_meta > vf->num_tc) { - dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n", - vf->vf_id, tc_filter->action_meta); - goto err; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -index 358bbdb587951..bd497cc5303a1 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h -@@ -135,6 +135,9 @@ int i40e_ndo_set_vf_spoofchk(struct net_device *netdev, int vf_id, bool enable); - - void i40e_vc_notify_link_state(struct i40e_pf *pf); - void i40e_vc_notify_reset(struct i40e_pf *pf); -+#ifdef CONFIG_PCI_IOV -+void i40e_restore_all_vfs_msi_state(struct pci_dev *pdev); -+#endif /* CONFIG_PCI_IOV */ - int i40e_get_vf_stats(struct net_device *netdev, int vf_id, - struct ifla_vf_stats *vf_stats); - -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index f0f39364819ac..ab46cfca4028d 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -2138,7 +2138,7 @@ static int ice_configure_phy(struct ice_vsi *vsi) - - /* Ensure we have media as we cannot configure a medialess port */ - if (!(phy->link_info.link_info & ICE_AQ_MEDIA_AVAILABLE)) -- return -EPERM; -+ return -ENOMEDIUM; - - ice_print_topo_conflict(vsi); - -@@ -9065,8 +9065,14 @@ int ice_stop(struct net_device *netdev) - int link_err = ice_force_phys_link_state(vsi, false); - - if (link_err) { -- netdev_err(vsi->netdev, "Failed to set physical link down, VSI %d error %d\n", -- vsi->vsi_num, link_err); -+ if (link_err == -ENOMEDIUM) -+ netdev_info(vsi->netdev, "Skipping link reconfig - no media attached, VSI %d\n", -+ vsi->vsi_num); -+ else -+ netdev_err(vsi->netdev, "Failed to set physical link down, VSI %d error %d\n", -+ vsi->vsi_num, link_err); -+ -+ ice_vsi_close(vsi); - return -EIO; - } - } -diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h -index 43c05b41627f7..2a894ca49d93b 100644 ---- a/drivers/net/ethernet/intel/igc/igc.h -+++ b/drivers/net/ethernet/intel/igc/igc.h -@@ -538,6 +538,7 @@ struct igc_nfc_filter { - u16 etype; - __be16 vlan_etype; - u16 vlan_tci; -+ u16 vlan_tci_mask; - u8 src_addr[ETH_ALEN]; - u8 dst_addr[ETH_ALEN]; - u8 user_data[8]; -diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c -index 81897f7a90a91..2bee9cace5983 100644 ---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c -+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c -@@ -957,6 +957,7 @@ static int igc_ethtool_set_coalesce(struct net_device *netdev, - } - - #define ETHER_TYPE_FULL_MASK ((__force __be16)~0) -+#define VLAN_TCI_FULL_MASK ((__force __be16)~0) - static int igc_ethtool_get_nfc_rule(struct igc_adapter *adapter, - struct ethtool_rxnfc *cmd) - { -@@ -979,10 +980,16 @@ static int igc_ethtool_get_nfc_rule(struct igc_adapter *adapter, - fsp->m_u.ether_spec.h_proto = ETHER_TYPE_FULL_MASK; - } - -+ if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_ETYPE) { -+ fsp->flow_type |= FLOW_EXT; -+ fsp->h_ext.vlan_etype = rule->filter.vlan_etype; -+ fsp->m_ext.vlan_etype = ETHER_TYPE_FULL_MASK; -+ } -+ - if (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) { - fsp->flow_type |= FLOW_EXT; - fsp->h_ext.vlan_tci = htons(rule->filter.vlan_tci); -- fsp->m_ext.vlan_tci = htons(VLAN_PRIO_MASK); -+ fsp->m_ext.vlan_tci = htons(rule->filter.vlan_tci_mask); - } - - if (rule->filter.match_flags & IGC_FILTER_FLAG_DST_MAC_ADDR) { -@@ -1217,6 +1224,7 @@ static void igc_ethtool_init_nfc_rule(struct igc_nfc_rule *rule, - - if ((fsp->flow_type & FLOW_EXT) && fsp->m_ext.vlan_tci) { - rule->filter.vlan_tci = ntohs(fsp->h_ext.vlan_tci); -+ rule->filter.vlan_tci_mask = ntohs(fsp->m_ext.vlan_tci); - rule->filter.match_flags |= IGC_FILTER_FLAG_VLAN_TCI; - } - -@@ -1254,11 +1262,19 @@ static void igc_ethtool_init_nfc_rule(struct igc_nfc_rule *rule, - memcpy(rule->filter.user_mask, fsp->m_ext.data, sizeof(fsp->m_ext.data)); - } - -- /* When multiple filter options or user data or vlan etype is set, use a -- * flex filter. -+ /* The i225/i226 has various different filters. Flex filters provide a -+ * way to match up to the first 128 bytes of a packet. Use them for: -+ * a) For specific user data -+ * b) For VLAN EtherType -+ * c) For full TCI match -+ * d) Or in case multiple filter criteria are set -+ * -+ * Otherwise, use the simple MAC, VLAN PRIO or EtherType filters. - */ - if ((rule->filter.match_flags & IGC_FILTER_FLAG_USER_DATA) || - (rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_ETYPE) || -+ ((rule->filter.match_flags & IGC_FILTER_FLAG_VLAN_TCI) && -+ rule->filter.vlan_tci_mask == ntohs(VLAN_TCI_FULL_MASK)) || - (rule->filter.match_flags & (rule->filter.match_flags - 1))) - rule->flex = true; - else -@@ -1328,6 +1344,26 @@ static int igc_ethtool_add_nfc_rule(struct igc_adapter *adapter, - return -EINVAL; - } - -+ /* There are two ways to match the VLAN TCI: -+ * 1. Match on PCP field and use vlan prio filter for it -+ * 2. Match on complete TCI field and use flex filter for it -+ */ -+ if ((fsp->flow_type & FLOW_EXT) && -+ fsp->m_ext.vlan_tci && -+ fsp->m_ext.vlan_tci != htons(VLAN_PRIO_MASK) && -+ fsp->m_ext.vlan_tci != VLAN_TCI_FULL_MASK) { -+ netdev_dbg(netdev, "VLAN mask not supported\n"); -+ return -EOPNOTSUPP; -+ } -+ -+ /* VLAN EtherType can only be matched by full mask. */ -+ if ((fsp->flow_type & FLOW_EXT) && -+ fsp->m_ext.vlan_etype && -+ fsp->m_ext.vlan_etype != ETHER_TYPE_FULL_MASK) { -+ netdev_dbg(netdev, "VLAN EtherType mask not supported\n"); -+ return -EOPNOTSUPP; -+ } -+ - if (fsp->location >= IGC_MAX_RXNFC_RULES) { - netdev_dbg(netdev, "Invalid location\n"); - return -EINVAL; -diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c -index 725db36e399d2..31ea0781b65ec 100644 ---- a/drivers/net/ethernet/intel/igc/igc_tsn.c -+++ b/drivers/net/ethernet/intel/igc/igc_tsn.c -@@ -178,7 +178,7 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter) - wr32(IGC_TQAVCC(i), tqavcc); - - wr32(IGC_TQAVHC(i), -- 0x80000000 + ring->hicredit * 0x7735); -+ 0x80000000 + ring->hicredit * 0x7736); - } else { - /* Disable any CBS for the queue */ - txqctl &= ~(IGC_TXQCTL_QAV_SEL_MASK); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -index 65c0373d34d12..90be87dc105d3 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c -@@ -78,7 +78,7 @@ static bool is_dev_rpm(void *cgxd) - - bool is_lmac_valid(struct cgx *cgx, int lmac_id) - { -- if (!cgx || lmac_id < 0 || lmac_id >= MAX_LMAC_PER_CGX) -+ if (!cgx || lmac_id < 0 || lmac_id >= cgx->max_lmac_per_mac) - return false; - return test_bit(lmac_id, &cgx->lmac_bmap); - } -@@ -90,7 +90,7 @@ static int get_sequence_id_of_lmac(struct cgx *cgx, int lmac_id) - { - int tmp, id = 0; - -- for_each_set_bit(tmp, &cgx->lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(tmp, &cgx->lmac_bmap, cgx->max_lmac_per_mac) { - if (tmp == lmac_id) - break; - id++; -@@ -121,7 +121,7 @@ u64 cgx_read(struct cgx *cgx, u64 lmac, u64 offset) - - struct lmac *lmac_pdata(u8 lmac_id, struct cgx *cgx) - { -- if (!cgx || lmac_id >= MAX_LMAC_PER_CGX) -+ if (!cgx || lmac_id >= cgx->max_lmac_per_mac) - return NULL; - - return cgx->lmac_idmap[lmac_id]; -@@ -1410,7 +1410,7 @@ int cgx_get_fwdata_base(u64 *base) - if (!cgx) - return -ENXIO; - -- first_lmac = find_first_bit(&cgx->lmac_bmap, MAX_LMAC_PER_CGX); -+ first_lmac = find_first_bit(&cgx->lmac_bmap, cgx->max_lmac_per_mac); - req = FIELD_SET(CMDREG_ID, CGX_CMD_GET_FWD_BASE, req); - err = cgx_fwi_cmd_generic(req, &resp, cgx, first_lmac); - if (!err) -@@ -1499,7 +1499,7 @@ static int cgx_fwi_link_change(struct cgx *cgx, int lmac_id, bool enable) - - static inline int cgx_fwi_read_version(u64 *resp, struct cgx *cgx) - { -- int first_lmac = find_first_bit(&cgx->lmac_bmap, MAX_LMAC_PER_CGX); -+ int first_lmac = find_first_bit(&cgx->lmac_bmap, cgx->max_lmac_per_mac); - u64 req = 0; - - req = FIELD_SET(CMDREG_ID, CGX_CMD_GET_FW_VER, req); -@@ -1537,7 +1537,7 @@ static void cgx_lmac_linkup_work(struct work_struct *work) - int i, err; - - /* Do Link up for all the enabled lmacs */ -- for_each_set_bit(i, &cgx->lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(i, &cgx->lmac_bmap, cgx->max_lmac_per_mac) { - err = cgx_fwi_link_change(cgx, i, true); - if (err) - dev_info(dev, "cgx port %d:%d Link up command failed\n", -@@ -1557,14 +1557,6 @@ int cgx_lmac_linkup_start(void *cgxd) - return 0; - } - --static void cgx_lmac_get_fifolen(struct cgx *cgx) --{ -- u64 cfg; -- -- cfg = cgx_read(cgx, 0, CGX_CONST); -- cgx->mac_ops->fifo_len = FIELD_GET(CGX_CONST_RXFIFO_SIZE, cfg); --} -- - static int cgx_configure_interrupt(struct cgx *cgx, struct lmac *lmac, - int cnt, bool req_free) - { -@@ -1619,17 +1611,14 @@ static int cgx_lmac_init(struct cgx *cgx) - u64 lmac_list; - int i, err; - -- cgx_lmac_get_fifolen(cgx); -- -- cgx->lmac_count = cgx->mac_ops->get_nr_lmacs(cgx); - /* lmac_list specifies which lmacs are enabled - * when bit n is set to 1, LMAC[n] is enabled - */ - if (cgx->mac_ops->non_contiguous_serdes_lane) - lmac_list = cgx_read(cgx, 0, CGXX_CMRX_RX_LMACS) & 0xFULL; - -- if (cgx->lmac_count > MAX_LMAC_PER_CGX) -- cgx->lmac_count = MAX_LMAC_PER_CGX; -+ if (cgx->lmac_count > cgx->max_lmac_per_mac) -+ cgx->lmac_count = cgx->max_lmac_per_mac; - - for (i = 0; i < cgx->lmac_count; i++) { - lmac = kzalloc(sizeof(struct lmac), GFP_KERNEL); -@@ -1707,7 +1696,7 @@ static int cgx_lmac_exit(struct cgx *cgx) - } - - /* Free all lmac related resources */ -- for_each_set_bit(i, &cgx->lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(i, &cgx->lmac_bmap, cgx->max_lmac_per_mac) { - lmac = cgx->lmac_idmap[i]; - if (!lmac) - continue; -@@ -1723,6 +1712,12 @@ static int cgx_lmac_exit(struct cgx *cgx) - - static void cgx_populate_features(struct cgx *cgx) - { -+ u64 cfg; -+ -+ cfg = cgx_read(cgx, 0, CGX_CONST); -+ cgx->mac_ops->fifo_len = FIELD_GET(CGX_CONST_RXFIFO_SIZE, cfg); -+ cgx->max_lmac_per_mac = FIELD_GET(CGX_CONST_MAX_LMACS, cfg); -+ - if (is_dev_rpm(cgx)) - cgx->hw_features = (RVU_LMAC_FEAT_DMACF | RVU_MAC_RPM | - RVU_LMAC_FEAT_FC | RVU_LMAC_FEAT_PTP); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h -index 04338db38671b..09ddb00f63cc7 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h -@@ -18,11 +18,8 @@ - /* PCI BAR nos */ - #define PCI_CFG_REG_BAR_NUM 0 - --#define CGX_ID_MASK 0x7 --#define MAX_LMAC_PER_CGX 4 -+#define CGX_ID_MASK 0xF - #define MAX_DMAC_ENTRIES_PER_CGX 32 --#define CGX_FIFO_LEN 65536 /* 64K for both Rx & Tx */ --#define CGX_OFFSET(x) ((x) * MAX_LMAC_PER_CGX) - - /* Registers */ - #define CGXX_CMRX_CFG 0x00 -@@ -56,6 +53,7 @@ - #define CGXX_SCRATCH1_REG 0x1058 - #define CGX_CONST 0x2000 - #define CGX_CONST_RXFIFO_SIZE GENMASK_ULL(23, 0) -+#define CGX_CONST_MAX_LMACS GENMASK_ULL(31, 24) - #define CGXX_SPUX_CONTROL1 0x10000 - #define CGXX_SPUX_LNX_FEC_CORR_BLOCKS 0x10700 - #define CGXX_SPUX_LNX_FEC_UNCORR_BLOCKS 0x10800 -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h -index 52b6016789fa4..697cfec74aa1e 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h -@@ -128,7 +128,10 @@ struct cgx { - struct pci_dev *pdev; - u8 cgx_id; - u8 lmac_count; -- struct lmac *lmac_idmap[MAX_LMAC_PER_CGX]; -+ /* number of LMACs per MAC could be 4 or 8 */ -+ u8 max_lmac_per_mac; -+#define MAX_LMAC_COUNT 8 -+ struct lmac *lmac_idmap[MAX_LMAC_COUNT]; - struct work_struct cgx_cmd_work; - struct workqueue_struct *cgx_cmd_workq; - struct list_head cgx_list; -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc.h b/drivers/net/ethernet/marvell/octeontx2/af/npc.h -index d027c23b8ef8e..aaff91bc7415a 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/npc.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/npc.h -@@ -514,7 +514,7 @@ struct npc_lt_def { - u8 ltype_mask; - u8 ltype_match; - u8 lid; --}; -+} __packed; - - struct npc_lt_def_ipsec { - u8 ltype_mask; -@@ -522,7 +522,7 @@ struct npc_lt_def_ipsec { - u8 lid; - u8 spi_offset; - u8 spi_nz; --}; -+} __packed; - - struct npc_lt_def_apad { - u8 ltype_mask; -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c -index a70e1153fa04b..6b4792a942d84 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c -@@ -283,6 +283,11 @@ void rpm_lmac_pause_frm_config(void *rpmd, int lmac_id, bool enable) - cfg = FIELD_SET(RPM_PFC_CLASS_MASK, 0, cfg); - rpm_write(rpm, lmac_id, RPMX_CMRX_PRT_CBFC_CTL, cfg); - -+ /* Disable forward pause to driver */ -+ cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG); -+ cfg &= ~RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_FWD; -+ rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg); -+ - /* Enable channel mask for all LMACS */ - rpm_write(rpm, 0, RPMX_CMR_CHAN_MSK_OR, ~0ULL); - } -@@ -451,12 +456,10 @@ int rpm_lmac_pfc_config(void *rpmd, int lmac_id, u8 tx_pause, u8 rx_pause, u16 p - - if (rx_pause) { - cfg &= ~(RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE | -- RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE | -- RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_FWD); -+ RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE); - } else { - cfg |= (RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE | -- RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE | -- RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_FWD); -+ RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE); - } - - if (tx_pause) { -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -index 95a7bc396e8ea..0b76dfa979d4e 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h -@@ -480,7 +480,7 @@ struct rvu { - u8 cgx_mapped_pfs; - u8 cgx_cnt_max; /* CGX port count max */ - u8 *pf2cgxlmac_map; /* pf to cgx_lmac map */ -- u16 *cgxlmac2pf_map; /* bitmap of mapped pfs for -+ u64 *cgxlmac2pf_map; /* bitmap of mapped pfs for - * every cgx lmac port - */ - unsigned long pf_notify_bmap; /* Flags for PF notification */ -@@ -850,6 +850,7 @@ u32 rvu_cgx_get_fifolen(struct rvu *rvu); - void *rvu_first_cgx_pdata(struct rvu *rvu); - int cgxlmac_to_pf(struct rvu *rvu, int cgx_id, int lmac_id); - int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable); -+int rvu_cgx_tx_enable(struct rvu *rvu, u16 pcifunc, bool enable); - int rvu_cgx_prio_flow_ctrl_cfg(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause, - u16 pfc_en); - int rvu_cgx_cfg_pause_frm(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause); -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c -index c60b9580ca969..bcb4385d0621c 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c -@@ -55,8 +55,9 @@ bool is_mac_feature_supported(struct rvu *rvu, int pf, int feature) - return (cgx_features_get(cgxd) & feature); - } - -+#define CGX_OFFSET(x) ((x) * rvu->hw->lmac_per_cgx) - /* Returns bitmap of mapped PFs */ --static u16 cgxlmac_to_pfmap(struct rvu *rvu, u8 cgx_id, u8 lmac_id) -+static u64 cgxlmac_to_pfmap(struct rvu *rvu, u8 cgx_id, u8 lmac_id) - { - return rvu->cgxlmac2pf_map[CGX_OFFSET(cgx_id) + lmac_id]; - } -@@ -71,7 +72,8 @@ int cgxlmac_to_pf(struct rvu *rvu, int cgx_id, int lmac_id) - if (!pfmap) - return -ENODEV; - else -- return find_first_bit(&pfmap, 16); -+ return find_first_bit(&pfmap, -+ rvu->cgx_cnt_max * rvu->hw->lmac_per_cgx); - } - - static u8 cgxlmac_id_to_bmap(u8 cgx_id, u8 lmac_id) -@@ -129,14 +131,14 @@ static int rvu_map_cgx_lmac_pf(struct rvu *rvu) - if (!cgx_cnt_max) - return 0; - -- if (cgx_cnt_max > 0xF || MAX_LMAC_PER_CGX > 0xF) -+ if (cgx_cnt_max > 0xF || rvu->hw->lmac_per_cgx > 0xF) - return -EINVAL; - - /* Alloc map table - * An additional entry is required since PF id starts from 1 and - * hence entry at offset 0 is invalid. - */ -- size = (cgx_cnt_max * MAX_LMAC_PER_CGX + 1) * sizeof(u8); -+ size = (cgx_cnt_max * rvu->hw->lmac_per_cgx + 1) * sizeof(u8); - rvu->pf2cgxlmac_map = devm_kmalloc(rvu->dev, size, GFP_KERNEL); - if (!rvu->pf2cgxlmac_map) - return -ENOMEM; -@@ -145,9 +147,10 @@ static int rvu_map_cgx_lmac_pf(struct rvu *rvu) - memset(rvu->pf2cgxlmac_map, 0xFF, size); - - /* Reverse map table */ -- rvu->cgxlmac2pf_map = devm_kzalloc(rvu->dev, -- cgx_cnt_max * MAX_LMAC_PER_CGX * sizeof(u16), -- GFP_KERNEL); -+ rvu->cgxlmac2pf_map = -+ devm_kzalloc(rvu->dev, -+ cgx_cnt_max * rvu->hw->lmac_per_cgx * sizeof(u64), -+ GFP_KERNEL); - if (!rvu->cgxlmac2pf_map) - return -ENOMEM; - -@@ -156,7 +159,7 @@ static int rvu_map_cgx_lmac_pf(struct rvu *rvu) - if (!rvu_cgx_pdata(cgx, rvu)) - continue; - lmac_bmap = cgx_get_lmac_bmap(rvu_cgx_pdata(cgx, rvu)); -- for_each_set_bit(iter, &lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(iter, &lmac_bmap, rvu->hw->lmac_per_cgx) { - lmac = cgx_get_lmacid(rvu_cgx_pdata(cgx, rvu), - iter); - rvu->pf2cgxlmac_map[pf] = cgxlmac_id_to_bmap(cgx, lmac); -@@ -235,7 +238,8 @@ static void cgx_notify_pfs(struct cgx_link_event *event, struct rvu *rvu) - pfmap = cgxlmac_to_pfmap(rvu, event->cgx_id, event->lmac_id); - - do { -- pfid = find_first_bit(&pfmap, 16); -+ pfid = find_first_bit(&pfmap, -+ rvu->cgx_cnt_max * rvu->hw->lmac_per_cgx); - clear_bit(pfid, &pfmap); - - /* check if notification is enabled */ -@@ -310,7 +314,7 @@ static int cgx_lmac_event_handler_init(struct rvu *rvu) - if (!cgxd) - continue; - lmac_bmap = cgx_get_lmac_bmap(cgxd); -- for_each_set_bit(lmac, &lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(lmac, &lmac_bmap, rvu->hw->lmac_per_cgx) { - err = cgx_lmac_evh_register(&cb, cgxd, lmac); - if (err) - dev_err(rvu->dev, -@@ -396,7 +400,7 @@ int rvu_cgx_exit(struct rvu *rvu) - if (!cgxd) - continue; - lmac_bmap = cgx_get_lmac_bmap(cgxd); -- for_each_set_bit(lmac, &lmac_bmap, MAX_LMAC_PER_CGX) -+ for_each_set_bit(lmac, &lmac_bmap, rvu->hw->lmac_per_cgx) - cgx_lmac_evh_unregister(cgxd, lmac); - } - -@@ -456,6 +460,23 @@ int rvu_cgx_config_rxtx(struct rvu *rvu, u16 pcifunc, bool start) - return mac_ops->mac_rx_tx_enable(cgxd, lmac_id, start); - } - -+int rvu_cgx_tx_enable(struct rvu *rvu, u16 pcifunc, bool enable) -+{ -+ int pf = rvu_get_pf(pcifunc); -+ struct mac_ops *mac_ops; -+ u8 cgx_id, lmac_id; -+ void *cgxd; -+ -+ if (!is_cgx_config_permitted(rvu, pcifunc)) -+ return LMAC_AF_ERR_PERM_DENIED; -+ -+ rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); -+ cgxd = rvu_cgx_pdata(cgx_id, rvu); -+ mac_ops = get_mac_ops(cgxd); -+ -+ return mac_ops->mac_tx_enable(cgxd, lmac_id, enable); -+} -+ - int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable) - { - struct mac_ops *mac_ops; -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -index 5c9dc3f9262f5..cc5d342e026c7 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c -@@ -2618,7 +2618,7 @@ static void rvu_dbg_cgx_init(struct rvu *rvu) - rvu->rvu_dbg.cgx = debugfs_create_dir(dname, - rvu->rvu_dbg.cgx_root); - -- for_each_set_bit(lmac_id, &lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(lmac_id, &lmac_bmap, rvu->hw->lmac_per_cgx) { - /* lmac debugfs dir */ - sprintf(dname, "lmac%d", lmac_id); - rvu->rvu_dbg.lmac = -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c -index 959f36efdc4a6..bb99302eab67a 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c -@@ -3923,90 +3923,18 @@ static void nix_find_link_frs(struct rvu *rvu, - req->minlen = minlen; - } - --static int --nix_config_link_credits(struct rvu *rvu, int blkaddr, int link, -- u16 pcifunc, u64 tx_credits) --{ -- struct rvu_hwinfo *hw = rvu->hw; -- int pf = rvu_get_pf(pcifunc); -- u8 cgx_id = 0, lmac_id = 0; -- unsigned long poll_tmo; -- bool restore_tx_en = 0; -- struct nix_hw *nix_hw; -- u64 cfg, sw_xoff = 0; -- u32 schq = 0; -- u32 credits; -- int rc; -- -- nix_hw = get_nix_hw(rvu->hw, blkaddr); -- if (!nix_hw) -- return NIX_AF_ERR_INVALID_NIXBLK; -- -- if (tx_credits == nix_hw->tx_credits[link]) -- return 0; -- -- /* Enable cgx tx if disabled for credits to be back */ -- if (is_pf_cgxmapped(rvu, pf)) { -- rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); -- restore_tx_en = !rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), -- lmac_id, true); -- } -- -- mutex_lock(&rvu->rsrc_lock); -- /* Disable new traffic to link */ -- if (hw->cap.nix_shaping) { -- schq = nix_get_tx_link(rvu, pcifunc); -- sw_xoff = rvu_read64(rvu, blkaddr, NIX_AF_TL1X_SW_XOFF(schq)); -- rvu_write64(rvu, blkaddr, -- NIX_AF_TL1X_SW_XOFF(schq), BIT_ULL(0)); -- } -- -- rc = NIX_AF_ERR_LINK_CREDITS; -- poll_tmo = jiffies + usecs_to_jiffies(200000); -- /* Wait for credits to return */ -- do { -- if (time_after(jiffies, poll_tmo)) -- goto exit; -- usleep_range(100, 200); -- -- cfg = rvu_read64(rvu, blkaddr, -- NIX_AF_TX_LINKX_NORM_CREDIT(link)); -- credits = (cfg >> 12) & 0xFFFFFULL; -- } while (credits != nix_hw->tx_credits[link]); -- -- cfg &= ~(0xFFFFFULL << 12); -- cfg |= (tx_credits << 12); -- rvu_write64(rvu, blkaddr, NIX_AF_TX_LINKX_NORM_CREDIT(link), cfg); -- rc = 0; -- -- nix_hw->tx_credits[link] = tx_credits; -- --exit: -- /* Enable traffic back */ -- if (hw->cap.nix_shaping && !sw_xoff) -- rvu_write64(rvu, blkaddr, NIX_AF_TL1X_SW_XOFF(schq), 0); -- -- /* Restore state of cgx tx */ -- if (restore_tx_en) -- rvu_cgx_config_tx(rvu_cgx_pdata(cgx_id, rvu), lmac_id, false); -- -- mutex_unlock(&rvu->rsrc_lock); -- return rc; --} -- - int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, - struct msg_rsp *rsp) - { - struct rvu_hwinfo *hw = rvu->hw; - u16 pcifunc = req->hdr.pcifunc; - int pf = rvu_get_pf(pcifunc); -- int blkaddr, schq, link = -1; -- struct nix_txsch *txsch; -- u64 cfg, lmac_fifo_len; -+ int blkaddr, link = -1; - struct nix_hw *nix_hw; - struct rvu_pfvf *pfvf; - u8 cgx = 0, lmac = 0; - u16 max_mtu; -+ u64 cfg; - - blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NIX, pcifunc); - if (blkaddr < 0) -@@ -4027,25 +3955,6 @@ int rvu_mbox_handler_nix_set_hw_frs(struct rvu *rvu, struct nix_frs_cfg *req, - if (req->update_minlen && req->minlen < NIC_HW_MIN_FRS) - return NIX_AF_ERR_FRS_INVALID; - -- /* Check if requester wants to update SMQ's */ -- if (!req->update_smq) -- goto rx_frscfg; -- -- /* Update min/maxlen in each of the SMQ attached to this PF/VF */ -- txsch = &nix_hw->txsch[NIX_TXSCH_LVL_SMQ]; -- mutex_lock(&rvu->rsrc_lock); -- for (schq = 0; schq < txsch->schq.max; schq++) { -- if (TXSCH_MAP_FUNC(txsch->pfvf_map[schq]) != pcifunc) -- continue; -- cfg = rvu_read64(rvu, blkaddr, NIX_AF_SMQX_CFG(schq)); -- cfg = (cfg & ~(0xFFFFULL << 8)) | ((u64)req->maxlen << 8); -- if (req->update_minlen) -- cfg = (cfg & ~0x7FULL) | ((u64)req->minlen & 0x7F); -- rvu_write64(rvu, blkaddr, NIX_AF_SMQX_CFG(schq), cfg); -- } -- mutex_unlock(&rvu->rsrc_lock); -- --rx_frscfg: - /* Check if config is for SDP link */ - if (req->sdp_link) { - if (!hw->sdp_links) -@@ -4068,7 +3977,6 @@ rx_frscfg: - if (link < 0) - return NIX_AF_ERR_RX_LINK_INVALID; - -- - linkcfg: - nix_find_link_frs(rvu, req, pcifunc); - -@@ -4078,19 +3986,7 @@ linkcfg: - cfg = (cfg & ~0xFFFFULL) | req->minlen; - rvu_write64(rvu, blkaddr, NIX_AF_RX_LINKX_CFG(link), cfg); - -- if (req->sdp_link || pf == 0) -- return 0; -- -- /* Update transmit credits for CGX links */ -- lmac_fifo_len = rvu_cgx_get_lmac_fifolen(rvu, cgx, lmac); -- if (!lmac_fifo_len) { -- dev_err(rvu->dev, -- "%s: Failed to get CGX/RPM%d:LMAC%d FIFO size\n", -- __func__, cgx, lmac); -- return 0; -- } -- return nix_config_link_credits(rvu, blkaddr, link, pcifunc, -- (lmac_fifo_len - req->maxlen) / 16); -+ return 0; - } - - int rvu_mbox_handler_nix_set_rx_cfg(struct rvu *rvu, struct nix_rx_cfg *req, -@@ -4183,7 +4079,7 @@ static void nix_link_config(struct rvu *rvu, int blkaddr, - - /* Get LMAC id's from bitmap */ - lmac_bmap = cgx_get_lmac_bmap(rvu_cgx_pdata(cgx, rvu)); -- for_each_set_bit(iter, &lmac_bmap, MAX_LMAC_PER_CGX) { -+ for_each_set_bit(iter, &lmac_bmap, rvu->hw->lmac_per_cgx) { - lmac_fifo_len = rvu_cgx_get_lmac_fifolen(rvu, cgx, iter); - if (!lmac_fifo_len) { - dev_err(rvu->dev, -@@ -4610,7 +4506,13 @@ int rvu_mbox_handler_nix_lf_stop_rx(struct rvu *rvu, struct msg_req *req, - pfvf = rvu_get_pfvf(rvu, pcifunc); - clear_bit(NIXLF_INITIALIZED, &pfvf->flags); - -- return rvu_cgx_start_stop_io(rvu, pcifunc, false); -+ err = rvu_cgx_start_stop_io(rvu, pcifunc, false); -+ if (err) -+ return err; -+ -+ rvu_cgx_tx_enable(rvu, pcifunc, true); -+ -+ return 0; - } - - #define RX_SA_BASE GENMASK_ULL(52, 7) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c -index 34fa59575fa91..54e0dfdc9d984 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c -@@ -1999,7 +1999,9 @@ int rvu_npc_exact_init(struct rvu *rvu) - /* Install SDP drop rule */ - drop_mcam_idx = &table->num_drop_rules; - -- max_lmac_cnt = rvu->cgx_cnt_max * MAX_LMAC_PER_CGX + PF_CGXMAP_BASE; -+ max_lmac_cnt = rvu->cgx_cnt_max * rvu->hw->lmac_per_cgx + -+ PF_CGXMAP_BASE; -+ - for (i = PF_CGXMAP_BASE; i < max_lmac_cnt; i++) { - if (rvu->pf2cgxlmac_map[i] == 0xFF) - continue; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index d136360ac6a98..a6d3fc96e1685 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -25,7 +25,7 @@ - struct mlx5_irq { - struct atomic_notifier_head nh; - cpumask_var_t mask; -- char name[MLX5_MAX_IRQ_NAME]; -+ char name[MLX5_MAX_IRQ_FORMATTED_NAME]; - struct mlx5_irq_pool *pool; - int refcount; - u32 index; -@@ -236,8 +236,8 @@ struct mlx5_irq *mlx5_irq_alloc(struct mlx5_irq_pool *pool, int i, - else - irq_sf_set_name(pool, name, i); - ATOMIC_INIT_NOTIFIER_HEAD(&irq->nh); -- snprintf(irq->name, MLX5_MAX_IRQ_NAME, -- "%s@pci:%s", name, pci_name(dev->pdev)); -+ snprintf(irq->name, MLX5_MAX_IRQ_FORMATTED_NAME, -+ MLX5_IRQ_NAME_FORMAT_STR, name, pci_name(dev->pdev)); - err = request_irq(irq->irqn, irq_int_handler, 0, irq->name, - &irq->nh); - if (err) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h -index 5c7e68bee43a0..4047179307c4a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.h -@@ -7,6 +7,9 @@ - #include - - #define MLX5_MAX_IRQ_NAME (32) -+#define MLX5_IRQ_NAME_FORMAT_STR ("%s@pci:%s") -+#define MLX5_MAX_IRQ_FORMATTED_NAME \ -+ (MLX5_MAX_IRQ_NAME + sizeof(MLX5_IRQ_NAME_FORMAT_STR)) - /* max irq_index is 2047, so four chars */ - #define MLX5_MAX_IRQ_IDX_CHARS (4) - #define MLX5_EQ_REFS_PER_IRQ (2) -diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -index 0d5a41a2ae010..227d01cace3f0 100644 ---- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -@@ -267,6 +267,13 @@ static bool mlxbf_gige_rx_packet(struct mlxbf_gige *priv, int *rx_pkts) - priv->stats.rx_truncate_errors++; - } - -+ /* Read receive consumer index before replenish so that this routine -+ * returns accurate return value even if packet is received into -+ * just-replenished buffer prior to exiting this routine. -+ */ -+ rx_ci = readq(priv->base + MLXBF_GIGE_RX_CQE_PACKET_CI); -+ rx_ci_rem = rx_ci % priv->rx_q_entries; -+ - /* Let hardware know we've replenished one buffer */ - rx_pi++; - -@@ -279,8 +286,6 @@ static bool mlxbf_gige_rx_packet(struct mlxbf_gige *priv, int *rx_pkts) - rx_pi_rem = rx_pi % priv->rx_q_entries; - if (rx_pi_rem == 0) - priv->valid_polarity ^= 1; -- rx_ci = readq(priv->base + MLXBF_GIGE_RX_CQE_PACKET_CI); -- rx_ci_rem = rx_ci % priv->rx_q_entries; - - if (skb) - netif_receive_skb(skb); -diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c -index 0d57ffcedf0c6..fc78bc959ded8 100644 ---- a/drivers/net/ethernet/qlogic/qla3xxx.c -+++ b/drivers/net/ethernet/qlogic/qla3xxx.c -@@ -2591,6 +2591,7 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev) - - if (qdev->lrg_buf_q_alloc_virt_addr == NULL) { - netdev_err(qdev->ndev, "lBufQ failed\n"); -+ kfree(qdev->lrg_buf); - return -ENOMEM; - } - qdev->lrg_buf_q_virt_addr = qdev->lrg_buf_q_alloc_virt_addr; -@@ -2615,6 +2616,7 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev) - qdev->lrg_buf_q_alloc_size, - qdev->lrg_buf_q_alloc_virt_addr, - qdev->lrg_buf_q_alloc_phy_addr); -+ kfree(qdev->lrg_buf); - return -ENOMEM; - } - -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index d22457f2cf9cf..06663c11ca96d 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -1145,7 +1145,7 @@ static void rtl8168ep_driver_start(struct rtl8169_private *tp) - { - r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_START); - r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01); -- rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 10); -+ rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30); - } - - static void rtl8168_driver_start(struct rtl8169_private *tp) -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 68cb5616ef991..c2c56a5289caf 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -68,16 +68,27 @@ int ravb_wait(struct net_device *ndev, enum ravb_reg reg, u32 mask, u32 value) - return -ETIMEDOUT; - } - --static int ravb_config(struct net_device *ndev) -+static int ravb_set_opmode(struct net_device *ndev, u32 opmode) - { -+ u32 csr_ops = 1U << (opmode & CCC_OPC); -+ u32 ccc_mask = CCC_OPC; - int error; - -- /* Set config mode */ -- ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG); -- /* Check if the operating mode is changed to the config mode */ -- error = ravb_wait(ndev, CSR, CSR_OPS, CSR_OPS_CONFIG); -- if (error) -- netdev_err(ndev, "failed to switch device to config mode\n"); -+ /* If gPTP active in config mode is supported it needs to be configured -+ * along with CSEL and operating mode in the same access. This is a -+ * hardware limitation. -+ */ -+ if (opmode & CCC_GAC) -+ ccc_mask |= CCC_GAC | CCC_CSEL; -+ -+ /* Set operating mode */ -+ ravb_modify(ndev, CCC, ccc_mask, opmode); -+ /* Check if the operating mode is changed to the requested one */ -+ error = ravb_wait(ndev, CSR, CSR_OPS, csr_ops); -+ if (error) { -+ netdev_err(ndev, "failed to switch device to requested mode (%u)\n", -+ opmode & CCC_OPC); -+ } - - return error; - } -@@ -675,7 +686,7 @@ static int ravb_dmac_init(struct net_device *ndev) - int error; - - /* Set CONFIG mode */ -- error = ravb_config(ndev); -+ error = ravb_set_opmode(ndev, CCC_OPC_CONFIG); - if (error) - return error; - -@@ -684,9 +695,7 @@ static int ravb_dmac_init(struct net_device *ndev) - return error; - - /* Setting the control will start the AVB-DMAC process. */ -- ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_OPERATION); -- -- return 0; -+ return ravb_set_opmode(ndev, CCC_OPC_OPERATION); - } - - static void ravb_get_tx_tstamp(struct net_device *ndev) -@@ -1048,7 +1057,7 @@ static int ravb_stop_dma(struct net_device *ndev) - return error; - - /* Stop AVB-DMAC process */ -- return ravb_config(ndev); -+ return ravb_set_opmode(ndev, CCC_OPC_CONFIG); - } - - /* E-MAC interrupt handler */ -@@ -2576,21 +2585,25 @@ static int ravb_set_gti(struct net_device *ndev) - return 0; - } - --static void ravb_set_config_mode(struct net_device *ndev) -+static int ravb_set_config_mode(struct net_device *ndev) - { - struct ravb_private *priv = netdev_priv(ndev); - const struct ravb_hw_info *info = priv->info; -+ int error; - - if (info->gptp) { -- ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG); -+ error = ravb_set_opmode(ndev, CCC_OPC_CONFIG); -+ if (error) -+ return error; - /* Set CSEL value */ - ravb_modify(ndev, CCC, CCC_CSEL, CCC_CSEL_HPB); - } else if (info->ccc_gac) { -- ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG | -- CCC_GAC | CCC_CSEL_HPB); -+ error = ravb_set_opmode(ndev, CCC_OPC_CONFIG | CCC_GAC | CCC_CSEL_HPB); - } else { -- ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG); -+ error = ravb_set_opmode(ndev, CCC_OPC_CONFIG); - } -+ -+ return error; - } - - /* Set tx and rx clock internal delay modes */ -@@ -2810,7 +2823,9 @@ static int ravb_probe(struct platform_device *pdev) - ndev->ethtool_ops = &ravb_ethtool_ops; - - /* Set AVB config mode */ -- ravb_set_config_mode(ndev); -+ error = ravb_set_config_mode(ndev); -+ if (error) -+ goto out_disable_gptp_clk; - - if (info->gptp || info->ccc_gac) { - /* Set GTI value */ -@@ -2933,8 +2948,7 @@ static int ravb_remove(struct platform_device *pdev) - dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, - priv->desc_bat_dma); - -- /* Set reset mode */ -- ravb_write(ndev, CCC_OPC_RESET, CCC); -+ ravb_set_opmode(ndev, CCC_OPC_RESET); - - clk_disable_unprepare(priv->gptp_clk); - clk_disable_unprepare(priv->refclk); -@@ -3018,8 +3032,11 @@ static int __maybe_unused ravb_resume(struct device *dev) - int ret = 0; - - /* If WoL is enabled set reset mode to rearm the WoL logic */ -- if (priv->wol_enabled) -- ravb_write(ndev, CCC_OPC_RESET, CCC); -+ if (priv->wol_enabled) { -+ ret = ravb_set_opmode(ndev, CCC_OPC_RESET); -+ if (ret) -+ return ret; -+ } - - /* All register have been reset to default values. - * Restore all registers which where setup at probe time and -@@ -3027,7 +3044,9 @@ static int __maybe_unused ravb_resume(struct device *dev) - */ - - /* Set AVB config mode */ -- ravb_set_config_mode(ndev); -+ ret = ravb_set_config_mode(ndev); -+ if (ret) -+ return ret; - - if (info->gptp || info->ccc_gac) { - /* Set GTI value */ -diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c -index 9220afeddee81..3f290791df1c4 100644 ---- a/drivers/net/ethernet/sfc/rx_common.c -+++ b/drivers/net/ethernet/sfc/rx_common.c -@@ -820,8 +820,10 @@ int efx_probe_filters(struct efx_nic *efx) - } - - if (!success) { -- efx_for_each_channel(channel, efx) -+ efx_for_each_channel(channel, efx) { - kfree(channel->rps_flow_id); -+ channel->rps_flow_id = NULL; -+ } - efx->type->filter_table_remove(efx); - rc = -ENOMEM; - goto out_unlock; -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index 477b4d4f860bd..bace989591f75 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -629,7 +629,7 @@ static void __gtp_encap_destroy(struct sock *sk) - gtp->sk0 = NULL; - else - gtp->sk1u = NULL; -- udp_sk(sk)->encap_type = 0; -+ WRITE_ONCE(udp_sk(sk)->encap_type, 0); - rcu_assign_sk_user_data(sk, NULL); - release_sock(sk); - sock_put(sk); -@@ -681,7 +681,7 @@ static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb) - - netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk); - -- switch (udp_sk(sk)->encap_type) { -+ switch (READ_ONCE(udp_sk(sk)->encap_type)) { - case UDP_ENCAP_GTP0: - netdev_dbg(gtp->dev, "received GTP0 packet\n"); - ret = gtp0_udp_encap_recv(gtp, skb); -diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c -index 3777c7e2e6fc0..e47bb125048d4 100644 ---- a/drivers/net/usb/ax88172a.c -+++ b/drivers/net/usb/ax88172a.c -@@ -161,7 +161,9 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) - u8 buf[ETH_ALEN]; - struct ax88172a_private *priv; - -- usbnet_get_endpoints(dev, intf); -+ ret = usbnet_get_endpoints(dev, intf); -+ if (ret) -+ return ret; - - priv = kzalloc(sizeof(*priv), GFP_KERNEL); - if (!priv) -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h -index 157d1f31c4871..c5a306b01fe20 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h -@@ -348,8 +348,8 @@ - #define RFIC_REG_RD 0xAD0470 - #define WFPM_CTRL_REG 0xA03030 - #define WFPM_OTP_CFG1_ADDR 0x00a03098 --#define WFPM_OTP_CFG1_IS_JACKET_BIT BIT(4) --#define WFPM_OTP_CFG1_IS_CDB_BIT BIT(5) -+#define WFPM_OTP_CFG1_IS_JACKET_BIT BIT(5) -+#define WFPM_OTP_CFG1_IS_CDB_BIT BIT(4) - - #define WFPM_GP2 0xA030B4 - -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h -index 69b95ad5993b0..2ec4ee8ab317c 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h -@@ -745,7 +745,7 @@ static inline void iwl_enable_rfkill_int(struct iwl_trans *trans) - } - } - --void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans); -+void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans, bool from_irq); - - static inline bool iwl_is_rfkill_set(struct iwl_trans *trans) - { -@@ -792,7 +792,7 @@ static inline bool iwl_pcie_dbg_on(struct iwl_trans *trans) - return (trans->dbg.dest_tlv || iwl_trans_dbg_ini_valid(trans)); - } - --void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state); -+void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state, bool from_irq); - void iwl_trans_pcie_dump_regs(struct iwl_trans *trans); - - #ifdef CONFIG_IWLWIFI_DEBUGFS -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -index 90a46faaaffdf..57a11ee05bc36 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -@@ -1781,7 +1781,7 @@ static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans) - return inta; - } - --void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans) -+void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans, bool from_irq) - { - struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); - struct isr_statistics *isr_stats = &trans_pcie->isr_stats; -@@ -1805,7 +1805,7 @@ void iwl_pcie_handle_rfkill_irq(struct iwl_trans *trans) - isr_stats->rfkill++; - - if (prev != report) -- iwl_trans_pcie_rf_kill(trans, report); -+ iwl_trans_pcie_rf_kill(trans, report, from_irq); - mutex_unlock(&trans_pcie->mutex); - - if (hw_rfkill) { -@@ -1945,7 +1945,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id) - - /* HW RF KILL switch toggled */ - if (inta & CSR_INT_BIT_RF_KILL) { -- iwl_pcie_handle_rfkill_irq(trans); -+ iwl_pcie_handle_rfkill_irq(trans, true); - handled |= CSR_INT_BIT_RF_KILL; - } - -@@ -2362,7 +2362,7 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id) - - /* HW RF KILL switch toggled */ - if (inta_hw & MSIX_HW_INT_CAUSES_REG_RF_KILL) -- iwl_pcie_handle_rfkill_irq(trans); -+ iwl_pcie_handle_rfkill_irq(trans, true); - - if (inta_hw & MSIX_HW_INT_CAUSES_REG_HW_ERR) { - IWL_ERR(trans, -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -index 796972f224326..c7ed35b3dd8d5 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c -@@ -1080,7 +1080,7 @@ bool iwl_pcie_check_hw_rf_kill(struct iwl_trans *trans) - report = test_bit(STATUS_RFKILL_OPMODE, &trans->status); - - if (prev != report) -- iwl_trans_pcie_rf_kill(trans, report); -+ iwl_trans_pcie_rf_kill(trans, report, false); - - return hw_rfkill; - } -@@ -1234,7 +1234,7 @@ static void iwl_pcie_init_msix(struct iwl_trans_pcie *trans_pcie) - trans_pcie->hw_mask = trans_pcie->hw_init_mask; - } - --static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans) -+static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool from_irq) - { - struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); - -@@ -1261,7 +1261,8 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans) - if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) { - IWL_DEBUG_INFO(trans, - "DEVICE_ENABLED bit was set and is now cleared\n"); -- iwl_pcie_synchronize_irqs(trans); -+ if (!from_irq) -+ iwl_pcie_synchronize_irqs(trans); - iwl_pcie_rx_napi_sync(trans); - iwl_pcie_tx_stop(trans); - iwl_pcie_rx_stop(trans); -@@ -1451,7 +1452,7 @@ void iwl_trans_pcie_handle_stop_rfkill(struct iwl_trans *trans, - clear_bit(STATUS_RFKILL_OPMODE, &trans->status); - } - if (hw_rfkill != was_in_rfkill) -- iwl_trans_pcie_rf_kill(trans, hw_rfkill); -+ iwl_trans_pcie_rf_kill(trans, hw_rfkill, false); - } - - static void iwl_trans_pcie_stop_device(struct iwl_trans *trans) -@@ -1466,12 +1467,12 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans) - mutex_lock(&trans_pcie->mutex); - trans_pcie->opmode_down = true; - was_in_rfkill = test_bit(STATUS_RFKILL_OPMODE, &trans->status); -- _iwl_trans_pcie_stop_device(trans); -+ _iwl_trans_pcie_stop_device(trans, false); - iwl_trans_pcie_handle_stop_rfkill(trans, was_in_rfkill); - mutex_unlock(&trans_pcie->mutex); - } - --void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state) -+void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state, bool from_irq) - { - struct iwl_trans_pcie __maybe_unused *trans_pcie = - IWL_TRANS_GET_PCIE_TRANS(trans); -@@ -1484,7 +1485,7 @@ void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state) - if (trans->trans_cfg->gen2) - _iwl_trans_pcie_gen2_stop_device(trans); - else -- _iwl_trans_pcie_stop_device(trans); -+ _iwl_trans_pcie_stop_device(trans, from_irq); - } - } - -@@ -2815,7 +2816,7 @@ static ssize_t iwl_dbgfs_rfkill_write(struct file *file, - IWL_WARN(trans, "changing debug rfkill %d->%d\n", - trans_pcie->debug_rfkill, new_value); - trans_pcie->debug_rfkill = new_value; -- iwl_pcie_handle_rfkill_irq(trans); -+ iwl_pcie_handle_rfkill_irq(trans, false); - - return count; - } -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 8df156c28aade..5368a37154cf9 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -1302,6 +1302,9 @@ static int pci_set_full_power_state(struct pci_dev *dev) - pci_restore_bars(dev); - } - -+ if (dev->bus->self) -+ pcie_aspm_pm_state_change(dev->bus->self); -+ - return 0; - } - -@@ -1396,6 +1399,9 @@ static int pci_set_low_power_state(struct pci_dev *dev, pci_power_t state) - pci_power_name(dev->current_state), - pci_power_name(state)); - -+ if (dev->bus->self) -+ pcie_aspm_pm_state_change(dev->bus->self); -+ - return 0; - } - -diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h -index ffccb03933e27..ed6d75d138c7a 100644 ---- a/drivers/pci/pci.h -+++ b/drivers/pci/pci.h -@@ -561,10 +561,12 @@ bool pcie_wait_for_link(struct pci_dev *pdev, bool active); - #ifdef CONFIG_PCIEASPM - void pcie_aspm_init_link_state(struct pci_dev *pdev); - void pcie_aspm_exit_link_state(struct pci_dev *pdev); -+void pcie_aspm_pm_state_change(struct pci_dev *pdev); - void pcie_aspm_powersave_config_link(struct pci_dev *pdev); - #else - static inline void pcie_aspm_init_link_state(struct pci_dev *pdev) { } - static inline void pcie_aspm_exit_link_state(struct pci_dev *pdev) { } -+static inline void pcie_aspm_pm_state_change(struct pci_dev *pdev) { } - static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev) { } - #endif - -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 5d1756f53ba84..25736d408e88e 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -1055,6 +1055,25 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) - up_read(&pci_bus_sem); - } - -+/* @pdev: the root port or switch downstream port */ -+void pcie_aspm_pm_state_change(struct pci_dev *pdev) -+{ -+ struct pcie_link_state *link = pdev->link_state; -+ -+ if (aspm_disabled || !link) -+ return; -+ /* -+ * Devices changed PM state, we should recheck if latency -+ * meets all functions' requirement -+ */ -+ down_read(&pci_bus_sem); -+ mutex_lock(&aspm_lock); -+ pcie_update_aspm_capable(link->root); -+ pcie_config_aspm_path(link); -+ mutex_unlock(&aspm_lock); -+ up_read(&pci_bus_sem); -+} -+ - void pcie_aspm_powersave_config_link(struct pci_dev *pdev) - { - struct pcie_link_state *link = pdev->link_state; -diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c -index b194e71f07bfc..aa51cb72cbba5 100644 ---- a/drivers/video/fbdev/imsttfb.c -+++ b/drivers/video/fbdev/imsttfb.c -@@ -1419,7 +1419,6 @@ static int init_imstt(struct fb_info *info) - if ((info->var.xres * info->var.yres) * (info->var.bits_per_pixel >> 3) > info->fix.smem_len - || !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) { - printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel); -- framebuffer_release(info); - return -ENODEV; - } - -@@ -1452,10 +1451,11 @@ static int init_imstt(struct fb_info *info) - FBINFO_HWACCEL_FILLRECT | - FBINFO_HWACCEL_YPAN; - -- fb_alloc_cmap(&info->cmap, 0, 0); -+ if (fb_alloc_cmap(&info->cmap, 0, 0)) -+ return -ENODEV; - - if (register_framebuffer(info) < 0) { -- framebuffer_release(info); -+ fb_dealloc_cmap(&info->cmap); - return -ENODEV; - } - -diff --git a/fs/9p/cache.c b/fs/9p/cache.c -index cebba4eaa0b57..12c0ae29f1857 100644 ---- a/fs/9p/cache.c -+++ b/fs/9p/cache.c -@@ -68,6 +68,8 @@ void v9fs_cache_inode_get_cookie(struct inode *inode) - &path, sizeof(path), - &version, sizeof(version), - i_size_read(&v9inode->netfs.inode)); -+ if (v9inode->netfs.cache) -+ mapping_set_release_always(inode->i_mapping); - - p9_debug(P9_DEBUG_FSC, "inode %p get cookie %p\n", - inode, v9fs_inode_cookie(v9inode)); -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index fcbb598d8c85d..a25fdc3e52310 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -682,6 +682,8 @@ static inline void afs_vnode_set_cache(struct afs_vnode *vnode, - { - #ifdef CONFIG_AFS_FSCACHE - vnode->netfs.cache = cookie; -+ if (cookie) -+ mapping_set_release_always(vnode->netfs.inode.i_mapping); - #endif - } - -diff --git a/fs/btrfs/delalloc-space.c b/fs/btrfs/delalloc-space.c -index 0b62ce77053f5..f2bc5563c0f92 100644 ---- a/fs/btrfs/delalloc-space.c -+++ b/fs/btrfs/delalloc-space.c -@@ -197,7 +197,7 @@ void btrfs_free_reserved_data_space(struct btrfs_inode *inode, - start = round_down(start, fs_info->sectorsize); - - btrfs_free_reserved_data_space_noquota(fs_info, len); -- btrfs_qgroup_free_data(inode, reserved, start, len); -+ btrfs_qgroup_free_data(inode, reserved, start, len, NULL); - } - - /** -diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c -index b14d2da9b26d3..14478da875313 100644 ---- a/fs/btrfs/file-item.c -+++ b/fs/btrfs/file-item.c -@@ -602,7 +602,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, - } - - sums->bytenr = start; -- sums->len = (int)size; -+ sums->len = size; - - offset = (start - key.offset) >> fs_info->sectorsize_bits; - offset *= csum_size; -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 0a46fff3dd067..1783a0fbf1665 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -3191,7 +3191,7 @@ static long btrfs_fallocate(struct file *file, int mode, - qgroup_reserved -= range->len; - } else if (qgroup_reserved > 0) { - btrfs_qgroup_free_data(BTRFS_I(inode), data_reserved, -- range->start, range->len); -+ range->start, range->len, NULL); - qgroup_reserved -= range->len; - } - list_del(&range->list); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 81eac121c6b23..9a7d77c410e22 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -466,7 +466,7 @@ out: - * And at reserve time, it's always aligned to page size, so - * just free one page here. - */ -- btrfs_qgroup_free_data(inode, NULL, 0, PAGE_SIZE); -+ btrfs_qgroup_free_data(inode, NULL, 0, PAGE_SIZE, NULL); - btrfs_free_path(path); - btrfs_end_transaction(trans); - return ret; -@@ -5372,7 +5372,7 @@ static void evict_inode_truncate_pages(struct inode *inode) - */ - if (state_flags & EXTENT_DELALLOC) - btrfs_qgroup_free_data(BTRFS_I(inode), NULL, start, -- end - start + 1); -+ end - start + 1, NULL); - - clear_extent_bit(io_tree, start, end, - EXTENT_CLEAR_ALL_BITS | EXTENT_DO_ACCOUNTING, -@@ -8440,7 +8440,7 @@ next: - * reserved data space. - * Since the IO will never happen for this page. - */ -- btrfs_qgroup_free_data(inode, NULL, cur, range_end + 1 - cur); -+ btrfs_qgroup_free_data(inode, NULL, cur, range_end + 1 - cur, NULL); - if (!inode_evicting) { - clear_extent_bit(tree, cur, range_end, EXTENT_LOCKED | - EXTENT_DELALLOC | EXTENT_UPTODATE | -@@ -9902,7 +9902,7 @@ static struct btrfs_trans_handle *insert_prealloc_file_extent( - struct btrfs_path *path; - u64 start = ins->objectid; - u64 len = ins->offset; -- int qgroup_released; -+ u64 qgroup_released = 0; - int ret; - - memset(&stack_fi, 0, sizeof(stack_fi)); -@@ -9915,9 +9915,9 @@ static struct btrfs_trans_handle *insert_prealloc_file_extent( - btrfs_set_stack_file_extent_compression(&stack_fi, BTRFS_COMPRESS_NONE); - /* Encryption and other encoding is reserved and all 0 */ - -- qgroup_released = btrfs_qgroup_release_data(inode, file_offset, len); -- if (qgroup_released < 0) -- return ERR_PTR(qgroup_released); -+ ret = btrfs_qgroup_release_data(inode, file_offset, len, &qgroup_released); -+ if (ret < 0) -+ return ERR_PTR(ret); - - if (trans) { - ret = insert_reserved_file_extent(trans, inode, -@@ -10903,7 +10903,7 @@ out_delalloc_release: - btrfs_delalloc_release_metadata(inode, disk_num_bytes, ret < 0); - out_qgroup_free_data: - if (ret < 0) -- btrfs_qgroup_free_data(inode, data_reserved, start, num_bytes); -+ btrfs_qgroup_free_data(inode, data_reserved, start, num_bytes, NULL); - out_free_data_space: - /* - * If btrfs_reserve_extent() succeeded, then we already decremented -diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c -index 0321753c16b9f..1b2af4785c0e2 100644 ---- a/fs/btrfs/ordered-data.c -+++ b/fs/btrfs/ordered-data.c -@@ -172,11 +172,12 @@ int btrfs_add_ordered_extent(struct btrfs_inode *inode, u64 file_offset, - struct rb_node *node; - struct btrfs_ordered_extent *entry; - int ret; -+ u64 qgroup_rsv = 0; - - if (flags & - ((1 << BTRFS_ORDERED_NOCOW) | (1 << BTRFS_ORDERED_PREALLOC))) { - /* For nocow write, we can release the qgroup rsv right now */ -- ret = btrfs_qgroup_free_data(inode, NULL, file_offset, num_bytes); -+ ret = btrfs_qgroup_free_data(inode, NULL, file_offset, num_bytes, &qgroup_rsv); - if (ret < 0) - return ret; - ret = 0; -@@ -185,7 +186,7 @@ int btrfs_add_ordered_extent(struct btrfs_inode *inode, u64 file_offset, - * The ordered extent has reserved qgroup space, release now - * and pass the reserved number for qgroup_record to free. - */ -- ret = btrfs_qgroup_release_data(inode, file_offset, num_bytes); -+ ret = btrfs_qgroup_release_data(inode, file_offset, num_bytes, &qgroup_rsv); - if (ret < 0) - return ret; - } -@@ -203,7 +204,7 @@ int btrfs_add_ordered_extent(struct btrfs_inode *inode, u64 file_offset, - entry->inode = igrab(&inode->vfs_inode); - entry->compress_type = compress_type; - entry->truncated_len = (u64)-1; -- entry->qgroup_rsv = ret; -+ entry->qgroup_rsv = qgroup_rsv; - entry->physical = (u64)-1; - - ASSERT((flags & ~BTRFS_ORDERED_TYPE_FLAGS) == 0); -diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h -index f59f2dbdb25ed..cc3ca4bb9bd54 100644 ---- a/fs/btrfs/ordered-data.h -+++ b/fs/btrfs/ordered-data.h -@@ -20,7 +20,7 @@ struct btrfs_ordered_sum { - /* - * this is the length in bytes covered by the sums array below. - */ -- int len; -+ u32 len; - struct list_head list; - /* last field is a variable length array of csums */ - u8 sums[]; -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 26cabffd59710..96ec9ccc2ef61 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -3833,13 +3833,14 @@ int btrfs_qgroup_reserve_data(struct btrfs_inode *inode, - - /* Free ranges specified by @reserved, normally in error path */ - static int qgroup_free_reserved_data(struct btrfs_inode *inode, -- struct extent_changeset *reserved, u64 start, u64 len) -+ struct extent_changeset *reserved, -+ u64 start, u64 len, u64 *freed_ret) - { - struct btrfs_root *root = inode->root; - struct ulist_node *unode; - struct ulist_iterator uiter; - struct extent_changeset changeset; -- int freed = 0; -+ u64 freed = 0; - int ret; - - extent_changeset_init(&changeset); -@@ -3880,7 +3881,9 @@ static int qgroup_free_reserved_data(struct btrfs_inode *inode, - } - btrfs_qgroup_free_refroot(root->fs_info, root->root_key.objectid, freed, - BTRFS_QGROUP_RSV_DATA); -- ret = freed; -+ if (freed_ret) -+ *freed_ret = freed; -+ ret = 0; - out: - extent_changeset_release(&changeset); - return ret; -@@ -3888,7 +3891,7 @@ out: - - static int __btrfs_qgroup_release_data(struct btrfs_inode *inode, - struct extent_changeset *reserved, u64 start, u64 len, -- int free) -+ u64 *released, int free) - { - struct extent_changeset changeset; - int trace_op = QGROUP_RELEASE; -@@ -3900,7 +3903,7 @@ static int __btrfs_qgroup_release_data(struct btrfs_inode *inode, - /* In release case, we shouldn't have @reserved */ - WARN_ON(!free && reserved); - if (free && reserved) -- return qgroup_free_reserved_data(inode, reserved, start, len); -+ return qgroup_free_reserved_data(inode, reserved, start, len, released); - extent_changeset_init(&changeset); - ret = clear_record_extent_bits(&inode->io_tree, start, start + len -1, - EXTENT_QGROUP_RESERVED, &changeset); -@@ -3915,7 +3918,8 @@ static int __btrfs_qgroup_release_data(struct btrfs_inode *inode, - btrfs_qgroup_free_refroot(inode->root->fs_info, - inode->root->root_key.objectid, - changeset.bytes_changed, BTRFS_QGROUP_RSV_DATA); -- ret = changeset.bytes_changed; -+ if (released) -+ *released = changeset.bytes_changed; - out: - extent_changeset_release(&changeset); - return ret; -@@ -3934,9 +3938,10 @@ out: - * NOTE: This function may sleep for memory allocation. - */ - int btrfs_qgroup_free_data(struct btrfs_inode *inode, -- struct extent_changeset *reserved, u64 start, u64 len) -+ struct extent_changeset *reserved, -+ u64 start, u64 len, u64 *freed) - { -- return __btrfs_qgroup_release_data(inode, reserved, start, len, 1); -+ return __btrfs_qgroup_release_data(inode, reserved, start, len, freed, 1); - } - - /* -@@ -3954,9 +3959,9 @@ int btrfs_qgroup_free_data(struct btrfs_inode *inode, - * - * NOTE: This function may sleep for memory allocation. - */ --int btrfs_qgroup_release_data(struct btrfs_inode *inode, u64 start, u64 len) -+int btrfs_qgroup_release_data(struct btrfs_inode *inode, u64 start, u64 len, u64 *released) - { -- return __btrfs_qgroup_release_data(inode, NULL, start, len, 0); -+ return __btrfs_qgroup_release_data(inode, NULL, start, len, released, 0); - } - - static void add_root_meta_rsv(struct btrfs_root *root, int num_bytes, -diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h -index 578c77e94200f..c382923f7628e 100644 ---- a/fs/btrfs/qgroup.h -+++ b/fs/btrfs/qgroup.h -@@ -360,10 +360,10 @@ int btrfs_verify_qgroup_counts(struct btrfs_fs_info *fs_info, u64 qgroupid, - /* New io_tree based accurate qgroup reserve API */ - int btrfs_qgroup_reserve_data(struct btrfs_inode *inode, - struct extent_changeset **reserved, u64 start, u64 len); --int btrfs_qgroup_release_data(struct btrfs_inode *inode, u64 start, u64 len); -+int btrfs_qgroup_release_data(struct btrfs_inode *inode, u64 start, u64 len, u64 *released); - int btrfs_qgroup_free_data(struct btrfs_inode *inode, - struct extent_changeset *reserved, u64 start, -- u64 len); -+ u64 len, u64 *freed); - int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, - enum btrfs_qgroup_rsv_type type, bool enforce); - int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, -diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c -index 03ca8f2f657ab..50b2ee163af60 100644 ---- a/fs/cachefiles/namei.c -+++ b/fs/cachefiles/namei.c -@@ -584,6 +584,8 @@ static bool cachefiles_open_file(struct cachefiles_object *object, - if (ret < 0) - goto check_failed; - -+ clear_bit(FSCACHE_COOKIE_NO_DATA_TO_READ, &object->cookie->flags); -+ - object->file = file; - - /* Always update the atime on an object we've just looked up (this is -diff --git a/fs/ceph/cache.c b/fs/ceph/cache.c -index 177d8e8d73fe4..de1dee46d3df7 100644 ---- a/fs/ceph/cache.c -+++ b/fs/ceph/cache.c -@@ -36,6 +36,8 @@ void ceph_fscache_register_inode_cookie(struct inode *inode) - &ci->i_vino, sizeof(ci->i_vino), - &ci->i_version, sizeof(ci->i_version), - i_size_read(inode)); -+ if (ci->netfs.cache) -+ mapping_set_release_always(inode->i_mapping); - } - - void ceph_fscache_unregister_inode_cookie(struct ceph_inode_info *ci) -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index 044e34cd835c1..dedc9d445f243 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -253,6 +253,7 @@ move_extent_per_page(struct file *o_filp, struct inode *donor_inode, - { - struct inode *orig_inode = file_inode(o_filp); - struct page *pagep[2] = {NULL, NULL}; -+ struct folio *folio[2] = {NULL, NULL}; - handle_t *handle; - ext4_lblk_t orig_blk_offset, donor_blk_offset; - unsigned long blocksize = orig_inode->i_sb->s_blocksize; -@@ -313,6 +314,13 @@ again: - * hold page's lock, if it is still the case data copy is not - * necessary, just swap data blocks between orig and donor. - */ -+ folio[0] = page_folio(pagep[0]); -+ folio[1] = page_folio(pagep[1]); -+ -+ VM_BUG_ON_FOLIO(folio_test_large(folio[0]), folio[0]); -+ VM_BUG_ON_FOLIO(folio_test_large(folio[1]), folio[1]); -+ VM_BUG_ON_FOLIO(folio_nr_pages(folio[0]) != folio_nr_pages(folio[1]), folio[1]); -+ - if (unwritten) { - ext4_double_down_write_data_sem(orig_inode, donor_inode); - /* If any of extents in range became initialized we have to -@@ -331,10 +339,8 @@ again: - ext4_double_up_write_data_sem(orig_inode, donor_inode); - goto data_copy; - } -- if ((page_has_private(pagep[0]) && -- !try_to_release_page(pagep[0], 0)) || -- (page_has_private(pagep[1]) && -- !try_to_release_page(pagep[1], 0))) { -+ if (!filemap_release_folio(folio[0], 0) || -+ !filemap_release_folio(folio[1], 0)) { - *err = -EBUSY; - goto drop_data_sem; - } -@@ -344,19 +350,19 @@ again: - block_len_in_page, 1, err); - drop_data_sem: - ext4_double_up_write_data_sem(orig_inode, donor_inode); -- goto unlock_pages; -+ goto unlock_folios; - } - data_copy: -- *err = mext_page_mkuptodate(pagep[0], from, from + replaced_size); -+ *err = mext_page_mkuptodate(&folio[0]->page, from, from + replaced_size); - if (*err) -- goto unlock_pages; -+ goto unlock_folios; - - /* At this point all buffers in range are uptodate, old mapping layout - * is no longer required, try to drop it now. */ -- if ((page_has_private(pagep[0]) && !try_to_release_page(pagep[0], 0)) || -- (page_has_private(pagep[1]) && !try_to_release_page(pagep[1], 0))) { -+ if (!filemap_release_folio(folio[0], 0) || -+ !filemap_release_folio(folio[1], 0)) { - *err = -EBUSY; -- goto unlock_pages; -+ goto unlock_folios; - } - ext4_double_down_write_data_sem(orig_inode, donor_inode); - replaced_count = ext4_swap_extents(handle, orig_inode, donor_inode, -@@ -369,13 +375,13 @@ data_copy: - replaced_size = - block_len_in_page << orig_inode->i_blkbits; - } else -- goto unlock_pages; -+ goto unlock_folios; - } - /* Perform all necessary steps similar write_begin()/write_end() - * but keeping in mind that i_size will not change */ -- if (!page_has_buffers(pagep[0])) -- create_empty_buffers(pagep[0], 1 << orig_inode->i_blkbits, 0); -- bh = page_buffers(pagep[0]); -+ if (!folio_buffers(folio[0])) -+ create_empty_buffers(&folio[0]->page, 1 << orig_inode->i_blkbits, 0); -+ bh = folio_buffers(folio[0]); - for (i = 0; i < data_offset_in_page; i++) - bh = bh->b_this_page; - for (i = 0; i < block_len_in_page; i++) { -@@ -385,7 +391,7 @@ data_copy: - bh = bh->b_this_page; - } - if (!*err) -- *err = block_commit_write(pagep[0], from, from + replaced_size); -+ *err = block_commit_write(&folio[0]->page, from, from + replaced_size); - - if (unlikely(*err < 0)) - goto repair_branches; -@@ -395,11 +401,11 @@ data_copy: - *err = ext4_jbd2_inode_add_write(handle, orig_inode, - (loff_t)orig_page_offset << PAGE_SHIFT, replaced_size); - --unlock_pages: -- unlock_page(pagep[0]); -- put_page(pagep[0]); -- unlock_page(pagep[1]); -- put_page(pagep[1]); -+unlock_folios: -+ folio_unlock(folio[0]); -+ folio_put(folio[0]); -+ folio_unlock(folio[1]); -+ folio_put(folio[1]); - stop_journal: - ext4_journal_stop(handle); - if (*err == -ENOSPC && -@@ -430,7 +436,7 @@ repair_branches: - *err = -EIO; - } - replaced_count = 0; -- goto unlock_pages; -+ goto unlock_folios; - } - - /** -diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c -index 5df04ed010cae..eb4d69f53337f 100644 ---- a/fs/f2fs/checkpoint.c -+++ b/fs/f2fs/checkpoint.c -@@ -984,7 +984,7 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi) - - cp_blk_no = le32_to_cpu(fsb->cp_blkaddr); - if (cur_page == cp2) -- cp_blk_no += 1 << le32_to_cpu(fsb->log_blocks_per_seg); -+ cp_blk_no += BIT(le32_to_cpu(fsb->log_blocks_per_seg)); - - for (i = 1; i < cp_blks; i++) { - void *sit_bitmap_ptr; -diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c -index 11d9dce994dbe..4cb58e8d699e2 100644 ---- a/fs/f2fs/compress.c -+++ b/fs/f2fs/compress.c -@@ -241,7 +241,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc) - unsigned int size = LZ4_MEM_COMPRESS; - - #ifdef CONFIG_F2FS_FS_LZ4HC -- if (F2FS_I(cc->inode)->i_compress_flag >> COMPRESS_LEVEL_OFFSET) -+ if (F2FS_I(cc->inode)->i_compress_level) - size = LZ4HC_MEM_COMPRESS; - #endif - -@@ -267,8 +267,7 @@ static void lz4_destroy_compress_ctx(struct compress_ctx *cc) - #ifdef CONFIG_F2FS_FS_LZ4HC - static int lz4hc_compress_pages(struct compress_ctx *cc) - { -- unsigned char level = F2FS_I(cc->inode)->i_compress_flag >> -- COMPRESS_LEVEL_OFFSET; -+ unsigned char level = F2FS_I(cc->inode)->i_compress_level; - int len; - - if (level) -@@ -332,17 +331,15 @@ static const struct f2fs_compress_ops f2fs_lz4_ops = { - #endif - - #ifdef CONFIG_F2FS_FS_ZSTD --#define F2FS_ZSTD_DEFAULT_CLEVEL 1 -- - static int zstd_init_compress_ctx(struct compress_ctx *cc) - { - zstd_parameters params; - zstd_cstream *stream; - void *workspace; - unsigned int workspace_size; -- unsigned char level = F2FS_I(cc->inode)->i_compress_flag >> -- COMPRESS_LEVEL_OFFSET; -+ unsigned char level = F2FS_I(cc->inode)->i_compress_level; - -+ /* Need to remain this for backward compatibility */ - if (!level) - level = F2FS_ZSTD_DEFAULT_CLEVEL; - -@@ -675,7 +672,7 @@ static int f2fs_compress_pages(struct compress_ctx *cc) - - cc->cbuf->clen = cpu_to_le32(cc->clen); - -- if (fi->i_compress_flag & 1 << COMPRESS_CHKSUM) -+ if (fi->i_compress_flag & BIT(COMPRESS_CHKSUM)) - chksum = f2fs_crc32(F2FS_I_SB(cc->inode), - cc->cbuf->cdata, cc->clen); - cc->cbuf->chksum = cpu_to_le32(chksum); -@@ -773,7 +770,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) - - ret = cops->decompress_pages(dic); - -- if (!ret && (fi->i_compress_flag & 1 << COMPRESS_CHKSUM)) { -+ if (!ret && (fi->i_compress_flag & BIT(COMPRESS_CHKSUM))) { - u32 provided = le32_to_cpu(dic->cbuf->chksum); - u32 calculated = f2fs_crc32(sbi, dic->cbuf->cdata, dic->clen); - -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index ea05710ca9bdf..3666c1fd77a64 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -95,17 +95,17 @@ static enum count_type __read_io_type(struct page *page) - /* postprocessing steps for read bios */ - enum bio_post_read_step { - #ifdef CONFIG_FS_ENCRYPTION -- STEP_DECRYPT = 1 << 0, -+ STEP_DECRYPT = BIT(0), - #else - STEP_DECRYPT = 0, /* compile out the decryption-related code */ - #endif - #ifdef CONFIG_F2FS_FS_COMPRESSION -- STEP_DECOMPRESS = 1 << 1, -+ STEP_DECOMPRESS = BIT(1), - #else - STEP_DECOMPRESS = 0, /* compile out the decompression-related code */ - #endif - #ifdef CONFIG_FS_VERITY -- STEP_VERITY = 1 << 2, -+ STEP_VERITY = BIT(2), - #else - STEP_VERITY = 0, /* compile out the verity-related code */ - #endif -@@ -409,7 +409,7 @@ int f2fs_target_device_index(struct f2fs_sb_info *sbi, block_t blkaddr) - - static blk_opf_t f2fs_io_flags(struct f2fs_io_info *fio) - { -- unsigned int temp_mask = (1 << NR_TEMP_TYPE) - 1; -+ unsigned int temp_mask = GENMASK(NR_TEMP_TYPE - 1, 0); - unsigned int fua_flag, meta_flag, io_flag; - blk_opf_t op_flags = 0; - -@@ -431,9 +431,9 @@ static blk_opf_t f2fs_io_flags(struct f2fs_io_info *fio) - * 5 | 4 | 3 | 2 | 1 | 0 | - * Cold | Warm | Hot | Cold | Warm | Hot | - */ -- if ((1 << fio->temp) & meta_flag) -+ if (BIT(fio->temp) & meta_flag) - op_flags |= REQ_META; -- if ((1 << fio->temp) & fua_flag) -+ if (BIT(fio->temp) & fua_flag) - op_flags |= REQ_FUA; - return op_flags; - } -diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c -index 8373eba3a1337..510736d2ae110 100644 ---- a/fs/f2fs/dir.c -+++ b/fs/f2fs/dir.c -@@ -29,7 +29,7 @@ static unsigned long dir_blocks(struct inode *inode) - static unsigned int dir_buckets(unsigned int level, int dir_level) - { - if (level + dir_level < MAX_DIR_HASH_DEPTH / 2) -- return 1 << (level + dir_level); -+ return BIT(level + dir_level); - else - return MAX_DIR_BUCKETS; - } -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index f56abb39601ac..5c76ba764b71f 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -64,7 +64,7 @@ enum { - }; - - #ifdef CONFIG_F2FS_FAULT_INJECTION --#define F2FS_ALL_FAULT_TYPE ((1 << FAULT_MAX) - 1) -+#define F2FS_ALL_FAULT_TYPE (GENMASK(FAULT_MAX - 1, 0)) - - struct f2fs_fault_info { - atomic_t inject_ops; -@@ -73,7 +73,7 @@ struct f2fs_fault_info { - }; - - extern const char *f2fs_fault_name[FAULT_MAX]; --#define IS_FAULT_SET(fi, type) ((fi)->inject_type & (1 << (type))) -+#define IS_FAULT_SET(fi, type) ((fi)->inject_type & BIT(type)) - #endif - - /* -@@ -840,7 +840,7 @@ struct f2fs_inode_info { - unsigned char i_compress_algorithm; /* algorithm type */ - unsigned char i_log_cluster_size; /* log of cluster size */ - unsigned char i_compress_level; /* compress level (lz4hc,zstd) */ -- unsigned short i_compress_flag; /* compress flag */ -+ unsigned char i_compress_flag; /* compress flag */ - unsigned int i_cluster_size; /* cluster size */ - - unsigned int atomic_write_cnt; -@@ -1412,7 +1412,7 @@ static inline void set_page_private_##name(struct page *page) \ - static inline void clear_page_private_##name(struct page *page) \ - { \ - clear_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \ -- if (page_private(page) == 1 << PAGE_PRIVATE_NOT_POINTER) { \ -+ if (page_private(page) == BIT(PAGE_PRIVATE_NOT_POINTER)) { \ - set_page_private(page, 0); \ - if (PagePrivate(page)) { \ - ClearPagePrivate(page); \ -@@ -1462,8 +1462,8 @@ static inline void set_page_private_data(struct page *page, unsigned long data) - - static inline void clear_page_private_data(struct page *page) - { -- page_private(page) &= (1 << PAGE_PRIVATE_MAX) - 1; -- if (page_private(page) == 1 << PAGE_PRIVATE_NOT_POINTER) { -+ page_private(page) &= GENMASK(PAGE_PRIVATE_MAX - 1, 0); -+ if (page_private(page) == BIT(PAGE_PRIVATE_NOT_POINTER)) { - set_page_private(page, 0); - if (PagePrivate(page)) { - ClearPagePrivate(page); -@@ -1501,6 +1501,8 @@ struct compress_data { - - #define F2FS_COMPRESSED_PAGE_MAGIC 0xF5F2C000 - -+#define F2FS_ZSTD_DEFAULT_CLEVEL 1 -+ - #define COMPRESS_LEVEL_OFFSET 8 - - /* compress context */ -@@ -2882,7 +2884,7 @@ static inline int f2fs_test_bit(unsigned int nr, char *addr) - int mask; - - addr += (nr >> 3); -- mask = 1 << (7 - (nr & 0x07)); -+ mask = BIT(7 - (nr & 0x07)); - return mask & *addr; - } - -@@ -2891,7 +2893,7 @@ static inline void f2fs_set_bit(unsigned int nr, char *addr) - int mask; - - addr += (nr >> 3); -- mask = 1 << (7 - (nr & 0x07)); -+ mask = BIT(7 - (nr & 0x07)); - *addr |= mask; - } - -@@ -2900,7 +2902,7 @@ static inline void f2fs_clear_bit(unsigned int nr, char *addr) - int mask; - - addr += (nr >> 3); -- mask = 1 << (7 - (nr & 0x07)); -+ mask = BIT(7 - (nr & 0x07)); - *addr &= ~mask; - } - -@@ -2910,7 +2912,7 @@ static inline int f2fs_test_and_set_bit(unsigned int nr, char *addr) - int ret; - - addr += (nr >> 3); -- mask = 1 << (7 - (nr & 0x07)); -+ mask = BIT(7 - (nr & 0x07)); - ret = mask & *addr; - *addr |= mask; - return ret; -@@ -2922,7 +2924,7 @@ static inline int f2fs_test_and_clear_bit(unsigned int nr, char *addr) - int ret; - - addr += (nr >> 3); -- mask = 1 << (7 - (nr & 0x07)); -+ mask = BIT(7 - (nr & 0x07)); - ret = mask & *addr; - *addr &= ~mask; - return ret; -@@ -2933,7 +2935,7 @@ static inline void f2fs_change_bit(unsigned int nr, char *addr) - int mask; - - addr += (nr >> 3); -- mask = 1 << (7 - (nr & 0x07)); -+ mask = BIT(7 - (nr & 0x07)); - *addr ^= mask; - } - -@@ -4333,15 +4335,14 @@ static inline int set_compress_context(struct inode *inode) - F2FS_OPTION(sbi).compress_log_size; - F2FS_I(inode)->i_compress_flag = - F2FS_OPTION(sbi).compress_chksum ? -- 1 << COMPRESS_CHKSUM : 0; -+ BIT(COMPRESS_CHKSUM) : 0; - F2FS_I(inode)->i_cluster_size = -- 1 << F2FS_I(inode)->i_log_cluster_size; -+ BIT(F2FS_I(inode)->i_log_cluster_size); - if ((F2FS_I(inode)->i_compress_algorithm == COMPRESS_LZ4 || - F2FS_I(inode)->i_compress_algorithm == COMPRESS_ZSTD) && - F2FS_OPTION(sbi).compress_level) -- F2FS_I(inode)->i_compress_flag |= -- F2FS_OPTION(sbi).compress_level << -- COMPRESS_LEVEL_OFFSET; -+ F2FS_I(inode)->i_compress_level = -+ F2FS_OPTION(sbi).compress_level; - F2FS_I(inode)->i_flags |= F2FS_COMPR_FL; - set_inode_flag(inode, FI_COMPRESSED_FILE); - stat_inc_compr_inode(inode); -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index d0c17366ebf48..9b9fb3c57ec6c 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -3983,7 +3983,16 @@ static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg) - - F2FS_I(inode)->i_compress_algorithm = option.algorithm; - F2FS_I(inode)->i_log_cluster_size = option.log_cluster_size; -- F2FS_I(inode)->i_cluster_size = 1 << option.log_cluster_size; -+ F2FS_I(inode)->i_cluster_size = BIT(option.log_cluster_size); -+ /* Set default level */ -+ if (F2FS_I(inode)->i_compress_algorithm == COMPRESS_ZSTD) -+ F2FS_I(inode)->i_compress_level = F2FS_ZSTD_DEFAULT_CLEVEL; -+ else -+ F2FS_I(inode)->i_compress_level = 0; -+ /* Adjust mount option level */ -+ if (option.algorithm == F2FS_OPTION(sbi).compress_algorithm && -+ F2FS_OPTION(sbi).compress_level) -+ F2FS_I(inode)->i_compress_level = F2FS_OPTION(sbi).compress_level; - f2fs_mark_inode_dirty_sync(inode, true); - - if (!f2fs_is_compress_backend_ready(inode)) -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 1fc7760499f10..0010579f17368 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -450,12 +450,18 @@ static int do_read_inode(struct inode *inode) - (fi->i_flags & F2FS_COMPR_FL)) { - if (F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, - i_log_cluster_size)) { -+ unsigned short compress_flag; -+ - atomic_set(&fi->i_compr_blocks, - le64_to_cpu(ri->i_compr_blocks)); - fi->i_compress_algorithm = ri->i_compress_algorithm; - fi->i_log_cluster_size = ri->i_log_cluster_size; -- fi->i_compress_flag = le16_to_cpu(ri->i_compress_flag); -- fi->i_cluster_size = 1 << fi->i_log_cluster_size; -+ compress_flag = le16_to_cpu(ri->i_compress_flag); -+ fi->i_compress_level = compress_flag >> -+ COMPRESS_LEVEL_OFFSET; -+ fi->i_compress_flag = compress_flag & -+ GENMASK(COMPRESS_LEVEL_OFFSET - 1, 0); -+ fi->i_cluster_size = BIT(fi->i_log_cluster_size); - set_inode_flag(inode, FI_COMPRESSED_FILE); - } - } -@@ -675,13 +681,17 @@ void f2fs_update_inode(struct inode *inode, struct page *node_page) - if (f2fs_sb_has_compression(F2FS_I_SB(inode)) && - F2FS_FITS_IN_INODE(ri, F2FS_I(inode)->i_extra_isize, - i_log_cluster_size)) { -+ unsigned short compress_flag; -+ - ri->i_compr_blocks = - cpu_to_le64(atomic_read( - &F2FS_I(inode)->i_compr_blocks)); - ri->i_compress_algorithm = - F2FS_I(inode)->i_compress_algorithm; -- ri->i_compress_flag = -- cpu_to_le16(F2FS_I(inode)->i_compress_flag); -+ compress_flag = F2FS_I(inode)->i_compress_flag | -+ F2FS_I(inode)->i_compress_level << -+ COMPRESS_LEVEL_OFFSET; -+ ri->i_compress_flag = cpu_to_le16(compress_flag); - ri->i_log_cluster_size = - F2FS_I(inode)->i_log_cluster_size; - } -diff --git a/fs/f2fs/node.h b/fs/f2fs/node.h -index 0aa48704c77a0..7068f3ac036a5 100644 ---- a/fs/f2fs/node.h -+++ b/fs/f2fs/node.h -@@ -93,17 +93,15 @@ static inline void copy_node_info(struct node_info *dst, - static inline void set_nat_flag(struct nat_entry *ne, - unsigned int type, bool set) - { -- unsigned char mask = 0x01 << type; - if (set) -- ne->ni.flag |= mask; -+ ne->ni.flag |= BIT(type); - else -- ne->ni.flag &= ~mask; -+ ne->ni.flag &= ~BIT(type); - } - - static inline bool get_nat_flag(struct nat_entry *ne, unsigned int type) - { -- unsigned char mask = 0x01 << type; -- return ne->ni.flag & mask; -+ return ne->ni.flag & BIT(type); - } - - static inline void nat_reset_flag(struct nat_entry *ne) -@@ -224,7 +222,7 @@ static inline pgoff_t next_nat_addr(struct f2fs_sb_info *sbi, - struct f2fs_nm_info *nm_i = NM_I(sbi); - - block_addr -= nm_i->nat_blkaddr; -- block_addr ^= 1 << sbi->log_blocks_per_seg; -+ block_addr ^= BIT(sbi->log_blocks_per_seg); - return block_addr + nm_i->nat_blkaddr; - } - -@@ -394,7 +392,7 @@ static inline nid_t get_nid(struct page *p, int off, bool i) - static inline int is_node(struct page *page, int type) - { - struct f2fs_node *rn = F2FS_NODE(page); -- return le32_to_cpu(rn->footer.flag) & (1 << type); -+ return le32_to_cpu(rn->footer.flag) & BIT(type); - } - - #define is_cold_node(page) is_node(page, COLD_BIT_SHIFT) -@@ -407,9 +405,9 @@ static inline void set_cold_node(struct page *page, bool is_dir) - unsigned int flag = le32_to_cpu(rn->footer.flag); - - if (is_dir) -- flag &= ~(0x1 << COLD_BIT_SHIFT); -+ flag &= ~BIT(COLD_BIT_SHIFT); - else -- flag |= (0x1 << COLD_BIT_SHIFT); -+ flag |= BIT(COLD_BIT_SHIFT); - rn->footer.flag = cpu_to_le32(flag); - } - -@@ -418,9 +416,9 @@ static inline void set_mark(struct page *page, int mark, int type) - struct f2fs_node *rn = F2FS_NODE(page); - unsigned int flag = le32_to_cpu(rn->footer.flag); - if (mark) -- flag |= (0x1 << type); -+ flag |= BIT(type); - else -- flag &= ~(0x1 << type); -+ flag &= ~BIT(type); - rn->footer.flag = cpu_to_le32(flag); - - #ifdef CONFIG_F2FS_CHECK_FS -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 1ba85ef97cbd3..3805162dcef2b 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -613,14 +613,12 @@ static int f2fs_set_lz4hc_level(struct f2fs_sb_info *sbi, const char *str) - { - #ifdef CONFIG_F2FS_FS_LZ4HC - unsigned int level; --#endif - - if (strlen(str) == 3) { - F2FS_OPTION(sbi).compress_level = 0; - return 0; - } - --#ifdef CONFIG_F2FS_FS_LZ4HC - str += 3; - - if (str[0] != ':') { -@@ -638,6 +636,10 @@ static int f2fs_set_lz4hc_level(struct f2fs_sb_info *sbi, const char *str) - F2FS_OPTION(sbi).compress_level = level; - return 0; - #else -+ if (strlen(str) == 3) { -+ F2FS_OPTION(sbi).compress_level = 0; -+ return 0; -+ } - f2fs_info(sbi, "kernel doesn't support lz4hc compression"); - return -EINVAL; - #endif -@@ -651,7 +653,7 @@ static int f2fs_set_zstd_level(struct f2fs_sb_info *sbi, const char *str) - int len = 4; - - if (strlen(str) == len) { -- F2FS_OPTION(sbi).compress_level = 0; -+ F2FS_OPTION(sbi).compress_level = F2FS_ZSTD_DEFAULT_CLEVEL; - return 0; - } - -@@ -664,7 +666,7 @@ static int f2fs_set_zstd_level(struct f2fs_sb_info *sbi, const char *str) - if (kstrtouint(str + 1, 10, &level)) - return -EINVAL; - -- if (!level || level > zstd_max_clevel()) { -+ if (level < zstd_min_clevel() || level > zstd_max_clevel()) { - f2fs_info(sbi, "invalid zstd compress level: %d", level); - return -EINVAL; - } -@@ -898,8 +900,8 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) - if (args->from && match_int(args, &arg)) - return -EINVAL; - if (arg <= 0 || arg > __ilog2_u32(BIO_MAX_VECS)) { -- f2fs_warn(sbi, "Not support %d, larger than %d", -- 1 << arg, BIO_MAX_VECS); -+ f2fs_warn(sbi, "Not support %ld, larger than %d", -+ BIT(arg), BIO_MAX_VECS); - return -EINVAL; - } - F2FS_OPTION(sbi).write_io_size_bits = arg; -@@ -1340,7 +1342,7 @@ default_check: - #endif - - if (F2FS_IO_SIZE_BITS(sbi) && !f2fs_lfs_mode(sbi)) { -- f2fs_err(sbi, "Should set mode=lfs with %uKB-sized IO", -+ f2fs_err(sbi, "Should set mode=lfs with %luKB-sized IO", - F2FS_IO_SIZE_KB(sbi)); - return -EINVAL; - } -@@ -3356,7 +3358,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi, - total_sections = le32_to_cpu(raw_super->section_count); - - /* blocks_per_seg should be 512, given the above check */ -- blocks_per_seg = 1 << le32_to_cpu(raw_super->log_blocks_per_seg); -+ blocks_per_seg = BIT(le32_to_cpu(raw_super->log_blocks_per_seg)); - - if (segment_count > F2FS_MAX_SEGMENT || - segment_count < F2FS_MIN_SEGMENTS) { -@@ -3625,9 +3627,9 @@ static void init_sb_info(struct f2fs_sb_info *sbi) - sbi->log_sectors_per_block = - le32_to_cpu(raw_super->log_sectors_per_block); - sbi->log_blocksize = le32_to_cpu(raw_super->log_blocksize); -- sbi->blocksize = 1 << sbi->log_blocksize; -+ sbi->blocksize = BIT(sbi->log_blocksize); - sbi->log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); -- sbi->blocks_per_seg = 1 << sbi->log_blocks_per_seg; -+ sbi->blocks_per_seg = BIT(sbi->log_blocks_per_seg); - sbi->segs_per_sec = le32_to_cpu(raw_super->segs_per_sec); - sbi->secs_per_zone = le32_to_cpu(raw_super->secs_per_zone); - sbi->total_sections = le32_to_cpu(raw_super->section_count); -@@ -3883,7 +3885,7 @@ void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason) - - f2fs_down_write(&sbi->sb_lock); - -- if (raw_super->s_stop_reason[reason] < ((1 << BITS_PER_BYTE) - 1)) -+ if (raw_super->s_stop_reason[reason] < GENMASK(BITS_PER_BYTE - 1, 0)) - raw_super->s_stop_reason[reason]++; - - err = f2fs_commit_super(sbi, false); -@@ -4033,7 +4035,7 @@ static int f2fs_scan_devices(struct f2fs_sb_info *sbi) - FDEV(i).start_blk, FDEV(i).end_blk); - } - f2fs_info(sbi, -- "IO Block Size: %8d KB", F2FS_IO_SIZE_KB(sbi)); -+ "IO Block Size: %8ld KB", F2FS_IO_SIZE_KB(sbi)); - return 0; - } - -diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c -index 3d68bfa75cf2a..751a108e612ff 100644 ---- a/fs/f2fs/sysfs.c -+++ b/fs/f2fs/sysfs.c -@@ -451,7 +451,7 @@ out: - if (ret < 0) - return ret; - #ifdef CONFIG_F2FS_FAULT_INJECTION -- if (a->struct_type == FAULT_INFO_TYPE && t >= (1 << FAULT_MAX)) -+ if (a->struct_type == FAULT_INFO_TYPE && t >= BIT(FAULT_MAX)) - return -EINVAL; - if (a->struct_type == FAULT_INFO_RATE && t >= UINT_MAX) - return -EINVAL; -diff --git a/fs/inode.c b/fs/inode.c -index 73ad1b0d47758..8cfda7a6d5900 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -215,6 +215,8 @@ int inode_init_always(struct super_block *sb, struct inode *inode) - lockdep_set_class_and_name(&mapping->invalidate_lock, - &sb->s_type->invalidate_lock_key, - "mapping.invalidate_lock"); -+ if (sb->s_iflags & SB_I_STABLE_WRITES) -+ mapping_set_stable_writes(mapping); - inode->i_private = NULL; - inode->i_mapping = mapping; - INIT_HLIST_HEAD(&inode->i_dentry); /* buggered by rcu freeing */ -diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c -index e731c00a9fcbc..d3c938dd2b12a 100644 ---- a/fs/nfs/fscache.c -+++ b/fs/nfs/fscache.c -@@ -176,6 +176,9 @@ void nfs_fscache_init_inode(struct inode *inode) - &auxdata, /* aux_data */ - sizeof(auxdata), - i_size_read(inode)); -+ -+ if (netfs_inode(inode)->cache) -+ mapping_set_release_always(inode->i_mapping); - } - - /* -diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h -index 512ac9dea9787..7f1aea4c11b9c 100644 ---- a/fs/smb/client/cifsglob.h -+++ b/fs/smb/client/cifsglob.h -@@ -972,7 +972,6 @@ release_iface(struct kref *ref) - struct cifs_server_iface *iface = container_of(ref, - struct cifs_server_iface, - refcount); -- list_del_init(&iface->iface_head); - kfree(iface); - } - -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index f725a119ce312..49fdc6dfdcf8d 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -258,10 +258,13 @@ cifs_mark_tcp_ses_conns_for_reconnect(struct TCP_Server_Info *server, - spin_lock(&cifs_tcp_ses_lock); - list_for_each_entry_safe(ses, nses, &pserver->smb_ses_list, smb_ses_list) { - /* check if iface is still active */ -- if (!cifs_chan_is_iface_active(ses, server)) -+ spin_lock(&ses->chan_lock); -+ if (!cifs_chan_is_iface_active(ses, server)) { -+ spin_unlock(&ses->chan_lock); - cifs_chan_update_iface(ses, server); -+ spin_lock(&ses->chan_lock); -+ } - -- spin_lock(&ses->chan_lock); - if (!mark_smb_session && cifs_chan_needs_reconnect(ses, server)) { - spin_unlock(&ses->chan_lock); - continue; -diff --git a/fs/smb/client/fscache.c b/fs/smb/client/fscache.c -index e73625b5d0cc6..f64bad513ba6d 100644 ---- a/fs/smb/client/fscache.c -+++ b/fs/smb/client/fscache.c -@@ -108,6 +108,8 @@ void cifs_fscache_get_inode_cookie(struct inode *inode) - &cifsi->uniqueid, sizeof(cifsi->uniqueid), - &cd, sizeof(cd), - i_size_read(&cifsi->netfs.inode)); -+ if (cifsi->netfs.cache) -+ mapping_set_release_always(inode->i_mapping); - } - - void cifs_fscache_unuse_inode_cookie(struct inode *inode, bool update) -diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c -index 7be51f9d2fa18..5343898bac8a6 100644 ---- a/fs/smb/client/inode.c -+++ b/fs/smb/client/inode.c -@@ -264,7 +264,7 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, - fattr->cf_dtype = DT_REG; - break; - case UNIX_SYMLINK: -- fattr->cf_mode |= S_IFLNK; -+ fattr->cf_mode |= S_IFLNK | cifs_sb->ctx->file_mode; - fattr->cf_dtype = DT_LNK; - break; - case UNIX_DIR: -diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c -index ba6cc50af390f..a7475bc05cac0 100644 ---- a/fs/smb/client/smb2file.c -+++ b/fs/smb/client/smb2file.c -@@ -34,7 +34,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp, - ErrorContextData) + - sizeof(struct smb2_symlink_err_rsp)); -- if (le32_to_cpu(err->ByteCount) < len || iov->iov_len < len + sizeof(*err)) -+ if (le32_to_cpu(err->ByteCount) < len || iov->iov_len < len + sizeof(*err) + 1) - return ERR_PTR(-EINVAL); - - p = (struct smb2_error_context_rsp *)err->ErrorData; -diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c -index 88942b1fb4318..fdf7a7f188c5f 100644 ---- a/fs/smb/client/smb2misc.c -+++ b/fs/smb/client/smb2misc.c -@@ -113,7 +113,7 @@ static __u32 get_neg_ctxt_len(struct smb2_hdr *hdr, __u32 len, - } else if (nc_offset + 1 == non_ctxlen) { - cifs_dbg(FYI, "no SPNEGO security blob in negprot rsp\n"); - size_of_pad_before_neg_ctxts = 0; -- } else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE) -+ } else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE + 1) - /* has padding, but no SPNEGO blob */ - size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen + 1; - else -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index df03d80ab6d5f..4596d2dfdec3a 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -588,16 +588,12 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - } - - /* -- * Go through iface_list and do kref_put to remove -- * any unused ifaces. ifaces in use will be removed -- * when the last user calls a kref_put on it -+ * Go through iface_list and mark them as inactive - */ - list_for_each_entry_safe(iface, niface, &ses->iface_list, -- iface_head) { -+ iface_head) - iface->is_active = 0; -- kref_put(&iface->refcount, release_iface); -- ses->iface_count--; -- } -+ - spin_unlock(&ses->iface_lock); - - /* -@@ -672,10 +668,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, - iface_head) { - ret = iface_cmp(iface, &tmp_iface); - if (!ret) { -- /* just get a ref so that it doesn't get picked/freed */ - iface->is_active = 1; -- kref_get(&iface->refcount); -- ses->iface_count++; - spin_unlock(&ses->iface_lock); - goto next_iface; - } else if (ret < 0) { -@@ -742,6 +735,20 @@ next_iface: - } - - out: -+ /* -+ * Go through the list again and put the inactive entries -+ */ -+ spin_lock(&ses->iface_lock); -+ list_for_each_entry_safe(iface, niface, &ses->iface_list, -+ iface_head) { -+ if (!iface->is_active) { -+ list_del(&iface->iface_head); -+ kref_put(&iface->refcount, release_iface); -+ ses->iface_count--; -+ } -+ } -+ spin_unlock(&ses->iface_lock); -+ - return rc; - } - -@@ -778,9 +785,14 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ - goto out; - - /* check if iface is still active */ -+ spin_lock(&ses->chan_lock); - pserver = ses->chans[0].server; -- if (pserver && !cifs_chan_is_iface_active(ses, pserver)) -+ if (pserver && !cifs_chan_is_iface_active(ses, pserver)) { -+ spin_unlock(&ses->chan_lock); - cifs_chan_update_iface(ses, pserver); -+ spin_lock(&ses->chan_lock); -+ } -+ spin_unlock(&ses->chan_lock); - - out: - kfree(out_buf); -@@ -5752,7 +5764,7 @@ struct smb_version_values smb20_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -5774,7 +5786,7 @@ struct smb_version_values smb21_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -5795,7 +5807,7 @@ struct smb_version_values smb3any_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -5816,7 +5828,7 @@ struct smb_version_values smbdefault_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -5837,7 +5849,7 @@ struct smb_version_values smb30_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -5858,7 +5870,7 @@ struct smb_version_values smb302_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -5879,7 +5891,7 @@ struct smb_version_values smb311_values = { - .header_size = sizeof(struct smb2_hdr), - .header_preamble_size = 0, - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 05ff8a457a3d7..2dfbf1b23cfa0 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -1386,7 +1386,7 @@ SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) - - /* Testing shows that buffer offset must be at location of Buffer[0] */ - req->SecurityBufferOffset = -- cpu_to_le16(sizeof(struct smb2_sess_setup_req) - 1 /* pad */); -+ cpu_to_le16(sizeof(struct smb2_sess_setup_req)); - req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len); - - memset(&rqst, 0, sizeof(struct smb_rqst)); -@@ -1905,8 +1905,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, - iov[0].iov_len = total_len - 1; - - /* Testing shows that buffer offset must be at location of Buffer[0] */ -- req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req) -- - 1 /* pad */); -+ req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)); - req->PathLength = cpu_to_le16(unc_path_len - 2); - iov[1].iov_base = unc_path; - iov[1].iov_len = unc_path_len; -@@ -3796,7 +3795,7 @@ SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon, - ses->Suid, (u8)watch_tree, completion_filter); - /* validate that notify information is plausible */ - if ((rsp_iov.iov_base == NULL) || -- (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp))) -+ (rsp_iov.iov_len < sizeof(struct smb2_change_notify_rsp) + 1)) - goto cnotify_exit; - - smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base; -@@ -5009,7 +5008,7 @@ int SMB2_query_directory_init(const unsigned int xid, - memcpy(bufptr, &asteriks, len); - - req->FileNameOffset = -- cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1); -+ cpu_to_le16(sizeof(struct smb2_query_directory_req)); - req->FileNameLength = cpu_to_le16(len); - /* - * BB could be 30 bytes or so longer if we used SMB2 specific -@@ -5205,8 +5204,7 @@ SMB2_set_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, - req->VolatileFileId = volatile_fid; - req->AdditionalInformation = cpu_to_le32(additional_info); - -- req->BufferOffset = -- cpu_to_le16(sizeof(struct smb2_set_info_req) - 1); -+ req->BufferOffset = cpu_to_le16(sizeof(struct smb2_set_info_req)); - req->BufferLength = cpu_to_le32(*size); - - memcpy(req->Buffer, *data, *size); -@@ -5440,9 +5438,9 @@ build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, - req->VolatileFileId = volatile_fid; - /* 1 for pad */ - req->InputBufferOffset = -- cpu_to_le16(sizeof(struct smb2_query_info_req) - 1); -+ cpu_to_le16(sizeof(struct smb2_query_info_req)); - req->OutputBufferLength = cpu_to_le32( -- outbuf_len + sizeof(struct smb2_query_info_rsp) - 1); -+ outbuf_len + sizeof(struct smb2_query_info_rsp)); - - iov->iov_base = (char *)req; - iov->iov_len = total_len; -diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h -index 1237bb86e93a8..a5773a06aba8e 100644 ---- a/fs/smb/client/smb2pdu.h -+++ b/fs/smb/client/smb2pdu.h -@@ -57,7 +57,7 @@ struct smb2_rdma_crypto_transform { - #define COMPOUND_FID 0xFFFFFFFFFFFFFFFFULL - - #define SMB2_SYMLINK_STRUCT_SIZE \ -- (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) -+ (sizeof(struct smb2_err_rsp) + sizeof(struct smb2_symlink_err_rsp)) - - #define SYMLINK_ERROR_TAG 0x4c4d5953 - -diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h -index 07549957b3099..5593bb49954c6 100644 ---- a/fs/smb/common/smb2pdu.h -+++ b/fs/smb/common/smb2pdu.h -@@ -189,7 +189,7 @@ struct smb2_err_rsp { - __u8 ErrorContextCount; - __u8 Reserved; - __le32 ByteCount; /* even if zero, at least one byte follows */ -- __u8 ErrorData[1]; /* variable length */ -+ __u8 ErrorData[]; /* variable length */ - } __packed; - - #define SMB3_AES_CCM_NONCE 11 -@@ -330,7 +330,7 @@ struct smb2_tree_connect_req { - __le16 Flags; /* Flags in SMB3.1.1 */ - __le16 PathOffset; - __le16 PathLength; -- __u8 Buffer[1]; /* variable length */ -+ __u8 Buffer[]; /* variable length */ - } __packed; - - /* Possible ShareType values */ -@@ -617,7 +617,7 @@ struct smb2_negotiate_rsp { - __le16 SecurityBufferOffset; - __le16 SecurityBufferLength; - __le32 NegotiateContextOffset; /* Pre:SMB3.1.1 was reserved/ignored */ -- __u8 Buffer[1]; /* variable length GSS security buffer */ -+ __u8 Buffer[]; /* variable length GSS security buffer */ - } __packed; - - -@@ -638,7 +638,7 @@ struct smb2_sess_setup_req { - __le16 SecurityBufferOffset; - __le16 SecurityBufferLength; - __le64 PreviousSessionId; -- __u8 Buffer[1]; /* variable length GSS security buffer */ -+ __u8 Buffer[]; /* variable length GSS security buffer */ - } __packed; - - /* Currently defined SessionFlags */ -@@ -655,7 +655,7 @@ struct smb2_sess_setup_rsp { - __le16 SessionFlags; - __le16 SecurityBufferOffset; - __le16 SecurityBufferLength; -- __u8 Buffer[1]; /* variable length GSS security buffer */ -+ __u8 Buffer[]; /* variable length GSS security buffer */ - } __packed; - - -@@ -737,7 +737,7 @@ struct smb2_read_req { - __le32 RemainingBytes; - __le16 ReadChannelInfoOffset; - __le16 ReadChannelInfoLength; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - /* Read flags */ -@@ -752,7 +752,7 @@ struct smb2_read_rsp { - __le32 DataLength; - __le32 DataRemaining; - __le32 Flags; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - -@@ -776,7 +776,7 @@ struct smb2_write_req { - __le16 WriteChannelInfoOffset; - __le16 WriteChannelInfoLength; - __le32 Flags; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - struct smb2_write_rsp { -@@ -787,7 +787,7 @@ struct smb2_write_rsp { - __le32 DataLength; - __le32 DataRemaining; - __u32 Reserved2; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - -@@ -834,7 +834,10 @@ struct smb2_lock_req { - __u64 PersistentFileId; - __u64 VolatileFileId; - /* Followed by at least one */ -- struct smb2_lock_element locks[1]; -+ union { -+ struct smb2_lock_element lock; -+ DECLARE_FLEX_ARRAY(struct smb2_lock_element, locks); -+ }; - } __packed; - - struct smb2_lock_rsp { -@@ -888,7 +891,7 @@ struct smb2_query_directory_req { - __le16 FileNameOffset; - __le16 FileNameLength; - __le32 OutputBufferLength; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - struct smb2_query_directory_rsp { -@@ -896,7 +899,7 @@ struct smb2_query_directory_rsp { - __le16 StructureSize; /* Must be 9 */ - __le16 OutputBufferOffset; - __le32 OutputBufferLength; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - /* -@@ -919,7 +922,7 @@ struct smb2_set_info_req { - __le32 AdditionalInformation; - __u64 PersistentFileId; - __u64 VolatileFileId; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - struct smb2_set_info_rsp { -@@ -974,7 +977,7 @@ struct smb2_change_notify_rsp { - __le16 StructureSize; /* Must be 9 */ - __le16 OutputBufferOffset; - __le32 OutputBufferLength; -- __u8 Buffer[1]; /* array of file notify structs */ -+ __u8 Buffer[]; /* array of file notify structs */ - } __packed; - - -@@ -1180,7 +1183,7 @@ struct smb2_create_rsp { - __u64 VolatileFileId; - __le32 CreateContextsOffset; - __le32 CreateContextsLength; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - struct create_posix { -@@ -1524,7 +1527,7 @@ struct smb2_query_info_req { - __le32 Flags; - __u64 PersistentFileId; - __u64 VolatileFileId; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - struct smb2_query_info_rsp { -@@ -1532,7 +1535,7 @@ struct smb2_query_info_rsp { - __le16 StructureSize; /* Must be 9 */ - __le16 OutputBufferOffset; - __le32 OutputBufferLength; -- __u8 Buffer[1]; -+ __u8 Buffer[]; - } __packed; - - /* -@@ -1593,7 +1596,10 @@ struct smb2_file_all_info { /* data block encoding of response to level 18 */ - __le32 Mode; - __le32 AlignmentRequirement; - __le32 FileNameLength; -- char FileName[1]; -+ union { -+ char __pad; /* Legacy structure padding */ -+ DECLARE_FLEX_ARRAY(char, FileName); -+ }; - } __packed; /* level 18 Query */ - - struct smb2_file_eof_info { /* encoding of request for level 10 */ -diff --git a/fs/smb/server/smb2ops.c b/fs/smb/server/smb2ops.c -index 535402629655e..27a9dce3e03ab 100644 ---- a/fs/smb/server/smb2ops.c -+++ b/fs/smb/server/smb2ops.c -@@ -26,7 +26,7 @@ static struct smb_version_values smb21_server_values = { - .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, - .header_size = sizeof(struct smb2_hdr), - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -52,7 +52,7 @@ static struct smb_version_values smb30_server_values = { - .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, - .header_size = sizeof(struct smb2_hdr), - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -79,7 +79,7 @@ static struct smb_version_values smb302_server_values = { - .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, - .header_size = sizeof(struct smb2_hdr), - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -@@ -106,7 +106,7 @@ static struct smb_version_values smb311_server_values = { - .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, - .header_size = sizeof(struct smb2_hdr), - .max_header_size = MAX_SMB2_HDR_SIZE, -- .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, -+ .read_rsp_size = sizeof(struct smb2_read_rsp), - .lock_cmd = SMB2_LOCK, - .cap_unix = 0, - .cap_nt_find = SMB2_NT_FIND, -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index ea48dd06d4da3..6e5ed0ac578a6 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -294,8 +294,7 @@ int init_smb2_neg_rsp(struct ksmbd_work *work) - if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) - rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE; - err = ksmbd_iov_pin_rsp(work, rsp, -- sizeof(struct smb2_negotiate_rsp) - -- sizeof(rsp->Buffer) + AUTH_GSS_LENGTH); -+ sizeof(struct smb2_negotiate_rsp) + AUTH_GSS_LENGTH); - if (err) - return err; - conn->use_spnego = true; -@@ -1263,9 +1262,8 @@ err_out: - - if (!rc) - rc = ksmbd_iov_pin_rsp(work, rsp, -- sizeof(struct smb2_negotiate_rsp) - -- sizeof(rsp->Buffer) + -- AUTH_GSS_LENGTH + neg_ctxt_len); -+ sizeof(struct smb2_negotiate_rsp) + -+ AUTH_GSS_LENGTH + neg_ctxt_len); - if (rc < 0) - smb2_set_err_rsp(work); - return rc; -diff --git a/fs/splice.c b/fs/splice.c -index 5969b7a1d353a..d0230cf8ec571 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -65,8 +65,7 @@ static bool page_cache_pipe_buf_try_steal(struct pipe_inode_info *pipe, - */ - folio_wait_writeback(folio); - -- if (folio_has_private(folio) && -- !filemap_release_folio(folio, GFP_KERNEL)) -+ if (!filemap_release_folio(folio, GFP_KERNEL)) - goto out_unlock; - - /* -@@ -764,6 +763,17 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out, - return out->f_op->splice_write(pipe, out, ppos, len, flags); - } - -+/* -+ * Indicate to the caller that there was a premature EOF when reading from the -+ * source and the caller didn't indicate they would be sending more data after -+ * this. -+ */ -+static void do_splice_eof(struct splice_desc *sd) -+{ -+ if (sd->splice_eof) -+ sd->splice_eof(sd); -+} -+ - /* - * Attempt to initiate a splice from a file to a pipe. - */ -@@ -864,7 +874,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, - - ret = do_splice_to(in, &pos, pipe, len, flags); - if (unlikely(ret <= 0)) -- goto out_release; -+ goto read_failure; - - read_len = ret; - sd->total_len = read_len; -@@ -904,6 +914,15 @@ done: - file_accessed(in); - return bytes; - -+read_failure: -+ /* -+ * If the user did *not* set SPLICE_F_MORE *and* we didn't hit that -+ * "use all of len" case that cleared SPLICE_F_MORE, *and* we did a -+ * "->splice_in()" that returned EOF (ie zero) *and* we have sent at -+ * least 1 byte *then* we will also do the ->splice_eof() call. -+ */ -+ if (ret == 0 && !more && len > 0 && bytes) -+ do_splice_eof(sd); - out_release: - /* - * If we did an incomplete transfer we must release -@@ -932,6 +951,14 @@ static int direct_splice_actor(struct pipe_inode_info *pipe, - sd->flags); - } - -+static void direct_file_splice_eof(struct splice_desc *sd) -+{ -+ struct file *file = sd->u.file; -+ -+ if (file->f_op->splice_eof) -+ file->f_op->splice_eof(file); -+} -+ - /** - * do_splice_direct - splices data directly between two files - * @in: file to splice from -@@ -957,6 +984,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out, - .flags = flags, - .pos = *ppos, - .u.file = out, -+ .splice_eof = direct_file_splice_eof, - .opos = opos, - }; - long ret; -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 3ce9e39ecdb85..ba22cf4f5fc0e 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -702,10 +702,14 @@ bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, u32 size) - aux->ctx_field_size = size; - } - -+static bool bpf_is_ldimm64(const struct bpf_insn *insn) -+{ -+ return insn->code == (BPF_LD | BPF_IMM | BPF_DW); -+} -+ - static inline bool bpf_pseudo_func(const struct bpf_insn *insn) - { -- return insn->code == (BPF_LD | BPF_IMM | BPF_DW) && -- insn->src_reg == BPF_PSEUDO_FUNC; -+ return bpf_is_ldimm64(insn) && insn->src_reg == BPF_PSEUDO_FUNC; - } - - struct bpf_prog_ops { -@@ -825,6 +829,11 @@ struct btf_func_model { - */ - #define BPF_TRAMP_F_SHARE_IPMODIFY BIT(6) - -+/* Indicate that current trampoline is in a tail call context. Then, it has to -+ * cache and restore tail_call_cnt to avoid infinite tail call loop. -+ */ -+#define BPF_TRAMP_F_TAIL_CALL_CTX BIT(7) -+ - /* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50 - * bytes on x86. - */ -diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h -index 1a32baa78ce26..f080ccf27d256 100644 ---- a/include/linux/bpf_verifier.h -+++ b/include/linux/bpf_verifier.h -@@ -429,6 +429,7 @@ struct bpf_insn_aux_data { - /* below fields are initialized once */ - unsigned int orig_idx; /* original instruction index */ - bool prune_point; -+ bool jmp_point; - }; - - #define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */ -diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h -index ee0d75d9a302d..1e0df607e40c4 100644 ---- a/include/linux/f2fs_fs.h -+++ b/include/linux/f2fs_fs.h -@@ -40,9 +40,8 @@ - - #define F2FS_ENC_UTF8_12_1 1 - --#define F2FS_IO_SIZE(sbi) (1 << F2FS_OPTION(sbi).write_io_size_bits) /* Blocks */ --#define F2FS_IO_SIZE_KB(sbi) (1 << (F2FS_OPTION(sbi).write_io_size_bits + 2)) /* KB */ --#define F2FS_IO_SIZE_BYTES(sbi) (1 << (F2FS_OPTION(sbi).write_io_size_bits + 12)) /* B */ -+#define F2FS_IO_SIZE(sbi) BIT(F2FS_OPTION(sbi).write_io_size_bits) /* Blocks */ -+#define F2FS_IO_SIZE_KB(sbi) BIT(F2FS_OPTION(sbi).write_io_size_bits + 2) /* KB */ - #define F2FS_IO_SIZE_BITS(sbi) (F2FS_OPTION(sbi).write_io_size_bits) /* power of 2 */ - #define F2FS_IO_SIZE_MASK(sbi) (F2FS_IO_SIZE(sbi) - 1) - #define F2FS_IO_ALIGNED(sbi) (F2FS_IO_SIZE(sbi) > 1) -@@ -340,7 +339,7 @@ enum { - OFFSET_BIT_SHIFT - }; - --#define OFFSET_BIT_MASK (0x07) /* (0x01 << OFFSET_BIT_SHIFT) - 1 */ -+#define OFFSET_BIT_MASK GENMASK(OFFSET_BIT_SHIFT - 1, 0) - - struct node_footer { - __le32 nid; /* node id */ -@@ -545,7 +544,7 @@ typedef __le32 f2fs_hash_t; - #define MAX_DIR_HASH_DEPTH 63 - - /* MAX buckets in one level of dir */ --#define MAX_DIR_BUCKETS (1 << ((MAX_DIR_HASH_DEPTH / 2) - 1)) -+#define MAX_DIR_BUCKETS BIT((MAX_DIR_HASH_DEPTH / 2) - 1) - - /* - * space utilization of regular dentry and inline dentry (w/o extra reservation) -diff --git a/include/linux/fs.h b/include/linux/fs.h -index b6af6abc7a77f..4a1911dcf834b 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2177,6 +2177,7 @@ struct file_operations { - int (*flock) (struct file *, int, struct file_lock *); - ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int); - ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int); -+ void (*splice_eof)(struct file *file); - int (*setlease)(struct file *, long, struct file_lock **, void **); - long (*fallocate)(struct file *file, int mode, loff_t offset, - loff_t len); -diff --git a/include/linux/group_cpus.h b/include/linux/group_cpus.h -new file mode 100644 -index 0000000000000..e42807ec61f6e ---- /dev/null -+++ b/include/linux/group_cpus.h -@@ -0,0 +1,14 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+/* -+ * Copyright (C) 2016 Thomas Gleixner. -+ * Copyright (C) 2016-2017 Christoph Hellwig. -+ */ -+ -+#ifndef __LINUX_GROUP_CPUS_H -+#define __LINUX_GROUP_CPUS_H -+#include -+#include -+ -+struct cpumask *group_cpus_evenly(unsigned int numgrps); -+ -+#endif -diff --git a/include/linux/net.h b/include/linux/net.h -index 18d942bbdf6e0..25baca60f6cba 100644 ---- a/include/linux/net.h -+++ b/include/linux/net.h -@@ -209,6 +209,7 @@ struct proto_ops { - int offset, size_t size, int flags); - ssize_t (*splice_read)(struct socket *sock, loff_t *ppos, - struct pipe_inode_info *pipe, size_t len, unsigned int flags); -+ void (*splice_eof)(struct socket *sock); - int (*set_peek_off)(struct sock *sk, int val); - int (*peek_len)(struct socket *sock); - -diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h -index 03307b72de6c6..1be5a1fa6a3a8 100644 ---- a/include/linux/pagemap.h -+++ b/include/linux/pagemap.h -@@ -199,6 +199,9 @@ enum mapping_flags { - /* writeback related tags are not used */ - AS_NO_WRITEBACK_TAGS = 5, - AS_LARGE_FOLIO_SUPPORT = 6, -+ AS_RELEASE_ALWAYS, /* Call ->release_folio(), even if no private data */ -+ AS_STABLE_WRITES, /* must wait for writeback before modifying -+ folio contents */ - }; - - /** -@@ -269,6 +272,36 @@ static inline int mapping_use_writeback_tags(struct address_space *mapping) - return !test_bit(AS_NO_WRITEBACK_TAGS, &mapping->flags); - } - -+static inline bool mapping_release_always(const struct address_space *mapping) -+{ -+ return test_bit(AS_RELEASE_ALWAYS, &mapping->flags); -+} -+ -+static inline void mapping_set_release_always(struct address_space *mapping) -+{ -+ set_bit(AS_RELEASE_ALWAYS, &mapping->flags); -+} -+ -+static inline void mapping_clear_release_always(struct address_space *mapping) -+{ -+ clear_bit(AS_RELEASE_ALWAYS, &mapping->flags); -+} -+ -+static inline bool mapping_stable_writes(const struct address_space *mapping) -+{ -+ return test_bit(AS_STABLE_WRITES, &mapping->flags); -+} -+ -+static inline void mapping_set_stable_writes(struct address_space *mapping) -+{ -+ set_bit(AS_STABLE_WRITES, &mapping->flags); -+} -+ -+static inline void mapping_clear_stable_writes(struct address_space *mapping) -+{ -+ clear_bit(AS_STABLE_WRITES, &mapping->flags); -+} -+ - static inline gfp_t mapping_gfp_mask(struct address_space * mapping) - { - return mapping->gfp_mask; -diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h -index c1637515a8a41..c953b8c0d2f43 100644 ---- a/include/linux/skmsg.h -+++ b/include/linux/skmsg.h -@@ -106,6 +106,7 @@ struct sk_psock { - struct mutex work_mutex; - struct sk_psock_work_state work_state; - struct delayed_work work; -+ struct sock *sk_pair; - struct rcu_work rwork; - }; - -diff --git a/include/linux/socket.h b/include/linux/socket.h -index 1db29aab8f9c3..b3c58042bd254 100644 ---- a/include/linux/socket.h -+++ b/include/linux/socket.h -@@ -324,6 +324,7 @@ struct ucred { - */ - - #define MSG_ZEROCOPY 0x4000000 /* Use user data in kernel path */ -+#define MSG_SPLICE_PAGES 0x8000000 /* Splice the pages from the iterator in sendmsg() */ - #define MSG_FASTOPEN 0x20000000 /* Send data in TCP SYN */ - #define MSG_CMSG_CLOEXEC 0x40000000 /* Set close_on_exec for file - descriptor received through -@@ -334,6 +335,8 @@ struct ucred { - #define MSG_CMSG_COMPAT 0 /* We never have 32 bit fixups */ - #endif - -+/* Flags to be cleared on entry by sendmsg and sendmmsg syscalls */ -+#define MSG_INTERNAL_SENDMSG_FLAGS (MSG_SPLICE_PAGES) - - /* Setsockoptions(2) level. Thanks to BSD these must match IPPROTO_xxx */ - #define SOL_IP 0 -diff --git a/include/linux/splice.h b/include/linux/splice.h -index a55179fd60fc3..41a70687be853 100644 ---- a/include/linux/splice.h -+++ b/include/linux/splice.h -@@ -38,6 +38,7 @@ struct splice_desc { - struct file *file; /* file to read/write */ - void *data; /* cookie */ - } u; -+ void (*splice_eof)(struct splice_desc *sd); /* Unexpected EOF handler */ - loff_t pos; /* file position */ - loff_t *opos; /* sendfile: output position */ - size_t num_spliced; /* number of bytes already spliced */ -diff --git a/include/linux/udp.h b/include/linux/udp.h -index e96da4157d04d..efd9ab6df3797 100644 ---- a/include/linux/udp.h -+++ b/include/linux/udp.h -@@ -30,25 +30,33 @@ static inline u32 udp_hashfn(const struct net *net, u32 num, u32 mask) - return (num + net_hash_mix(net)) & mask; - } - -+enum { -+ UDP_FLAGS_CORK, /* Cork is required */ -+ UDP_FLAGS_NO_CHECK6_TX, /* Send zero UDP6 checksums on TX? */ -+ UDP_FLAGS_NO_CHECK6_RX, /* Allow zero UDP6 checksums on RX? */ -+ UDP_FLAGS_GRO_ENABLED, /* Request GRO aggregation */ -+ UDP_FLAGS_ACCEPT_FRAGLIST, -+ UDP_FLAGS_ACCEPT_L4, -+ UDP_FLAGS_ENCAP_ENABLED, /* This socket enabled encap */ -+}; -+ - struct udp_sock { - /* inet_sock has to be the first member */ - struct inet_sock inet; - #define udp_port_hash inet.sk.__sk_common.skc_u16hashes[0] - #define udp_portaddr_hash inet.sk.__sk_common.skc_u16hashes[1] - #define udp_portaddr_node inet.sk.__sk_common.skc_portaddr_node -+ -+ unsigned long udp_flags; -+ - int pending; /* Any pending frames ? */ -- unsigned int corkflag; /* Cork is required */ - __u8 encap_type; /* Is this an Encapsulation socket? */ -- unsigned char no_check6_tx:1,/* Send zero UDP6 checksums on TX? */ -- no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */ -- encap_enabled:1, /* This socket enabled encap -- * processing; UDP tunnels and -- * different encapsulation layer set -- * this -- */ -- gro_enabled:1, /* Request GRO aggregation */ -- accept_udp_l4:1, -- accept_udp_fraglist:1; -+ -+/* indicator bits used by pcflag: */ -+#define UDPLITE_BIT 0x1 /* set by udplite proto init function */ -+#define UDPLITE_SEND_CC 0x2 /* set via udplite setsockopt */ -+#define UDPLITE_RECV_CC 0x4 /* set via udplite setsocktopt */ -+ __u8 pcflag; /* marks socket as UDP-Lite if > 0 */ - /* - * Following member retains the information to create a UDP header - * when the socket is uncorked. -@@ -60,12 +68,6 @@ struct udp_sock { - */ - __u16 pcslen; - __u16 pcrlen; --/* indicator bits used by pcflag: */ --#define UDPLITE_BIT 0x1 /* set by udplite proto init function */ --#define UDPLITE_SEND_CC 0x2 /* set via udplite setsockopt */ --#define UDPLITE_RECV_CC 0x4 /* set via udplite setsocktopt */ -- __u8 pcflag; /* marks socket as UDP-Lite if > 0 */ -- __u8 unused[3]; - /* - * For encapsulation sockets. - */ -@@ -89,6 +91,17 @@ struct udp_sock { - int forward_deficit; - }; - -+#define udp_test_bit(nr, sk) \ -+ test_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags) -+#define udp_set_bit(nr, sk) \ -+ set_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags) -+#define udp_test_and_set_bit(nr, sk) \ -+ test_and_set_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags) -+#define udp_clear_bit(nr, sk) \ -+ clear_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags) -+#define udp_assign_bit(nr, sk, val) \ -+ assign_bit(UDP_FLAGS_##nr, &udp_sk(sk)->udp_flags, val) -+ - #define UDP_MAX_SEGMENTS (1 << 6UL) - - static inline struct udp_sock *udp_sk(const struct sock *sk) -@@ -98,22 +111,22 @@ static inline struct udp_sock *udp_sk(const struct sock *sk) - - static inline void udp_set_no_check6_tx(struct sock *sk, bool val) - { -- udp_sk(sk)->no_check6_tx = val; -+ udp_assign_bit(NO_CHECK6_TX, sk, val); - } - - static inline void udp_set_no_check6_rx(struct sock *sk, bool val) - { -- udp_sk(sk)->no_check6_rx = val; -+ udp_assign_bit(NO_CHECK6_RX, sk, val); - } - --static inline bool udp_get_no_check6_tx(struct sock *sk) -+static inline bool udp_get_no_check6_tx(const struct sock *sk) - { -- return udp_sk(sk)->no_check6_tx; -+ return udp_test_bit(NO_CHECK6_TX, sk); - } - --static inline bool udp_get_no_check6_rx(struct sock *sk) -+static inline bool udp_get_no_check6_rx(const struct sock *sk) - { -- return udp_sk(sk)->no_check6_rx; -+ return udp_test_bit(NO_CHECK6_RX, sk); - } - - static inline void udp_cmsg_recv(struct msghdr *msg, struct sock *sk, -@@ -132,10 +145,12 @@ static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb) - if (!skb_is_gso(skb)) - return false; - -- if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && !udp_sk(sk)->accept_udp_l4) -+ if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 && -+ !udp_test_bit(ACCEPT_L4, sk)) - return true; - -- if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST && !udp_sk(sk)->accept_udp_fraglist) -+ if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST && -+ !udp_test_bit(ACCEPT_FRAGLIST, sk)) - return true; - - return false; -@@ -143,8 +158,8 @@ static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb) - - static inline void udp_allow_gso(struct sock *sk) - { -- udp_sk(sk)->accept_udp_l4 = 1; -- udp_sk(sk)->accept_udp_fraglist = 1; -+ udp_set_bit(ACCEPT_L4, sk); -+ udp_set_bit(ACCEPT_FRAGLIST, sk); - } - - #define udp_portaddr_for_each_entry(__sk, list) \ -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index 480fa579787e5..55ca217c626b7 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -77,6 +77,7 @@ static inline struct unix_sock *unix_sk(const struct sock *sk) - { - return (struct unix_sock *)sk; - } -+#define unix_peer(sk) (unix_sk(sk)->peer) - - #define peer_wait peer_wq.wait - -diff --git a/include/net/inet_common.h b/include/net/inet_common.h -index cec453c18f1d6..4673bbfd2811f 100644 ---- a/include/net/inet_common.h -+++ b/include/net/inet_common.h -@@ -33,6 +33,7 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags, - bool kern); - int inet_send_prepare(struct sock *sk); - int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size); -+void inet_splice_eof(struct socket *sock); - ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, - size_t size, int flags); - int inet_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, -diff --git a/include/net/ip.h b/include/net/ip.h -index c286344628dba..c83c09c65623f 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -95,7 +95,7 @@ static inline void ipcm_init_sk(struct ipcm_cookie *ipcm, - ipcm_init(ipcm); - - ipcm->sockc.mark = READ_ONCE(inet->sk.sk_mark); -- ipcm->sockc.tsflags = inet->sk.sk_tsflags; -+ ipcm->sockc.tsflags = READ_ONCE(inet->sk.sk_tsflags); - ipcm->oif = READ_ONCE(inet->sk.sk_bound_dev_if); - ipcm->addr = inet->inet_saddr; - ipcm->protocol = inet->inet_num; -diff --git a/include/net/netfilter/nf_conntrack_act_ct.h b/include/net/netfilter/nf_conntrack_act_ct.h -index 078d3c52c03f9..e5f2f0b73a9a0 100644 ---- a/include/net/netfilter/nf_conntrack_act_ct.h -+++ b/include/net/netfilter/nf_conntrack_act_ct.h -@@ -20,7 +20,22 @@ static inline struct nf_conn_act_ct_ext *nf_conn_act_ct_ext_find(const struct nf - #endif - } - --static inline struct nf_conn_act_ct_ext *nf_conn_act_ct_ext_add(struct nf_conn *ct) -+static inline void nf_conn_act_ct_ext_fill(struct sk_buff *skb, struct nf_conn *ct, -+ enum ip_conntrack_info ctinfo) -+{ -+#if IS_ENABLED(CONFIG_NET_ACT_CT) -+ struct nf_conn_act_ct_ext *act_ct_ext; -+ -+ act_ct_ext = nf_conn_act_ct_ext_find(ct); -+ if (dev_net(skb->dev) == &init_net && act_ct_ext) -+ act_ct_ext->ifindex[CTINFO2DIR(ctinfo)] = skb->dev->ifindex; -+#endif -+} -+ -+static inline struct -+nf_conn_act_ct_ext *nf_conn_act_ct_ext_add(struct sk_buff *skb, -+ struct nf_conn *ct, -+ enum ip_conntrack_info ctinfo) - { - #if IS_ENABLED(CONFIG_NET_ACT_CT) - struct nf_conn_act_ct_ext *act_ct = nf_ct_ext_find(ct, NF_CT_EXT_ACT_CT); -@@ -29,22 +44,11 @@ static inline struct nf_conn_act_ct_ext *nf_conn_act_ct_ext_add(struct nf_conn * - return act_ct; - - act_ct = nf_ct_ext_add(ct, NF_CT_EXT_ACT_CT, GFP_ATOMIC); -+ nf_conn_act_ct_ext_fill(skb, ct, ctinfo); - return act_ct; - #else - return NULL; - #endif - } - --static inline void nf_conn_act_ct_ext_fill(struct sk_buff *skb, struct nf_conn *ct, -- enum ip_conntrack_info ctinfo) --{ --#if IS_ENABLED(CONFIG_NET_ACT_CT) -- struct nf_conn_act_ct_ext *act_ct_ext; -- -- act_ct_ext = nf_conn_act_ct_ext_find(ct); -- if (dev_net(skb->dev) == &init_net && act_ct_ext) -- act_ct_ext->ifindex[CTINFO2DIR(ctinfo)] = skb->dev->ifindex; --#endif --} -- - #endif /* _NF_CONNTRACK_ACT_CT_H */ -diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h -index cd982f4a0f50c..dde4dd9c4012c 100644 ---- a/include/net/netfilter/nf_flow_table.h -+++ b/include/net/netfilter/nf_flow_table.h -@@ -53,14 +53,17 @@ struct nf_flowtable_type { - struct list_head list; - int family; - int (*init)(struct nf_flowtable *ft); -+ bool (*gc)(const struct flow_offload *flow); - int (*setup)(struct nf_flowtable *ft, - struct net_device *dev, - enum flow_block_command cmd); - int (*action)(struct net *net, -- const struct flow_offload *flow, -+ struct flow_offload *flow, - enum flow_offload_tuple_dir dir, - struct nf_flow_rule *flow_rule); - void (*free)(struct nf_flowtable *ft); -+ void (*get)(struct nf_flowtable *ft); -+ void (*put)(struct nf_flowtable *ft); - nf_hookfn *hook; - struct module *owner; - }; -@@ -164,6 +167,8 @@ enum nf_flow_flags { - NF_FLOW_HW_DYING, - NF_FLOW_HW_DEAD, - NF_FLOW_HW_PENDING, -+ NF_FLOW_HW_BIDIRECTIONAL, -+ NF_FLOW_HW_ESTABLISHED, - }; - - enum flow_offload_type { -@@ -237,6 +242,11 @@ nf_flow_table_offload_add_cb(struct nf_flowtable *flow_table, - } - - list_add_tail(&block_cb->list, &block->cb_list); -+ up_write(&flow_table->flow_block_lock); -+ -+ if (flow_table->type->get) -+ flow_table->type->get(flow_table); -+ return 0; - - unlock: - up_write(&flow_table->flow_block_lock); -@@ -259,6 +269,9 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, - WARN_ON(true); - } - up_write(&flow_table->flow_block_lock); -+ -+ if (flow_table->type->put) -+ flow_table->type->put(flow_table); - } - - int flow_offload_route_init(struct flow_offload *flow, -@@ -266,7 +279,7 @@ int flow_offload_route_init(struct flow_offload *flow, - - int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); - void flow_offload_refresh(struct nf_flowtable *flow_table, -- struct flow_offload *flow); -+ struct flow_offload *flow, bool force); - - struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table, - struct flow_offload_tuple *tuple); -@@ -312,10 +325,10 @@ void nf_flow_table_offload_flush_cleanup(struct nf_flowtable *flowtable); - int nf_flow_table_offload_setup(struct nf_flowtable *flowtable, - struct net_device *dev, - enum flow_block_command cmd); --int nf_flow_rule_route_ipv4(struct net *net, const struct flow_offload *flow, -+int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow, - enum flow_offload_tuple_dir dir, - struct nf_flow_rule *flow_rule); --int nf_flow_rule_route_ipv6(struct net *net, const struct flow_offload *flow, -+int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow, - enum flow_offload_tuple_dir dir, - struct nf_flow_rule *flow_rule); - -diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h -index c4a6147b0ef8c..5225d2bd1a6e9 100644 ---- a/include/net/netfilter/nf_tables_ipv4.h -+++ b/include/net/netfilter/nf_tables_ipv4.h -@@ -29,8 +29,8 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) - if (iph->ihl < 5 || iph->version != 4) - return -1; - -- len = ntohs(iph->tot_len); -- thoff = iph->ihl * 4; -+ len = iph_totlen(pkt->skb, iph); -+ thoff = skb_network_offset(pkt->skb) + (iph->ihl * 4); - if (pkt->skb->len < len) - return -1; - else if (len < thoff) -@@ -62,7 +62,7 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt) - if (iph->ihl < 5 || iph->version != 4) - goto inhdr_error; - -- len = ntohs(iph->tot_len); -+ len = iph_totlen(pkt->skb, iph); - thoff = iph->ihl * 4; - if (pkt->skb->len < len) { - __IP_INC_STATS(nft_net(pkt), IPSTATS_MIB_INTRUNCATEDPKTS); -diff --git a/include/net/sock.h b/include/net/sock.h -index b6027b01c2455..6b51e85ae69e3 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1279,6 +1279,7 @@ struct proto { - size_t len, int flags, int *addr_len); - int (*sendpage)(struct sock *sk, struct page *page, - int offset, size_t size, int flags); -+ void (*splice_eof)(struct socket *sock); - int (*bind)(struct sock *sk, - struct sockaddr *addr, int addr_len); - int (*bind_add)(struct sock *sk, -@@ -1928,7 +1929,9 @@ struct sockcm_cookie { - static inline void sockcm_init(struct sockcm_cookie *sockc, - const struct sock *sk) - { -- *sockc = (struct sockcm_cookie) { .tsflags = sk->sk_tsflags }; -+ *sockc = (struct sockcm_cookie) { -+ .tsflags = READ_ONCE(sk->sk_tsflags) -+ }; - } - - int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg, -@@ -2741,9 +2744,9 @@ void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk, - static inline void - sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb) - { -- ktime_t kt = skb->tstamp; - struct skb_shared_hwtstamps *hwtstamps = skb_hwtstamps(skb); -- -+ u32 tsflags = READ_ONCE(sk->sk_tsflags); -+ ktime_t kt = skb->tstamp; - /* - * generate control messages if - * - receive time stamping in software requested -@@ -2751,10 +2754,10 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb) - * - hardware time stamps available and wanted - */ - if (sock_flag(sk, SOCK_RCVTSTAMP) || -- (sk->sk_tsflags & SOF_TIMESTAMPING_RX_SOFTWARE) || -- (kt && sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) || -+ (tsflags & SOF_TIMESTAMPING_RX_SOFTWARE) || -+ (kt && tsflags & SOF_TIMESTAMPING_SOFTWARE) || - (hwtstamps->hwtstamp && -- (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE))) -+ (tsflags & SOF_TIMESTAMPING_RAW_HARDWARE))) - __sock_recv_timestamp(msg, sk, skb); - else - sock_write_timestamp(sk, kt); -@@ -2776,7 +2779,8 @@ static inline void sock_recv_cmsgs(struct msghdr *msg, struct sock *sk, - #define TSFLAGS_ANY (SOF_TIMESTAMPING_SOFTWARE | \ - SOF_TIMESTAMPING_RAW_HARDWARE) - -- if (sk->sk_flags & FLAGS_RECV_CMSGS || sk->sk_tsflags & TSFLAGS_ANY) -+ if (sk->sk_flags & FLAGS_RECV_CMSGS || -+ READ_ONCE(sk->sk_tsflags) & TSFLAGS_ANY) - __sock_recv_cmsgs(msg, sk, skb); - else if (unlikely(sock_flag(sk, SOCK_TIMESTAMP))) - sock_write_timestamp(sk, skb->tstamp); -@@ -2825,6 +2829,11 @@ static inline bool sk_is_tcp(const struct sock *sk) - return sk->sk_type == SOCK_STREAM && sk->sk_protocol == IPPROTO_TCP; - } - -+static inline bool sk_is_stream_unix(const struct sock *sk) -+{ -+ return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM; -+} -+ - /** - * sk_eat_skb - Release a skb if it is no longer needed - * @sk: socket to eat this skb from -diff --git a/include/net/tcp.h b/include/net/tcp.h -index c3d56b337f358..4c838f7290dd9 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -332,6 +332,7 @@ int tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size); - int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size); - int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *copied, - size_t size, struct ubuf_info *uarg); -+void tcp_splice_eof(struct socket *sock); - int tcp_sendpage(struct sock *sk, struct page *page, int offset, size_t size, - int flags); - int tcp_sendpage_locked(struct sock *sk, struct page *page, int offset, -diff --git a/include/net/udp.h b/include/net/udp.h -index fee053bcd17c6..fa4cdbe55552c 100644 ---- a/include/net/udp.h -+++ b/include/net/udp.h -@@ -269,6 +269,7 @@ int udp_get_port(struct sock *sk, unsigned short snum, - int udp_err(struct sk_buff *, u32); - int udp_abort(struct sock *sk, int err); - int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len); -+void udp_splice_eof(struct socket *sock); - int udp_push_pending_frames(struct sock *sk); - void udp_flush_pending_frames(struct sock *sk); - int udp_cmsg_send(struct sock *sk, struct msghdr *msg, u16 *gso_size); -diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h -index 72394f441dad8..e5f81710b18f4 100644 ---- a/include/net/udp_tunnel.h -+++ b/include/net/udp_tunnel.h -@@ -174,16 +174,13 @@ static inline int udp_tunnel_handle_offloads(struct sk_buff *skb, bool udp_csum) - } - #endif - --static inline void udp_tunnel_encap_enable(struct socket *sock) -+static inline void udp_tunnel_encap_enable(struct sock *sk) - { -- struct udp_sock *up = udp_sk(sock->sk); -- -- if (up->encap_enabled) -+ if (udp_test_and_set_bit(ENCAP_ENABLED, sk)) - return; - -- up->encap_enabled = 1; - #if IS_ENABLED(CONFIG_IPV6) -- if (sock->sk->sk_family == PF_INET6) -+ if (READ_ONCE(sk->sk_family) == PF_INET6) - ipv6_stub->udpv6_encap_enable(); - #endif - udp_encap_enable(); -diff --git a/io_uring/net.c b/io_uring/net.c -index 57c626cb4d1a5..67f09a40bcb21 100644 ---- a/io_uring/net.c -+++ b/io_uring/net.c -@@ -389,6 +389,7 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags) - if (flags & MSG_WAITALL) - min_ret = iov_iter_count(&msg.msg_iter); - -+ flags &= ~MSG_INTERNAL_SENDMSG_FLAGS; - msg.msg_flags = flags; - ret = sock_sendmsg(sock, &msg); - if (ret < min_ret) { -@@ -1137,6 +1138,7 @@ int io_send_zc(struct io_kiocb *req, unsigned int issue_flags) - msg_flags |= MSG_DONTWAIT; - if (msg_flags & MSG_WAITALL) - min_ret = iov_iter_count(&msg.msg_iter); -+ msg_flags &= ~MSG_INTERNAL_SENDMSG_FLAGS; - - msg.msg_flags = msg_flags; - msg.msg_ubuf = &io_notif_to_data(zc->notif)->uarg; -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 7225cb67c0d3a..76bf1de261152 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -365,9 +365,18 @@ static int bpf_adj_delta_to_imm(struct bpf_insn *insn, u32 pos, s32 end_old, - static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, s32 end_old, - s32 end_new, s32 curr, const bool probe_pass) - { -- const s32 off_min = S16_MIN, off_max = S16_MAX; -+ s64 off_min, off_max, off; - s32 delta = end_new - end_old; -- s32 off = insn->off; -+ -+ if (insn->code == (BPF_JMP32 | BPF_JA)) { -+ off = insn->imm; -+ off_min = S32_MIN; -+ off_max = S32_MAX; -+ } else { -+ off = insn->off; -+ off_min = S16_MIN; -+ off_max = S16_MAX; -+ } - - if (curr < pos && curr + off + 1 >= end_old) - off += delta; -@@ -375,8 +384,12 @@ static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, s32 end_old, - off -= delta; - if (off < off_min || off > off_max) - return -ERANGE; -- if (!probe_pass) -- insn->off = off; -+ if (!probe_pass) { -+ if (insn->code == (BPF_JMP32 | BPF_JA)) -+ insn->imm = off; -+ else -+ insn->off = off; -+ } - return 0; - } - -@@ -1586,6 +1599,7 @@ EXPORT_SYMBOL_GPL(__bpf_call_base); - INSN_3(JMP, JSLE, K), \ - INSN_3(JMP, JSET, K), \ - INSN_2(JMP, JA), \ -+ INSN_2(JMP32, JA), \ - /* Store instructions. */ \ - /* Register based. */ \ - INSN_3(STX, MEM, B), \ -@@ -1862,6 +1876,9 @@ out: - JMP_JA: - insn += insn->off; - CONT; -+ JMP32_JA: -+ insn += insn->imm; -+ CONT; - JMP_EXIT: - return BPF_R0; - /* JMP */ -diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c -index c4381dfcd6b09..748ac86169941 100644 ---- a/kernel/bpf/trampoline.c -+++ b/kernel/bpf/trampoline.c -@@ -443,8 +443,8 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut - goto out; - } - -- /* clear all bits except SHARE_IPMODIFY */ -- tr->flags &= BPF_TRAMP_F_SHARE_IPMODIFY; -+ /* clear all bits except SHARE_IPMODIFY and TAIL_CALL_CTX */ -+ tr->flags &= (BPF_TRAMP_F_SHARE_IPMODIFY | BPF_TRAMP_F_TAIL_CALL_CTX); - - if (tlinks[BPF_TRAMP_FEXIT].nr_links || - tlinks[BPF_TRAMP_MODIFY_RETURN].nr_links) { -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 12d360d80c149..142e10d49fd81 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -2254,7 +2254,10 @@ static int check_subprogs(struct bpf_verifier_env *env) - goto next; - if (BPF_OP(code) == BPF_EXIT || BPF_OP(code) == BPF_CALL) - goto next; -- off = i + insn[i].off + 1; -+ if (code == (BPF_JMP32 | BPF_JA)) -+ off = i + insn[i].imm + 1; -+ else -+ off = i + insn[i].off + 1; - if (off < subprog_start || off >= subprog_end) { - verbose(env, "jump out of range from insn %d to %d\n", i, off); - return -EINVAL; -@@ -2266,6 +2269,7 @@ next: - * or unconditional jump back - */ - if (code != (BPF_JMP | BPF_EXIT) && -+ code != (BPF_JMP32 | BPF_JA) && - code != (BPF_JMP | BPF_JA)) { - verbose(env, "last insn is not an exit or jmp\n"); - return -EINVAL; -@@ -2512,6 +2516,16 @@ static int check_reg_arg(struct bpf_verifier_env *env, u32 regno, - return 0; - } - -+static void mark_jmp_point(struct bpf_verifier_env *env, int idx) -+{ -+ env->insn_aux_data[idx].jmp_point = true; -+} -+ -+static bool is_jmp_point(struct bpf_verifier_env *env, int insn_idx) -+{ -+ return env->insn_aux_data[insn_idx].jmp_point; -+} -+ - /* for any branch, call, exit record the history of jmps in the given state */ - static int push_jmp_history(struct bpf_verifier_env *env, - struct bpf_verifier_state *cur) -@@ -2520,6 +2534,9 @@ static int push_jmp_history(struct bpf_verifier_env *env, - struct bpf_idx_pair *p; - size_t alloc_size; - -+ if (!is_jmp_point(env, env->insn_idx)) -+ return 0; -+ - cnt++; - alloc_size = kmalloc_size_roundup(size_mul(cnt, sizeof(*p))); - p = krealloc(cur->jmp_history, alloc_size, GFP_USER); -@@ -2534,12 +2551,29 @@ static int push_jmp_history(struct bpf_verifier_env *env, - - /* Backtrack one insn at a time. If idx is not at the top of recorded - * history then previous instruction came from straight line execution. -+ * Return -ENOENT if we exhausted all instructions within given state. -+ * -+ * It's legal to have a bit of a looping with the same starting and ending -+ * insn index within the same state, e.g.: 3->4->5->3, so just because current -+ * instruction index is the same as state's first_idx doesn't mean we are -+ * done. If there is still some jump history left, we should keep going. We -+ * need to take into account that we might have a jump history between given -+ * state's parent and itself, due to checkpointing. In this case, we'll have -+ * history entry recording a jump from last instruction of parent state and -+ * first instruction of given state. - */ - static int get_prev_insn_idx(struct bpf_verifier_state *st, int i, - u32 *history) - { - u32 cnt = *history; - -+ if (i == st->first_insn_idx) { -+ if (cnt == 0) -+ return -ENOENT; -+ if (cnt == 1 && st->jmp_history[0].idx == i) -+ return -ENOENT; -+ } -+ - if (cnt && st->jmp_history[cnt - 1].idx == i) { - i = st->jmp_history[cnt - 1].prev_idx; - (*history)--; -@@ -3035,9 +3069,9 @@ static int __mark_chain_precision(struct bpf_verifier_env *env, int frame, int r - * Nothing to be tracked further in the parent state. - */ - return 0; -- if (i == first_idx) -- break; - i = get_prev_insn_idx(st, i, &history); -+ if (i == -ENOENT) -+ break; - if (i >= env->prog->len) { - /* This can happen if backtracking reached insn 0 - * and there are still reg_mask or stack_mask -@@ -11000,11 +11034,16 @@ static struct bpf_verifier_state_list **explored_state( - return &env->explored_states[(idx ^ state->callsite) % state_htab_size(env)]; - } - --static void init_explored_state(struct bpf_verifier_env *env, int idx) -+static void mark_prune_point(struct bpf_verifier_env *env, int idx) - { - env->insn_aux_data[idx].prune_point = true; - } - -+static bool is_prune_point(struct bpf_verifier_env *env, int insn_idx) -+{ -+ return env->insn_aux_data[insn_idx].prune_point; -+} -+ - enum { - DONE_EXPLORING = 0, - KEEP_EXPLORING = 1, -@@ -11033,9 +11072,11 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env, - return -EINVAL; - } - -- if (e == BRANCH) -+ if (e == BRANCH) { - /* mark branch target for state pruning */ -- init_explored_state(env, w); -+ mark_prune_point(env, w); -+ mark_jmp_point(env, w); -+ } - - if (insn_state[w] == 0) { - /* tree-edge */ -@@ -11062,21 +11103,23 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env, - return DONE_EXPLORING; - } - --static int visit_func_call_insn(int t, int insn_cnt, -- struct bpf_insn *insns, -+static int visit_func_call_insn(int t, struct bpf_insn *insns, - struct bpf_verifier_env *env, - bool visit_callee) - { -- int ret; -+ int ret, insn_sz; - -- ret = push_insn(t, t + 1, FALLTHROUGH, env, false); -+ insn_sz = bpf_is_ldimm64(&insns[t]) ? 2 : 1; -+ ret = push_insn(t, t + insn_sz, FALLTHROUGH, env, false); - if (ret) - return ret; - -- if (t + 1 < insn_cnt) -- init_explored_state(env, t + 1); -+ mark_prune_point(env, t + insn_sz); -+ /* when we exit from subprog, we need to record non-linear history */ -+ mark_jmp_point(env, t + insn_sz); -+ - if (visit_callee) { -- init_explored_state(env, t); -+ mark_prune_point(env, t); - ret = push_insn(t, t + insns[t].imm + 1, BRANCH, env, - /* It's ok to allow recursion from CFG point of - * view. __check_func_call() will do the actual -@@ -11092,65 +11135,64 @@ static int visit_func_call_insn(int t, int insn_cnt, - * DONE_EXPLORING - the instruction was fully explored - * KEEP_EXPLORING - there is still work to be done before it is fully explored - */ --static int visit_insn(int t, int insn_cnt, struct bpf_verifier_env *env) -+static int visit_insn(int t, struct bpf_verifier_env *env) - { -- struct bpf_insn *insns = env->prog->insnsi; -- int ret; -+ struct bpf_insn *insns = env->prog->insnsi, *insn = &insns[t]; -+ int ret, off, insn_sz; - -- if (bpf_pseudo_func(insns + t)) -- return visit_func_call_insn(t, insn_cnt, insns, env, true); -+ if (bpf_pseudo_func(insn)) -+ return visit_func_call_insn(t, insns, env, true); - - /* All non-branch instructions have a single fall-through edge. */ -- if (BPF_CLASS(insns[t].code) != BPF_JMP && -- BPF_CLASS(insns[t].code) != BPF_JMP32) -- return push_insn(t, t + 1, FALLTHROUGH, env, false); -+ if (BPF_CLASS(insn->code) != BPF_JMP && -+ BPF_CLASS(insn->code) != BPF_JMP32) { -+ insn_sz = bpf_is_ldimm64(insn) ? 2 : 1; -+ return push_insn(t, t + insn_sz, FALLTHROUGH, env, false); -+ } - -- switch (BPF_OP(insns[t].code)) { -+ switch (BPF_OP(insn->code)) { - case BPF_EXIT: - return DONE_EXPLORING; - - case BPF_CALL: -- if (insns[t].imm == BPF_FUNC_timer_set_callback) -- /* Mark this call insn to trigger is_state_visited() check -- * before call itself is processed by __check_func_call(). -- * Otherwise new async state will be pushed for further -- * exploration. -+ if (insn->imm == BPF_FUNC_timer_set_callback) -+ /* Mark this call insn as a prune point to trigger -+ * is_state_visited() check before call itself is -+ * processed by __check_func_call(). Otherwise new -+ * async state will be pushed for further exploration. - */ -- init_explored_state(env, t); -- return visit_func_call_insn(t, insn_cnt, insns, env, -- insns[t].src_reg == BPF_PSEUDO_CALL); -+ mark_prune_point(env, t); -+ return visit_func_call_insn(t, insns, env, insn->src_reg == BPF_PSEUDO_CALL); - - case BPF_JA: -- if (BPF_SRC(insns[t].code) != BPF_K) -+ if (BPF_SRC(insn->code) != BPF_K) - return -EINVAL; - -+ if (BPF_CLASS(insn->code) == BPF_JMP) -+ off = insn->off; -+ else -+ off = insn->imm; -+ - /* unconditional jump with single edge */ -- ret = push_insn(t, t + insns[t].off + 1, FALLTHROUGH, env, -+ ret = push_insn(t, t + off + 1, FALLTHROUGH, env, - true); - if (ret) - return ret; - -- /* unconditional jmp is not a good pruning point, -- * but it's marked, since backtracking needs -- * to record jmp history in is_state_visited(). -- */ -- init_explored_state(env, t + insns[t].off + 1); -- /* tell verifier to check for equivalent states -- * after every call and jump -- */ -- if (t + 1 < insn_cnt) -- init_explored_state(env, t + 1); -+ mark_prune_point(env, t + off + 1); -+ mark_jmp_point(env, t + off + 1); - - return ret; - - default: - /* conditional jump with two edges */ -- init_explored_state(env, t); -+ mark_prune_point(env, t); -+ - ret = push_insn(t, t + 1, FALLTHROUGH, env, true); - if (ret) - return ret; - -- return push_insn(t, t + insns[t].off + 1, BRANCH, env, true); -+ return push_insn(t, t + insn->off + 1, BRANCH, env, true); - } - } - -@@ -11181,7 +11223,7 @@ static int check_cfg(struct bpf_verifier_env *env) - while (env->cfg.cur_stack > 0) { - int t = insn_stack[env->cfg.cur_stack - 1]; - -- ret = visit_insn(t, insn_cnt, env); -+ ret = visit_insn(t, env); - switch (ret) { - case DONE_EXPLORING: - insn_state[t] = EXPLORED; -@@ -11205,11 +11247,21 @@ static int check_cfg(struct bpf_verifier_env *env) - } - - for (i = 0; i < insn_cnt; i++) { -+ struct bpf_insn *insn = &env->prog->insnsi[i]; -+ - if (insn_state[i] != EXPLORED) { - verbose(env, "unreachable insn %d\n", i); - ret = -EINVAL; - goto err_free; - } -+ if (bpf_is_ldimm64(insn)) { -+ if (insn_state[i + 1] != 0) { -+ verbose(env, "jump into the middle of ldimm64 insn %d\n", i); -+ ret = -EINVAL; -+ goto err_free; -+ } -+ i++; /* skip second half of ldimm64 */ -+ } - } - ret = 0; /* cfg looks good */ - -@@ -12178,11 +12230,11 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx) - bool add_new_state = env->test_state_freq ? true : false; - - cur->last_insn_idx = env->prev_insn_idx; -- if (!env->insn_aux_data[insn_idx].prune_point) -+ if (!is_prune_point(env, insn_idx)) - /* this 'insn_idx' instruction wasn't marked, so we will not - * be doing state search here - */ -- return 0; -+ return push_jmp_history(env, cur); - - /* bpf progs typically have pruning point every 4 instructions - * http://vger.kernel.org/bpfconf2019.html#session-1 -@@ -12674,15 +12726,18 @@ static int do_check(struct bpf_verifier_env *env) - return err; - } else if (opcode == BPF_JA) { - if (BPF_SRC(insn->code) != BPF_K || -- insn->imm != 0 || - insn->src_reg != BPF_REG_0 || - insn->dst_reg != BPF_REG_0 || -- class == BPF_JMP32) { -+ (class == BPF_JMP && insn->imm != 0) || -+ (class == BPF_JMP32 && insn->off != 0)) { - verbose(env, "BPF_JA uses reserved fields\n"); - return -EINVAL; - } - -- env->insn_idx += insn->off + 1; -+ if (class == BPF_JMP) -+ env->insn_idx += insn->off + 1; -+ else -+ env->insn_idx += insn->imm + 1; - continue; - - } else if (opcode == BPF_EXIT) { -@@ -13508,13 +13563,13 @@ static bool insn_is_cond_jump(u8 code) - { - u8 op; - -+ op = BPF_OP(code); - if (BPF_CLASS(code) == BPF_JMP32) -- return true; -+ return op != BPF_JA; - - if (BPF_CLASS(code) != BPF_JMP) - return false; - -- op = BPF_OP(code); - return op != BPF_JA && op != BPF_EXIT && op != BPF_CALL; - } - -@@ -15442,6 +15497,9 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) - if (!tr) - return -ENOMEM; - -+ if (tgt_prog && tgt_prog->aux->tail_call_reachable) -+ tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX; -+ - prog->aux->dst_trampoline = tr; - return 0; - } -diff --git a/kernel/cpu.c b/kernel/cpu.c -index 551468d9c5a85..e6f0101941ed8 100644 ---- a/kernel/cpu.c -+++ b/kernel/cpu.c -@@ -446,9 +446,31 @@ static int __init smt_cmdline_disable(char *str) - } - early_param("nosmt", smt_cmdline_disable); - --static inline bool cpu_smt_allowed(unsigned int cpu) -+/* -+ * For Archicture supporting partial SMT states check if the thread is allowed. -+ * Otherwise this has already been checked through cpu_smt_max_threads when -+ * setting the SMT level. -+ */ -+static inline bool cpu_smt_thread_allowed(unsigned int cpu) - { -- if (cpu_smt_control == CPU_SMT_ENABLED) -+#ifdef CONFIG_SMT_NUM_THREADS_DYNAMIC -+ return topology_smt_thread_allowed(cpu); -+#else -+ return true; -+#endif -+} -+ -+static inline bool cpu_bootable(unsigned int cpu) -+{ -+ if (cpu_smt_control == CPU_SMT_ENABLED && cpu_smt_thread_allowed(cpu)) -+ return true; -+ -+ /* All CPUs are bootable if controls are not configured */ -+ if (cpu_smt_control == CPU_SMT_NOT_IMPLEMENTED) -+ return true; -+ -+ /* All CPUs are bootable if CPU is not SMT capable */ -+ if (cpu_smt_control == CPU_SMT_NOT_SUPPORTED) - return true; - - if (topology_is_primary_thread(cpu)) -@@ -471,7 +493,7 @@ bool cpu_smt_possible(void) - } - EXPORT_SYMBOL_GPL(cpu_smt_possible); - #else --static inline bool cpu_smt_allowed(unsigned int cpu) { return true; } -+static inline bool cpu_bootable(unsigned int cpu) { return true; } - #endif - - static inline enum cpuhp_state -@@ -574,10 +596,10 @@ static int bringup_wait_for_ap(unsigned int cpu) - * SMT soft disabling on X86 requires to bring the CPU out of the - * BIOS 'wait for SIPI' state in order to set the CR4.MCE bit. The - * CPU marked itself as booted_once in notify_cpu_starting() so the -- * cpu_smt_allowed() check will now return false if this is not the -+ * cpu_bootable() check will now return false if this is not the - * primary sibling. - */ -- if (!cpu_smt_allowed(cpu)) -+ if (!cpu_bootable(cpu)) - return -ECANCELED; - - if (st->target <= CPUHP_AP_ONLINE_IDLE) -@@ -1464,7 +1486,7 @@ static int cpu_up(unsigned int cpu, enum cpuhp_state target) - err = -EBUSY; - goto out; - } -- if (!cpu_smt_allowed(cpu)) { -+ if (!cpu_bootable(cpu)) { - err = -EPERM; - goto out; - } -@@ -2294,6 +2316,12 @@ int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval) - for_each_online_cpu(cpu) { - if (topology_is_primary_thread(cpu)) - continue; -+ /* -+ * Disable can be called with CPU_SMT_ENABLED when changing -+ * from a higher to lower number of SMT threads per core. -+ */ -+ if (ctrlval == CPU_SMT_ENABLED && cpu_smt_thread_allowed(cpu)) -+ continue; - ret = cpu_down_maps_locked(cpu, CPUHP_OFFLINE); - if (ret) - break; -@@ -2328,6 +2356,8 @@ int cpuhp_smt_enable(void) - /* Skip online CPUs and CPUs on offline nodes */ - if (cpu_online(cpu) || !node_online(cpu_to_node(cpu))) - continue; -+ if (!cpu_smt_thread_allowed(cpu)) -+ continue; - ret = _cpu_up(cpu, 0, CPUHP_ONLINE); - if (ret) - break; -diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c -index d9a5c1d65a79d..44a4eba80315c 100644 ---- a/kernel/irq/affinity.c -+++ b/kernel/irq/affinity.c -@@ -7,398 +7,7 @@ - #include - #include - #include --#include -- --static void irq_spread_init_one(struct cpumask *irqmsk, struct cpumask *nmsk, -- unsigned int cpus_per_vec) --{ -- const struct cpumask *siblmsk; -- int cpu, sibl; -- -- for ( ; cpus_per_vec > 0; ) { -- cpu = cpumask_first(nmsk); -- -- /* Should not happen, but I'm too lazy to think about it */ -- if (cpu >= nr_cpu_ids) -- return; -- -- cpumask_clear_cpu(cpu, nmsk); -- cpumask_set_cpu(cpu, irqmsk); -- cpus_per_vec--; -- -- /* If the cpu has siblings, use them first */ -- siblmsk = topology_sibling_cpumask(cpu); -- for (sibl = -1; cpus_per_vec > 0; ) { -- sibl = cpumask_next(sibl, siblmsk); -- if (sibl >= nr_cpu_ids) -- break; -- if (!cpumask_test_and_clear_cpu(sibl, nmsk)) -- continue; -- cpumask_set_cpu(sibl, irqmsk); -- cpus_per_vec--; -- } -- } --} -- --static cpumask_var_t *alloc_node_to_cpumask(void) --{ -- cpumask_var_t *masks; -- int node; -- -- masks = kcalloc(nr_node_ids, sizeof(cpumask_var_t), GFP_KERNEL); -- if (!masks) -- return NULL; -- -- for (node = 0; node < nr_node_ids; node++) { -- if (!zalloc_cpumask_var(&masks[node], GFP_KERNEL)) -- goto out_unwind; -- } -- -- return masks; -- --out_unwind: -- while (--node >= 0) -- free_cpumask_var(masks[node]); -- kfree(masks); -- return NULL; --} -- --static void free_node_to_cpumask(cpumask_var_t *masks) --{ -- int node; -- -- for (node = 0; node < nr_node_ids; node++) -- free_cpumask_var(masks[node]); -- kfree(masks); --} -- --static void build_node_to_cpumask(cpumask_var_t *masks) --{ -- int cpu; -- -- for_each_possible_cpu(cpu) -- cpumask_set_cpu(cpu, masks[cpu_to_node(cpu)]); --} -- --static int get_nodes_in_cpumask(cpumask_var_t *node_to_cpumask, -- const struct cpumask *mask, nodemask_t *nodemsk) --{ -- int n, nodes = 0; -- -- /* Calculate the number of nodes in the supplied affinity mask */ -- for_each_node(n) { -- if (cpumask_intersects(mask, node_to_cpumask[n])) { -- node_set(n, *nodemsk); -- nodes++; -- } -- } -- return nodes; --} -- --struct node_vectors { -- unsigned id; -- -- union { -- unsigned nvectors; -- unsigned ncpus; -- }; --}; -- --static int ncpus_cmp_func(const void *l, const void *r) --{ -- const struct node_vectors *ln = l; -- const struct node_vectors *rn = r; -- -- return ln->ncpus - rn->ncpus; --} -- --/* -- * Allocate vector number for each node, so that for each node: -- * -- * 1) the allocated number is >= 1 -- * -- * 2) the allocated numbver is <= active CPU number of this node -- * -- * The actual allocated total vectors may be less than @numvecs when -- * active total CPU number is less than @numvecs. -- * -- * Active CPUs means the CPUs in '@cpu_mask AND @node_to_cpumask[]' -- * for each node. -- */ --static void alloc_nodes_vectors(unsigned int numvecs, -- cpumask_var_t *node_to_cpumask, -- const struct cpumask *cpu_mask, -- const nodemask_t nodemsk, -- struct cpumask *nmsk, -- struct node_vectors *node_vectors) --{ -- unsigned n, remaining_ncpus = 0; -- -- for (n = 0; n < nr_node_ids; n++) { -- node_vectors[n].id = n; -- node_vectors[n].ncpus = UINT_MAX; -- } -- -- for_each_node_mask(n, nodemsk) { -- unsigned ncpus; -- -- cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); -- ncpus = cpumask_weight(nmsk); -- -- if (!ncpus) -- continue; -- remaining_ncpus += ncpus; -- node_vectors[n].ncpus = ncpus; -- } -- -- numvecs = min_t(unsigned, remaining_ncpus, numvecs); -- -- sort(node_vectors, nr_node_ids, sizeof(node_vectors[0]), -- ncpus_cmp_func, NULL); -- -- /* -- * Allocate vectors for each node according to the ratio of this -- * node's nr_cpus to remaining un-assigned ncpus. 'numvecs' is -- * bigger than number of active numa nodes. Always start the -- * allocation from the node with minimized nr_cpus. -- * -- * This way guarantees that each active node gets allocated at -- * least one vector, and the theory is simple: over-allocation -- * is only done when this node is assigned by one vector, so -- * other nodes will be allocated >= 1 vector, since 'numvecs' is -- * bigger than number of numa nodes. -- * -- * One perfect invariant is that number of allocated vectors for -- * each node is <= CPU count of this node: -- * -- * 1) suppose there are two nodes: A and B -- * ncpu(X) is CPU count of node X -- * vecs(X) is the vector count allocated to node X via this -- * algorithm -- * -- * ncpu(A) <= ncpu(B) -- * ncpu(A) + ncpu(B) = N -- * vecs(A) + vecs(B) = V -- * -- * vecs(A) = max(1, round_down(V * ncpu(A) / N)) -- * vecs(B) = V - vecs(A) -- * -- * both N and V are integer, and 2 <= V <= N, suppose -- * V = N - delta, and 0 <= delta <= N - 2 -- * -- * 2) obviously vecs(A) <= ncpu(A) because: -- * -- * if vecs(A) is 1, then vecs(A) <= ncpu(A) given -- * ncpu(A) >= 1 -- * -- * otherwise, -- * vecs(A) <= V * ncpu(A) / N <= ncpu(A), given V <= N -- * -- * 3) prove how vecs(B) <= ncpu(B): -- * -- * if round_down(V * ncpu(A) / N) == 0, vecs(B) won't be -- * over-allocated, so vecs(B) <= ncpu(B), -- * -- * otherwise: -- * -- * vecs(A) = -- * round_down(V * ncpu(A) / N) = -- * round_down((N - delta) * ncpu(A) / N) = -- * round_down((N * ncpu(A) - delta * ncpu(A)) / N) >= -- * round_down((N * ncpu(A) - delta * N) / N) = -- * cpu(A) - delta -- * -- * then: -- * -- * vecs(A) - V >= ncpu(A) - delta - V -- * => -- * V - vecs(A) <= V + delta - ncpu(A) -- * => -- * vecs(B) <= N - ncpu(A) -- * => -- * vecs(B) <= cpu(B) -- * -- * For nodes >= 3, it can be thought as one node and another big -- * node given that is exactly what this algorithm is implemented, -- * and we always re-calculate 'remaining_ncpus' & 'numvecs', and -- * finally for each node X: vecs(X) <= ncpu(X). -- * -- */ -- for (n = 0; n < nr_node_ids; n++) { -- unsigned nvectors, ncpus; -- -- if (node_vectors[n].ncpus == UINT_MAX) -- continue; -- -- WARN_ON_ONCE(numvecs == 0); -- -- ncpus = node_vectors[n].ncpus; -- nvectors = max_t(unsigned, 1, -- numvecs * ncpus / remaining_ncpus); -- WARN_ON_ONCE(nvectors > ncpus); -- -- node_vectors[n].nvectors = nvectors; -- -- remaining_ncpus -= ncpus; -- numvecs -= nvectors; -- } --} -- --static int __irq_build_affinity_masks(unsigned int startvec, -- unsigned int numvecs, -- unsigned int firstvec, -- cpumask_var_t *node_to_cpumask, -- const struct cpumask *cpu_mask, -- struct cpumask *nmsk, -- struct irq_affinity_desc *masks) --{ -- unsigned int i, n, nodes, cpus_per_vec, extra_vecs, done = 0; -- unsigned int last_affv = firstvec + numvecs; -- unsigned int curvec = startvec; -- nodemask_t nodemsk = NODE_MASK_NONE; -- struct node_vectors *node_vectors; -- -- if (cpumask_empty(cpu_mask)) -- return 0; -- -- nodes = get_nodes_in_cpumask(node_to_cpumask, cpu_mask, &nodemsk); -- -- /* -- * If the number of nodes in the mask is greater than or equal the -- * number of vectors we just spread the vectors across the nodes. -- */ -- if (numvecs <= nodes) { -- for_each_node_mask(n, nodemsk) { -- /* Ensure that only CPUs which are in both masks are set */ -- cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); -- cpumask_or(&masks[curvec].mask, &masks[curvec].mask, nmsk); -- if (++curvec == last_affv) -- curvec = firstvec; -- } -- return numvecs; -- } -- -- node_vectors = kcalloc(nr_node_ids, -- sizeof(struct node_vectors), -- GFP_KERNEL); -- if (!node_vectors) -- return -ENOMEM; -- -- /* allocate vector number for each node */ -- alloc_nodes_vectors(numvecs, node_to_cpumask, cpu_mask, -- nodemsk, nmsk, node_vectors); -- -- for (i = 0; i < nr_node_ids; i++) { -- unsigned int ncpus, v; -- struct node_vectors *nv = &node_vectors[i]; -- -- if (nv->nvectors == UINT_MAX) -- continue; -- -- /* Get the cpus on this node which are in the mask */ -- cpumask_and(nmsk, cpu_mask, node_to_cpumask[nv->id]); -- ncpus = cpumask_weight(nmsk); -- if (!ncpus) -- continue; -- -- WARN_ON_ONCE(nv->nvectors > ncpus); -- -- /* Account for rounding errors */ -- extra_vecs = ncpus - nv->nvectors * (ncpus / nv->nvectors); -- -- /* Spread allocated vectors on CPUs of the current node */ -- for (v = 0; v < nv->nvectors; v++, curvec++) { -- cpus_per_vec = ncpus / nv->nvectors; -- -- /* Account for extra vectors to compensate rounding errors */ -- if (extra_vecs) { -- cpus_per_vec++; -- --extra_vecs; -- } -- -- /* -- * wrapping has to be considered given 'startvec' -- * may start anywhere -- */ -- if (curvec >= last_affv) -- curvec = firstvec; -- irq_spread_init_one(&masks[curvec].mask, nmsk, -- cpus_per_vec); -- } -- done += nv->nvectors; -- } -- kfree(node_vectors); -- return done; --} -- --/* -- * build affinity in two stages: -- * 1) spread present CPU on these vectors -- * 2) spread other possible CPUs on these vectors -- */ --static int irq_build_affinity_masks(unsigned int startvec, unsigned int numvecs, -- unsigned int firstvec, -- struct irq_affinity_desc *masks) --{ -- unsigned int curvec = startvec, nr_present = 0, nr_others = 0; -- cpumask_var_t *node_to_cpumask; -- cpumask_var_t nmsk, npresmsk; -- int ret = -ENOMEM; -- -- if (!zalloc_cpumask_var(&nmsk, GFP_KERNEL)) -- return ret; -- -- if (!zalloc_cpumask_var(&npresmsk, GFP_KERNEL)) -- goto fail_nmsk; -- -- node_to_cpumask = alloc_node_to_cpumask(); -- if (!node_to_cpumask) -- goto fail_npresmsk; -- -- /* Stabilize the cpumasks */ -- cpus_read_lock(); -- build_node_to_cpumask(node_to_cpumask); -- -- /* Spread on present CPUs starting from affd->pre_vectors */ -- ret = __irq_build_affinity_masks(curvec, numvecs, firstvec, -- node_to_cpumask, cpu_present_mask, -- nmsk, masks); -- if (ret < 0) -- goto fail_build_affinity; -- nr_present = ret; -- -- /* -- * Spread on non present CPUs starting from the next vector to be -- * handled. If the spreading of present CPUs already exhausted the -- * vector space, assign the non present CPUs to the already spread -- * out vectors. -- */ -- if (nr_present >= numvecs) -- curvec = firstvec; -- else -- curvec = firstvec + nr_present; -- cpumask_andnot(npresmsk, cpu_possible_mask, cpu_present_mask); -- ret = __irq_build_affinity_masks(curvec, numvecs, firstvec, -- node_to_cpumask, npresmsk, nmsk, -- masks); -- if (ret >= 0) -- nr_others = ret; -- -- fail_build_affinity: -- cpus_read_unlock(); -- -- if (ret >= 0) -- WARN_ON(nr_present + nr_others < numvecs); -- -- free_node_to_cpumask(node_to_cpumask); -- -- fail_npresmsk: -- free_cpumask_var(npresmsk); -- -- fail_nmsk: -- free_cpumask_var(nmsk); -- return ret < 0 ? ret : 0; --} -+#include - - static void default_calc_sets(struct irq_affinity *affd, unsigned int affvecs) - { -@@ -461,14 +70,18 @@ irq_create_affinity_masks(unsigned int nvecs, struct irq_affinity *affd) - */ - for (i = 0, usedvecs = 0; i < affd->nr_sets; i++) { - unsigned int this_vecs = affd->set_size[i]; -- int ret; -+ int j; -+ struct cpumask *result = group_cpus_evenly(this_vecs); - -- ret = irq_build_affinity_masks(curvec, this_vecs, -- curvec, masks); -- if (ret) { -+ if (!result) { - kfree(masks); - return NULL; - } -+ -+ for (j = 0; j < this_vecs; j++) -+ cpumask_copy(&masks[curvec + j].mask, &result[j]); -+ kfree(result); -+ - curvec += this_vecs; - usedvecs += this_vecs; - } -diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c -index 8fdf076720384..929dcbc04d29c 100644 ---- a/kernel/rcu/srcutree.c -+++ b/kernel/rcu/srcutree.c -@@ -1100,10 +1100,37 @@ static unsigned long srcu_gp_start_if_needed(struct srcu_struct *ssp, - spin_lock_irqsave_sdp_contention(sdp, &flags); - if (rhp) - rcu_segcblist_enqueue(&sdp->srcu_cblist, rhp); -+ /* -+ * The snapshot for acceleration must be taken _before_ the read of the -+ * current gp sequence used for advancing, otherwise advancing may fail -+ * and acceleration may then fail too. -+ * -+ * This could happen if: -+ * -+ * 1) The RCU_WAIT_TAIL segment has callbacks (gp_num = X + 4) and the -+ * RCU_NEXT_READY_TAIL also has callbacks (gp_num = X + 8). -+ * -+ * 2) The grace period for RCU_WAIT_TAIL is seen as started but not -+ * completed so rcu_seq_current() returns X + SRCU_STATE_SCAN1. -+ * -+ * 3) This value is passed to rcu_segcblist_advance() which can't move -+ * any segment forward and fails. -+ * -+ * 4) srcu_gp_start_if_needed() still proceeds with callback acceleration. -+ * But then the call to rcu_seq_snap() observes the grace period for the -+ * RCU_WAIT_TAIL segment as completed and the subsequent one for the -+ * RCU_NEXT_READY_TAIL segment as started (ie: X + 4 + SRCU_STATE_SCAN1) -+ * so it returns a snapshot of the next grace period, which is X + 12. -+ * -+ * 5) The value of X + 12 is passed to rcu_segcblist_accelerate() but the -+ * freshly enqueued callback in RCU_NEXT_TAIL can't move to -+ * RCU_NEXT_READY_TAIL which already has callbacks for a previous grace -+ * period (gp_num = X + 8). So acceleration fails. -+ */ -+ s = rcu_seq_snap(&ssp->srcu_gp_seq); - rcu_segcblist_advance(&sdp->srcu_cblist, - rcu_seq_current(&ssp->srcu_gp_seq)); -- s = rcu_seq_snap(&ssp->srcu_gp_seq); -- (void)rcu_segcblist_accelerate(&sdp->srcu_cblist, s); -+ WARN_ON_ONCE(!rcu_segcblist_accelerate(&sdp->srcu_cblist, s) && rhp); - if (ULONG_CMP_LT(sdp->srcu_gp_seq_needed, s)) { - sdp->srcu_gp_seq_needed = s; - needgp = true; -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 06d52525407b8..71cad4f1323c6 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -646,8 +646,8 @@ static inline bool __rb_time_read(rb_time_t *t, u64 *ret, unsigned long *cnt) - - *cnt = rb_time_cnt(top); - -- /* If top and msb counts don't match, this interrupted a write */ -- if (*cnt != rb_time_cnt(msb)) -+ /* If top, msb or bottom counts don't match, this interrupted a write */ -+ if (*cnt != rb_time_cnt(msb) || *cnt != rb_time_cnt(bottom)) - return false; - - /* The shift to msb will lose its cnt bits */ -diff --git a/lib/Makefile b/lib/Makefile -index 5ffe72ec99797..6f1611d053e6a 100644 ---- a/lib/Makefile -+++ b/lib/Makefile -@@ -361,6 +361,8 @@ obj-$(CONFIG_SBITMAP) += sbitmap.o - - obj-$(CONFIG_PARMAN) += parman.o - -+obj-y += group_cpus.o -+ - # GCC library routines - obj-$(CONFIG_GENERIC_LIB_ASHLDI3) += ashldi3.o - obj-$(CONFIG_GENERIC_LIB_ASHRDI3) += ashrdi3.o -diff --git a/lib/group_cpus.c b/lib/group_cpus.c -new file mode 100644 -index 0000000000000..0292611901b8b ---- /dev/null -+++ b/lib/group_cpus.c -@@ -0,0 +1,438 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* -+ * Copyright (C) 2016 Thomas Gleixner. -+ * Copyright (C) 2016-2017 Christoph Hellwig. -+ */ -+#include -+#include -+#include -+#include -+#include -+ -+#ifdef CONFIG_SMP -+ -+static void grp_spread_init_one(struct cpumask *irqmsk, struct cpumask *nmsk, -+ unsigned int cpus_per_grp) -+{ -+ const struct cpumask *siblmsk; -+ int cpu, sibl; -+ -+ for ( ; cpus_per_grp > 0; ) { -+ cpu = cpumask_first(nmsk); -+ -+ /* Should not happen, but I'm too lazy to think about it */ -+ if (cpu >= nr_cpu_ids) -+ return; -+ -+ cpumask_clear_cpu(cpu, nmsk); -+ cpumask_set_cpu(cpu, irqmsk); -+ cpus_per_grp--; -+ -+ /* If the cpu has siblings, use them first */ -+ siblmsk = topology_sibling_cpumask(cpu); -+ for (sibl = -1; cpus_per_grp > 0; ) { -+ sibl = cpumask_next(sibl, siblmsk); -+ if (sibl >= nr_cpu_ids) -+ break; -+ if (!cpumask_test_and_clear_cpu(sibl, nmsk)) -+ continue; -+ cpumask_set_cpu(sibl, irqmsk); -+ cpus_per_grp--; -+ } -+ } -+} -+ -+static cpumask_var_t *alloc_node_to_cpumask(void) -+{ -+ cpumask_var_t *masks; -+ int node; -+ -+ masks = kcalloc(nr_node_ids, sizeof(cpumask_var_t), GFP_KERNEL); -+ if (!masks) -+ return NULL; -+ -+ for (node = 0; node < nr_node_ids; node++) { -+ if (!zalloc_cpumask_var(&masks[node], GFP_KERNEL)) -+ goto out_unwind; -+ } -+ -+ return masks; -+ -+out_unwind: -+ while (--node >= 0) -+ free_cpumask_var(masks[node]); -+ kfree(masks); -+ return NULL; -+} -+ -+static void free_node_to_cpumask(cpumask_var_t *masks) -+{ -+ int node; -+ -+ for (node = 0; node < nr_node_ids; node++) -+ free_cpumask_var(masks[node]); -+ kfree(masks); -+} -+ -+static void build_node_to_cpumask(cpumask_var_t *masks) -+{ -+ int cpu; -+ -+ for_each_possible_cpu(cpu) -+ cpumask_set_cpu(cpu, masks[cpu_to_node(cpu)]); -+} -+ -+static int get_nodes_in_cpumask(cpumask_var_t *node_to_cpumask, -+ const struct cpumask *mask, nodemask_t *nodemsk) -+{ -+ int n, nodes = 0; -+ -+ /* Calculate the number of nodes in the supplied affinity mask */ -+ for_each_node(n) { -+ if (cpumask_intersects(mask, node_to_cpumask[n])) { -+ node_set(n, *nodemsk); -+ nodes++; -+ } -+ } -+ return nodes; -+} -+ -+struct node_groups { -+ unsigned id; -+ -+ union { -+ unsigned ngroups; -+ unsigned ncpus; -+ }; -+}; -+ -+static int ncpus_cmp_func(const void *l, const void *r) -+{ -+ const struct node_groups *ln = l; -+ const struct node_groups *rn = r; -+ -+ return ln->ncpus - rn->ncpus; -+} -+ -+/* -+ * Allocate group number for each node, so that for each node: -+ * -+ * 1) the allocated number is >= 1 -+ * -+ * 2) the allocated number is <= active CPU number of this node -+ * -+ * The actual allocated total groups may be less than @numgrps when -+ * active total CPU number is less than @numgrps. -+ * -+ * Active CPUs means the CPUs in '@cpu_mask AND @node_to_cpumask[]' -+ * for each node. -+ */ -+static void alloc_nodes_groups(unsigned int numgrps, -+ cpumask_var_t *node_to_cpumask, -+ const struct cpumask *cpu_mask, -+ const nodemask_t nodemsk, -+ struct cpumask *nmsk, -+ struct node_groups *node_groups) -+{ -+ unsigned n, remaining_ncpus = 0; -+ -+ for (n = 0; n < nr_node_ids; n++) { -+ node_groups[n].id = n; -+ node_groups[n].ncpus = UINT_MAX; -+ } -+ -+ for_each_node_mask(n, nodemsk) { -+ unsigned ncpus; -+ -+ cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); -+ ncpus = cpumask_weight(nmsk); -+ -+ if (!ncpus) -+ continue; -+ remaining_ncpus += ncpus; -+ node_groups[n].ncpus = ncpus; -+ } -+ -+ numgrps = min_t(unsigned, remaining_ncpus, numgrps); -+ -+ sort(node_groups, nr_node_ids, sizeof(node_groups[0]), -+ ncpus_cmp_func, NULL); -+ -+ /* -+ * Allocate groups for each node according to the ratio of this -+ * node's nr_cpus to remaining un-assigned ncpus. 'numgrps' is -+ * bigger than number of active numa nodes. Always start the -+ * allocation from the node with minimized nr_cpus. -+ * -+ * This way guarantees that each active node gets allocated at -+ * least one group, and the theory is simple: over-allocation -+ * is only done when this node is assigned by one group, so -+ * other nodes will be allocated >= 1 groups, since 'numgrps' is -+ * bigger than number of numa nodes. -+ * -+ * One perfect invariant is that number of allocated groups for -+ * each node is <= CPU count of this node: -+ * -+ * 1) suppose there are two nodes: A and B -+ * ncpu(X) is CPU count of node X -+ * grps(X) is the group count allocated to node X via this -+ * algorithm -+ * -+ * ncpu(A) <= ncpu(B) -+ * ncpu(A) + ncpu(B) = N -+ * grps(A) + grps(B) = G -+ * -+ * grps(A) = max(1, round_down(G * ncpu(A) / N)) -+ * grps(B) = G - grps(A) -+ * -+ * both N and G are integer, and 2 <= G <= N, suppose -+ * G = N - delta, and 0 <= delta <= N - 2 -+ * -+ * 2) obviously grps(A) <= ncpu(A) because: -+ * -+ * if grps(A) is 1, then grps(A) <= ncpu(A) given -+ * ncpu(A) >= 1 -+ * -+ * otherwise, -+ * grps(A) <= G * ncpu(A) / N <= ncpu(A), given G <= N -+ * -+ * 3) prove how grps(B) <= ncpu(B): -+ * -+ * if round_down(G * ncpu(A) / N) == 0, vecs(B) won't be -+ * over-allocated, so grps(B) <= ncpu(B), -+ * -+ * otherwise: -+ * -+ * grps(A) = -+ * round_down(G * ncpu(A) / N) = -+ * round_down((N - delta) * ncpu(A) / N) = -+ * round_down((N * ncpu(A) - delta * ncpu(A)) / N) >= -+ * round_down((N * ncpu(A) - delta * N) / N) = -+ * cpu(A) - delta -+ * -+ * then: -+ * -+ * grps(A) - G >= ncpu(A) - delta - G -+ * => -+ * G - grps(A) <= G + delta - ncpu(A) -+ * => -+ * grps(B) <= N - ncpu(A) -+ * => -+ * grps(B) <= cpu(B) -+ * -+ * For nodes >= 3, it can be thought as one node and another big -+ * node given that is exactly what this algorithm is implemented, -+ * and we always re-calculate 'remaining_ncpus' & 'numgrps', and -+ * finally for each node X: grps(X) <= ncpu(X). -+ * -+ */ -+ for (n = 0; n < nr_node_ids; n++) { -+ unsigned ngroups, ncpus; -+ -+ if (node_groups[n].ncpus == UINT_MAX) -+ continue; -+ -+ WARN_ON_ONCE(numgrps == 0); -+ -+ ncpus = node_groups[n].ncpus; -+ ngroups = max_t(unsigned, 1, -+ numgrps * ncpus / remaining_ncpus); -+ WARN_ON_ONCE(ngroups > ncpus); -+ -+ node_groups[n].ngroups = ngroups; -+ -+ remaining_ncpus -= ncpus; -+ numgrps -= ngroups; -+ } -+} -+ -+static int __group_cpus_evenly(unsigned int startgrp, unsigned int numgrps, -+ cpumask_var_t *node_to_cpumask, -+ const struct cpumask *cpu_mask, -+ struct cpumask *nmsk, struct cpumask *masks) -+{ -+ unsigned int i, n, nodes, cpus_per_grp, extra_grps, done = 0; -+ unsigned int last_grp = numgrps; -+ unsigned int curgrp = startgrp; -+ nodemask_t nodemsk = NODE_MASK_NONE; -+ struct node_groups *node_groups; -+ -+ if (cpumask_empty(cpu_mask)) -+ return 0; -+ -+ nodes = get_nodes_in_cpumask(node_to_cpumask, cpu_mask, &nodemsk); -+ -+ /* -+ * If the number of nodes in the mask is greater than or equal the -+ * number of groups we just spread the groups across the nodes. -+ */ -+ if (numgrps <= nodes) { -+ for_each_node_mask(n, nodemsk) { -+ /* Ensure that only CPUs which are in both masks are set */ -+ cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); -+ cpumask_or(&masks[curgrp], &masks[curgrp], nmsk); -+ if (++curgrp == last_grp) -+ curgrp = 0; -+ } -+ return numgrps; -+ } -+ -+ node_groups = kcalloc(nr_node_ids, -+ sizeof(struct node_groups), -+ GFP_KERNEL); -+ if (!node_groups) -+ return -ENOMEM; -+ -+ /* allocate group number for each node */ -+ alloc_nodes_groups(numgrps, node_to_cpumask, cpu_mask, -+ nodemsk, nmsk, node_groups); -+ for (i = 0; i < nr_node_ids; i++) { -+ unsigned int ncpus, v; -+ struct node_groups *nv = &node_groups[i]; -+ -+ if (nv->ngroups == UINT_MAX) -+ continue; -+ -+ /* Get the cpus on this node which are in the mask */ -+ cpumask_and(nmsk, cpu_mask, node_to_cpumask[nv->id]); -+ ncpus = cpumask_weight(nmsk); -+ if (!ncpus) -+ continue; -+ -+ WARN_ON_ONCE(nv->ngroups > ncpus); -+ -+ /* Account for rounding errors */ -+ extra_grps = ncpus - nv->ngroups * (ncpus / nv->ngroups); -+ -+ /* Spread allocated groups on CPUs of the current node */ -+ for (v = 0; v < nv->ngroups; v++, curgrp++) { -+ cpus_per_grp = ncpus / nv->ngroups; -+ -+ /* Account for extra groups to compensate rounding errors */ -+ if (extra_grps) { -+ cpus_per_grp++; -+ --extra_grps; -+ } -+ -+ /* -+ * wrapping has to be considered given 'startgrp' -+ * may start anywhere -+ */ -+ if (curgrp >= last_grp) -+ curgrp = 0; -+ grp_spread_init_one(&masks[curgrp], nmsk, -+ cpus_per_grp); -+ } -+ done += nv->ngroups; -+ } -+ kfree(node_groups); -+ return done; -+} -+ -+/** -+ * group_cpus_evenly - Group all CPUs evenly per NUMA/CPU locality -+ * @numgrps: number of groups -+ * -+ * Return: cpumask array if successful, NULL otherwise. And each element -+ * includes CPUs assigned to this group -+ * -+ * Try to put close CPUs from viewpoint of CPU and NUMA locality into -+ * same group, and run two-stage grouping: -+ * 1) allocate present CPUs on these groups evenly first -+ * 2) allocate other possible CPUs on these groups evenly -+ * -+ * We guarantee in the resulted grouping that all CPUs are covered, and -+ * no same CPU is assigned to multiple groups -+ */ -+struct cpumask *group_cpus_evenly(unsigned int numgrps) -+{ -+ unsigned int curgrp = 0, nr_present = 0, nr_others = 0; -+ cpumask_var_t *node_to_cpumask; -+ cpumask_var_t nmsk, npresmsk; -+ int ret = -ENOMEM; -+ struct cpumask *masks = NULL; -+ -+ if (!zalloc_cpumask_var(&nmsk, GFP_KERNEL)) -+ return NULL; -+ -+ if (!zalloc_cpumask_var(&npresmsk, GFP_KERNEL)) -+ goto fail_nmsk; -+ -+ node_to_cpumask = alloc_node_to_cpumask(); -+ if (!node_to_cpumask) -+ goto fail_npresmsk; -+ -+ masks = kcalloc(numgrps, sizeof(*masks), GFP_KERNEL); -+ if (!masks) -+ goto fail_node_to_cpumask; -+ -+ build_node_to_cpumask(node_to_cpumask); -+ -+ /* -+ * Make a local cache of 'cpu_present_mask', so the two stages -+ * spread can observe consistent 'cpu_present_mask' without holding -+ * cpu hotplug lock, then we can reduce deadlock risk with cpu -+ * hotplug code. -+ * -+ * Here CPU hotplug may happen when reading `cpu_present_mask`, and -+ * we can live with the case because it only affects that hotplug -+ * CPU is handled in the 1st or 2nd stage, and either way is correct -+ * from API user viewpoint since 2-stage spread is sort of -+ * optimization. -+ */ -+ cpumask_copy(npresmsk, data_race(cpu_present_mask)); -+ -+ /* grouping present CPUs first */ -+ ret = __group_cpus_evenly(curgrp, numgrps, node_to_cpumask, -+ npresmsk, nmsk, masks); -+ if (ret < 0) -+ goto fail_build_affinity; -+ nr_present = ret; -+ -+ /* -+ * Allocate non present CPUs starting from the next group to be -+ * handled. If the grouping of present CPUs already exhausted the -+ * group space, assign the non present CPUs to the already -+ * allocated out groups. -+ */ -+ if (nr_present >= numgrps) -+ curgrp = 0; -+ else -+ curgrp = nr_present; -+ cpumask_andnot(npresmsk, cpu_possible_mask, npresmsk); -+ ret = __group_cpus_evenly(curgrp, numgrps, node_to_cpumask, -+ npresmsk, nmsk, masks); -+ if (ret >= 0) -+ nr_others = ret; -+ -+ fail_build_affinity: -+ if (ret >= 0) -+ WARN_ON(nr_present + nr_others < numgrps); -+ -+ fail_node_to_cpumask: -+ free_node_to_cpumask(node_to_cpumask); -+ -+ fail_npresmsk: -+ free_cpumask_var(npresmsk); -+ -+ fail_nmsk: -+ free_cpumask_var(nmsk); -+ if (ret < 0) { -+ kfree(masks); -+ return NULL; -+ } -+ return masks; -+} -+#else /* CONFIG_SMP */ -+struct cpumask *group_cpus_evenly(unsigned int numgrps) -+{ -+ struct cpumask *masks = kcalloc(numgrps, sizeof(*masks), GFP_KERNEL); -+ -+ if (!masks) -+ return NULL; -+ -+ /* assign all CPUs(cpu 0) to the 1st group only */ -+ cpumask_copy(&masks[0], cpu_possible_mask); -+ return masks; -+} -+#endif /* CONFIG_SMP */ -diff --git a/mm/filemap.c b/mm/filemap.c -index 10fe6430693bd..2809b1174f04e 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -4005,6 +4005,8 @@ bool filemap_release_folio(struct folio *folio, gfp_t gfp) - struct address_space * const mapping = folio->mapping; - - BUG_ON(!folio_test_locked(folio)); -+ if (!folio_needs_release(folio)) -+ return true; - if (folio_test_writeback(folio)) - return false; - -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 2753fb54cdf38..59577946735b1 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -2694,8 +2694,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) - gfp = current_gfp_context(mapping_gfp_mask(mapping) & - GFP_RECLAIM_MASK); - -- if (folio_test_private(folio) && -- !filemap_release_folio(folio, gfp)) { -+ if (!filemap_release_folio(folio, gfp)) { - ret = -EBUSY; - goto out; - } -diff --git a/mm/internal.h b/mm/internal.h -index 6b7ef495b56d3..d01130efce5fb 100644 ---- a/mm/internal.h -+++ b/mm/internal.h -@@ -163,6 +163,17 @@ static inline void set_page_refcounted(struct page *page) - set_page_count(page, 1); - } - -+/* -+ * Return true if a folio needs ->release_folio() calling upon it. -+ */ -+static inline bool folio_needs_release(struct folio *folio) -+{ -+ struct address_space *mapping = folio_mapping(folio); -+ -+ return folio_has_private(folio) || -+ (mapping && mapping_release_always(mapping)); -+} -+ - extern unsigned long highest_memmap_pfn; - - /* -diff --git a/mm/khugepaged.c b/mm/khugepaged.c -index ef72d3df4b65b..65bd0b105266a 100644 ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -1818,6 +1818,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, - xas_set(&xas, start); - for (index = start; index < end; index++) { - struct page *page = xas_next(&xas); -+ struct folio *folio; - - VM_BUG_ON(index != xas.xa_index); - if (is_shmem) { -@@ -1844,8 +1845,6 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, - } - - if (xa_is_value(page) || !PageUptodate(page)) { -- struct folio *folio; -- - xas_unlock_irq(&xas); - /* swap in or instantiate fallocated page */ - if (shmem_get_folio(mapping->host, index, -@@ -1933,13 +1932,15 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, - goto out_unlock; - } - -- if (page_mapping(page) != mapping) { -+ folio = page_folio(page); -+ -+ if (folio_mapping(folio) != mapping) { - result = SCAN_TRUNCATED; - goto out_unlock; - } - -- if (!is_shmem && (PageDirty(page) || -- PageWriteback(page))) { -+ if (!is_shmem && (folio_test_dirty(folio) || -+ folio_test_writeback(folio))) { - /* - * khugepaged only works on read-only fd, so this - * page is dirty because it hasn't been flushed -@@ -1949,20 +1950,19 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, - goto out_unlock; - } - -- if (isolate_lru_page(page)) { -+ if (folio_isolate_lru(folio)) { - result = SCAN_DEL_PAGE_LRU; - goto out_unlock; - } - -- if (page_has_private(page) && -- !try_to_release_page(page, GFP_KERNEL)) { -+ if (!filemap_release_folio(folio, GFP_KERNEL)) { - result = SCAN_PAGE_HAS_PRIVATE; -- putback_lru_page(page); -+ folio_putback_lru(folio); - goto out_unlock; - } - -- if (page_mapped(page)) -- try_to_unmap(page_folio(page), -+ if (folio_mapped(folio)) -+ try_to_unmap(folio, - TTU_IGNORE_MLOCK | TTU_BATCH_FLUSH); - - xas_lock_irq(&xas); -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index ebd717157c813..5b846ed5dcbe9 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -827,16 +827,15 @@ static int truncate_error_page(struct page *p, unsigned long pfn, - int ret = MF_FAILED; - - if (mapping->a_ops->error_remove_page) { -+ struct folio *folio = page_folio(p); - int err = mapping->a_ops->error_remove_page(mapping, p); - -- if (err != 0) { -+ if (err != 0) - pr_info("%#lx: Failed to punch page: %d\n", pfn, err); -- } else if (page_has_private(p) && -- !try_to_release_page(p, GFP_NOIO)) { -+ else if (!filemap_release_folio(folio, GFP_NOIO)) - pr_info("%#lx: failed to release buffers\n", pfn); -- } else { -+ else - ret = MF_RECOVERED; -- } - } else { - /* - * If the file system doesn't support it just invalidate -diff --git a/mm/memory.c b/mm/memory.c -index 0d1b3ee8fcd7a..fc8b264ec0cac 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3617,8 +3617,8 @@ EXPORT_SYMBOL_GPL(unmap_mapping_pages); - void unmap_mapping_range(struct address_space *mapping, - loff_t const holebegin, loff_t const holelen, int even_cows) - { -- pgoff_t hba = holebegin >> PAGE_SHIFT; -- pgoff_t hlen = (holelen + PAGE_SIZE - 1) >> PAGE_SHIFT; -+ pgoff_t hba = (pgoff_t)(holebegin) >> PAGE_SHIFT; -+ pgoff_t hlen = ((pgoff_t)(holelen) + PAGE_SIZE - 1) >> PAGE_SHIFT; - - /* Check for overflow. */ - if (sizeof(holelen) > sizeof(hlen)) { -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index bd2570b4f9b7b..3b9d3a4b43869 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1069,6 +1069,9 @@ void mhp_deinit_memmap_on_memory(unsigned long pfn, unsigned long nr_pages) - kasan_remove_zero_shadow(__va(PFN_PHYS(pfn)), PFN_PHYS(nr_pages)); - } - -+/* -+ * Must be called with mem_hotplug_lock in write mode. -+ */ - int __ref online_pages(unsigned long pfn, unsigned long nr_pages, - struct zone *zone, struct memory_group *group) - { -@@ -1089,7 +1092,6 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, - !IS_ALIGNED(pfn + nr_pages, PAGES_PER_SECTION))) - return -EINVAL; - -- mem_hotplug_begin(); - - /* associate pfn range with the zone */ - move_pfn_range_to_zone(zone, pfn, nr_pages, NULL, MIGRATE_ISOLATE); -@@ -1148,7 +1150,6 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, - writeback_set_ratelimit(); - - memory_notify(MEM_ONLINE, &arg); -- mem_hotplug_done(); - return 0; - - failed_addition: -@@ -1157,7 +1158,6 @@ failed_addition: - (((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1); - memory_notify(MEM_CANCEL_ONLINE, &arg); - remove_pfn_range_from_zone(zone, pfn, nr_pages); -- mem_hotplug_done(); - return ret; - } - -@@ -1382,7 +1382,7 @@ int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags) - ret = create_memory_block_devices(start, size, mhp_altmap.alloc, - group); - if (ret) { -- arch_remove_memory(start, size, NULL); -+ arch_remove_memory(start, size, params.altmap); - goto error; - } - -@@ -1787,6 +1787,9 @@ static int count_system_ram_pages_cb(unsigned long start_pfn, - return 0; - } - -+/* -+ * Must be called with mem_hotplug_lock in write mode. -+ */ - int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages, - struct zone *zone, struct memory_group *group) - { -@@ -1809,8 +1812,6 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages, - !IS_ALIGNED(start_pfn + nr_pages, PAGES_PER_SECTION))) - return -EINVAL; - -- mem_hotplug_begin(); -- - /* - * Don't allow to offline memory blocks that contain holes. - * Consequently, memory blocks with holes can never get onlined -@@ -1946,7 +1947,6 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages, - - memory_notify(MEM_OFFLINE, &arg); - remove_pfn_range_from_zone(zone, start_pfn, nr_pages); -- mem_hotplug_done(); - return 0; - - failed_removal_isolated: -@@ -1961,7 +1961,6 @@ failed_removal: - (unsigned long long) start_pfn << PAGE_SHIFT, - ((unsigned long long) end_pfn << PAGE_SHIFT) - 1, - reason); -- mem_hotplug_done(); - return ret; - } - -diff --git a/mm/migrate.c b/mm/migrate.c -index 91bd69c61148e..c93dd6a31c31a 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -914,8 +914,7 @@ static int fallback_migrate_folio(struct address_space *mapping, - * Buffers may be managed in a filesystem specific way. - * We must have no buffers or drop them. - */ -- if (folio_test_private(src) && -- !filemap_release_folio(src, GFP_KERNEL)) -+ if (!filemap_release_folio(src, GFP_KERNEL)) - return mode == MIGRATE_SYNC ? -EAGAIN : -EBUSY; - - return migrate_folio(mapping, dst, src, mode); -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 7e9d8d857ecca..de5f69921b946 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -3078,7 +3078,7 @@ EXPORT_SYMBOL_GPL(folio_wait_writeback_killable); - */ - void folio_wait_stable(struct folio *folio) - { -- if (folio_inode(folio)->i_sb->s_iflags & SB_I_STABLE_WRITES) -+ if (mapping_stable_writes(folio_mapping(folio))) - folio_wait_writeback(folio); - } - EXPORT_SYMBOL_GPL(folio_wait_stable); -diff --git a/mm/truncate.c b/mm/truncate.c -index c0be77e5c0083..0d4dd233f5187 100644 ---- a/mm/truncate.c -+++ b/mm/truncate.c -@@ -19,7 +19,6 @@ - #include - #include - #include --#include /* grr. try_to_release_page */ - #include - #include - #include "internal.h" -@@ -276,7 +275,7 @@ static long mapping_evict_folio(struct address_space *mapping, - if (folio_ref_count(folio) > - folio_nr_pages(folio) + folio_has_private(folio) + 1) - return 0; -- if (folio_has_private(folio) && !filemap_release_folio(folio, 0)) -+ if (!filemap_release_folio(folio, 0)) - return 0; - - return remove_mapping(mapping, folio); -@@ -581,8 +580,7 @@ static int invalidate_complete_folio2(struct address_space *mapping, - if (folio->mapping != mapping) - return 0; - -- if (folio_has_private(folio) && -- !filemap_release_folio(folio, GFP_KERNEL)) -+ if (!filemap_release_folio(folio, GFP_KERNEL)) - return 0; - - spin_lock(&mapping->host->i_lock); -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 3f090faa6377f..9f3cfb7caa48d 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -1992,7 +1992,7 @@ retry: - * (refcount == 1) it can be freed. Otherwise, leave - * the folio on the LRU so it is swappable. - */ -- if (folio_has_private(folio)) { -+ if (folio_needs_release(folio)) { - if (!filemap_release_folio(folio, sc->gfp_mask)) - goto activate_locked; - if (!mapping && folio_ref_count(folio) == 1) { -@@ -2618,9 +2618,9 @@ static void shrink_active_list(unsigned long nr_to_scan, - } - - if (unlikely(buffer_heads_over_limit)) { -- if (folio_test_private(folio) && folio_trylock(folio)) { -- if (folio_test_private(folio)) -- filemap_release_folio(folio, 0); -+ if (folio_needs_release(folio) && -+ folio_trylock(folio)) { -+ filemap_release_folio(folio, 0); - folio_unlock(folio); - } - } -diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c -index 9c828067b4481..b0be23559243c 100644 ---- a/net/can/j1939/socket.c -+++ b/net/can/j1939/socket.c -@@ -974,6 +974,7 @@ static void __j1939_sk_errqueue(struct j1939_session *session, struct sock *sk, - struct sock_exterr_skb *serr; - struct sk_buff *skb; - char *state = "UNK"; -+ u32 tsflags; - int err; - - jsk = j1939_sk(sk); -@@ -981,13 +982,14 @@ static void __j1939_sk_errqueue(struct j1939_session *session, struct sock *sk, - if (!(jsk->state & J1939_SOCK_ERRQUEUE)) - return; - -+ tsflags = READ_ONCE(sk->sk_tsflags); - switch (type) { - case J1939_ERRQUEUE_TX_ACK: -- if (!(sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)) -+ if (!(tsflags & SOF_TIMESTAMPING_TX_ACK)) - return; - break; - case J1939_ERRQUEUE_TX_SCHED: -- if (!(sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)) -+ if (!(tsflags & SOF_TIMESTAMPING_TX_SCHED)) - return; - break; - case J1939_ERRQUEUE_TX_ABORT: -@@ -997,7 +999,7 @@ static void __j1939_sk_errqueue(struct j1939_session *session, struct sock *sk, - case J1939_ERRQUEUE_RX_DPO: - fallthrough; - case J1939_ERRQUEUE_RX_ABORT: -- if (!(sk->sk_tsflags & SOF_TIMESTAMPING_RX_SOFTWARE)) -+ if (!(tsflags & SOF_TIMESTAMPING_RX_SOFTWARE)) - return; - break; - default: -@@ -1054,7 +1056,7 @@ static void __j1939_sk_errqueue(struct j1939_session *session, struct sock *sk, - } - - serr->opt_stats = true; -- if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) -+ if (tsflags & SOF_TIMESTAMPING_OPT_ID) - serr->ee.ee_data = session->tskey; - - netdev_dbg(session->priv->ndev, "%s: 0x%p tskey: %i, state: %s\n", -diff --git a/net/can/raw.c b/net/can/raw.c -index 8c104339d538d..488320738e319 100644 ---- a/net/can/raw.c -+++ b/net/can/raw.c -@@ -881,6 +881,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) - - skb->dev = dev; - skb->priority = sk->sk_priority; -+ skb->mark = sk->sk_mark; - skb->tstamp = sockc.transmit_time; - - skb_setup_tx_timestamp(skb, sockc.tsflags); -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 73b1e0e53534e..8a819d0a7bfb0 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -4913,7 +4913,7 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb, - serr->ee.ee_info = tstype; - serr->opt_stats = opt_stats; - serr->header.h4.iif = skb->dev ? skb->dev->ifindex : 0; -- if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) { -+ if (READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_OPT_ID) { - serr->ee.ee_data = skb_shinfo(skb)->tskey; - if (sk_is_tcp(sk)) - serr->ee.ee_data -= atomic_read(&sk->sk_tskey); -@@ -4969,21 +4969,23 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb, - { - struct sk_buff *skb; - bool tsonly, opt_stats = false; -+ u32 tsflags; - - if (!sk) - return; - -- if (!hwtstamps && !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TX_SWHW) && -+ tsflags = READ_ONCE(sk->sk_tsflags); -+ if (!hwtstamps && !(tsflags & SOF_TIMESTAMPING_OPT_TX_SWHW) && - skb_shinfo(orig_skb)->tx_flags & SKBTX_IN_PROGRESS) - return; - -- tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY; -+ tsonly = tsflags & SOF_TIMESTAMPING_OPT_TSONLY; - if (!skb_may_tx_timestamp(sk, tsonly)) - return; - - if (tsonly) { - #ifdef CONFIG_INET -- if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS) && -+ if ((tsflags & SOF_TIMESTAMPING_OPT_STATS) && - sk_is_tcp(sk)) { - skb = tcp_get_timestamping_opt_stats(sk, orig_skb, - ack_skb); -diff --git a/net/core/skmsg.c b/net/core/skmsg.c -index a5c1f67dc96ec..3818035ea0021 100644 ---- a/net/core/skmsg.c -+++ b/net/core/skmsg.c -@@ -825,6 +825,8 @@ static void sk_psock_destroy(struct work_struct *work) - - if (psock->sk_redir) - sock_put(psock->sk_redir); -+ if (psock->sk_pair) -+ sock_put(psock->sk_pair); - sock_put(psock->sk); - kfree(psock); - } -diff --git a/net/core/sock.c b/net/core/sock.c -index 4305e55dbfba4..c50a14a02edd4 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -890,7 +890,7 @@ static int sock_timestamping_bind_phc(struct sock *sk, int phc_index) - if (!match) - return -EINVAL; - -- sk->sk_bind_phc = phc_index; -+ WRITE_ONCE(sk->sk_bind_phc, phc_index); - - return 0; - } -@@ -926,7 +926,7 @@ int sock_set_timestamping(struct sock *sk, int optname, - return ret; - } - -- sk->sk_tsflags = val; -+ WRITE_ONCE(sk->sk_tsflags, val); - sock_valbool_flag(sk, SOCK_TSTAMP_NEW, optname == SO_TIMESTAMPING_NEW); - - if (val & SOF_TIMESTAMPING_RX_SOFTWARE) -@@ -1704,9 +1704,16 @@ int sk_getsockopt(struct sock *sk, int level, int optname, - break; - - case SO_TIMESTAMPING_OLD: -+ case SO_TIMESTAMPING_NEW: - lv = sizeof(v.timestamping); -- v.timestamping.flags = sk->sk_tsflags; -- v.timestamping.bind_phc = sk->sk_bind_phc; -+ /* For the later-added case SO_TIMESTAMPING_NEW: Be strict about only -+ * returning the flags when they were set through the same option. -+ * Don't change the beviour for the old case SO_TIMESTAMPING_OLD. -+ */ -+ if (optname == SO_TIMESTAMPING_OLD || sock_flag(sk, SOCK_TSTAMP_NEW)) { -+ v.timestamping.flags = READ_ONCE(sk->sk_tsflags); -+ v.timestamping.bind_phc = READ_ONCE(sk->sk_bind_phc); -+ } - break; - - case SO_RCVTIMEO_OLD: -@@ -2764,6 +2771,7 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg, - sockc->mark = *(u32 *)CMSG_DATA(cmsg); - break; - case SO_TIMESTAMPING_OLD: -+ case SO_TIMESTAMPING_NEW: - if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32))) - return -EINVAL; - -diff --git a/net/core/sock_map.c b/net/core/sock_map.c -index 38e01f82f2ef3..91140bc0541f3 100644 ---- a/net/core/sock_map.c -+++ b/net/core/sock_map.c -@@ -538,6 +538,8 @@ static bool sock_map_sk_state_allowed(const struct sock *sk) - { - if (sk_is_tcp(sk)) - return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN); -+ if (sk_is_stream_unix(sk)) -+ return (1 << sk->sk_state) & TCPF_ESTABLISHED; - return true; - } - -diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c -index 03f8f33dc134c..8324e9f970668 100644 ---- a/net/dns_resolver/dns_key.c -+++ b/net/dns_resolver/dns_key.c -@@ -91,8 +91,6 @@ const struct cred *dns_resolver_cache; - static int - dns_resolver_preparse(struct key_preparsed_payload *prep) - { -- const struct dns_server_list_v1_header *v1; -- const struct dns_payload_header *bin; - struct user_key_payload *upayload; - unsigned long derrno; - int ret; -@@ -103,27 +101,28 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) - return -EINVAL; - - if (data[0] == 0) { -+ const struct dns_server_list_v1_header *v1; -+ - /* It may be a server list. */ -- if (datalen <= sizeof(*bin)) -+ if (datalen <= sizeof(*v1)) - return -EINVAL; - -- bin = (const struct dns_payload_header *)data; -- kenter("[%u,%u],%u", bin->content, bin->version, datalen); -- if (bin->content != DNS_PAYLOAD_IS_SERVER_LIST) { -+ v1 = (const struct dns_server_list_v1_header *)data; -+ kenter("[%u,%u],%u", v1->hdr.content, v1->hdr.version, datalen); -+ if (v1->hdr.content != DNS_PAYLOAD_IS_SERVER_LIST) { - pr_warn_ratelimited( - "dns_resolver: Unsupported content type (%u)\n", -- bin->content); -+ v1->hdr.content); - return -EINVAL; - } - -- if (bin->version != 1) { -+ if (v1->hdr.version != 1) { - pr_warn_ratelimited( - "dns_resolver: Unsupported server list version (%u)\n", -- bin->version); -+ v1->hdr.version); - return -EINVAL; - } - -- v1 = (const struct dns_server_list_v1_header *)bin; - if ((v1->status != DNS_LOOKUP_GOOD && - v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) { - if (prep->expiry == TIME64_MAX) -diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c -index 1a4c11356c96c..fc4ccecf9495c 100644 ---- a/net/ethtool/netlink.c -+++ b/net/ethtool/netlink.c -@@ -509,7 +509,7 @@ lock_and_cont: - cont: - idx++; - } -- -+ ret = 0; - } - rtnl_unlock(); - -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 5d379df90c826..347c3768df6e8 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -838,6 +838,21 @@ int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) - } - EXPORT_SYMBOL(inet_sendmsg); - -+void inet_splice_eof(struct socket *sock) -+{ -+ const struct proto *prot; -+ struct sock *sk = sock->sk; -+ -+ if (unlikely(inet_send_prepare(sk))) -+ return; -+ -+ /* IPV6_ADDRFORM can change sk->sk_prot under us. */ -+ prot = READ_ONCE(sk->sk_prot); -+ if (prot->splice_eof) -+ prot->splice_eof(sock); -+} -+EXPORT_SYMBOL_GPL(inet_splice_eof); -+ - ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, - size_t size, int flags) - { -@@ -1057,6 +1072,7 @@ const struct proto_ops inet_stream_ops = { - #ifdef CONFIG_MMU - .mmap = tcp_mmap, - #endif -+ .splice_eof = inet_splice_eof, - .sendpage = inet_sendpage, - .splice_read = tcp_splice_read, - .read_sock = tcp_read_sock, -@@ -1091,6 +1107,7 @@ const struct proto_ops inet_dgram_ops = { - .read_skb = udp_read_skb, - .recvmsg = inet_recvmsg, - .mmap = sock_no_mmap, -+ .splice_eof = inet_splice_eof, - .sendpage = inet_sendpage, - .set_peek_off = sk_set_peek_off, - #ifdef CONFIG_COMPAT -@@ -1122,6 +1139,7 @@ static const struct proto_ops inet_sockraw_ops = { - .sendmsg = inet_sendmsg, - .recvmsg = inet_recvmsg, - .mmap = sock_no_mmap, -+ .splice_eof = inet_splice_eof, - .sendpage = inet_sendpage, - #ifdef CONFIG_COMPAT - .compat_ioctl = inet_compat_ioctl, -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 493c679ea54f3..e19ef88ae181f 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -990,8 +990,8 @@ static int __ip_append_data(struct sock *sk, - mtu = cork->gso_size ? IP_MAX_MTU : cork->fragsize; - paged = !!cork->gso_size; - -- if (cork->tx_flags & SKBTX_ANY_SW_TSTAMP && -- sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) -+ if (cork->tx_flags & SKBTX_ANY_TSTAMP && -+ READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_OPT_ID) - tskey = atomic_inc_return(&sk->sk_tskey) - 1; - - hh_len = LL_RESERVED_SPACE(rt->dst.dev); -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 63aa52becd880..c1fb7580ea581 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -509,7 +509,7 @@ static bool ipv4_datagram_support_cmsg(const struct sock *sk, - * or without payload (SOF_TIMESTAMPING_OPT_TSONLY). - */ - info = PKTINFO_SKB_CB(skb); -- if (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG) || -+ if (!(READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_OPT_CMSG) || - !info->ipi_ifindex) - return false; - -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 58409ea2da0af..0b7844a8d5711 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1492,6 +1492,22 @@ int tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) - } - EXPORT_SYMBOL(tcp_sendmsg); - -+void tcp_splice_eof(struct socket *sock) -+{ -+ struct sock *sk = sock->sk; -+ struct tcp_sock *tp = tcp_sk(sk); -+ int mss_now, size_goal; -+ -+ if (!tcp_write_queue_tail(sk)) -+ return; -+ -+ lock_sock(sk); -+ mss_now = tcp_send_mss(sk, &size_goal, 0); -+ tcp_push(sk, 0, mss_now, tp->nonagle, size_goal); -+ release_sock(sk); -+} -+EXPORT_SYMBOL_GPL(tcp_splice_eof); -+ - /* - * Handle reading urgent data. BSD has very simple semantics for - * this, no blocking and very strange errors 8) -@@ -2359,14 +2375,14 @@ void tcp_recv_timestamp(struct msghdr *msg, const struct sock *sk, - } - } - -- if (sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) -+ if (READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_SOFTWARE) - has_timestamping = true; - else - tss->ts[0] = (struct timespec64) {0}; - } - - if (tss->ts[2].tv_sec || tss->ts[2].tv_nsec) { -- if (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) -+ if (READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_RAW_HARDWARE) - has_timestamping = true; - else - tss->ts[2] = (struct timespec64) {0}; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 7ebbbe561e402..be2c807eed15d 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -3067,6 +3067,7 @@ struct proto tcp_prot = { - .keepalive = tcp_set_keepalive, - .recvmsg = tcp_recvmsg, - .sendmsg = tcp_sendmsg, -+ .splice_eof = tcp_splice_eof, - .sendpage = tcp_sendpage, - .backlog_rcv = tcp_v4_do_rcv, - .release_cb = tcp_release_cb, -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 65abc92a81bd0..5672d9a86c5d2 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -733,7 +733,7 @@ int __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable) - iph->saddr, uh->source, skb->dev->ifindex, - inet_sdif(skb), udptable, NULL); - -- if (!sk || udp_sk(sk)->encap_type) { -+ if (!sk || READ_ONCE(udp_sk(sk)->encap_type)) { - /* No socket for error: try tunnels before discarding */ - if (static_branch_unlikely(&udp_encap_needed_key)) { - sk = __udp4_lib_err_encap(net, iph, uh, udptable, sk, skb, -@@ -1068,7 +1068,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - __be16 dport; - u8 tos; - int err, is_udplite = IS_UDPLITE(sk); -- int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE; -+ int corkreq = udp_test_bit(CORK, sk) || msg->msg_flags & MSG_MORE; - int (*getfrag)(void *, char *, int, int, int, struct sk_buff *); - struct sk_buff *skb; - struct ip_options_data opt_copy; -@@ -1332,57 +1332,33 @@ do_confirm: - } - EXPORT_SYMBOL(udp_sendmsg); - --int udp_sendpage(struct sock *sk, struct page *page, int offset, -- size_t size, int flags) -+void udp_splice_eof(struct socket *sock) - { -- struct inet_sock *inet = inet_sk(sk); -+ struct sock *sk = sock->sk; - struct udp_sock *up = udp_sk(sk); -- int ret; - -- if (flags & MSG_SENDPAGE_NOTLAST) -- flags |= MSG_MORE; -- -- if (!up->pending) { -- struct msghdr msg = { .msg_flags = flags|MSG_MORE }; -- -- /* Call udp_sendmsg to specify destination address which -- * sendpage interface can't pass. -- * This will succeed only when the socket is connected. -- */ -- ret = udp_sendmsg(sk, &msg, 0); -- if (ret < 0) -- return ret; -- } -+ if (!up->pending || udp_test_bit(CORK, sk)) -+ return; - - lock_sock(sk); -+ if (up->pending && !udp_test_bit(CORK, sk)) -+ udp_push_pending_frames(sk); -+ release_sock(sk); -+} -+EXPORT_SYMBOL_GPL(udp_splice_eof); - -- if (unlikely(!up->pending)) { -- release_sock(sk); -- -- net_dbg_ratelimited("cork failed\n"); -- return -EINVAL; -- } -+int udp_sendpage(struct sock *sk, struct page *page, int offset, -+ size_t size, int flags) -+{ -+ struct bio_vec bvec; -+ struct msghdr msg = { .msg_flags = flags | MSG_SPLICE_PAGES }; - -- ret = ip_append_page(sk, &inet->cork.fl.u.ip4, -- page, offset, size, flags); -- if (ret == -EOPNOTSUPP) { -- release_sock(sk); -- return sock_no_sendpage(sk->sk_socket, page, offset, -- size, flags); -- } -- if (ret < 0) { -- udp_flush_pending_frames(sk); -- goto out; -- } -+ if (flags & MSG_SENDPAGE_NOTLAST) -+ msg.msg_flags |= MSG_MORE; - -- up->len += size; -- if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE))) -- ret = udp_push_pending_frames(sk); -- if (!ret) -- ret = size; --out: -- release_sock(sk); -- return ret; -+ bvec_set_page(&bvec, page, size, offset); -+ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size); -+ return udp_sendmsg(sk, &msg, size); - } - - #define UDP_SKB_IS_STATELESS 0x80000000 -@@ -1925,7 +1901,7 @@ try_again: - (struct sockaddr *)sin); - } - -- if (udp_sk(sk)->gro_enabled) -+ if (udp_test_bit(GRO_ENABLED, sk)) - udp_cmsg_recv(msg, sk, skb); - - if (inet->cmsg_flags) -@@ -2138,7 +2114,8 @@ static int udp_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) - } - nf_reset_ct(skb); - -- if (static_branch_unlikely(&udp_encap_needed_key) && up->encap_type) { -+ if (static_branch_unlikely(&udp_encap_needed_key) && -+ READ_ONCE(up->encap_type)) { - int (*encap_rcv)(struct sock *sk, struct sk_buff *skb); - - /* -@@ -2669,7 +2646,7 @@ void udp_destroy_sock(struct sock *sk) - if (encap_destroy) - encap_destroy(sk); - } -- if (up->encap_enabled) -+ if (udp_test_bit(ENCAP_ENABLED, sk)) - static_branch_dec(&udp_encap_needed_key); - } - } -@@ -2697,9 +2674,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, - switch (optname) { - case UDP_CORK: - if (val != 0) { -- WRITE_ONCE(up->corkflag, 1); -+ udp_set_bit(CORK, sk); - } else { -- WRITE_ONCE(up->corkflag, 0); -+ udp_clear_bit(CORK, sk); - lock_sock(sk); - push_pending_frames(sk); - release_sock(sk); -@@ -2723,10 +2700,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, - #endif - fallthrough; - case UDP_ENCAP_L2TPINUDP: -- up->encap_type = val; -- lock_sock(sk); -- udp_tunnel_encap_enable(sk->sk_socket); -- release_sock(sk); -+ WRITE_ONCE(up->encap_type, val); -+ udp_tunnel_encap_enable(sk); - break; - default: - err = -ENOPROTOOPT; -@@ -2735,11 +2710,11 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, - break; - - case UDP_NO_CHECK6_TX: -- up->no_check6_tx = valbool; -+ udp_set_no_check6_tx(sk, valbool); - break; - - case UDP_NO_CHECK6_RX: -- up->no_check6_rx = valbool; -+ udp_set_no_check6_rx(sk, valbool); - break; - - case UDP_SEGMENT: -@@ -2749,14 +2724,12 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, - break; - - case UDP_GRO: -- lock_sock(sk); - - /* when enabling GRO, accept the related GSO packet type */ - if (valbool) -- udp_tunnel_encap_enable(sk->sk_socket); -- up->gro_enabled = valbool; -- up->accept_udp_l4 = valbool; -- release_sock(sk); -+ udp_tunnel_encap_enable(sk); -+ udp_assign_bit(GRO_ENABLED, sk, valbool); -+ udp_assign_bit(ACCEPT_L4, sk, valbool); - break; - - /* -@@ -2824,19 +2797,19 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, - - switch (optname) { - case UDP_CORK: -- val = READ_ONCE(up->corkflag); -+ val = udp_test_bit(CORK, sk); - break; - - case UDP_ENCAP: -- val = up->encap_type; -+ val = READ_ONCE(up->encap_type); - break; - - case UDP_NO_CHECK6_TX: -- val = up->no_check6_tx; -+ val = udp_get_no_check6_tx(sk); - break; - - case UDP_NO_CHECK6_RX: -- val = up->no_check6_rx; -+ val = udp_get_no_check6_rx(sk); - break; - - case UDP_SEGMENT: -@@ -2844,7 +2817,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, - break; - - case UDP_GRO: -- val = up->gro_enabled; -+ val = udp_test_bit(GRO_ENABLED, sk); - break; - - /* The following two cannot be changed on UDP sockets, the return is -@@ -2946,6 +2919,7 @@ struct proto udp_prot = { - .getsockopt = udp_getsockopt, - .sendmsg = udp_sendmsg, - .recvmsg = udp_recvmsg, -+ .splice_eof = udp_splice_eof, - .sendpage = udp_sendpage, - .release_cb = ip4_datagram_release_cb, - .hash = udp_lib_hash, -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 6d1a4bec2614d..8096576fd9bde 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -549,10 +549,10 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb, - NAPI_GRO_CB(skb)->is_flist = 0; - if (!sk || !udp_sk(sk)->gro_receive) { - if (skb->dev->features & NETIF_F_GRO_FRAGLIST) -- NAPI_GRO_CB(skb)->is_flist = sk ? !udp_sk(sk)->gro_enabled : 1; -+ NAPI_GRO_CB(skb)->is_flist = sk ? !udp_test_bit(GRO_ENABLED, sk) : 1; - - if ((!sk && (skb->dev->features & NETIF_F_GRO_UDP_FWD)) || -- (sk && udp_sk(sk)->gro_enabled) || NAPI_GRO_CB(skb)->is_flist) -+ (sk && udp_test_bit(GRO_ENABLED, sk)) || NAPI_GRO_CB(skb)->is_flist) - return call_gro_receive(udp_gro_receive_segment, head, skb); - - /* no GRO, be sure flush the current packet */ -diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c -index 5f8104cf082d0..732e21b75ba28 100644 ---- a/net/ipv4/udp_tunnel_core.c -+++ b/net/ipv4/udp_tunnel_core.c -@@ -78,7 +78,7 @@ void setup_udp_tunnel_sock(struct net *net, struct socket *sock, - udp_sk(sk)->gro_receive = cfg->gro_receive; - udp_sk(sk)->gro_complete = cfg->gro_complete; - -- udp_tunnel_encap_enable(sock); -+ udp_tunnel_encap_enable(sk); - } - EXPORT_SYMBOL_GPL(setup_udp_tunnel_sock); - -diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c -index eac206a290d05..183f6dc372429 100644 ---- a/net/ipv4/xfrm4_input.c -+++ b/net/ipv4/xfrm4_input.c -@@ -85,11 +85,11 @@ int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) - struct udphdr *uh; - struct iphdr *iph; - int iphlen, len; -- - __u8 *udpdata; - __be32 *udpdata32; -- __u16 encap_type = up->encap_type; -+ u16 encap_type; - -+ encap_type = READ_ONCE(up->encap_type); - /* if this is not encapsulated socket, then just return now */ - if (!encap_type) - return 1; -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index b5309ae87fd79..a2f29ca516000 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -711,6 +711,7 @@ const struct proto_ops inet6_stream_ops = { - #ifdef CONFIG_MMU - .mmap = tcp_mmap, - #endif -+ .splice_eof = inet_splice_eof, - .sendpage = inet_sendpage, - .sendmsg_locked = tcp_sendmsg_locked, - .sendpage_locked = tcp_sendpage_locked, -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 3c2b2a85de367..e9ae084d038d1 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1506,8 +1506,8 @@ static int __ip6_append_data(struct sock *sk, - mtu = cork->gso_size ? IP6_MAX_MTU : cork->fragsize; - orig_mtu = mtu; - -- if (cork->tx_flags & SKBTX_ANY_SW_TSTAMP && -- sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) -+ if (cork->tx_flags & SKBTX_ANY_TSTAMP && -+ READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_OPT_ID) - tskey = atomic_inc_return(&sk->sk_tskey) - 1; - - hh_len = LL_RESERVED_SPACE(rt->dst.dev); -diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c -index 4d5a27dd9a4b2..a5d7d1915ba7e 100644 ---- a/net/ipv6/ping.c -+++ b/net/ipv6/ping.c -@@ -119,7 +119,7 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - return -EINVAL; - - ipcm6_init_sk(&ipc6, np); -- ipc6.sockc.tsflags = sk->sk_tsflags; -+ ipc6.sockc.tsflags = READ_ONCE(sk->sk_tsflags); - ipc6.sockc.mark = READ_ONCE(sk->sk_mark); - - fl6.flowi6_oif = oif; -diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index df3abd9e5237c..dc31752a7edcc 100644 ---- a/net/ipv6/raw.c -+++ b/net/ipv6/raw.c -@@ -776,7 +776,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - fl6.flowi6_uid = sk->sk_uid; - - ipcm6_init(&ipc6); -- ipc6.sockc.tsflags = sk->sk_tsflags; -+ ipc6.sockc.tsflags = READ_ONCE(sk->sk_tsflags); - ipc6.sockc.mark = fl6.flowi6_mark; - - if (sin6) { -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 7be89dcfd5fc5..ba9a22db5805c 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -2158,6 +2158,7 @@ struct proto tcpv6_prot = { - .keepalive = tcp_set_keepalive, - .recvmsg = tcp_recvmsg, - .sendmsg = tcp_sendmsg, -+ .splice_eof = tcp_splice_eof, - .sendpage = tcp_sendpage, - .backlog_rcv = tcp_v6_do_rcv, - .release_cb = tcp_release_cb, -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 64b36c2ba774a..961106eda69d0 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -440,7 +440,7 @@ try_again: - (struct sockaddr *)sin6); - } - -- if (udp_sk(sk)->gro_enabled) -+ if (udp_test_bit(GRO_ENABLED, sk)) - udp_cmsg_recv(msg, sk, skb); - - if (np->rxopt.all) -@@ -598,7 +598,7 @@ int __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - sk = __udp6_lib_lookup(net, daddr, uh->dest, saddr, uh->source, - inet6_iif(skb), inet6_sdif(skb), udptable, NULL); - -- if (!sk || udp_sk(sk)->encap_type) { -+ if (!sk || READ_ONCE(udp_sk(sk)->encap_type)) { - /* No socket for error: try tunnels before discarding */ - if (static_branch_unlikely(&udpv6_encap_needed_key)) { - sk = __udp6_lib_err_encap(net, hdr, offset, uh, -@@ -712,7 +712,8 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) - } - nf_reset_ct(skb); - -- if (static_branch_unlikely(&udpv6_encap_needed_key) && up->encap_type) { -+ if (static_branch_unlikely(&udpv6_encap_needed_key) && -+ READ_ONCE(up->encap_type)) { - int (*encap_rcv)(struct sock *sk, struct sk_buff *skb); - - /* -@@ -882,7 +883,7 @@ start_lookup: - /* If zero checksum and no_check is not on for - * the socket then skip it. - */ -- if (!uh->check && !udp_sk(sk)->no_check6_rx) -+ if (!uh->check && !udp_get_no_check6_rx(sk)) - continue; - if (!first) { - first = sk; -@@ -1000,7 +1001,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, - if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst)) - udp6_sk_rx_dst_set(sk, dst); - -- if (!uh->check && !udp_sk(sk)->no_check6_rx) { -+ if (!uh->check && !udp_get_no_check6_rx(sk)) { - if (refcounted) - sock_put(sk); - goto report_csum_error; -@@ -1022,7 +1023,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, - /* Unicast */ - sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable); - if (sk) { -- if (!uh->check && !udp_sk(sk)->no_check6_rx) -+ if (!uh->check && !udp_get_no_check6_rx(sk)) - goto report_csum_error; - return udp6_unicast_rcv_skb(sk, skb, uh); - } -@@ -1260,7 +1261,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, - kfree_skb(skb); - return -EINVAL; - } -- if (udp_sk(sk)->no_check6_tx) { -+ if (udp_get_no_check6_tx(sk)) { - kfree_skb(skb); - return -EINVAL; - } -@@ -1281,7 +1282,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, - - if (is_udplite) - csum = udplite_csum(skb); -- else if (udp_sk(sk)->no_check6_tx) { /* UDP csum disabled */ -+ else if (udp_get_no_check6_tx(sk)) { /* UDP csum disabled */ - skb->ip_summed = CHECKSUM_NONE; - goto send; - } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */ -@@ -1351,14 +1352,14 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - int addr_len = msg->msg_namelen; - bool connected = false; - int ulen = len; -- int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE; -+ int corkreq = udp_test_bit(CORK, sk) || msg->msg_flags & MSG_MORE; - int err; - int is_udplite = IS_UDPLITE(sk); - int (*getfrag)(void *, char *, int, int, int, struct sk_buff *); - - ipcm6_init(&ipc6); - ipc6.gso_size = READ_ONCE(up->gso_size); -- ipc6.sockc.tsflags = sk->sk_tsflags; -+ ipc6.sockc.tsflags = READ_ONCE(sk->sk_tsflags); - ipc6.sockc.mark = READ_ONCE(sk->sk_mark); - - /* destination address check */ -@@ -1657,6 +1658,20 @@ do_confirm: - goto out; - } - -+static void udpv6_splice_eof(struct socket *sock) -+{ -+ struct sock *sk = sock->sk; -+ struct udp_sock *up = udp_sk(sk); -+ -+ if (!up->pending || udp_test_bit(CORK, sk)) -+ return; -+ -+ lock_sock(sk); -+ if (up->pending && !udp_test_bit(CORK, sk)) -+ udp_v6_push_pending_frames(sk); -+ release_sock(sk); -+} -+ - void udpv6_destroy_sock(struct sock *sk) - { - struct udp_sock *up = udp_sk(sk); -@@ -1674,7 +1689,7 @@ void udpv6_destroy_sock(struct sock *sk) - if (encap_destroy) - encap_destroy(sk); - } -- if (up->encap_enabled) { -+ if (udp_test_bit(ENCAP_ENABLED, sk)) { - static_branch_dec(&udpv6_encap_needed_key); - udp_encap_disable(); - } -@@ -1768,6 +1783,7 @@ struct proto udpv6_prot = { - .getsockopt = udpv6_getsockopt, - .sendmsg = udpv6_sendmsg, - .recvmsg = udpv6_recvmsg, -+ .splice_eof = udpv6_splice_eof, - .release_cb = ip6_datagram_release_cb, - .hash = udp_lib_hash, - .unhash = udp_lib_unhash, -diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c -index 4907ab241d6be..4156387248e40 100644 ---- a/net/ipv6/xfrm6_input.c -+++ b/net/ipv6/xfrm6_input.c -@@ -81,14 +81,14 @@ int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) - struct ipv6hdr *ip6h; - int len; - int ip6hlen = sizeof(struct ipv6hdr); -- - __u8 *udpdata; - __be32 *udpdata32; -- __u16 encap_type = up->encap_type; -+ u16 encap_type; - - if (skb->protocol == htons(ETH_P_IP)) - return xfrm4_udp_encap_rcv(sk, skb); - -+ encap_type = READ_ONCE(up->encap_type); - /* if this is not encapsulated socket, then just return now */ - if (!encap_type) - return 1; -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 03608d3ded4b8..8d21ff25f1602 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -1139,9 +1139,9 @@ static void l2tp_tunnel_destruct(struct sock *sk) - switch (tunnel->encap) { - case L2TP_ENCAPTYPE_UDP: - /* No longer an encapsulation socket. See net/ipv4/udp.c */ -- (udp_sk(sk))->encap_type = 0; -- (udp_sk(sk))->encap_rcv = NULL; -- (udp_sk(sk))->encap_destroy = NULL; -+ WRITE_ONCE(udp_sk(sk)->encap_type, 0); -+ udp_sk(sk)->encap_rcv = NULL; -+ udp_sk(sk)->encap_destroy = NULL; - break; - case L2TP_ENCAPTYPE_IP: - break; -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index d611783c2601f..8ed7769cae836 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -1899,6 +1899,17 @@ static void tcp_release_cb_override(struct sock *ssk) - tcp_release_cb(ssk); - } - -+static int tcp_abort_override(struct sock *ssk, int err) -+{ -+ /* closing a listener subflow requires a great deal of care. -+ * keep it simple and just prevent such operation -+ */ -+ if (inet_sk_state_load(ssk) == TCP_LISTEN) -+ return -EINVAL; -+ -+ return tcp_abort(ssk, err); -+} -+ - static struct tcp_ulp_ops subflow_ulp_ops __read_mostly = { - .name = "mptcp", - .owner = THIS_MODULE, -@@ -1942,6 +1953,7 @@ void __init mptcp_subflow_init(void) - - tcp_prot_override = tcp_prot; - tcp_prot_override.release_cb = tcp_release_cb_override; -+ tcp_prot_override.diag_destroy = tcp_abort_override; - - #if IS_ENABLED(CONFIG_MPTCP_IPV6) - /* In struct mptcp_subflow_request_sock, we assume the TCP request sock -@@ -1977,6 +1989,7 @@ void __init mptcp_subflow_init(void) - - tcpv6_prot_override = tcpv6_prot; - tcpv6_prot_override.release_cb = tcp_release_cb_override; -+ tcpv6_prot_override.diag_destroy = tcp_abort_override; - #endif - - mptcp_diag_subflow_init(&subflow_ulp_ops); -diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c -index 7243079ef3546..b452eb3ddcecb 100644 ---- a/net/netfilter/ipvs/ip_vs_xmit.c -+++ b/net/netfilter/ipvs/ip_vs_xmit.c -@@ -994,7 +994,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af, - old_dsfield = ipv4_get_dsfield(old_iph); - *ttl = old_iph->ttl; - if (payload_len) -- *payload_len = ntohs(old_iph->tot_len); -+ *payload_len = skb_ip_totlen(skb); - } - - /* Implement full-functionality option for ECN encapsulation */ -diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c -index 81c26a96c30bb..c1d99cb370b44 100644 ---- a/net/netfilter/nf_flow_table_core.c -+++ b/net/netfilter/nf_flow_table_core.c -@@ -314,12 +314,12 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) - EXPORT_SYMBOL_GPL(flow_offload_add); - - void flow_offload_refresh(struct nf_flowtable *flow_table, -- struct flow_offload *flow) -+ struct flow_offload *flow, bool force) - { - u32 timeout; - - timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow); -- if (timeout - READ_ONCE(flow->timeout) > HZ) -+ if (force || timeout - READ_ONCE(flow->timeout) > HZ) - WRITE_ONCE(flow->timeout, timeout); - else - return; -@@ -416,11 +416,18 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table, - return err; - } - -+static bool nf_flow_custom_gc(struct nf_flowtable *flow_table, -+ const struct flow_offload *flow) -+{ -+ return flow_table->type->gc && flow_table->type->gc(flow); -+} -+ - static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table, - struct flow_offload *flow, void *data) - { - if (nf_flow_has_expired(flow) || -- nf_ct_is_dying(flow->ct)) -+ nf_ct_is_dying(flow->ct) || -+ nf_flow_custom_gc(flow_table, flow)) - flow_offload_teardown(flow); - - if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) { -diff --git a/net/netfilter/nf_flow_table_inet.c b/net/netfilter/nf_flow_table_inet.c -index 0ccabf3fa6aa3..9505f9d188ff2 100644 ---- a/net/netfilter/nf_flow_table_inet.c -+++ b/net/netfilter/nf_flow_table_inet.c -@@ -39,7 +39,7 @@ nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb, - } - - static int nf_flow_rule_route_inet(struct net *net, -- const struct flow_offload *flow, -+ struct flow_offload *flow, - enum flow_offload_tuple_dir dir, - struct nf_flow_rule *flow_rule) - { -diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c -index b350fe9d00b0b..6feaac9ab05c8 100644 ---- a/net/netfilter/nf_flow_table_ip.c -+++ b/net/netfilter/nf_flow_table_ip.c -@@ -384,7 +384,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, - if (skb_try_make_writable(skb, thoff + hdrsize)) - return NF_DROP; - -- flow_offload_refresh(flow_table, flow); -+ flow_offload_refresh(flow_table, flow, false); - - nf_flow_encap_pop(skb, tuplehash); - thoff -= offset; -@@ -646,7 +646,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, - if (skb_try_make_writable(skb, thoff + hdrsize)) - return NF_DROP; - -- flow_offload_refresh(flow_table, flow); -+ flow_offload_refresh(flow_table, flow, false); - - nf_flow_encap_pop(skb, tuplehash); - -diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c -index 4d9b99abe37d6..1c26f03fc6617 100644 ---- a/net/netfilter/nf_flow_table_offload.c -+++ b/net/netfilter/nf_flow_table_offload.c -@@ -679,7 +679,7 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - return 0; - } - --int nf_flow_rule_route_ipv4(struct net *net, const struct flow_offload *flow, -+int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow, - enum flow_offload_tuple_dir dir, - struct nf_flow_rule *flow_rule) - { -@@ -704,7 +704,7 @@ int nf_flow_rule_route_ipv4(struct net *net, const struct flow_offload *flow, - } - EXPORT_SYMBOL_GPL(nf_flow_rule_route_ipv4); - --int nf_flow_rule_route_ipv6(struct net *net, const struct flow_offload *flow, -+int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow, - enum flow_offload_tuple_dir dir, - struct nf_flow_rule *flow_rule) - { -@@ -735,7 +735,7 @@ nf_flow_offload_rule_alloc(struct net *net, - { - const struct nf_flowtable *flowtable = offload->flowtable; - const struct flow_offload_tuple *tuple, *other_tuple; -- const struct flow_offload *flow = offload->flow; -+ struct flow_offload *flow = offload->flow; - struct dst_entry *other_dst = NULL; - struct nf_flow_rule *flow_rule; - int err = -ENOMEM; -@@ -895,8 +895,9 @@ static int flow_offload_rule_add(struct flow_offload_work *offload, - - ok_count += flow_offload_tuple_add(offload, flow_rule[0], - FLOW_OFFLOAD_DIR_ORIGINAL); -- ok_count += flow_offload_tuple_add(offload, flow_rule[1], -- FLOW_OFFLOAD_DIR_REPLY); -+ if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags)) -+ ok_count += flow_offload_tuple_add(offload, flow_rule[1], -+ FLOW_OFFLOAD_DIR_REPLY); - if (ok_count == 0) - return -ENOENT; - -@@ -926,7 +927,8 @@ static void flow_offload_work_del(struct flow_offload_work *offload) - { - clear_bit(IPS_HW_OFFLOAD_BIT, &offload->flow->ct->status); - flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_ORIGINAL); -- flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY); -+ if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags)) -+ flow_offload_tuple_del(offload, FLOW_OFFLOAD_DIR_REPLY); - set_bit(NF_FLOW_HW_DEAD, &offload->flow->flags); - } - -@@ -946,7 +948,9 @@ static void flow_offload_work_stats(struct flow_offload_work *offload) - u64 lastused; - - flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_ORIGINAL, &stats[0]); -- flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_REPLY, &stats[1]); -+ if (test_bit(NF_FLOW_HW_BIDIRECTIONAL, &offload->flow->flags)) -+ flow_offload_tuple_stats(offload, FLOW_OFFLOAD_DIR_REPLY, -+ &stats[1]); - - lastused = max_t(u64, stats[0].lastused, stats[1].lastused); - offload->flow->timeout = max_t(u64, offload->flow->timeout, -diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c -index cb894f0d63e9d..c66689ad2b491 100644 ---- a/net/netfilter/nf_log_syslog.c -+++ b/net/netfilter/nf_log_syslog.c -@@ -322,7 +322,7 @@ dump_ipv4_packet(struct net *net, struct nf_log_buf *m, - - /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */ - nf_log_buf_add(m, "LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ", -- ntohs(ih->tot_len), ih->tos & IPTOS_TOS_MASK, -+ iph_totlen(skb, ih), ih->tos & IPTOS_TOS_MASK, - ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id)); - - /* Max length: 6 "CE DF MF " */ -diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c -index cee3e4e905ec8..e0c117229ee9d 100644 ---- a/net/netfilter/nf_tables_core.c -+++ b/net/netfilter/nf_tables_core.c -@@ -141,7 +141,7 @@ static bool nft_payload_fast_eval(const struct nft_expr *expr, - else { - if (!(pkt->flags & NFT_PKTINFO_L4PROTO)) - return false; -- ptr = skb_network_header(skb) + nft_thoff(pkt); -+ ptr = skb->data + nft_thoff(pkt); - } - - ptr += priv->offset; -diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c -index 5f59dbab3e933..55fcf0280c5c3 100644 ---- a/net/netfilter/nft_immediate.c -+++ b/net/netfilter/nft_immediate.c -@@ -78,7 +78,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx, - case NFT_GOTO: - err = nf_tables_bind_chain(ctx, chain); - if (err < 0) -- return err; -+ goto err1; - break; - default: - break; -diff --git a/net/netfilter/xt_length.c b/net/netfilter/xt_length.c -index 9fbfad13176f0..ca730cedb5d41 100644 ---- a/net/netfilter/xt_length.c -+++ b/net/netfilter/xt_length.c -@@ -21,7 +21,7 @@ static bool - length_mt(const struct sk_buff *skb, struct xt_action_param *par) - { - const struct xt_length_info *info = par->matchinfo; -- u_int16_t pktlen = ntohs(ip_hdr(skb)->tot_len); -+ u32 pktlen = skb_ip_totlen(skb); - - return (pktlen >= info->min && pktlen <= info->max) ^ info->invert; - } -diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c -index 1dac28136e6a3..18be13fb9b75a 100644 ---- a/net/nfc/llcp_core.c -+++ b/net/nfc/llcp_core.c -@@ -145,6 +145,13 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, - - static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) - { -+ /* Since using nfc_llcp_local may result in usage of nfc_dev, whenever -+ * we hold a reference to local, we also need to hold a reference to -+ * the device to avoid UAF. -+ */ -+ if (!nfc_get_device(local->dev->idx)) -+ return NULL; -+ - kref_get(&local->ref); - - return local; -@@ -177,10 +184,18 @@ static void local_release(struct kref *ref) - - int nfc_llcp_local_put(struct nfc_llcp_local *local) - { -+ struct nfc_dev *dev; -+ int ret; -+ - if (local == NULL) - return 0; - -- return kref_put(&local->ref, local_release); -+ dev = local->dev; -+ -+ ret = kref_put(&local->ref, local_release); -+ nfc_put_device(dev); -+ -+ return ret; - } - - static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, -@@ -959,8 +974,17 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local, - } - - new_sock = nfc_llcp_sock(new_sk); -- new_sock->dev = local->dev; -+ - new_sock->local = nfc_llcp_local_get(local); -+ if (!new_sock->local) { -+ reason = LLCP_DM_REJ; -+ sock_put(&new_sock->sk); -+ release_sock(&sock->sk); -+ sock_put(&sock->sk); -+ goto fail; -+ } -+ -+ new_sock->dev = local->dev; - new_sock->rw = sock->rw; - new_sock->miux = sock->miux; - new_sock->nfc_protocol = sock->nfc_protocol; -@@ -1597,7 +1621,16 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) - if (local == NULL) - return -ENOMEM; - -- local->dev = ndev; -+ /* As we are going to initialize local's refcount, we need to get the -+ * nfc_dev to avoid UAF, otherwise there is no point in continuing. -+ * See nfc_llcp_local_get(). -+ */ -+ local->dev = nfc_get_device(ndev->idx); -+ if (!local->dev) { -+ kfree(local); -+ return -ENODEV; -+ } -+ - INIT_LIST_HEAD(&local->list); - kref_init(&local->ref); - mutex_init(&local->sdp_lock); -diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c -index c8eaf4234b2e0..0591cfb289d50 100644 ---- a/net/openvswitch/conntrack.c -+++ b/net/openvswitch/conntrack.c -@@ -1252,7 +1252,7 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, - if (err) - return err; - -- nf_conn_act_ct_ext_add(ct); -+ nf_conn_act_ct_ext_add(skb, ct, ctinfo); - } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && - labels_nonzero(&info->labels.mask)) { - err = ovs_ct_set_labels(ct, key, &info->labels.value, -diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c -index 4c7f7861ea967..d6d33f854050a 100644 ---- a/net/sched/act_ct.c -+++ b/net/sched/act_ct.c -@@ -168,11 +168,11 @@ tcf_ct_flow_table_add_action_nat_udp(const struct nf_conntrack_tuple *tuple, - - static void tcf_ct_flow_table_add_action_meta(struct nf_conn *ct, - enum ip_conntrack_dir dir, -+ enum ip_conntrack_info ctinfo, - struct flow_action *action) - { - struct nf_conn_labels *ct_labels; - struct flow_action_entry *entry; -- enum ip_conntrack_info ctinfo; - u32 *act_ct_labels; - - entry = tcf_ct_flow_table_flow_action_get_next(action); -@@ -180,8 +180,6 @@ static void tcf_ct_flow_table_add_action_meta(struct nf_conn *ct, - #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) - entry->ct_metadata.mark = READ_ONCE(ct->mark); - #endif -- ctinfo = dir == IP_CT_DIR_ORIGINAL ? IP_CT_ESTABLISHED : -- IP_CT_ESTABLISHED_REPLY; - /* aligns with the CT reference on the SKB nf_ct_set */ - entry->ct_metadata.cookie = (unsigned long)ct | ctinfo; - entry->ct_metadata.orig_dir = dir == IP_CT_DIR_ORIGINAL; -@@ -235,22 +233,26 @@ static int tcf_ct_flow_table_add_action_nat(struct net *net, - } - - static int tcf_ct_flow_table_fill_actions(struct net *net, -- const struct flow_offload *flow, -+ struct flow_offload *flow, - enum flow_offload_tuple_dir tdir, - struct nf_flow_rule *flow_rule) - { - struct flow_action *action = &flow_rule->rule->action; - int num_entries = action->num_entries; - struct nf_conn *ct = flow->ct; -+ enum ip_conntrack_info ctinfo; - enum ip_conntrack_dir dir; - int i, err; - - switch (tdir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - dir = IP_CT_DIR_ORIGINAL; -+ ctinfo = IP_CT_ESTABLISHED; -+ set_bit(NF_FLOW_HW_ESTABLISHED, &flow->flags); - break; - case FLOW_OFFLOAD_DIR_REPLY: - dir = IP_CT_DIR_REPLY; -+ ctinfo = IP_CT_ESTABLISHED_REPLY; - break; - default: - return -EOPNOTSUPP; -@@ -260,7 +262,7 @@ static int tcf_ct_flow_table_fill_actions(struct net *net, - if (err) - goto err_nat; - -- tcf_ct_flow_table_add_action_meta(ct, dir, action); -+ tcf_ct_flow_table_add_action_meta(ct, dir, ctinfo, action); - return 0; - - err_nat: -@@ -272,8 +274,39 @@ err_nat: - return err; - } - -+static bool tcf_ct_flow_is_outdated(const struct flow_offload *flow) -+{ -+ return test_bit(IPS_SEEN_REPLY_BIT, &flow->ct->status) && -+ test_bit(IPS_HW_OFFLOAD_BIT, &flow->ct->status) && -+ !test_bit(NF_FLOW_HW_PENDING, &flow->flags) && -+ !test_bit(NF_FLOW_HW_ESTABLISHED, &flow->flags); -+} -+ -+static void tcf_ct_flow_table_get_ref(struct tcf_ct_flow_table *ct_ft); -+ -+static void tcf_ct_nf_get(struct nf_flowtable *ft) -+{ -+ struct tcf_ct_flow_table *ct_ft = -+ container_of(ft, struct tcf_ct_flow_table, nf_ft); -+ -+ tcf_ct_flow_table_get_ref(ct_ft); -+} -+ -+static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft); -+ -+static void tcf_ct_nf_put(struct nf_flowtable *ft) -+{ -+ struct tcf_ct_flow_table *ct_ft = -+ container_of(ft, struct tcf_ct_flow_table, nf_ft); -+ -+ tcf_ct_flow_table_put(ct_ft); -+} -+ - static struct nf_flowtable_type flowtable_ct = { -+ .gc = tcf_ct_flow_is_outdated, - .action = tcf_ct_flow_table_fill_actions, -+ .get = tcf_ct_nf_get, -+ .put = tcf_ct_nf_put, - .owner = THIS_MODULE, - }; - -@@ -322,9 +355,13 @@ err_alloc: - return err; - } - -+static void tcf_ct_flow_table_get_ref(struct tcf_ct_flow_table *ct_ft) -+{ -+ refcount_inc(&ct_ft->ref); -+} -+ - static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) - { -- struct flow_block_cb *block_cb, *tmp_cb; - struct tcf_ct_flow_table *ct_ft; - struct flow_block *block; - -@@ -332,24 +369,18 @@ static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) - rwork); - nf_flow_table_free(&ct_ft->nf_ft); - -- /* Remove any remaining callbacks before cleanup */ - block = &ct_ft->nf_ft.flow_block; - down_write(&ct_ft->nf_ft.flow_block_lock); -- list_for_each_entry_safe(block_cb, tmp_cb, &block->cb_list, list) { -- list_del(&block_cb->list); -- flow_block_cb_free(block_cb); -- } -+ WARN_ON(!list_empty(&block->cb_list)); - up_write(&ct_ft->nf_ft.flow_block_lock); - kfree(ct_ft); - - module_put(THIS_MODULE); - } - --static void tcf_ct_flow_table_put(struct tcf_ct_params *params) -+static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft) - { -- struct tcf_ct_flow_table *ct_ft = params->ct_ft; -- -- if (refcount_dec_and_test(¶ms->ct_ft->ref)) { -+ if (refcount_dec_and_test(&ct_ft->ref)) { - rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); - INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); - queue_rcu_work(act_ct_wq, &ct_ft->rwork); -@@ -363,9 +394,20 @@ static void tcf_ct_flow_tc_ifidx(struct flow_offload *entry, - entry->tuplehash[dir].tuple.tc.iifidx = act_ct_ext->ifindex[dir]; - } - -+static void tcf_ct_flow_ct_ext_ifidx_update(struct flow_offload *entry) -+{ -+ struct nf_conn_act_ct_ext *act_ct_ext; -+ -+ act_ct_ext = nf_conn_act_ct_ext_find(entry->ct); -+ if (act_ct_ext) { -+ tcf_ct_flow_tc_ifidx(entry, act_ct_ext, FLOW_OFFLOAD_DIR_ORIGINAL); -+ tcf_ct_flow_tc_ifidx(entry, act_ct_ext, FLOW_OFFLOAD_DIR_REPLY); -+ } -+} -+ - static void tcf_ct_flow_table_add(struct tcf_ct_flow_table *ct_ft, - struct nf_conn *ct, -- bool tcp) -+ bool tcp, bool bidirectional) - { - struct nf_conn_act_ct_ext *act_ct_ext; - struct flow_offload *entry; -@@ -384,6 +426,8 @@ static void tcf_ct_flow_table_add(struct tcf_ct_flow_table *ct_ft, - ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; - ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL; - } -+ if (bidirectional) -+ __set_bit(NF_FLOW_HW_BIDIRECTIONAL, &entry->flags); - - act_ct_ext = nf_conn_act_ct_ext_find(ct); - if (act_ct_ext) { -@@ -407,26 +451,34 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft, - struct nf_conn *ct, - enum ip_conntrack_info ctinfo) - { -- bool tcp = false; -- -- if ((ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY) || -- !test_bit(IPS_ASSURED_BIT, &ct->status)) -- return; -+ bool tcp = false, bidirectional = true; - - switch (nf_ct_protonum(ct)) { - case IPPROTO_TCP: -- tcp = true; -- if (ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) -+ if ((ctinfo != IP_CT_ESTABLISHED && -+ ctinfo != IP_CT_ESTABLISHED_REPLY) || -+ !test_bit(IPS_ASSURED_BIT, &ct->status) || -+ ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) - return; -+ -+ tcp = true; - break; - case IPPROTO_UDP: -+ if (!nf_ct_is_confirmed(ct)) -+ return; -+ if (!test_bit(IPS_ASSURED_BIT, &ct->status)) -+ bidirectional = false; - break; - #ifdef CONFIG_NF_CT_PROTO_GRE - case IPPROTO_GRE: { - struct nf_conntrack_tuple *tuple; - -- if (ct->status & IPS_NAT_MASK) -+ if ((ctinfo != IP_CT_ESTABLISHED && -+ ctinfo != IP_CT_ESTABLISHED_REPLY) || -+ !test_bit(IPS_ASSURED_BIT, &ct->status) || -+ ct->status & IPS_NAT_MASK) - return; -+ - tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; - /* No support for GRE v1 */ - if (tuple->src.u.gre.key || tuple->dst.u.gre.key) -@@ -442,7 +494,7 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft, - ct->status & IPS_SEQ_ADJUST) - return; - -- tcf_ct_flow_table_add(ct_ft, ct, tcp); -+ tcf_ct_flow_table_add(ct_ft, ct, tcp, bidirectional); - } - - static bool -@@ -596,6 +648,7 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, - struct flow_offload_tuple tuple = {}; - enum ip_conntrack_info ctinfo; - struct tcphdr *tcph = NULL; -+ bool force_refresh = false; - struct flow_offload *flow; - struct nf_conn *ct; - u8 dir; -@@ -621,15 +674,40 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, - flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); - ct = flow->ct; - -+ if (dir == FLOW_OFFLOAD_DIR_REPLY && -+ !test_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags)) { -+ /* Only offload reply direction after connection became -+ * assured. -+ */ -+ if (test_bit(IPS_ASSURED_BIT, &ct->status)) -+ set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags); -+ else if (test_bit(NF_FLOW_HW_ESTABLISHED, &flow->flags)) -+ /* If flow_table flow has already been updated to the -+ * established state, then don't refresh. -+ */ -+ return false; -+ force_refresh = true; -+ } -+ - if (tcph && (unlikely(tcph->fin || tcph->rst))) { - flow_offload_teardown(flow); - return false; - } - -- ctinfo = dir == FLOW_OFFLOAD_DIR_ORIGINAL ? IP_CT_ESTABLISHED : -- IP_CT_ESTABLISHED_REPLY; -+ if (dir == FLOW_OFFLOAD_DIR_ORIGINAL) -+ ctinfo = test_bit(IPS_SEEN_REPLY_BIT, &ct->status) ? -+ IP_CT_ESTABLISHED : IP_CT_NEW; -+ else -+ ctinfo = IP_CT_ESTABLISHED_REPLY; -+ -+ nf_conn_act_ct_ext_fill(skb, ct, ctinfo); -+ tcf_ct_flow_ct_ext_ifidx_update(flow); -+ flow_offload_refresh(nf_ft, flow, force_refresh); -+ if (!test_bit(IPS_ASSURED_BIT, &ct->status)) { -+ /* Process this flow in SW to allow promoting to ASSURED */ -+ return false; -+ } - -- flow_offload_refresh(nf_ft, flow); - nf_conntrack_get(&ct->ct_general); - nf_ct_set(skb, ct, ctinfo); - if (nf_ft->flags & NF_FLOWTABLE_COUNTER) -@@ -832,18 +910,23 @@ out_free: - return err; - } - --static void tcf_ct_params_free(struct rcu_head *head) -+static void tcf_ct_params_free(struct tcf_ct_params *params) - { -- struct tcf_ct_params *params = container_of(head, -- struct tcf_ct_params, rcu); -- -- tcf_ct_flow_table_put(params); -- -+ if (params->ct_ft) -+ tcf_ct_flow_table_put(params->ct_ft); - if (params->tmpl) - nf_ct_put(params->tmpl); - kfree(params); - } - -+static void tcf_ct_params_free_rcu(struct rcu_head *head) -+{ -+ struct tcf_ct_params *params; -+ -+ params = container_of(head, struct tcf_ct_params, rcu); -+ tcf_ct_params_free(params); -+} -+ - #if IS_ENABLED(CONFIG_NF_NAT) - /* Modelled after nf_nat_ipv[46]_fn(). - * range is only used for new, uninitialized NAT state. -@@ -1121,7 +1204,7 @@ do_nat: - tcf_ct_act_set_labels(ct, p->labels, p->labels_mask); - - if (!nf_ct_is_confirmed(ct)) -- nf_conn_act_ct_ext_add(ct); -+ nf_conn_act_ct_ext_add(skb, ct, ctinfo); - - /* This will take care of sending queued events - * even if the connection is already confirmed. -@@ -1390,7 +1473,7 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla, - - err = tcf_ct_flow_table_get(net, params); - if (err) -- goto cleanup_params; -+ goto cleanup; - - spin_lock_bh(&c->tcf_lock); - goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch); -@@ -1401,17 +1484,15 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla, - if (goto_ch) - tcf_chain_put_by_act(goto_ch); - if (params) -- call_rcu(¶ms->rcu, tcf_ct_params_free); -+ call_rcu(¶ms->rcu, tcf_ct_params_free_rcu); - - return res; - --cleanup_params: -- if (params->tmpl) -- nf_ct_put(params->tmpl); - cleanup: - if (goto_ch) - tcf_chain_put_by_act(goto_ch); -- kfree(params); -+ if (params) -+ tcf_ct_params_free(params); - tcf_idr_release(*a, bind); - return err; - } -@@ -1423,7 +1504,7 @@ static void tcf_ct_cleanup(struct tc_action *a) - - params = rcu_dereference_protected(c->params, 1); - if (params) -- call_rcu(¶ms->rcu, tcf_ct_params_free); -+ call_rcu(¶ms->rcu, tcf_ct_params_free_rcu); - } - - static int tcf_ct_dump_key_val(struct sk_buff *skb, -diff --git a/net/sched/em_text.c b/net/sched/em_text.c -index 6f3c1fb2fb44c..f176afb70559e 100644 ---- a/net/sched/em_text.c -+++ b/net/sched/em_text.c -@@ -97,8 +97,10 @@ retry: - - static void em_text_destroy(struct tcf_ematch *m) - { -- if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) -+ if (EM_TEXT_PRIV(m) && EM_TEXT_PRIV(m)->config) { - textsearch_destroy(EM_TEXT_PRIV(m)->config); -+ kfree(EM_TEXT_PRIV(m)); -+ } - } - - static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m) -diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c -index 80ea7d954eceb..801044e7d1949 100644 ---- a/net/smc/smc_diag.c -+++ b/net/smc/smc_diag.c -@@ -153,8 +153,7 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, - .lnk[0].link_id = link->link_id, - }; - -- memcpy(linfo.lnk[0].ibname, -- smc->conn.lgr->lnk[0].smcibdev->ibdev->name, -+ memcpy(linfo.lnk[0].ibname, link->smcibdev->ibdev->name, - sizeof(link->smcibdev->ibdev->name)); - smc_gid_be16_convert(linfo.lnk[0].gid, link->gid); - smc_gid_be16_convert(linfo.lnk[0].peer_gid, link->peer_gid); -diff --git a/net/socket.c b/net/socket.c -index 04cba91c7cbe5..639d76f20384e 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -130,6 +130,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page, - static ssize_t sock_splice_read(struct file *file, loff_t *ppos, - struct pipe_inode_info *pipe, size_t len, - unsigned int flags); -+static void sock_splice_eof(struct file *file); - - #ifdef CONFIG_PROC_FS - static void sock_show_fdinfo(struct seq_file *m, struct file *f) -@@ -164,6 +165,7 @@ static const struct file_operations socket_file_ops = { - .sendpage = sock_sendpage, - .splice_write = generic_splice_sendpage, - .splice_read = sock_splice_read, -+ .splice_eof = sock_splice_eof, - .show_fdinfo = sock_show_fdinfo, - }; - -@@ -740,6 +742,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg) - { - struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; - struct sockaddr_storage address; -+ int save_len = msg->msg_namelen; - int ret; - - if (msg->msg_name) { -@@ -749,6 +752,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg) - - ret = __sock_sendmsg(sock, msg); - msg->msg_name = save_addr; -+ msg->msg_namelen = save_len; - - return ret; - } -@@ -826,7 +830,7 @@ static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp) - - static ktime_t get_timestamp(struct sock *sk, struct sk_buff *skb, int *if_index) - { -- bool cycles = sk->sk_tsflags & SOF_TIMESTAMPING_BIND_PHC; -+ bool cycles = READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_BIND_PHC; - struct skb_shared_hwtstamps *shhwtstamps = skb_hwtstamps(skb); - struct net_device *orig_dev; - ktime_t hwtstamp; -@@ -878,12 +882,12 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, - int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP); - int new_tstamp = sock_flag(sk, SOCK_TSTAMP_NEW); - struct scm_timestamping_internal tss; -- - int empty = 1, false_tstamp = 0; - struct skb_shared_hwtstamps *shhwtstamps = - skb_hwtstamps(skb); - int if_index; - ktime_t hwtstamp; -+ u32 tsflags; - - /* Race occurred between timestamp enabling and packet - receiving. Fill in the current time for now. */ -@@ -925,11 +929,12 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, - } - - memset(&tss, 0, sizeof(tss)); -- if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) && -+ tsflags = READ_ONCE(sk->sk_tsflags); -+ if ((tsflags & SOF_TIMESTAMPING_SOFTWARE) && - ktime_to_timespec64_cond(skb->tstamp, tss.ts + 0)) - empty = 0; - if (shhwtstamps && -- (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) && -+ (tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) && - !skb_is_swtx_tstamp(skb, false_tstamp)) { - if_index = 0; - if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP_NETDEV) -@@ -937,14 +942,14 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, - else - hwtstamp = shhwtstamps->hwtstamp; - -- if (sk->sk_tsflags & SOF_TIMESTAMPING_BIND_PHC) -+ if (tsflags & SOF_TIMESTAMPING_BIND_PHC) - hwtstamp = ptp_convert_timestamp(&hwtstamp, -- sk->sk_bind_phc); -+ READ_ONCE(sk->sk_bind_phc)); - - if (ktime_to_timespec64_cond(hwtstamp, tss.ts + 2)) { - empty = 0; - -- if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) && -+ if ((tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) && - !skb_is_err_queue(skb)) - put_ts_pktinfo(msg, skb, if_index); - } -@@ -1088,6 +1093,14 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos, - return sock->ops->splice_read(sock, ppos, pipe, len, flags); - } - -+static void sock_splice_eof(struct file *file) -+{ -+ struct socket *sock = file->private_data; -+ -+ if (sock->ops->splice_eof) -+ sock->ops->splice_eof(sock); -+} -+ - static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to) - { - struct file *file = iocb->ki_filp; -@@ -2128,6 +2141,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, - msg.msg_name = (struct sockaddr *)&address; - msg.msg_namelen = addr_len; - } -+ flags &= ~MSG_INTERNAL_SENDMSG_FLAGS; - if (sock->file->f_flags & O_NONBLOCK) - flags |= MSG_DONTWAIT; - msg.msg_flags = flags; -@@ -2479,6 +2493,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, - msg_sys->msg_control = ctl_buf; - msg_sys->msg_control_is_user = false; - } -+ flags &= ~MSG_INTERNAL_SENDMSG_FLAGS; - msg_sys->msg_flags = flags; - - if (sock->file->f_flags & O_NONBLOCK) -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 6dbeb80073338..be2ed7b0fe21c 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -211,8 +211,6 @@ static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb) - } - #endif /* CONFIG_SECURITY_NETWORK */ - --#define unix_peer(sk) (unix_sk(sk)->peer) -- - static inline int unix_our_peer(struct sock *sk, struct sock *osk) - { - return unix_peer(osk) == sk; -diff --git a/net/unix/unix_bpf.c b/net/unix/unix_bpf.c -index 2f9d8271c6ec7..7ea7c3a0d0d06 100644 ---- a/net/unix/unix_bpf.c -+++ b/net/unix/unix_bpf.c -@@ -159,12 +159,17 @@ int unix_dgram_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool re - - int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) - { -+ struct sock *sk_pair; -+ - if (restore) { - sk->sk_write_space = psock->saved_write_space; - sock_replace_proto(sk, psock->sk_proto); - return 0; - } - -+ sk_pair = unix_peer(sk); -+ sock_hold(sk_pair); -+ psock->sk_pair = sk_pair; - unix_stream_bpf_check_needs_rebuild(psock->sk_proto); - sock_replace_proto(sk, &unix_stream_bpf_prot); - return 0; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index a88ed60dcd96a..1c8ffc5cf97f6 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9581,6 +9581,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), - SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), - SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), -+ SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), - SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), -@@ -9663,6 +9664,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x89c6, "Zbook Fury 17 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x89ca, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), - SND_PCI_QUIRK(0x103c, 0x89d3, "HP EliteBook 645 G9 (MB 89D2)", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), -+ SND_PCI_QUIRK(0x103c, 0x8a0f, "HP Pavilion 14-ec1xxx", ALC287_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8a20, "HP Laptop 15s-fq5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), - SND_PCI_QUIRK(0x103c, 0x8a25, "HP Victus 16-d1xxx (MB 8A25)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT), - SND_PCI_QUIRK(0x103c, 0x8a78, "HP Dev One", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST), -@@ -9707,6 +9709,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8c96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), - SND_PCI_QUIRK(0x103c, 0x8ca4, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8ca7, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8cf5, "HP ZBook Studio 16", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED), -@@ -9904,6 +9907,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1558, 0xc019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1558, 0xc022, "Clevo NH77[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS), -+ SND_PCI_QUIRK(0x17aa, 0x3882, "Lenovo Yoga Pro 7 14APH8", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), - SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340), - SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), - SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), -diff --git a/sound/soc/fsl/fsl_rpmsg.c b/sound/soc/fsl/fsl_rpmsg.c -index bf94838bdbefe..5c07a8ff0c9c0 100644 ---- a/sound/soc/fsl/fsl_rpmsg.c -+++ b/sound/soc/fsl/fsl_rpmsg.c -@@ -231,7 +231,7 @@ static int fsl_rpmsg_probe(struct platform_device *pdev) - ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component, - &fsl_rpmsg_dai, 1); - if (ret) -- return ret; -+ goto err_pm_disable; - - rpmsg->card_pdev = platform_device_register_data(&pdev->dev, - "imx-audio-rpmsg", -@@ -241,16 +241,22 @@ static int fsl_rpmsg_probe(struct platform_device *pdev) - if (IS_ERR(rpmsg->card_pdev)) { - dev_err(&pdev->dev, "failed to register rpmsg card\n"); - ret = PTR_ERR(rpmsg->card_pdev); -- return ret; -+ goto err_pm_disable; - } - - return 0; -+ -+err_pm_disable: -+ pm_runtime_disable(&pdev->dev); -+ return ret; - } - - static int fsl_rpmsg_remove(struct platform_device *pdev) - { - struct fsl_rpmsg *rpmsg = platform_get_drvdata(pdev); - -+ pm_runtime_disable(&pdev->dev); -+ - if (rpmsg->card_pdev) - platform_device_unregister(rpmsg->card_pdev); - -diff --git a/sound/soc/mediatek/mt8186/mt8186-dai-adda.c b/sound/soc/mediatek/mt8186/mt8186-dai-adda.c -index 094402470dc23..858b95b199dcb 100644 ---- a/sound/soc/mediatek/mt8186/mt8186-dai-adda.c -+++ b/sound/soc/mediatek/mt8186/mt8186-dai-adda.c -@@ -499,7 +499,7 @@ static const struct snd_soc_dapm_widget mtk_dai_adda_widgets[] = { - SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), - - SND_SOC_DAPM_SUPPLY_S("AUD_PAD_TOP", SUPPLY_SEQ_ADDA_AUD_PAD_TOP, -- 0, 0, 0, -+ AFE_AUD_PAD_TOP, RG_RX_FIFO_ON_SFT, 0, - mtk_adda_pad_top_event, - SND_SOC_DAPM_PRE_PMU), - SND_SOC_DAPM_SUPPLY_S("ADDA_MTKAIF_CFG", SUPPLY_SEQ_ADDA_MTKAIF_CFG, -diff --git a/sound/soc/meson/g12a-toacodec.c b/sound/soc/meson/g12a-toacodec.c -index ddc667956cf5e..8d8d848ebd58b 100644 ---- a/sound/soc/meson/g12a-toacodec.c -+++ b/sound/soc/meson/g12a-toacodec.c -@@ -71,6 +71,9 @@ static int g12a_toacodec_mux_put_enum(struct snd_kcontrol *kcontrol, - struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; - unsigned int mux, reg; - -+ if (ucontrol->value.enumerated.item[0] >= e->items) -+ return -EINVAL; -+ - mux = snd_soc_enum_item_to_val(e, ucontrol->value.enumerated.item[0]); - regmap_field_read(priv->field_dat_sel, ®); - -@@ -101,7 +104,7 @@ static int g12a_toacodec_mux_put_enum(struct snd_kcontrol *kcontrol, - - snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); - -- return 0; -+ return 1; - } - - static SOC_ENUM_SINGLE_DECL(g12a_toacodec_mux_enum, TOACODEC_CTRL0, -diff --git a/sound/soc/meson/g12a-tohdmitx.c b/sound/soc/meson/g12a-tohdmitx.c -index 579a04ad4d197..154c324fdd42a 100644 ---- a/sound/soc/meson/g12a-tohdmitx.c -+++ b/sound/soc/meson/g12a-tohdmitx.c -@@ -45,6 +45,9 @@ static int g12a_tohdmitx_i2s_mux_put_enum(struct snd_kcontrol *kcontrol, - struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; - unsigned int mux, changed; - -+ if (ucontrol->value.enumerated.item[0] >= e->items) -+ return -EINVAL; -+ - mux = snd_soc_enum_item_to_val(e, ucontrol->value.enumerated.item[0]); - changed = snd_soc_component_test_bits(component, e->reg, - CTRL0_I2S_DAT_SEL, -@@ -93,6 +96,9 @@ static int g12a_tohdmitx_spdif_mux_put_enum(struct snd_kcontrol *kcontrol, - struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; - unsigned int mux, changed; - -+ if (ucontrol->value.enumerated.item[0] >= e->items) -+ return -EINVAL; -+ - mux = snd_soc_enum_item_to_val(e, ucontrol->value.enumerated.item[0]); - changed = snd_soc_component_test_bits(component, TOHDMITX_CTRL0, - CTRL0_SPDIF_SEL, -@@ -112,7 +118,7 @@ static int g12a_tohdmitx_spdif_mux_put_enum(struct snd_kcontrol *kcontrol, - - snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); - -- return 0; -+ return 1; - } - - static SOC_ENUM_SINGLE_DECL(g12a_tohdmitx_spdif_mux_enum, TOHDMITX_CTRL0, -diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c -index f9297900cea6d..78f19c255f20b 100644 ---- a/tools/testing/selftests/bpf/verifier/ld_imm64.c -+++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c -@@ -9,8 +9,8 @@ - BPF_MOV64_IMM(BPF_REG_0, 2), - BPF_EXIT_INSN(), - }, -- .errstr = "invalid BPF_LD_IMM insn", -- .errstr_unpriv = "R1 pointer comparison", -+ .errstr = "jump into the middle of ldimm64 insn 1", -+ .errstr_unpriv = "jump into the middle of ldimm64 insn 1", - .result = REJECT, - }, - { -@@ -23,8 +23,8 @@ - BPF_LD_IMM64(BPF_REG_0, 1), - BPF_EXIT_INSN(), - }, -- .errstr = "invalid BPF_LD_IMM insn", -- .errstr_unpriv = "R1 pointer comparison", -+ .errstr = "jump into the middle of ldimm64 insn 1", -+ .errstr_unpriv = "jump into the middle of ldimm64 insn 1", - .result = REJECT, - }, - { -diff --git a/tools/testing/selftests/drivers/net/bonding/bond-arp-interval-causes-panic.sh b/tools/testing/selftests/drivers/net/bonding/bond-arp-interval-causes-panic.sh -index 71c00bfafbc99..2ff58fed76e28 100755 ---- a/tools/testing/selftests/drivers/net/bonding/bond-arp-interval-causes-panic.sh -+++ b/tools/testing/selftests/drivers/net/bonding/bond-arp-interval-causes-panic.sh -@@ -33,16 +33,16 @@ ip netns add "client" - ip link set dev link1_1 netns client down name eth0 - ip netns exec client ip link add dev bond0 down type bond mode 1 \ - miimon 100 all_slaves_active 1 --ip netns exec client ip link set dev eth0 down master bond0 -+ip netns exec client ip link set dev eth0 master bond0 - ip netns exec client ip link set dev bond0 up - ip netns exec client ip addr add ${client_ip4}/24 dev bond0 - ip netns exec client ping -c 5 $server_ip4 >/dev/null - --ip netns exec client ip link set dev eth0 down nomaster -+ip netns exec client ip link set dev eth0 nomaster - ip netns exec client ip link set dev bond0 down - ip netns exec client ip link set dev bond0 type bond mode 0 \ - arp_interval 1000 arp_ip_target "+${server_ip4}" --ip netns exec client ip link set dev eth0 down master bond0 -+ip netns exec client ip link set dev eth0 master bond0 - ip netns exec client ip link set dev bond0 up - ip netns exec client ping -c 5 $server_ip4 >/dev/null - -diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh -index e52d513009fb0..2107579e2939d 100755 ---- a/tools/testing/selftests/net/mptcp/mptcp_join.sh -+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh -@@ -2167,9 +2167,9 @@ link_failure_tests() - pm_nl_set_limits $ns1 0 2 - pm_nl_add_endpoint $ns1 10.0.2.1 dev ns1eth2 flags signal - pm_nl_set_limits $ns2 1 2 -- FAILING_LINKS="1" - pm_nl_add_endpoint $ns2 10.0.3.2 dev ns2eth3 flags subflow,backup -- run_tests $ns1 $ns2 10.0.1.1 1 -+ FAILING_LINKS="1" \ -+ run_tests $ns1 $ns2 10.0.1.1 1 - chk_join_nr 2 2 2 - chk_add_nr 1 1 - chk_link_usage $ns2 ns2eth3 $cinsent 0 -@@ -2183,8 +2183,8 @@ link_failure_tests() - pm_nl_add_endpoint $ns1 10.0.2.1 dev ns1eth2 flags signal - pm_nl_set_limits $ns2 1 2 - pm_nl_add_endpoint $ns2 10.0.3.2 dev ns2eth3 flags subflow,backup -- FAILING_LINKS="1 2" -- run_tests $ns1 $ns2 10.0.1.1 1 -+ FAILING_LINKS="1 2" \ -+ run_tests $ns1 $ns2 10.0.1.1 1 - chk_join_nr 2 2 2 - chk_add_nr 1 1 - chk_stale_nr $ns2 2 4 2 -@@ -2199,8 +2199,8 @@ link_failure_tests() - pm_nl_add_endpoint $ns1 10.0.2.1 dev ns1eth2 flags signal - pm_nl_set_limits $ns2 1 3 - pm_nl_add_endpoint $ns2 10.0.3.2 dev ns2eth3 flags subflow,backup -- FAILING_LINKS="1 2" -- run_tests $ns1 $ns2 10.0.1.1 2 -+ FAILING_LINKS="1 2" \ -+ run_tests $ns1 $ns2 10.0.1.1 2 - chk_join_nr 2 2 2 - chk_add_nr 1 1 - chk_stale_nr $ns2 1 -1 2 -@@ -3041,7 +3041,7 @@ fastclose_tests() - - if reset_check_counter "fastclose server test" "MPTcpExtMPFastcloseRx"; then - run_tests $ns1 $ns2 10.0.1.1 1024 0 fastclose_server -- chk_join_nr 0 0 0 -+ chk_join_nr 0 0 0 0 0 0 1 - chk_fclose_nr 1 1 invert - chk_rst_nr 1 1 - fi -diff --git a/tools/testing/selftests/vm/memfd_secret.c b/tools/testing/selftests/vm/memfd_secret.c -index 957b9e18c7295..9b298f6a04b37 100644 ---- a/tools/testing/selftests/vm/memfd_secret.c -+++ b/tools/testing/selftests/vm/memfd_secret.c -@@ -62,6 +62,9 @@ static void test_mlock_limit(int fd) - char *mem; - - len = mlock_limit_cur; -+ if (len % page_size != 0) -+ len = (len/page_size) * page_size; -+ - mem = mmap(NULL, len, prot, mode, fd, 0); - if (mem == MAP_FAILED) { - fail("unable to mmap secret memory\n"); diff --git a/patch/kernel/odroidxu4-current/patch-6.1.72-73.patch b/patch/kernel/odroidxu4-current/patch-6.1.72-73.patch deleted file mode 100644 index feadcd413e..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.72-73.patch +++ /dev/null @@ -1,294 +0,0 @@ -diff --git a/Makefile b/Makefile -index bad3387b3251c..e4f2d019ca745 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 72 -+SUBLEVEL = 73 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c -index b3b4542e31ed5..573de0d49e172 100644 ---- a/fs/nfsd/nfsctl.c -+++ b/fs/nfsd/nfsctl.c -@@ -716,10 +716,8 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred - - err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred); - -- if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active) -- nfsd_last_thread(net); -- else if (err >= 0 && -- !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) -+ if (err >= 0 && -+ !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1)) - svc_get(nn->nfsd_serv); - - nfsd_put(net); -@@ -769,9 +767,6 @@ out_close: - svc_xprt_put(xprt); - } - out_err: -- if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active) -- nfsd_last_thread(net); -- - nfsd_put(net); - return err; - } -diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h -index 53166cce7062c..09726c5b9a317 100644 ---- a/fs/nfsd/nfsd.h -+++ b/fs/nfsd/nfsd.h -@@ -97,12 +97,7 @@ int nfsd_pool_stats_open(struct inode *, struct file *); - int nfsd_pool_stats_release(struct inode *, struct file *); - void nfsd_shutdown_threads(struct net *net); - --static inline void nfsd_put(struct net *net) --{ -- struct nfsd_net *nn = net_generic(net, nfsd_net_id); -- -- svc_put(nn->nfsd_serv); --} -+void nfsd_put(struct net *net); - - bool i_am_nfsd(void); - -@@ -139,7 +134,6 @@ int nfsd_vers(struct nfsd_net *nn, int vers, enum vers_op change); - int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op change); - void nfsd_reset_versions(struct nfsd_net *nn); - int nfsd_create_serv(struct net *net); --void nfsd_last_thread(struct net *net); - - extern int nfsd_max_blksize; - -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index 350c6c72f793f..c7695ebd28dc3 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -523,14 +523,9 @@ static struct notifier_block nfsd_inet6addr_notifier = { - /* Only used under nfsd_mutex, so this atomic may be overkill: */ - static atomic_t nfsd_notifier_refcount = ATOMIC_INIT(0); - --void nfsd_last_thread(struct net *net) -+static void nfsd_last_thread(struct svc_serv *serv, struct net *net) - { - struct nfsd_net *nn = net_generic(net, nfsd_net_id); -- struct svc_serv *serv = nn->nfsd_serv; -- -- spin_lock(&nfsd_notifier_lock); -- nn->nfsd_serv = NULL; -- spin_unlock(&nfsd_notifier_lock); - - /* check if the notifier still has clients */ - if (atomic_dec_return(&nfsd_notifier_refcount) == 0) { -@@ -540,8 +535,6 @@ void nfsd_last_thread(struct net *net) - #endif - } - -- svc_xprt_destroy_all(serv, net); -- - /* - * write_ports can create the server without actually starting - * any threads--if we get shut down before any threads are -@@ -632,8 +625,7 @@ void nfsd_shutdown_threads(struct net *net) - svc_get(serv); - /* Kill outstanding nfsd threads */ - svc_set_num_threads(serv, NULL, 0); -- nfsd_last_thread(net); -- svc_put(serv); -+ nfsd_put(net); - mutex_unlock(&nfsd_mutex); - } - -@@ -663,6 +655,9 @@ int nfsd_create_serv(struct net *net) - serv->sv_maxconn = nn->max_connections; - error = svc_bind(serv, net); - if (error < 0) { -+ /* NOT nfsd_put() as notifiers (see below) haven't -+ * been set up yet. -+ */ - svc_put(serv); - return error; - } -@@ -705,6 +700,29 @@ int nfsd_get_nrthreads(int n, int *nthreads, struct net *net) - return 0; - } - -+/* This is the callback for kref_put() below. -+ * There is no code here as the first thing to be done is -+ * call svc_shutdown_net(), but we cannot get the 'net' from -+ * the kref. So do all the work when kref_put returns true. -+ */ -+static void nfsd_noop(struct kref *ref) -+{ -+} -+ -+void nfsd_put(struct net *net) -+{ -+ struct nfsd_net *nn = net_generic(net, nfsd_net_id); -+ -+ if (kref_put(&nn->nfsd_serv->sv_refcnt, nfsd_noop)) { -+ svc_xprt_destroy_all(nn->nfsd_serv, net); -+ nfsd_last_thread(nn->nfsd_serv, net); -+ svc_destroy(&nn->nfsd_serv->sv_refcnt); -+ spin_lock(&nfsd_notifier_lock); -+ nn->nfsd_serv = NULL; -+ spin_unlock(&nfsd_notifier_lock); -+ } -+} -+ - int nfsd_set_nrthreads(int n, int *nthreads, struct net *net) - { - int i = 0; -@@ -755,7 +773,7 @@ int nfsd_set_nrthreads(int n, int *nthreads, struct net *net) - if (err) - break; - } -- svc_put(nn->nfsd_serv); -+ nfsd_put(net); - return err; - } - -@@ -770,7 +788,6 @@ nfsd_svc(int nrservs, struct net *net, const struct cred *cred) - int error; - bool nfsd_up_before; - struct nfsd_net *nn = net_generic(net, nfsd_net_id); -- struct svc_serv *serv; - - mutex_lock(&nfsd_mutex); - dprintk("nfsd: creating service\n"); -@@ -790,25 +807,22 @@ nfsd_svc(int nrservs, struct net *net, const struct cred *cred) - goto out; - - nfsd_up_before = nn->nfsd_net_up; -- serv = nn->nfsd_serv; - - error = nfsd_startup_net(net, cred); - if (error) - goto out_put; -- error = svc_set_num_threads(serv, NULL, nrservs); -+ error = svc_set_num_threads(nn->nfsd_serv, NULL, nrservs); - if (error) - goto out_shutdown; -- error = serv->sv_nrthreads; -- if (error == 0) -- nfsd_last_thread(net); -+ error = nn->nfsd_serv->sv_nrthreads; - out_shutdown: - if (error < 0 && !nfsd_up_before) - nfsd_shutdown_net(net); - out_put: - /* Threads now hold service active */ - if (xchg(&nn->keep_active, 0)) -- svc_put(serv); -- svc_put(serv); -+ nfsd_put(net); -+ nfsd_put(net); - out: - mutex_unlock(&nfsd_mutex); - return error; -diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c -index 2e15b182e59fc..7286a56aebfa9 100644 ---- a/fs/smb/client/cifsfs.c -+++ b/fs/smb/client/cifsfs.c -@@ -1240,7 +1240,7 @@ static int cifs_flush_folio(struct inode *inode, loff_t pos, loff_t *_fstart, lo - int rc = 0; - - folio = filemap_get_folio(inode->i_mapping, index); -- if (IS_ERR(folio)) -+ if (!folio) - return 0; - - size = folio_size(folio); -diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h -index 88ff7bb2bb9bd..632086b2f644a 100644 ---- a/include/net/dst_ops.h -+++ b/include/net/dst_ops.h -@@ -16,7 +16,7 @@ struct dst_ops { - unsigned short family; - unsigned int gc_thresh; - -- int (*gc)(struct dst_ops *ops); -+ void (*gc)(struct dst_ops *ops); - struct dst_entry * (*check)(struct dst_entry *, __u32 cookie); - unsigned int (*default_advmss)(const struct dst_entry *); - unsigned int (*mtu)(const struct dst_entry *); -diff --git a/net/core/dst.c b/net/core/dst.c -index bc9c9be4e0801..d178c564138ee 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -82,12 +82,8 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev, - - if (ops->gc && - !(flags & DST_NOCOUNT) && -- dst_entries_get_fast(ops) > ops->gc_thresh) { -- if (ops->gc(ops)) { -- pr_notice_ratelimited("Route cache is full: consider increasing sysctl net.ipv6.route.max_size.\n"); -- return NULL; -- } -- } -+ dst_entries_get_fast(ops) > ops->gc_thresh) -+ ops->gc(ops); - - dst = kmem_cache_alloc(ops->kmem_cachep, GFP_ATOMIC); - if (!dst) -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 0bcdb675ba2c1..7f65dc750feb8 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -91,7 +91,7 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *); - static void ip6_dst_destroy(struct dst_entry *); - static void ip6_dst_ifdown(struct dst_entry *, - struct net_device *dev, int how); --static int ip6_dst_gc(struct dst_ops *ops); -+static void ip6_dst_gc(struct dst_ops *ops); - - static int ip6_pkt_discard(struct sk_buff *skb); - static int ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb); -@@ -3288,11 +3288,10 @@ out: - return dst; - } - --static int ip6_dst_gc(struct dst_ops *ops) -+static void ip6_dst_gc(struct dst_ops *ops) - { - struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops); - int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval; -- int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size; - int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity; - int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout; - unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc; -@@ -3300,11 +3299,10 @@ static int ip6_dst_gc(struct dst_ops *ops) - int entries; - - entries = dst_entries_get_fast(ops); -- if (entries > rt_max_size) -+ if (entries > ops->gc_thresh) - entries = dst_entries_get_slow(ops); - -- if (time_after(rt_last_gc + rt_min_interval, jiffies) && -- entries <= rt_max_size) -+ if (time_after(rt_last_gc + rt_min_interval, jiffies)) - goto out; - - fib6_run_gc(atomic_inc_return(&net->ipv6.ip6_rt_gc_expire), net, true); -@@ -3314,7 +3312,6 @@ static int ip6_dst_gc(struct dst_ops *ops) - out: - val = atomic_read(&net->ipv6.ip6_rt_gc_expire); - atomic_set(&net->ipv6.ip6_rt_gc_expire, val - (val >> rt_elasticity)); -- return entries > rt_max_size; - } - - static int ip6_nh_lookup_table(struct net *net, struct fib6_config *cfg, -@@ -6517,7 +6514,7 @@ static int __net_init ip6_route_net_init(struct net *net) - #endif - - net->ipv6.sysctl.flush_delay = 0; -- net->ipv6.sysctl.ip6_rt_max_size = 4096; -+ net->ipv6.sysctl.ip6_rt_max_size = INT_MAX; - net->ipv6.sysctl.ip6_rt_gc_min_interval = HZ / 2; - net->ipv6.sysctl.ip6_rt_gc_timeout = 60*HZ; - net->ipv6.sysctl.ip6_rt_gc_interval = 30*HZ; diff --git a/patch/kernel/odroidxu4-current/patch-6.1.73-74.patch b/patch/kernel/odroidxu4-current/patch-6.1.73-74.patch deleted file mode 100644 index 4e3e51d397..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.73-74.patch +++ /dev/null @@ -1,3175 +0,0 @@ -diff --git a/Makefile b/Makefile -index e4f2d019ca745..63125d1ffd9cf 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 73 -+SUBLEVEL = 74 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c -index 3c1590c27fae3..723abcb10c801 100644 ---- a/arch/arc/kernel/signal.c -+++ b/arch/arc/kernel/signal.c -@@ -61,7 +61,7 @@ struct rt_sigframe { - unsigned int sigret_magic; - }; - --static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) -+static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) - { - int err = 0; - #ifndef CONFIG_ISA_ARCOMPACT -@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) - #else - v2abi.r58 = v2abi.r59 = 0; - #endif -- err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi)); -+ err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi)); - #endif - return err; - } - --static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) -+static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) - { - int err = 0; - #ifndef CONFIG_ISA_ARCOMPACT -diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c -index b2f5f4f28705f..f779e386b6e7d 100644 ---- a/arch/arm/mach-sunxi/mc_smp.c -+++ b/arch/arm/mach-sunxi/mc_smp.c -@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void) - for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) { - ret = of_property_match_string(node, "enable-method", - sunxi_mc_smp_data[i].enable_method); -- if (!ret) -+ if (ret >= 0) - break; - } - - of_node_put(node); -- if (ret) -+ if (ret < 0) - return -ENODEV; - - is_a83t = sunxi_mc_smp_data[i].is_a83t; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi -index ee6095baba4d3..7d9b8064ad2ec 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi -@@ -510,8 +510,7 @@ ap_i2c_tp: &i2c5 { - &pci_rootport { - mvl_wifi: wifi@0,0 { - compatible = "pci1b4b,2b42"; -- reg = <0x83010000 0x0 0x00000000 0x0 0x00100000 -- 0x83010000 0x0 0x00100000 0x0 0x00100000>; -+ reg = <0x0000 0x0 0x0 0x0 0x0>; - interrupt-parent = <&gpio0>; - interrupts = <8 IRQ_TYPE_LEVEL_LOW>; - pinctrl-names = "default"; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts -index 853e88455e750..9e4b12ed62cbe 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts -+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts -@@ -34,8 +34,8 @@ - &pci_rootport { - wifi@0,0 { - compatible = "qcom,ath10k"; -- reg = <0x00010000 0x0 0x00000000 0x0 0x00000000>, -- <0x03010010 0x0 0x00000000 0x0 0x00200000>; -+ reg = <0x00000000 0x0 0x00000000 0x0 0x00000000>, -+ <0x03000010 0x0 0x00000000 0x0 0x00200000>; - qcom,ath10k-calibration-variant = "GO_DUMO"; - }; - }; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi -index 23bfba86daabe..7ba25315dd9ab 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi -@@ -489,6 +489,7 @@ ap_i2c_audio: &i2c8 { - #address-cells = <3>; - #size-cells = <2>; - ranges; -+ device_type = "pci"; - }; - }; - -diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi -index 234b5bbda1204..f4d6dbbbddcd4 100644 ---- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi -@@ -958,7 +958,7 @@ - , - , - ; -- interrupt-names = "sys", "pmc", "msi", "legacy", "err"; -+ interrupt-names = "sys", "pmc", "msg", "legacy", "err"; - bus-range = <0x0 0xf>; - clocks = <&cru ACLK_PCIE20_MST>, <&cru ACLK_PCIE20_SLV>, - <&cru ACLK_PCIE20_DBI>, <&cru PCLK_PCIE20>, -diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h -index b9a4ab54285c1..9b16a3b8e7060 100644 ---- a/arch/loongarch/include/asm/elf.h -+++ b/arch/loongarch/include/asm/elf.h -@@ -293,7 +293,7 @@ extern const char *__elf_platform; - #define ELF_PLAT_INIT(_r, load_addr) do { \ - _r->regs[1] = _r->regs[2] = _r->regs[3] = _r->regs[4] = 0; \ - _r->regs[5] = _r->regs[6] = _r->regs[7] = _r->regs[8] = 0; \ -- _r->regs[9] = _r->regs[10] = _r->regs[11] = _r->regs[12] = 0; \ -+ _r->regs[9] = _r->regs[10] /* syscall n */ = _r->regs[12] = 0; \ - _r->regs[13] = _r->regs[14] = _r->regs[15] = _r->regs[16] = 0; \ - _r->regs[17] = _r->regs[18] = _r->regs[19] = _r->regs[20] = 0; \ - _r->regs[21] = _r->regs[22] = _r->regs[23] = _r->regs[24] = 0; \ -diff --git a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi -index 8143a61111e33..c16b521308cb1 100644 ---- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi -+++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi -@@ -123,8 +123,7 @@ - compatible = "pci0014,7a03.0", - "pci0014,7a03", - "pciclass0c0320", -- "pciclass0c03", -- "loongson, pci-gmac"; -+ "pciclass0c03"; - - reg = <0x1800 0x0 0x0 0x0 0x0>; - interrupts = <12 IRQ_TYPE_LEVEL_LOW>, -diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi -index 2f45fce2cdc4a..ed99ee316febb 100644 ---- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi -+++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi -@@ -186,8 +186,7 @@ - compatible = "pci0014,7a03.0", - "pci0014,7a03", - "pciclass020000", -- "pciclass0200", -- "loongson, pci-gmac"; -+ "pciclass0200"; - - reg = <0x1800 0x0 0x0 0x0 0x0>; - interrupts = <12 IRQ_TYPE_LEVEL_HIGH>, -diff --git a/block/blk-mq.c b/block/blk-mq.c -index 383d94615e502..368f1947c8956 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -1500,14 +1500,26 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q, - } - EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list); - -+static bool blk_is_flush_data_rq(struct request *rq) -+{ -+ return (rq->rq_flags & RQF_FLUSH_SEQ) && !is_flush_rq(rq); -+} -+ - static bool blk_mq_rq_inflight(struct request *rq, void *priv) - { - /* - * If we find a request that isn't idle we know the queue is busy - * as it's checked in the iter. - * Return false to stop the iteration. -+ * -+ * In case of queue quiesce, if one flush data request is completed, -+ * don't count it as inflight given the flush sequence is suspended, -+ * and the original flush data request is invisible to driver, just -+ * like other pending requests because of quiesce - */ -- if (blk_mq_request_started(rq)) { -+ if (blk_mq_request_started(rq) && !(blk_queue_quiesced(rq->q) && -+ blk_is_flush_data_rq(rq) && -+ blk_mq_request_completed(rq))) { - bool *busy = priv; - - *busy = true; -diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c -index c297e40c5bdc0..5ebeb0d7b6be0 100644 ---- a/drivers/acpi/resource.c -+++ b/drivers/acpi/resource.c -@@ -512,6 +512,13 @@ static const struct dmi_system_id maingear_laptop[] = { - DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"), - }, - }, -+ { -+ /* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."), -+ DMI_MATCH(DMI_BOARD_NAME, "RP-15"), -+ }, -+ }, - { - /* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ - .matches = { -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 9cc3a2b1b4fc1..d933ef6cc65af 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -5005,7 +5005,7 @@ static __poll_t binder_poll(struct file *filp, - - thread = binder_get_thread(proc); - if (!thread) -- return POLLERR; -+ return EPOLLERR; - - binder_inner_proc_lock(thread->proc); - thread->looper |= BINDER_LOOPER_STATE_POLL; -diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c -index cd87f12733f27..ed607850f87fb 100644 ---- a/drivers/android/binder_alloc.c -+++ b/drivers/android/binder_alloc.c -@@ -557,7 +557,7 @@ err_alloc_buf_struct_failed: - * is the sum of the three given sizes (each rounded up to - * pointer-sized boundary) - * -- * Return: The allocated buffer or %NULL if error -+ * Return: The allocated buffer or %ERR_PTR(-errno) if error - */ - struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, - size_t data_size, -@@ -706,7 +706,7 @@ void binder_alloc_free_buf(struct binder_alloc *alloc, - /* - * We could eliminate the call to binder_alloc_clear_buf() - * from binder_alloc_deferred_release() by moving this to -- * binder_alloc_free_buf_locked(). However, that could -+ * binder_free_buf_locked(). However, that could - * increase contention for the alloc mutex if clear_on_free - * is used frequently for large buffers. The mutex is not - * needed for correctness here. -@@ -1005,7 +1005,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item, - goto err_mmget; - if (!mmap_read_trylock(mm)) - goto err_mmap_read_lock_failed; -- vma = binder_alloc_get_vma(alloc); -+ vma = vma_lookup(mm, page_addr); -+ if (vma && vma != binder_alloc_get_vma(alloc)) -+ goto err_invalid_vma; - - list_lru_isolate(lru, item); - spin_unlock(lock); -@@ -1031,6 +1033,8 @@ enum lru_status binder_alloc_free_page(struct list_head *item, - mutex_unlock(&alloc->mutex); - return LRU_REMOVED_RETRY; - -+err_invalid_vma: -+ mmap_read_unlock(mm); - err_mmap_read_lock_failed: - mmput_async(mm); - err_mmget: -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index efa5535a8e1d8..3124837aa406f 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -609,12 +609,12 @@ static void virtblk_config_changed(struct virtio_device *vdev) - static int init_vq(struct virtio_blk *vblk) - { - int err; -- int i; -+ unsigned short i; - vq_callback_t **callbacks; - const char **names; - struct virtqueue **vqs; - unsigned short num_vqs; -- unsigned int num_poll_vqs; -+ unsigned short num_poll_vqs; - struct virtio_device *vdev = vblk->vdev; - struct irq_affinity desc = { 0, }; - -@@ -658,13 +658,13 @@ static int init_vq(struct virtio_blk *vblk) - - for (i = 0; i < num_vqs - num_poll_vqs; i++) { - callbacks[i] = virtblk_done; -- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%d", i); -+ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%u", i); - names[i] = vblk->vqs[i].name; - } - - for (; i < num_vqs; i++) { - callbacks[i] = NULL; -- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); -+ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%u", i); - names[i] = vblk->vqs[i].name; - } - -diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c -index aa53797dbfc14..7782785a86e69 100644 ---- a/drivers/clk/rockchip/clk-rk3128.c -+++ b/drivers/clk/rockchip/clk-rk3128.c -@@ -490,7 +490,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { - GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS), - GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS), - GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS), -- GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS), -+ GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS), - GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS), - GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS), - GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS), -diff --git a/drivers/clk/rockchip/clk-rk3568.c b/drivers/clk/rockchip/clk-rk3568.c -index 2f54f630c8b65..1ffb755feea4f 100644 ---- a/drivers/clk/rockchip/clk-rk3568.c -+++ b/drivers/clk/rockchip/clk-rk3568.c -@@ -72,6 +72,7 @@ static struct rockchip_pll_rate_table rk3568_pll_rates[] = { - RK3036_PLL_RATE(408000000, 1, 68, 2, 2, 1, 0), - RK3036_PLL_RATE(312000000, 1, 78, 6, 1, 1, 0), - RK3036_PLL_RATE(297000000, 2, 99, 4, 1, 1, 0), -+ RK3036_PLL_RATE(292500000, 1, 195, 4, 4, 1, 0), - RK3036_PLL_RATE(241500000, 2, 161, 4, 2, 1, 0), - RK3036_PLL_RATE(216000000, 1, 72, 4, 2, 1, 0), - RK3036_PLL_RATE(200000000, 1, 100, 3, 4, 1, 0), -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -index fd796574f87a5..8123feb1a1161 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -@@ -479,6 +479,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, - if (size & 0x3 || *pos & 0x3) - return -EINVAL; - -+ if (!adev->didt_rreg) -+ return -EOPNOTSUPP; -+ - r = pm_runtime_get_sync(adev_to_drm(adev)->dev); - if (r < 0) { - pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); -@@ -535,6 +538,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user - if (size & 0x3 || *pos & 0x3) - return -EINVAL; - -+ if (!adev->didt_wreg) -+ return -EOPNOTSUPP; -+ - r = pm_runtime_get_sync(adev_to_drm(adev)->dev); - if (r < 0) { - pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); -diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c -index 2eddd7f6cd41e..811dd3ea63620 100644 ---- a/drivers/gpu/drm/amd/amdgpu/soc15.c -+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c -@@ -1411,9 +1411,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags) - if (amdgpu_sriov_vf(adev)) - *flags = 0; - -- adev->nbio.funcs->get_clockgating_state(adev, flags); -+ if (adev->nbio.funcs && adev->nbio.funcs->get_clockgating_state) -+ adev->nbio.funcs->get_clockgating_state(adev, flags); - -- adev->hdp.funcs->get_clock_gating_state(adev, flags); -+ if (adev->hdp.funcs && adev->hdp.funcs->get_clock_gating_state) -+ adev->hdp.funcs->get_clock_gating_state(adev, flags); - - if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(13, 0, 2)) { - -@@ -1429,9 +1431,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags) - } - - /* AMD_CG_SUPPORT_ROM_MGCG */ -- adev->smuio.funcs->get_clock_gating_state(adev, flags); -+ if (adev->smuio.funcs && adev->smuio.funcs->get_clock_gating_state) -+ adev->smuio.funcs->get_clock_gating_state(adev, flags); - -- adev->df.funcs->get_clockgating_state(adev, flags); -+ if (adev->df.funcs && adev->df.funcs->get_clockgating_state) -+ adev->df.funcs->get_clockgating_state(adev, flags); - } - - static int soc15_common_set_powergating_state(void *handle, -diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c -index e507d2e1410b7..93e40e0a15087 100644 ---- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c -+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c -@@ -1018,13 +1018,20 @@ static enum bp_result get_ss_info_v4_5( - DC_LOG_BIOS("AS_SIGNAL_TYPE_HDMI ss_percentage: %d\n", ss_info->spread_spectrum_percentage); - break; - case AS_SIGNAL_TYPE_DISPLAY_PORT: -- ss_info->spread_spectrum_percentage = -+ if (bp->base.integrated_info) { -+ DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", bp->base.integrated_info->gpuclk_ss_percentage); -+ ss_info->spread_spectrum_percentage = -+ bp->base.integrated_info->gpuclk_ss_percentage; -+ ss_info->type.CENTER_MODE = -+ bp->base.integrated_info->gpuclk_ss_type; -+ } else { -+ ss_info->spread_spectrum_percentage = - disp_cntl_tbl->dp_ss_percentage; -- ss_info->spread_spectrum_range = -+ ss_info->spread_spectrum_range = - disp_cntl_tbl->dp_ss_rate_10hz * 10; -- if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE) -- ss_info->type.CENTER_MODE = true; -- -+ if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE) -+ ss_info->type.CENTER_MODE = true; -+ } - DC_LOG_BIOS("AS_SIGNAL_TYPE_DISPLAY_PORT ss_percentage: %d\n", ss_info->spread_spectrum_percentage); - break; - case AS_SIGNAL_TYPE_GPU_PLL: -@@ -2830,6 +2837,8 @@ static enum bp_result get_integrated_info_v2_2( - info->ma_channel_number = info_v2_2->umachannelnumber; - info->dp_ss_control = - le16_to_cpu(info_v2_2->reserved1); -+ info->gpuclk_ss_percentage = info_v2_2->gpuclk_ss_percentage; -+ info->gpuclk_ss_type = info_v2_2->gpuclk_ss_type; - - for (i = 0; i < NUMBER_OF_UCHAR_FOR_GUID; ++i) { - info->ext_disp_conn_info.gu_id[i] = -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -index 893991a0eb971..28b83133db910 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c -@@ -324,7 +324,7 @@ static struct wm_table lpddr5_wm_table = { - { - .wm_inst = WM_A, - .wm_type = WM_TYPE_PSTATE_CHG, -- .pstate_latency_us = 11.65333, -+ .pstate_latency_us = 129.0, - .sr_exit_time_us = 11.5, - .sr_enter_plus_exit_time_us = 14.5, - .valid = true, -@@ -332,7 +332,7 @@ static struct wm_table lpddr5_wm_table = { - { - .wm_inst = WM_B, - .wm_type = WM_TYPE_PSTATE_CHG, -- .pstate_latency_us = 11.65333, -+ .pstate_latency_us = 129.0, - .sr_exit_time_us = 11.5, - .sr_enter_plus_exit_time_us = 14.5, - .valid = true, -@@ -340,7 +340,7 @@ static struct wm_table lpddr5_wm_table = { - { - .wm_inst = WM_C, - .wm_type = WM_TYPE_PSTATE_CHG, -- .pstate_latency_us = 11.65333, -+ .pstate_latency_us = 129.0, - .sr_exit_time_us = 11.5, - .sr_enter_plus_exit_time_us = 14.5, - .valid = true, -@@ -348,7 +348,7 @@ static struct wm_table lpddr5_wm_table = { - { - .wm_inst = WM_D, - .wm_type = WM_TYPE_PSTATE_CHG, -- .pstate_latency_us = 11.65333, -+ .pstate_latency_us = 129.0, - .sr_exit_time_us = 11.5, - .sr_enter_plus_exit_time_us = 14.5, - .valid = true, -diff --git a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h -index bc96d02113608..813463ffe15c5 100644 ---- a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h -+++ b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h -@@ -417,6 +417,8 @@ struct integrated_info { - /* V2.1 */ - struct edp_info edp1_info; - struct edp_info edp2_info; -+ uint32_t gpuclk_ss_percentage; -+ uint32_t gpuclk_ss_type; - }; - - /* -diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index df9bf3c9206e7..cb90e70d85e86 100644 ---- a/drivers/gpu/drm/drm_crtc.c -+++ b/drivers/gpu/drm/drm_crtc.c -@@ -715,8 +715,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, - struct drm_mode_set set; - uint32_t __user *set_connectors_ptr; - struct drm_modeset_acquire_ctx ctx; -- int ret; -- int i; -+ int ret, i, num_connectors = 0; - - if (!drm_core_check_feature(dev, DRIVER_MODESET)) - return -EOPNOTSUPP; -@@ -871,6 +870,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, - connector->name); - - connector_set[i] = connector; -+ num_connectors++; - } - } - -@@ -879,7 +879,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, - set.y = crtc_req->y; - set.mode = mode; - set.connectors = connector_set; -- set.num_connectors = crtc_req->count_connectors; -+ set.num_connectors = num_connectors; - set.fb = fb; - - if (drm_drv_uses_atomic_modeset(dev)) -@@ -892,7 +892,7 @@ out: - drm_framebuffer_put(fb); - - if (connector_set) { -- for (i = 0; i < crtc_req->count_connectors; i++) { -+ for (i = 0; i < num_connectors; i++) { - if (connector_set[i]) - drm_connector_put(connector_set[i]); - } -diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c -index a971590b81323..e2c7373f20c6b 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_dma.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c -@@ -107,18 +107,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, - return 0; - - if (!priv->mapping) { -- void *mapping; -+ void *mapping = NULL; - - if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) - mapping = arm_iommu_create_mapping(&platform_bus_type, - EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); - else if (IS_ENABLED(CONFIG_IOMMU_DMA)) - mapping = iommu_get_domain_for_dev(priv->dma_dev); -- else -- mapping = ERR_PTR(-ENODEV); - -- if (IS_ERR(mapping)) -- return PTR_ERR(mapping); -+ if (!mapping) -+ return -ENODEV; - priv->mapping = mapping; - } - -diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c -index b7c11bdce2c89..1a7194a653ae5 100644 ---- a/drivers/gpu/drm/exynos/exynos_hdmi.c -+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c -@@ -1861,6 +1861,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data) - return ret; - - crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI); -+ if (IS_ERR(crtc)) -+ return PTR_ERR(crtc); - crtc->pipe_clk = &hdata->phy_clk; - - ret = hdmi_create_connector(encoder); -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c -index 6cb5eefa45e9a..5a08458fe1b7f 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c -@@ -31,7 +31,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) - - type |= 0x00000001; /* PAGE_ALL */ - if (atomic_read(&vmm->engref[NVKM_SUBDEV_BAR])) -- type |= 0x00000004; /* HUB_ONLY */ -+ type |= 0x00000006; /* HUB_ONLY | ALL PDB (hack) */ - - mutex_lock(&vmm->mmu->mutex); - -diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c -index 8a8a3dd8af0c1..df07e3ae0ffb4 100644 ---- a/drivers/hid/hid-nintendo.c -+++ b/drivers/hid/hid-nintendo.c -@@ -325,28 +325,28 @@ struct joycon_imu_cal { - * All the controller's button values are stored in a u32. - * They can be accessed with bitwise ANDs. - */ --static const u32 JC_BTN_Y = BIT(0); --static const u32 JC_BTN_X = BIT(1); --static const u32 JC_BTN_B = BIT(2); --static const u32 JC_BTN_A = BIT(3); --static const u32 JC_BTN_SR_R = BIT(4); --static const u32 JC_BTN_SL_R = BIT(5); --static const u32 JC_BTN_R = BIT(6); --static const u32 JC_BTN_ZR = BIT(7); --static const u32 JC_BTN_MINUS = BIT(8); --static const u32 JC_BTN_PLUS = BIT(9); --static const u32 JC_BTN_RSTICK = BIT(10); --static const u32 JC_BTN_LSTICK = BIT(11); --static const u32 JC_BTN_HOME = BIT(12); --static const u32 JC_BTN_CAP = BIT(13); /* capture button */ --static const u32 JC_BTN_DOWN = BIT(16); --static const u32 JC_BTN_UP = BIT(17); --static const u32 JC_BTN_RIGHT = BIT(18); --static const u32 JC_BTN_LEFT = BIT(19); --static const u32 JC_BTN_SR_L = BIT(20); --static const u32 JC_BTN_SL_L = BIT(21); --static const u32 JC_BTN_L = BIT(22); --static const u32 JC_BTN_ZL = BIT(23); -+#define JC_BTN_Y BIT(0) -+#define JC_BTN_X BIT(1) -+#define JC_BTN_B BIT(2) -+#define JC_BTN_A BIT(3) -+#define JC_BTN_SR_R BIT(4) -+#define JC_BTN_SL_R BIT(5) -+#define JC_BTN_R BIT(6) -+#define JC_BTN_ZR BIT(7) -+#define JC_BTN_MINUS BIT(8) -+#define JC_BTN_PLUS BIT(9) -+#define JC_BTN_RSTICK BIT(10) -+#define JC_BTN_LSTICK BIT(11) -+#define JC_BTN_HOME BIT(12) -+#define JC_BTN_CAP BIT(13) /* capture button */ -+#define JC_BTN_DOWN BIT(16) -+#define JC_BTN_UP BIT(17) -+#define JC_BTN_RIGHT BIT(18) -+#define JC_BTN_LEFT BIT(19) -+#define JC_BTN_SR_L BIT(20) -+#define JC_BTN_SL_L BIT(21) -+#define JC_BTN_L BIT(22) -+#define JC_BTN_ZL BIT(23) - - enum joycon_msg_type { - JOYCON_MSG_TYPE_NONE, -@@ -859,14 +859,27 @@ static int joycon_request_calibration(struct joycon_ctlr *ctlr) - */ - static void joycon_calc_imu_cal_divisors(struct joycon_ctlr *ctlr) - { -- int i; -+ int i, divz = 0; - - for (i = 0; i < 3; i++) { - ctlr->imu_cal_accel_divisor[i] = ctlr->accel_cal.scale[i] - - ctlr->accel_cal.offset[i]; - ctlr->imu_cal_gyro_divisor[i] = ctlr->gyro_cal.scale[i] - - ctlr->gyro_cal.offset[i]; -+ -+ if (ctlr->imu_cal_accel_divisor[i] == 0) { -+ ctlr->imu_cal_accel_divisor[i] = 1; -+ divz++; -+ } -+ -+ if (ctlr->imu_cal_gyro_divisor[i] == 0) { -+ ctlr->imu_cal_gyro_divisor[i] = 1; -+ divz++; -+ } - } -+ -+ if (divz) -+ hid_warn(ctlr->hdev, "inaccurate IMU divisors (%d)\n", divz); - } - - static const s16 DFLT_ACCEL_OFFSET /*= 0*/; -@@ -1095,16 +1108,16 @@ static void joycon_parse_imu_report(struct joycon_ctlr *ctlr, - JC_IMU_SAMPLES_PER_DELTA_AVG) { - ctlr->imu_avg_delta_ms = ctlr->imu_delta_samples_sum / - ctlr->imu_delta_samples_count; -- /* don't ever want divide by zero shenanigans */ -- if (ctlr->imu_avg_delta_ms == 0) { -- ctlr->imu_avg_delta_ms = 1; -- hid_warn(ctlr->hdev, -- "calculated avg imu delta of 0\n"); -- } - ctlr->imu_delta_samples_count = 0; - ctlr->imu_delta_samples_sum = 0; - } - -+ /* don't ever want divide by zero shenanigans */ -+ if (ctlr->imu_avg_delta_ms == 0) { -+ ctlr->imu_avg_delta_ms = 1; -+ hid_warn(ctlr->hdev, "calculated avg imu delta of 0\n"); -+ } -+ - /* useful for debugging IMU sample rate */ - hid_dbg(ctlr->hdev, - "imu_report: ms=%u last_ms=%u delta=%u avg_delta=%u\n", -diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c -index 2210aa62e3d06..ec7f27a6ce016 100644 ---- a/drivers/hwmon/corsair-psu.c -+++ b/drivers/hwmon/corsair-psu.c -@@ -837,7 +837,23 @@ static struct hid_driver corsairpsu_driver = { - .reset_resume = corsairpsu_resume, - #endif - }; --module_hid_driver(corsairpsu_driver); -+ -+static int __init corsair_init(void) -+{ -+ return hid_register_driver(&corsairpsu_driver); -+} -+ -+static void __exit corsair_exit(void) -+{ -+ hid_unregister_driver(&corsairpsu_driver); -+} -+ -+/* -+ * With module_init() the driver would load before the HID bus when -+ * built-in, so use late_initcall() instead. -+ */ -+late_initcall(corsair_init); -+module_exit(corsair_exit); - - MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Wilken Gottwalt "); -diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h -index 0174fbf1a9637..d8e4d902b01ad 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x.h -+++ b/drivers/hwtracing/coresight/coresight-etm4x.h -@@ -1032,7 +1032,7 @@ struct etmv4_drvdata { - u8 ctxid_size; - u8 vmid_size; - u8 ccsize; -- u8 ccitmin; -+ u16 ccitmin; - u8 s_ex_level; - u8 ns_ex_level; - u8 q_support; -diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c -index 016220ba0addd..8d8fa8e8afe04 100644 ---- a/drivers/hwtracing/ptt/hisi_ptt.c -+++ b/drivers/hwtracing/ptt/hisi_ptt.c -@@ -342,9 +342,9 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt) - return ret; - - hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ); -- ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq, -- NULL, hisi_ptt_isr, 0, -- DRV_NAME, hisi_ptt); -+ ret = devm_request_irq(&pdev->dev, hisi_ptt->trace_irq, hisi_ptt_isr, -+ IRQF_NOBALANCING | IRQF_NO_THREAD, DRV_NAME, -+ hisi_ptt); - if (ret) { - pci_err(pdev, "failed to request irq %d, ret = %d\n", - hisi_ptt->trace_irq, ret); -@@ -659,6 +659,9 @@ static int hisi_ptt_pmu_event_init(struct perf_event *event) - return -EOPNOTSUPP; - } - -+ if (event->attach_state & PERF_ATTACH_TASK) -+ return -EOPNOTSUPP; -+ - if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type) - return -ENOENT; - -diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c -index b31cf4f18f854..6aa4f1f062401 100644 ---- a/drivers/i2c/busses/i2c-rk3x.c -+++ b/drivers/i2c/busses/i2c-rk3x.c -@@ -178,6 +178,7 @@ struct rk3x_i2c_soc_data { - * @clk: function clk for rk3399 or function & Bus clks for others - * @pclk: Bus clk for rk3399 - * @clk_rate_nb: i2c clk rate change notify -+ * @irq: irq number - * @t: I2C known timing information - * @lock: spinlock for the i2c bus - * @wait: the waitqueue to wait for i2c transfer -@@ -200,6 +201,7 @@ struct rk3x_i2c { - struct clk *clk; - struct clk *pclk; - struct notifier_block clk_rate_nb; -+ int irq; - - /* Settings */ - struct i2c_timings t; -@@ -1087,13 +1089,18 @@ static int rk3x_i2c_xfer_common(struct i2c_adapter *adap, - - spin_unlock_irqrestore(&i2c->lock, flags); - -- rk3x_i2c_start(i2c); -- - if (!polling) { -+ rk3x_i2c_start(i2c); -+ - timeout = wait_event_timeout(i2c->wait, !i2c->busy, - msecs_to_jiffies(WAIT_TIMEOUT)); - } else { -+ disable_irq(i2c->irq); -+ rk3x_i2c_start(i2c); -+ - timeout = rk3x_i2c_wait_xfer_poll(i2c); -+ -+ enable_irq(i2c->irq); - } - - spin_lock_irqsave(&i2c->lock, flags); -@@ -1310,6 +1317,8 @@ static int rk3x_i2c_probe(struct platform_device *pdev) - return ret; - } - -+ i2c->irq = irq; -+ - platform_set_drvdata(pdev, i2c); - - if (i2c->soc_data->calc_timings == rk3x_i2c_v0_calc_timings) { -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 8404286302b0c..e8011d70d0799 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -286,6 +286,7 @@ static const struct xpad_device { - { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, - { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, -+ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, - { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, - { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, - { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, -diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c -index 246958795f606..e1e4f1133296a 100644 ---- a/drivers/input/keyboard/atkbd.c -+++ b/drivers/input/keyboard/atkbd.c -@@ -746,6 +746,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) - ps2dev->serio->phys); - } - -+#ifdef CONFIG_X86 -+static bool atkbd_is_portable_device(void) -+{ -+ static const char * const chassis_types[] = { -+ "8", /* Portable */ -+ "9", /* Laptop */ -+ "10", /* Notebook */ -+ "14", /* Sub-Notebook */ -+ "31", /* Convertible */ -+ "32", /* Detachable */ -+ }; -+ int i; -+ -+ for (i = 0; i < ARRAY_SIZE(chassis_types); i++) -+ if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i])) -+ return true; -+ -+ return false; -+} -+ -+/* -+ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops -+ * the controller is always in translated mode. In this mode mice/touchpads will -+ * not work. So in this case simply assume a keyboard is connected to avoid -+ * confusing some laptop keyboards. -+ * -+ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is -+ * ok in translated mode, only atkbd_select_set() checks atkbd->id and in -+ * translated mode that is a no-op. -+ */ -+static bool atkbd_skip_getid(struct atkbd *atkbd) -+{ -+ return atkbd->translated && atkbd_is_portable_device(); -+} -+#else -+static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; } -+#endif -+ - /* - * atkbd_probe() probes for an AT keyboard on a serio port. - */ -@@ -775,12 +813,12 @@ static int atkbd_probe(struct atkbd *atkbd) - */ - - param[0] = param[1] = 0xa5; /* initialize with invalid values */ -- if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { -+ if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { - - /* -- * If the get ID command failed, we check if we can at least set the LEDs on -- * the keyboard. This should work on every keyboard out there. It also turns -- * the LEDs off, which we want anyway. -+ * If the get ID command was skipped or failed, we check if we can at least set -+ * the LEDs on the keyboard. This should work on every keyboard out there. -+ * It also turns the LEDs off, which we want anyway. - */ - param[0] = 0; - if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index e43e93ac2798a..b6749af462620 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -183,6 +183,7 @@ static const char * const smbus_pnp_ids[] = { - "LEN009b", /* T580 */ - "LEN0402", /* X1 Extreme Gen 2 / P1 Gen 2 */ - "LEN040f", /* P1 Gen 3 */ -+ "LEN0411", /* L14 Gen 1 */ - "LEN200f", /* T450s */ - "LEN2044", /* L470 */ - "LEN2054", /* E480 */ -diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h -index 9c39553d30fa2..b585b1dab870e 100644 ---- a/drivers/input/serio/i8042-acpipnpio.h -+++ b/drivers/input/serio/i8042-acpipnpio.h -@@ -360,6 +360,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { - }, - .driver_data = (void *)(SERIO_QUIRK_DRITEK) - }, -+ { -+ /* Acer TravelMate P459-G2-M */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), -+ }, -+ .driver_data = (void *)(SERIO_QUIRK_NOMUX) -+ }, - { - /* Amoi M636/A737 */ - .matches = { -diff --git a/drivers/leds/trigger/ledtrig-tty.c b/drivers/leds/trigger/ledtrig-tty.c -index 8ae0d2d284aff..3e69a7bde9284 100644 ---- a/drivers/leds/trigger/ledtrig-tty.c -+++ b/drivers/leds/trigger/ledtrig-tty.c -@@ -168,6 +168,10 @@ static void ledtrig_tty_deactivate(struct led_classdev *led_cdev) - - cancel_delayed_work_sync(&trigger_data->dwork); - -+ kfree(trigger_data->ttyname); -+ tty_kref_put(trigger_data->tty); -+ trigger_data->tty = NULL; -+ - kfree(trigger_data); - } - -diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig -index 662d219c39bf4..db0e97020256e 100644 ---- a/drivers/md/Kconfig -+++ b/drivers/md/Kconfig -@@ -650,6 +650,7 @@ config DM_ZONED - - config DM_AUDIT - bool "DM audit events" -+ depends on BLK_DEV_DM - depends on AUDIT - help - Generate audit events for device-mapper. -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index e4564ca1f2434..f7783199f81d4 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -36,7 +36,6 @@ - */ - - #include --#include - #include - #include - #include -@@ -6833,18 +6832,7 @@ static void raid5d(struct md_thread *thread) - spin_unlock_irq(&conf->device_lock); - md_check_recovery(mddev); - spin_lock_irq(&conf->device_lock); -- -- /* -- * Waiting on MD_SB_CHANGE_PENDING below may deadlock -- * seeing md_check_recovery() is needed to clear -- * the flag when using mdmon. -- */ -- continue; - } -- -- wait_event_lock_irq(mddev->sb_wait, -- !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags), -- conf->device_lock); - } - pr_debug("%d stripes handled\n", handled); - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index f60a16de565ed..0c694ab3c110c 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -6447,6 +6447,14 @@ static void tg3_dump_state(struct tg3 *tp) - int i; - u32 *regs; - -+ /* If it is a PCI error, all registers will be 0xffff, -+ * we don't dump them out, just report the error and return -+ */ -+ if (tp->pdev->error_state != pci_channel_io_normal) { -+ netdev_err(tp->dev, "PCI channel ERROR!\n"); -+ return; -+ } -+ - regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); - if (!regs) - return; -@@ -11184,7 +11192,8 @@ static void tg3_reset_task(struct work_struct *work) - rtnl_lock(); - tg3_full_lock(tp, 0); - -- if (tp->pcierr_recovery || !netif_running(tp->dev)) { -+ if (tp->pcierr_recovery || !netif_running(tp->dev) || -+ tp->pdev->error_state != pci_channel_io_normal) { - tg3_flag_clear(tp, RESET_TASK_PENDING); - tg3_full_unlock(tp); - rtnl_unlock(); -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -index 49c7aa86faaa8..e129ee1020f0a 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c -@@ -59,11 +59,6 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id - return -ENODEV; - } - -- if (!of_device_is_compatible(np, "loongson, pci-gmac")) { -- pr_info("dwmac_loongson_pci: Incompatible OF node\n"); -- return -ENODEV; -- } -- - plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); - if (!plat) - return -ENOMEM; -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -index 57a11ee05bc36..91b73e7a41134 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c -@@ -1381,7 +1381,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, - * if it is true then one of the handlers took the page. - */ - -- if (reclaim) { -+ if (reclaim && txq) { - u16 sequence = le16_to_cpu(pkt->hdr.sequence); - int index = SEQ_TO_INDEX(sequence); - int cmd_index = iwl_txq_get_cmd_index(txq, index); -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 5b906dbb1096c..0c088db944706 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1511,7 +1511,8 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, - if (id->ncap == 0) { - /* namespace not allocated or attached */ - info->is_removed = true; -- return -ENODEV; -+ ret = -ENODEV; -+ goto error; - } - - info->anagrpid = id->anagrpid; -@@ -1529,8 +1530,10 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, - !memchr_inv(ids->nguid, 0, sizeof(ids->nguid))) - memcpy(ids->nguid, id->nguid, sizeof(ids->nguid)); - } -+ -+error: - kfree(id); -- return 0; -+ return ret; - } - - static int nvme_ns_info_from_id_cs_indep(struct nvme_ctrl *ctrl, -@@ -1922,9 +1925,10 @@ static void nvme_update_disk_info(struct gendisk *disk, - - /* - * The block layer can't support LBA sizes larger than the page size -- * yet, so catch this early and don't allow block I/O. -+ * or smaller than a sector size yet, so catch this early and don't -+ * allow block I/O. - */ -- if (ns->lba_shift > PAGE_SHIFT) { -+ if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) { - capacity = 0; - bs = (1 << 9); - } -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index 118bf08a708b9..a892d679e3389 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -382,6 +382,11 @@ struct nvme_ctrl { - enum nvme_dctype dctype; - }; - -+static inline enum nvme_ctrl_state nvme_ctrl_state(struct nvme_ctrl *ctrl) -+{ -+ return READ_ONCE(ctrl->state); -+} -+ - enum nvme_iopolicy { - NVME_IOPOLICY_NUMA, - NVME_IOPOLICY_RR, -diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c -index 6a2816f3b4e80..73ae16059a1cb 100644 ---- a/drivers/nvme/target/configfs.c -+++ b/drivers/nvme/target/configfs.c -@@ -16,6 +16,7 @@ - #endif - #include - #include -+#include - - #include "nvmet.h" - -@@ -508,6 +509,7 @@ static ssize_t nvmet_ns_ana_grpid_store(struct config_item *item, - - down_write(&nvmet_ana_sem); - oldgrpid = ns->anagrpid; -+ newgrpid = array_index_nospec(newgrpid, NVMET_MAX_ANAGRPS); - nvmet_ana_group_enabled[newgrpid]++; - ns->anagrpid = newgrpid; - nvmet_ana_group_enabled[oldgrpid]--; -@@ -1580,6 +1582,7 @@ static struct config_group *nvmet_ana_groups_make_group( - grp->grpid = grpid; - - down_write(&nvmet_ana_sem); -+ grpid = array_index_nospec(grpid, NVMET_MAX_ANAGRPS); - nvmet_ana_group_enabled[grpid]++; - up_write(&nvmet_ana_sem); - -diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c -index 9f5d784cd95d5..3644997a83425 100644 ---- a/drivers/parport/parport_serial.c -+++ b/drivers/parport/parport_serial.c -@@ -65,6 +65,10 @@ enum parport_pc_pci_cards { - sunix_5069a, - sunix_5079a, - sunix_5099a, -+ brainboxes_uc257, -+ brainboxes_is300, -+ brainboxes_uc414, -+ brainboxes_px263, - }; - - /* each element directly indexed from enum list, above */ -@@ -158,6 +162,10 @@ static struct parport_pc_pci cards[] = { - /* sunix_5069a */ { 1, { { 1, 2 }, } }, - /* sunix_5079a */ { 1, { { 1, 2 }, } }, - /* sunix_5099a */ { 1, { { 1, 2 }, } }, -+ /* brainboxes_uc257 */ { 1, { { 3, -1 }, } }, -+ /* brainboxes_is300 */ { 1, { { 3, -1 }, } }, -+ /* brainboxes_uc414 */ { 1, { { 3, -1 }, } }, -+ /* brainboxes_px263 */ { 1, { { 3, -1 }, } }, - }; - - static struct pci_device_id parport_serial_pci_tbl[] = { -@@ -277,6 +285,38 @@ static struct pci_device_id parport_serial_pci_tbl[] = { - { PCI_VENDOR_ID_SUNIX, PCI_DEVICE_ID_SUNIX_1999, PCI_VENDOR_ID_SUNIX, - 0x0104, 0, 0, sunix_5099a }, - -+ /* Brainboxes UC-203 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0bc1, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0bc2, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ -+ /* Brainboxes UC-257 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0861, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0862, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0863, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ -+ /* Brainboxes UC-414 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0e61, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc414 }, -+ -+ /* Brainboxes UC-475 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0981, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ { PCI_VENDOR_ID_INTASHIELD, 0x0982, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, -+ -+ /* Brainboxes IS-300/IS-500 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x0da0, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_is300 }, -+ -+ /* Brainboxes PX-263/PX-295 */ -+ { PCI_VENDOR_ID_INTASHIELD, 0x402c, -+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px263 }, -+ - { 0, } /* terminate list */ - }; - MODULE_DEVICE_TABLE(pci,parport_serial_pci_tbl); -@@ -542,6 +582,30 @@ static struct pciserial_board pci_parport_serial_boards[] = { - .base_baud = 921600, - .uart_offset = 0x8, - }, -+ [brainboxes_uc257] = { -+ .flags = FL_BASE2, -+ .num_ports = 2, -+ .base_baud = 115200, -+ .uart_offset = 8, -+ }, -+ [brainboxes_is300] = { -+ .flags = FL_BASE2, -+ .num_ports = 1, -+ .base_baud = 115200, -+ .uart_offset = 8, -+ }, -+ [brainboxes_uc414] = { -+ .flags = FL_BASE2, -+ .num_ports = 4, -+ .base_baud = 115200, -+ .uart_offset = 8, -+ }, -+ [brainboxes_px263] = { -+ .flags = FL_BASE2, -+ .num_ports = 4, -+ .base_baud = 921600, -+ .uart_offset = 8, -+ }, - }; - - struct parport_serial_private { -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index c132839d99dc8..8765544bac35c 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4602,17 +4602,21 @@ static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags) - * But the implementation could block peer-to-peer transactions between them - * and provide ACS-like functionality. - */ --static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags) -+static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags) - { - if (!pci_is_pcie(dev) || - ((pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) && - (pci_pcie_type(dev) != PCI_EXP_TYPE_DOWNSTREAM))) - return -ENOTTY; - -+ /* -+ * Future Zhaoxin Root Ports and Switch Downstream Ports will -+ * implement ACS capability in accordance with the PCIe Spec. -+ */ - switch (dev->device) { - case 0x0710 ... 0x071e: - case 0x0721: -- case 0x0723 ... 0x0732: -+ case 0x0723 ... 0x0752: - return pci_acs_ctrl_enabled(acs_flags, - PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); - } -diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig -index 530426a74f751..b3cea8d56c4f6 100644 ---- a/drivers/pinctrl/cirrus/Kconfig -+++ b/drivers/pinctrl/cirrus/Kconfig -@@ -1,7 +1,8 @@ - # SPDX-License-Identifier: GPL-2.0-only - config PINCTRL_LOCHNAGAR - tristate "Cirrus Logic Lochnagar pinctrl driver" -- depends on MFD_LOCHNAGAR -+ # Avoid clash caused by MIPS defining RST, which is used in the driver -+ depends on MFD_LOCHNAGAR && !MIPS - select GPIOLIB - select PINMUX - select PINCONF -diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c -index 68509a2301b8f..5abab6bc763ae 100644 ---- a/drivers/pinctrl/pinctrl-cy8c95x0.c -+++ b/drivers/pinctrl/pinctrl-cy8c95x0.c -@@ -749,6 +749,8 @@ static int cy8c95x0_gpio_get_pincfg(struct cy8c95x0_pinctrl *chip, - ret = regmap_read(chip->regmap, reg, ®_val); - if (reg_val & bit) - arg = 1; -+ if (param == PIN_CONFIG_OUTPUT_ENABLE) -+ arg = !arg; - - *config = pinconf_to_config_packed(param, (u16)arg); - out: -@@ -857,7 +859,7 @@ static int cy8c95x0_setup_gpiochip(struct cy8c95x0_pinctrl *chip) - gc->get_direction = cy8c95x0_gpio_get_direction; - gc->get_multiple = cy8c95x0_gpio_get_multiple; - gc->set_multiple = cy8c95x0_gpio_set_multiple; -- gc->set_config = gpiochip_generic_config, -+ gc->set_config = gpiochip_generic_config; - gc->can_sleep = true; - gc->add_pin_ranges = cy8c95x0_add_pin_ranges; - -diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c -index c5e4e35c8d204..8e2b07ed2ce94 100644 ---- a/drivers/platform/x86/intel/vbtn.c -+++ b/drivers/platform/x86/intel/vbtn.c -@@ -73,10 +73,10 @@ struct intel_vbtn_priv { - bool wakeup_mode; - }; - --static void detect_tablet_mode(struct platform_device *device) -+static void detect_tablet_mode(struct device *dev) - { -- struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); -- acpi_handle handle = ACPI_HANDLE(&device->dev); -+ struct intel_vbtn_priv *priv = dev_get_drvdata(dev); -+ acpi_handle handle = ACPI_HANDLE(dev); - unsigned long long vgbs; - acpi_status status; - int m; -@@ -89,6 +89,8 @@ static void detect_tablet_mode(struct platform_device *device) - input_report_switch(priv->switches_dev, SW_TABLET_MODE, m); - m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0; - input_report_switch(priv->switches_dev, SW_DOCK, m); -+ -+ input_sync(priv->switches_dev); - } - - /* -@@ -134,7 +136,7 @@ static int intel_vbtn_input_setup(struct platform_device *device) - priv->switches_dev->id.bustype = BUS_HOST; - - if (priv->has_switches) { -- detect_tablet_mode(device); -+ detect_tablet_mode(&device->dev); - - ret = input_register_device(priv->switches_dev); - if (ret) -@@ -198,6 +200,9 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) - autorelease = val && (!ke_rel || ke_rel->type == KE_IGNORE); - - sparse_keymap_report_event(input_dev, event, val, autorelease); -+ -+ /* Some devices need this to report further events */ -+ acpi_evaluate_object(handle, "VBDL", NULL, NULL); - } - - /* -@@ -358,7 +363,13 @@ static void intel_vbtn_pm_complete(struct device *dev) - - static int intel_vbtn_pm_resume(struct device *dev) - { -+ struct intel_vbtn_priv *priv = dev_get_drvdata(dev); -+ - intel_vbtn_pm_complete(dev); -+ -+ if (priv->has_switches) -+ detect_tablet_mode(dev); -+ - return 0; - } - -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index 05a55bc31c796..6edd2e294750e 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -8149,8 +8149,19 @@ static struct ibm_struct volume_driver_data = { - * TPACPI_FAN_WR_TPEC is also available and should be used to - * command the fan. The X31/X40/X41 seems to have 8 fan levels, - * but the ACPI tables just mention level 7. -+ * -+ * TPACPI_FAN_RD_TPEC_NS: -+ * This mode is used for a few ThinkPads (L13 Yoga Gen2, X13 Yoga Gen2 etc.) -+ * that are using non-standard EC locations for reporting fan speeds. -+ * Currently these platforms only provide fan rpm reporting. -+ * - */ - -+#define FAN_RPM_CAL_CONST 491520 /* FAN RPM calculation offset for some non-standard ECFW */ -+ -+#define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */ -+#define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */ -+ - enum { /* Fan control constants */ - fan_status_offset = 0x2f, /* EC register 0x2f */ - fan_rpm_offset = 0x84, /* EC register 0x84: LSB, 0x85 MSB (RPM) -@@ -8158,6 +8169,11 @@ enum { /* Fan control constants */ - fan_select_offset = 0x31, /* EC register 0x31 (Firmware 7M) - bit 0 selects which fan is active */ - -+ fan_status_offset_ns = 0x93, /* Special status/control offset for non-standard EC Fan1 */ -+ fan2_status_offset_ns = 0x96, /* Special status/control offset for non-standard EC Fan2 */ -+ fan_rpm_status_ns = 0x95, /* Special offset for Fan1 RPM status for non-standard EC */ -+ fan2_rpm_status_ns = 0x98, /* Special offset for Fan2 RPM status for non-standard EC */ -+ - TP_EC_FAN_FULLSPEED = 0x40, /* EC fan mode: full speed */ - TP_EC_FAN_AUTO = 0x80, /* EC fan mode: auto fan control */ - -@@ -8168,6 +8184,7 @@ enum fan_status_access_mode { - TPACPI_FAN_NONE = 0, /* No fan status or control */ - TPACPI_FAN_RD_ACPI_GFAN, /* Use ACPI GFAN */ - TPACPI_FAN_RD_TPEC, /* Use ACPI EC regs 0x2f, 0x84-0x85 */ -+ TPACPI_FAN_RD_TPEC_NS, /* Use non-standard ACPI EC regs (eg: L13 Yoga gen2 etc.) */ - }; - - enum fan_control_access_mode { -@@ -8195,6 +8212,8 @@ static u8 fan_control_desired_level; - static u8 fan_control_resume_level; - static int fan_watchdog_maxinterval; - -+static bool fan_with_ns_addr; -+ - static struct mutex fan_mutex; - - static void fan_watchdog_fire(struct work_struct *ignored); -@@ -8325,6 +8344,15 @@ static int fan_get_status(u8 *status) - } - - break; -+ case TPACPI_FAN_RD_TPEC_NS: -+ /* Default mode is AUTO which means controlled by EC */ -+ if (!acpi_ec_read(fan_status_offset_ns, &s)) -+ return -EIO; -+ -+ if (status) -+ *status = s; -+ -+ break; - - default: - return -ENXIO; -@@ -8341,7 +8369,8 @@ static int fan_get_status_safe(u8 *status) - if (mutex_lock_killable(&fan_mutex)) - return -ERESTARTSYS; - rc = fan_get_status(&s); -- if (!rc) -+ /* NS EC doesn't have register with level settings */ -+ if (!rc && !fan_with_ns_addr) - fan_update_desired_level(s); - mutex_unlock(&fan_mutex); - -@@ -8368,7 +8397,13 @@ static int fan_get_speed(unsigned int *speed) - - if (likely(speed)) - *speed = (hi << 8) | lo; -+ break; -+ case TPACPI_FAN_RD_TPEC_NS: -+ if (!acpi_ec_read(fan_rpm_status_ns, &lo)) -+ return -EIO; - -+ if (speed) -+ *speed = lo ? FAN_RPM_CAL_CONST / lo : 0; - break; - - default: -@@ -8380,7 +8415,7 @@ static int fan_get_speed(unsigned int *speed) - - static int fan2_get_speed(unsigned int *speed) - { -- u8 hi, lo; -+ u8 hi, lo, status; - bool rc; - - switch (fan_status_access_mode) { -@@ -8396,7 +8431,21 @@ static int fan2_get_speed(unsigned int *speed) - - if (likely(speed)) - *speed = (hi << 8) | lo; -+ break; - -+ case TPACPI_FAN_RD_TPEC_NS: -+ rc = !acpi_ec_read(fan2_status_offset_ns, &status); -+ if (rc) -+ return -EIO; -+ if (!(status & FAN_NS_CTRL_STATUS)) { -+ pr_info("secondary fan control not supported\n"); -+ return -EIO; -+ } -+ rc = !acpi_ec_read(fan2_rpm_status_ns, &lo); -+ if (rc) -+ return -EIO; -+ if (speed) -+ *speed = lo ? FAN_RPM_CAL_CONST / lo : 0; - break; - - default: -@@ -8899,6 +8948,7 @@ static const struct attribute_group fan_driver_attr_group = { - #define TPACPI_FAN_2FAN 0x0002 /* EC 0x31 bit 0 selects fan2 */ - #define TPACPI_FAN_2CTL 0x0004 /* selects fan2 control */ - #define TPACPI_FAN_NOFAN 0x0008 /* no fan available */ -+#define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */ - - static const struct tpacpi_quirk fan_quirk_table[] __initconst = { - TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1), -@@ -8917,6 +8967,8 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { - TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */ - TPACPI_Q_LNV3('N', '3', '0', TPACPI_FAN_2CTL), /* P15 (1st gen) / P15v (1st gen) */ - TPACPI_Q_LNV3('N', '3', '7', TPACPI_FAN_2CTL), /* T15g (2nd gen) */ -+ TPACPI_Q_LNV3('R', '1', 'F', TPACPI_FAN_NS), /* L13 Yoga Gen 2 */ -+ TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS), /* X13 Yoga Gen 2*/ - TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */ - }; - -@@ -8951,18 +9003,27 @@ static int __init fan_init(struct ibm_init_struct *iibm) - return -ENODEV; - } - -+ if (quirks & TPACPI_FAN_NS) { -+ pr_info("ECFW with non-standard fan reg control found\n"); -+ fan_with_ns_addr = 1; -+ /* Fan ctrl support from host is undefined for now */ -+ tp_features.fan_ctrl_status_undef = 1; -+ } -+ - if (gfan_handle) { - /* 570, 600e/x, 770e, 770x */ - fan_status_access_mode = TPACPI_FAN_RD_ACPI_GFAN; - } else { - /* all other ThinkPads: note that even old-style - * ThinkPad ECs supports the fan control register */ -- if (likely(acpi_ec_read(fan_status_offset, -- &fan_control_initial_status))) { -+ if (fan_with_ns_addr || -+ likely(acpi_ec_read(fan_status_offset, &fan_control_initial_status))) { - int res; - unsigned int speed; - -- fan_status_access_mode = TPACPI_FAN_RD_TPEC; -+ fan_status_access_mode = fan_with_ns_addr ? -+ TPACPI_FAN_RD_TPEC_NS : TPACPI_FAN_RD_TPEC; -+ - if (quirks & TPACPI_FAN_Q1) - fan_quirk1_setup(); - /* Try and probe the 2nd fan */ -@@ -8971,7 +9032,8 @@ static int __init fan_init(struct ibm_init_struct *iibm) - if (res >= 0 && speed != FAN_NOT_PRESENT) { - /* It responded - so let's assume it's there */ - tp_features.second_fan = 1; -- tp_features.second_fan_ctl = 1; -+ /* fan control not currently available for ns ECFW */ -+ tp_features.second_fan_ctl = !fan_with_ns_addr; - pr_info("secondary fan control detected & enabled\n"); - } else { - /* Fan not auto-detected */ -@@ -9146,6 +9208,7 @@ static int fan_read(struct seq_file *m) - str_enabled_disabled(status), status); - break; - -+ case TPACPI_FAN_RD_TPEC_NS: - case TPACPI_FAN_RD_TPEC: - /* all except 570, 600e/x, 770e, 770x */ - rc = fan_get_status_safe(&status); -@@ -9160,13 +9223,22 @@ static int fan_read(struct seq_file *m) - - seq_printf(m, "speed:\t\t%d\n", speed); - -- if (status & TP_EC_FAN_FULLSPEED) -- /* Disengaged mode takes precedence */ -- seq_printf(m, "level:\t\tdisengaged\n"); -- else if (status & TP_EC_FAN_AUTO) -- seq_printf(m, "level:\t\tauto\n"); -- else -- seq_printf(m, "level:\t\t%d\n", status); -+ if (fan_status_access_mode == TPACPI_FAN_RD_TPEC_NS) { -+ /* -+ * No full speed bit in NS EC -+ * EC Auto mode is set by default. -+ * No other levels settings available -+ */ -+ seq_printf(m, "level:\t\t%s\n", status & FAN_NS_CTRL ? "unknown" : "auto"); -+ } else { -+ if (status & TP_EC_FAN_FULLSPEED) -+ /* Disengaged mode takes precedence */ -+ seq_printf(m, "level:\t\tdisengaged\n"); -+ else if (status & TP_EC_FAN_AUTO) -+ seq_printf(m, "level:\t\tauto\n"); -+ else -+ seq_printf(m, "level:\t\t%d\n", status); -+ } - break; - - case TPACPI_FAN_NONE: -diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c -index 5ca145b64e63d..30951914afac7 100644 ---- a/drivers/reset/hisilicon/hi6220_reset.c -+++ b/drivers/reset/hisilicon/hi6220_reset.c -@@ -164,7 +164,7 @@ static int hi6220_reset_probe(struct platform_device *pdev) - if (!data) - return -ENOMEM; - -- type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev); -+ type = (uintptr_t)of_device_get_match_data(dev); - - regmap = syscon_node_to_regmap(np); - if (IS_ERR(regmap)) { -diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c -index 0c1df1d5f1aca..a165b1a59fde5 100644 ---- a/drivers/s390/block/scm_blk.c -+++ b/drivers/s390/block/scm_blk.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - #include "scm_blk.h" - -@@ -130,7 +131,7 @@ static void scm_request_done(struct scm_request *scmrq) - - for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) { - msb = &scmrq->aob->msb[i]; -- aidaw = msb->data_addr; -+ aidaw = (u64)phys_to_virt(msb->data_addr); - - if ((msb->flags & MSB_FLAG_IDA) && aidaw && - IS_ALIGNED(aidaw, PAGE_SIZE)) -@@ -195,12 +196,12 @@ static int scm_request_prepare(struct scm_request *scmrq) - msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9); - msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE; - msb->flags |= MSB_FLAG_IDA; -- msb->data_addr = (u64) aidaw; -+ msb->data_addr = (u64)virt_to_phys(aidaw); - - rq_for_each_segment(bv, req, iter) { - WARN_ON(bv.bv_offset); - msb->blk_count += bv.bv_len >> 12; -- aidaw->data_addr = (u64) page_address(bv.bv_page); -+ aidaw->data_addr = virt_to_phys(page_address(bv.bv_page)); - aidaw++; - } - -diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c -index 43afbb7c5ab91..e55e8cef8defc 100644 ---- a/drivers/uio/uio.c -+++ b/drivers/uio/uio.c -@@ -466,13 +466,13 @@ static int uio_open(struct inode *inode, struct file *filep) - - mutex_lock(&minor_lock); - idev = idr_find(&uio_idr, iminor(inode)); -- mutex_unlock(&minor_lock); - if (!idev) { - ret = -ENODEV; -+ mutex_unlock(&minor_lock); - goto out; - } -- - get_device(&idev->dev); -+ mutex_unlock(&minor_lock); - - if (!try_module_get(idev->owner)) { - ret = -ENODEV; -@@ -1064,9 +1064,8 @@ void uio_unregister_device(struct uio_info *info) - wake_up_interruptible(&idev->wait); - kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - -- device_unregister(&idev->dev); -- - uio_free_minor(minor); -+ device_unregister(&idev->dev); - - return; - } -diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c -index b54f470e0d031..b38304b444764 100644 ---- a/fs/debugfs/file.c -+++ b/fs/debugfs/file.c -@@ -84,6 +84,14 @@ int debugfs_file_get(struct dentry *dentry) - struct debugfs_fsdata *fsd; - void *d_fsd; - -+ /* -+ * This could only happen if some debugfs user erroneously calls -+ * debugfs_file_get() on a dentry that isn't even a file, let -+ * them know about it. -+ */ -+ if (WARN_ON(!d_is_reg(dentry))) -+ return -EINVAL; -+ - d_fsd = READ_ONCE(dentry->d_fsdata); - if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) { - fsd = d_fsd; -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index 2e8e112b19930..08ef685167ec5 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -237,17 +237,19 @@ static const struct super_operations debugfs_super_operations = { - - static void debugfs_release_dentry(struct dentry *dentry) - { -- void *fsd = dentry->d_fsdata; -+ struct debugfs_fsdata *fsd = dentry->d_fsdata; - -- if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) -- kfree(dentry->d_fsdata); -+ if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) -+ return; -+ -+ kfree(fsd); - } - - static struct vfsmount *debugfs_automount(struct path *path) - { -- debugfs_automount_t f; -- f = (debugfs_automount_t)path->dentry->d_fsdata; -- return f(path->dentry, d_inode(path->dentry)->i_private); -+ struct debugfs_fsdata *fsd = path->dentry->d_fsdata; -+ -+ return fsd->automount(path->dentry, d_inode(path->dentry)->i_private); - } - - static const struct dentry_operations debugfs_dops = { -@@ -635,13 +637,23 @@ struct dentry *debugfs_create_automount(const char *name, - void *data) - { - struct dentry *dentry = start_creating(name, parent); -+ struct debugfs_fsdata *fsd; - struct inode *inode; - - if (IS_ERR(dentry)) - return dentry; - -+ fsd = kzalloc(sizeof(*fsd), GFP_KERNEL); -+ if (!fsd) { -+ failed_creating(dentry); -+ return ERR_PTR(-ENOMEM); -+ } -+ -+ fsd->automount = f; -+ - if (!(debugfs_allow & DEBUGFS_ALLOW_API)) { - failed_creating(dentry); -+ kfree(fsd); - return ERR_PTR(-EPERM); - } - -@@ -649,13 +661,14 @@ struct dentry *debugfs_create_automount(const char *name, - if (unlikely(!inode)) { - pr_err("out of free dentries, can not create automount '%s'\n", - name); -+ kfree(fsd); - return failed_creating(dentry); - } - - make_empty_dir_inode(inode); - inode->i_flags |= S_AUTOMOUNT; - inode->i_private = data; -- dentry->d_fsdata = (void *)f; -+ dentry->d_fsdata = fsd; - /* directory inodes start off with i_nlink == 2 (for "." entry) */ - inc_nlink(inode); - d_instantiate(dentry, inode); -diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h -index 92af8ae313134..f7c489b5a368c 100644 ---- a/fs/debugfs/internal.h -+++ b/fs/debugfs/internal.h -@@ -17,8 +17,14 @@ extern const struct file_operations debugfs_full_proxy_file_operations; - - struct debugfs_fsdata { - const struct file_operations *real_fops; -- refcount_t active_users; -- struct completion active_users_drained; -+ union { -+ /* automount_fn is used when real_fops is NULL */ -+ debugfs_automount_t automount; -+ struct { -+ refcount_t active_users; -+ struct completion active_users_drained; -+ }; -+ }; - }; - - /* -diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c -index adaad16468d8a..8816e13ca7c9e 100644 ---- a/fs/f2fs/xattr.c -+++ b/fs/f2fs/xattr.c -@@ -754,6 +754,12 @@ retry: - memcpy(pval, value, size); - last->e_value_size = cpu_to_le16(size); - new_hsize += newsize; -+ /* -+ * Explicitly add the null terminator. The unused xattr space -+ * is supposed to always be zeroed, which would make this -+ * unnecessary, but don't depend on that. -+ */ -+ *(u32 *)((u8 *)last + newsize) = 0; - } - - error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index f1d9db6686e31..556b259a00ba6 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -123,7 +123,7 @@ static int journal_submit_commit_record(journal_t *journal, - struct commit_header *tmp; - struct buffer_head *bh; - struct timespec64 now; -- blk_opf_t write_flags = REQ_OP_WRITE | REQ_SYNC; -+ blk_opf_t write_flags = REQ_OP_WRITE | JBD2_JOURNAL_REQ_FLAGS; - - *cbh = NULL; - -@@ -300,6 +300,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal, - if (!ret) - ret = err; - } -+ cond_resched(); - spin_lock(&journal->j_list_lock); - jinode->i_flags &= ~JI_COMMIT_RUNNING; - smp_mb(); -@@ -429,8 +430,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) - */ - jbd2_journal_update_sb_log_tail(journal, - journal->j_tail_sequence, -- journal->j_tail, -- REQ_SYNC); -+ journal->j_tail, 0); - mutex_unlock(&journal->j_checkpoint_mutex); - } else { - jbd2_debug(3, "superblock not updated\n"); -@@ -749,6 +749,7 @@ start_journal_io: - - for (i = 0; i < bufs; i++) { - struct buffer_head *bh = wbuf[i]; -+ - /* - * Compute checksum. - */ -@@ -761,7 +762,8 @@ start_journal_io: - clear_buffer_dirty(bh); - set_buffer_uptodate(bh); - bh->b_end_io = journal_end_buffer_io_sync; -- submit_bh(REQ_OP_WRITE | REQ_SYNC, bh); -+ submit_bh(REQ_OP_WRITE | JBD2_JOURNAL_REQ_FLAGS, -+ bh); - } - cond_resched(); - -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index 2696f43e7239f..3df45e4699f10 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -1109,8 +1109,7 @@ int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) - * space and if we lose sb update during power failure we'd replay - * old transaction with possibly newly overwritten data. - */ -- ret = jbd2_journal_update_sb_log_tail(journal, tid, block, -- REQ_SYNC | REQ_FUA); -+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, REQ_FUA); - if (ret) - goto out; - -@@ -1597,8 +1596,7 @@ static int journal_reset(journal_t *journal) - */ - jbd2_journal_update_sb_log_tail(journal, - journal->j_tail_sequence, -- journal->j_tail, -- REQ_SYNC | REQ_FUA); -+ journal->j_tail, REQ_FUA); - mutex_unlock(&journal->j_checkpoint_mutex); - } - return jbd2_journal_start_thread(journal); -@@ -1620,9 +1618,16 @@ static int jbd2_write_superblock(journal_t *journal, blk_opf_t write_flags) - return -EIO; - } - -- trace_jbd2_write_superblock(journal, write_flags); -+ /* -+ * Always set high priority flags to exempt from block layer's -+ * QOS policies, e.g. writeback throttle. -+ */ -+ write_flags |= JBD2_JOURNAL_REQ_FLAGS; - if (!(journal->j_flags & JBD2_BARRIER)) - write_flags &= ~(REQ_FUA | REQ_PREFLUSH); -+ -+ trace_jbd2_write_superblock(journal, write_flags); -+ - if (buffer_write_io_error(bh)) { - /* - * Oh, dear. A previous attempt to write the journal -@@ -1871,7 +1876,7 @@ void jbd2_journal_update_sb_errno(journal_t *journal) - jbd2_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode); - sb->s_errno = cpu_to_be32(errcode); - -- jbd2_write_superblock(journal, REQ_SYNC | REQ_FUA); -+ jbd2_write_superblock(journal, REQ_FUA); - } - EXPORT_SYMBOL(jbd2_journal_update_sb_errno); - -@@ -2176,8 +2181,7 @@ int jbd2_journal_destroy(journal_t *journal) - ++journal->j_transaction_sequence; - write_unlock(&journal->j_state_lock); - -- jbd2_mark_journal_empty(journal, -- REQ_SYNC | REQ_PREFLUSH | REQ_FUA); -+ jbd2_mark_journal_empty(journal, REQ_PREFLUSH | REQ_FUA); - mutex_unlock(&journal->j_checkpoint_mutex); - } else - err = -EIO; -@@ -2486,7 +2490,7 @@ int jbd2_journal_flush(journal_t *journal, unsigned int flags) - * the magic code for a fully-recovered superblock. Any future - * commits of data to the journal will restore the current - * s_start value. */ -- jbd2_mark_journal_empty(journal, REQ_SYNC | REQ_FUA); -+ jbd2_mark_journal_empty(journal, REQ_FUA); - - if (flags) - err = __jbd2_journal_erase(journal, flags); -@@ -2536,7 +2540,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) - if (write) { - /* Lock to make assertions happy... */ - mutex_lock_io(&journal->j_checkpoint_mutex); -- jbd2_mark_journal_empty(journal, REQ_SYNC | REQ_FUA); -+ jbd2_mark_journal_empty(journal, REQ_FUA); - mutex_unlock(&journal->j_checkpoint_mutex); - } - -diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h -index c403816d0b6c1..97bb1838555b4 100644 ---- a/fs/smb/client/cifspdu.h -+++ b/fs/smb/client/cifspdu.h -@@ -882,11 +882,13 @@ typedef struct smb_com_open_rsp { - __u8 OplockLevel; - __u16 Fid; - __le32 CreateAction; -- __le64 CreationTime; -- __le64 LastAccessTime; -- __le64 LastWriteTime; -- __le64 ChangeTime; -- __le32 FileAttributes; -+ struct_group(common_attributes, -+ __le64 CreationTime; -+ __le64 LastAccessTime; -+ __le64 LastWriteTime; -+ __le64 ChangeTime; -+ __le32 FileAttributes; -+ ); - __le64 AllocationSize; - __le64 EndOfFile; - __le16 FileType; -@@ -2268,11 +2270,13 @@ typedef struct { - /* QueryFileInfo/QueryPathinfo (also for SetPath/SetFile) data buffer formats */ - /******************************************************************************/ - typedef struct { /* data block encoding of response to level 263 QPathInfo */ -- __le64 CreationTime; -- __le64 LastAccessTime; -- __le64 LastWriteTime; -- __le64 ChangeTime; -- __le32 Attributes; -+ struct_group(common_attributes, -+ __le64 CreationTime; -+ __le64 LastAccessTime; -+ __le64 LastWriteTime; -+ __le64 ChangeTime; -+ __le32 Attributes; -+ ); - __u32 Pad1; - __le64 AllocationSize; - __le64 EndOfFile; /* size ie offset to first free byte in file */ -diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c -index c90d4ec9292ca..67c5fc2b2db94 100644 ---- a/fs/smb/client/cifssmb.c -+++ b/fs/smb/client/cifssmb.c -@@ -1234,8 +1234,10 @@ openRetry: - *oplock |= CIFS_CREATE_ACTION; - - if (buf) { -- /* copy from CreationTime to Attributes */ -- memcpy((char *)buf, (char *)&rsp->CreationTime, 36); -+ /* copy commonly used attributes */ -+ memcpy(&buf->common_attributes, -+ &rsp->common_attributes, -+ sizeof(buf->common_attributes)); - /* the file_info buf is endian converted by caller */ - buf->AllocationSize = rsp->AllocationSize; - buf->EndOfFile = rsp->EndOfFile; -diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c -index fdf7a7f188c5f..15fa022e79993 100644 ---- a/fs/smb/client/smb2misc.c -+++ b/fs/smb/client/smb2misc.c -@@ -173,6 +173,21 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server) - } - - mid = le64_to_cpu(shdr->MessageId); -+ if (check_smb2_hdr(shdr, mid)) -+ return 1; -+ -+ if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { -+ cifs_dbg(VFS, "Invalid structure size %u\n", -+ le16_to_cpu(shdr->StructureSize)); -+ return 1; -+ } -+ -+ command = le16_to_cpu(shdr->Command); -+ if (command >= NUMBER_OF_SMB2_COMMANDS) { -+ cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); -+ return 1; -+ } -+ - if (len < pdu_size) { - if ((len >= hdr_size) - && (shdr->Status != 0)) { -@@ -193,21 +208,6 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server) - return 1; - } - -- if (check_smb2_hdr(shdr, mid)) -- return 1; -- -- if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { -- cifs_dbg(VFS, "Invalid structure size %u\n", -- le16_to_cpu(shdr->StructureSize)); -- return 1; -- } -- -- command = le16_to_cpu(shdr->Command); -- if (command >= NUMBER_OF_SMB2_COMMANDS) { -- cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); -- return 1; -- } -- - if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) { - if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 || - pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) { -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 4596d2dfdec3a..5a157000bdfe6 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -398,8 +398,10 @@ smb2_dump_detail(void *buf, struct TCP_Server_Info *server) - cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", - shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, - shdr->Id.SyncId.ProcessId); -- cifs_server_dbg(VFS, "smb buf %p len %u\n", buf, -- server->ops->calc_smb_size(buf)); -+ if (!server->ops->check_message(buf, server->total_read, server)) { -+ cifs_server_dbg(VFS, "smb buf %p len %u\n", buf, -+ server->ops->calc_smb_size(buf)); -+ } - #endif - } - -diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c -index 2dfbf1b23cfa0..e65f998ea4cfc 100644 ---- a/fs/smb/client/smb2pdu.c -+++ b/fs/smb/client/smb2pdu.c -@@ -3429,12 +3429,10 @@ __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, - } else { - trace_smb3_close_done(xid, persistent_fid, tcon->tid, - ses->Suid); -- /* -- * Note that have to subtract 4 since struct network_open_info -- * has a final 4 byte pad that close response does not have -- */ - if (pbuf) -- memcpy(pbuf, (char *)&rsp->CreationTime, sizeof(*pbuf) - 4); -+ memcpy(&pbuf->network_open_info, -+ &rsp->network_open_info, -+ sizeof(pbuf->network_open_info)); - } - - atomic_dec(&tcon->num_remote_opens); -diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h -index a5773a06aba8e..8d011fedecd03 100644 ---- a/fs/smb/client/smb2pdu.h -+++ b/fs/smb/client/smb2pdu.h -@@ -339,13 +339,15 @@ struct smb2_file_reparse_point_info { - } __packed; - - struct smb2_file_network_open_info { -- __le64 CreationTime; -- __le64 LastAccessTime; -- __le64 LastWriteTime; -- __le64 ChangeTime; -- __le64 AllocationSize; -- __le64 EndOfFile; -- __le32 Attributes; -+ struct_group(network_open_info, -+ __le64 CreationTime; -+ __le64 LastAccessTime; -+ __le64 LastWriteTime; -+ __le64 ChangeTime; -+ __le64 AllocationSize; -+ __le64 EndOfFile; -+ __le32 Attributes; -+ ); - __le32 Reserved; - } __packed; /* level 34 Query also similar returned in close rsp and open rsp */ - -diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h -index 5593bb49954c6..a3936ff53d9d0 100644 ---- a/fs/smb/common/smb2pdu.h -+++ b/fs/smb/common/smb2pdu.h -@@ -699,13 +699,16 @@ struct smb2_close_rsp { - __le16 StructureSize; /* 60 */ - __le16 Flags; - __le32 Reserved; -- __le64 CreationTime; -- __le64 LastAccessTime; -- __le64 LastWriteTime; -- __le64 ChangeTime; -- __le64 AllocationSize; /* Beginning of FILE_STANDARD_INFO equivalent */ -- __le64 EndOfFile; -- __le32 Attributes; -+ struct_group(network_open_info, -+ __le64 CreationTime; -+ __le64 LastAccessTime; -+ __le64 LastWriteTime; -+ __le64 ChangeTime; -+ /* Beginning of FILE_STANDARD_INFO equivalent */ -+ __le64 AllocationSize; -+ __le64 EndOfFile; -+ __le32 Attributes; -+ ); - } __packed; - - -diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c -index 6e5ed0ac578a6..46070951d163a 100644 ---- a/fs/smb/server/smb2pdu.c -+++ b/fs/smb/server/smb2pdu.c -@@ -2969,7 +2969,7 @@ int smb2_open(struct ksmbd_work *work) - &may_flags); - - if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -- if (open_flags & O_CREAT) { -+ if (open_flags & (O_CREAT | O_TRUNC)) { - ksmbd_debug(SMB, - "User does not have write permission\n"); - rc = -EACCES; -@@ -5941,12 +5941,6 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, - } - case FILE_RENAME_INFORMATION: - { -- if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -- ksmbd_debug(SMB, -- "User does not have write permission\n"); -- return -EACCES; -- } -- - if (buf_len < sizeof(struct smb2_file_rename_info)) - return -EINVAL; - -@@ -5966,12 +5960,6 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp, - } - case FILE_DISPOSITION_INFORMATION: - { -- if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -- ksmbd_debug(SMB, -- "User does not have write permission\n"); -- return -EACCES; -- } -- - if (buf_len < sizeof(struct smb2_file_disposition_info)) - return -EINVAL; - -@@ -6033,7 +6021,7 @@ int smb2_set_info(struct ksmbd_work *work) - { - struct smb2_set_info_req *req; - struct smb2_set_info_rsp *rsp; -- struct ksmbd_file *fp; -+ struct ksmbd_file *fp = NULL; - int rc = 0; - unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID; - -@@ -6053,6 +6041,13 @@ int smb2_set_info(struct ksmbd_work *work) - rsp = smb2_get_msg(work->response_buf); - } - -+ if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { -+ ksmbd_debug(SMB, "User does not have write permission\n"); -+ pr_err("User does not have write permission\n"); -+ rc = -EACCES; -+ goto err_out; -+ } -+ - if (!has_file_id(id)) { - id = req->VolatileFileId; - pid = req->PersistentFileId; -diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c -index d9bbd2eb89c35..6fd3560028d3a 100644 ---- a/fs/smb/server/smbacl.c -+++ b/fs/smb/server/smbacl.c -@@ -401,10 +401,6 @@ static void parse_dacl(struct user_namespace *user_ns, - if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) - return; - -- ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL); -- if (!ppace) -- return; -- - ret = init_acl_state(&acl_state, num_aces); - if (ret) - return; -@@ -414,6 +410,13 @@ static void parse_dacl(struct user_namespace *user_ns, - return; - } - -+ ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), GFP_KERNEL); -+ if (!ppace) { -+ free_acl_state(&default_acl_state); -+ free_acl_state(&acl_state); -+ return; -+ } -+ - /* - * reset rwx permissions for user/group/other. - * Also, if num_aces is 0 i.e. DACL has no ACEs, -diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h -index 870ae4cd82029..dce105f67b4d8 100644 ---- a/include/linux/ieee80211.h -+++ b/include/linux/ieee80211.h -@@ -2658,12 +2658,14 @@ ieee80211_he_oper_size(const u8 *he_oper_ie) - static inline const struct ieee80211_he_6ghz_oper * - ieee80211_he_6ghz_oper(const struct ieee80211_he_operation *he_oper) - { -- const u8 *ret = (const void *)&he_oper->optional; -+ const u8 *ret; - u32 he_oper_params; - - if (!he_oper) - return NULL; - -+ ret = (const void *)&he_oper->optional; -+ - he_oper_params = le32_to_cpu(he_oper->he_oper_params); - - if (!(he_oper_params & IEEE80211_HE_OPERATION_6GHZ_OP_INFO)) -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index ebb1608d9dcd2..6611af5f1d0c6 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -1374,6 +1374,9 @@ JBD2_FEATURE_INCOMPAT_FUNCS(csum2, CSUM_V2) - JBD2_FEATURE_INCOMPAT_FUNCS(csum3, CSUM_V3) - JBD2_FEATURE_INCOMPAT_FUNCS(fast_commit, FAST_COMMIT) - -+/* Journal high priority write IO operation flags */ -+#define JBD2_JOURNAL_REQ_FLAGS (REQ_META | REQ_SYNC | REQ_IDLE) -+ - /* - * Journal flag definitions - */ -diff --git a/init/Kconfig b/init/Kconfig -index de255842f5d09..148704640252e 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1914,7 +1914,7 @@ config RUST - depends on !MODVERSIONS - depends on !GCC_PLUGINS - depends on !RANDSTRUCT -- depends on !DEBUG_INFO_BTF -+ depends on !DEBUG_INFO_BTF || PAHOLE_HAS_LANG_EXCLUDE - select CONSTRUCTORS - help - Enables Rust support in the kernel. -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 71cad4f1323c6..1285e7fb597ee 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -3644,6 +3644,12 @@ rb_reserve_next_event(struct trace_buffer *buffer, - int nr_loops = 0; - int add_ts_default; - -+ /* ring buffer does cmpxchg, make sure it is safe in NMI context */ -+ if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) && -+ (unlikely(in_nmi()))) { -+ return NULL; -+ } -+ - rb_start_commit(cpu_buffer); - /* The commit page can not change after this */ - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index deae65af76ecf..2b3c4cd8382b3 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -4679,7 +4679,11 @@ static int s_show(struct seq_file *m, void *v) - iter->leftover = ret; - - } else { -- print_trace_line(iter); -+ ret = print_trace_line(iter); -+ if (ret == TRACE_TYPE_PARTIAL_LINE) { -+ iter->seq.full = 0; -+ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n"); -+ } - ret = trace_print_seq(m, &iter->seq); - /* - * If we overflow the seq_file buffer, then it will -@@ -4912,6 +4916,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp) - return 0; - } - -+int tracing_single_release_file_tr(struct inode *inode, struct file *filp) -+{ -+ tracing_release_file_tr(inode, filp); -+ return single_release(inode, filp); -+} -+ - static int tracing_mark_open(struct inode *inode, struct file *filp) - { - stream_open(inode, filp); -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index 10aaafa2936dc..aad7fcd84617c 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -592,6 +592,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp); - int tracing_open_generic_tr(struct inode *inode, struct file *filp); - int tracing_open_file_tr(struct inode *inode, struct file *filp); - int tracing_release_file_tr(struct inode *inode, struct file *filp); -+int tracing_single_release_file_tr(struct inode *inode, struct file *filp); - bool tracing_is_disabled(void); - bool tracer_tracing_is_on(struct trace_array *tr); - void tracer_tracing_on(struct trace_array *tr); -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index 1470af2190735..3b0da1bddf633 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -5532,10 +5532,12 @@ static int event_hist_open(struct inode *inode, struct file *file) - { - int ret; - -- ret = security_locked_down(LOCKDOWN_TRACEFS); -+ ret = tracing_open_file_tr(inode, file); - if (ret) - return ret; - -+ /* Clear private_data to avoid warning in single_open() */ -+ file->private_data = NULL; - return single_open(file, hist_show, file); - } - -@@ -5543,7 +5545,7 @@ const struct file_operations event_hist_fops = { - .open = event_hist_open, - .read = seq_read, - .llseek = seq_lseek, -- .release = single_release, -+ .release = tracing_single_release_file_tr, - }; - - #ifdef CONFIG_HIST_TRIGGERS_DEBUG -@@ -5809,10 +5811,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) - { - int ret; - -- ret = security_locked_down(LOCKDOWN_TRACEFS); -+ ret = tracing_open_file_tr(inode, file); - if (ret) - return ret; - -+ /* Clear private_data to avoid warning in single_open() */ -+ file->private_data = NULL; - return single_open(file, hist_debug_show, file); - } - -@@ -5820,7 +5824,7 @@ const struct file_operations event_hist_debug_fops = { - .open = event_hist_debug_open, - .read = seq_read, - .llseek = seq_lseek, -- .release = single_release, -+ .release = tracing_single_release_file_tr, - }; - #endif - -diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c -index 5cd4fb6563068..bf1965b180992 100644 ---- a/kernel/trace/trace_output.c -+++ b/kernel/trace/trace_output.c -@@ -1445,11 +1445,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, - { - struct print_entry *field; - struct trace_seq *s = &iter->seq; -+ int max = iter->ent_size - offsetof(struct print_entry, buf); - - trace_assign_type(field, iter->ent); - - seq_print_ip_sym(s, field->ip, flags); -- trace_seq_printf(s, ": %s", field->buf); -+ trace_seq_printf(s, ": %.*s", max, field->buf); - - return trace_handle_return(s); - } -@@ -1458,10 +1459,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, - struct trace_event *event) - { - struct print_entry *field; -+ int max = iter->ent_size - offsetof(struct print_entry, buf); - - trace_assign_type(field, iter->ent); - -- trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf); -+ trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf); - - return trace_handle_return(&iter->seq); - } -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index 4db0199651f56..95541b99aa8ea 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -364,6 +364,15 @@ config PAHOLE_HAS_BTF_TAG - btf_decl_tag) or not. Currently only clang compiler implements - these attributes, so make the config depend on CC_IS_CLANG. - -+config PAHOLE_HAS_LANG_EXCLUDE -+ def_bool PAHOLE_VERSION >= 124 -+ help -+ Support for the --lang_exclude flag which makes pahole exclude -+ compilation units from the supplied language. Used in Kbuild to -+ omit Rust CUs which are not supported in version 1.24 of pahole, -+ otherwise it would emit malformed kernel and module binaries when -+ using DEBUG_INFO_BTF_MODULES. -+ - config DEBUG_INFO_BTF_MODULES - def_bool y - depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF -diff --git a/lib/idr.c b/lib/idr.c -index 13f2758c23773..da36054c3ca02 100644 ---- a/lib/idr.c -+++ b/lib/idr.c -@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) - goto delete; - xas_store(&xas, xa_mk_value(v)); - } else { -- if (!test_bit(bit, bitmap->bitmap)) -+ if (!bitmap || !test_bit(bit, bitmap->bitmap)) - goto err; - __clear_bit(bit, bitmap->bitmap); - xas_set_mark(&xas, XA_FREE_MARK); -diff --git a/lib/test_ida.c b/lib/test_ida.c -index b068806259615..55105baa19da9 100644 ---- a/lib/test_ida.c -+++ b/lib/test_ida.c -@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) - IDA_BUG_ON(ida, !ida_is_empty(ida)); - } - -+/* -+ * Check various situations where we attempt to free an ID we don't own. -+ */ -+static void ida_check_bad_free(struct ida *ida) -+{ -+ unsigned long i; -+ -+ printk("vvv Ignore \"not allocated\" warnings\n"); -+ /* IDA is empty; all of these will fail */ -+ ida_free(ida, 0); -+ for (i = 0; i < 31; i++) -+ ida_free(ida, 1 << i); -+ -+ /* IDA contains a single value entry */ -+ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3); -+ ida_free(ida, 0); -+ for (i = 0; i < 31; i++) -+ ida_free(ida, 1 << i); -+ -+ /* IDA contains a single bitmap */ -+ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023); -+ ida_free(ida, 0); -+ for (i = 0; i < 31; i++) -+ ida_free(ida, 1 << i); -+ -+ /* IDA contains a tree */ -+ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1); -+ ida_free(ida, 0); -+ for (i = 0; i < 31; i++) -+ ida_free(ida, 1 << i); -+ printk("^^^ \"not allocated\" warnings over\n"); -+ -+ ida_free(ida, 3); -+ ida_free(ida, 1023); -+ ida_free(ida, (1 << 20) - 1); -+ -+ IDA_BUG_ON(ida, !ida_is_empty(ida)); -+} -+ - static DEFINE_IDA(ida); - - static int ida_checks(void) -@@ -162,6 +201,7 @@ static int ida_checks(void) - ida_check_leaf(&ida, 1024 * 64); - ida_check_max(&ida); - ida_check_conv(&ida); -+ ida_check_bad_free(&ida); - - printk("IDA: %u of %u tests passed\n", tests_passed, tests_run); - return (tests_run != tests_passed) ? 0 : -EINVAL; -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 41daa47d03934..c842f150c3048 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -253,9 +253,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) - { - int max_clean = atomic_read(&tbl->gc_entries) - - READ_ONCE(tbl->gc_thresh2); -+ u64 tmax = ktime_get_ns() + NSEC_PER_MSEC; - unsigned long tref = jiffies - 5 * HZ; - struct neighbour *n, *tmp; - int shrunk = 0; -+ int loop = 0; - - NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs); - -@@ -278,11 +280,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) - shrunk++; - if (shrunk >= max_clean) - break; -+ if (++loop == 16) { -+ if (ktime_get_ns() > tmax) -+ goto unlock; -+ loop = 0; -+ } - } - } - - WRITE_ONCE(tbl->last_flush, jiffies); -- -+unlock: - write_unlock_bh(&tbl->lock); - - return shrunk; -diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c -index ae42e956eff5a..9bfe128ada47d 100644 ---- a/net/mac80211/ht.c -+++ b/net/mac80211/ht.c -@@ -271,6 +271,7 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata, - case NL80211_CHAN_WIDTH_80: - case NL80211_CHAN_WIDTH_80P80: - case NL80211_CHAN_WIDTH_160: -+ case NL80211_CHAN_WIDTH_320: - bw = ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ? - IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20; - break; -diff --git a/net/mptcp/options.c b/net/mptcp/options.c -index 0c786ceda5ee6..74027bb5b4296 100644 ---- a/net/mptcp/options.c -+++ b/net/mptcp/options.c -@@ -103,6 +103,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, - mp_opt->suboptions |= OPTION_MPTCP_DSS; - mp_opt->use_map = 1; - mp_opt->mpc_map = 1; -+ mp_opt->use_ack = 0; - mp_opt->data_len = get_unaligned_be16(ptr); - ptr += 2; - } -diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c -index 3e40a1ba48f79..4a13b9f7abb44 100644 ---- a/net/qrtr/ns.c -+++ b/net/qrtr/ns.c -@@ -569,7 +569,9 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from, - if (!node) - return -ENOENT; - -- return server_del(node, port, true); -+ server_del(node, port, true); -+ -+ return 0; - } - - static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, -diff --git a/net/wireless/core.c b/net/wireless/core.c -index 63d75fecc2c53..8809e668ed912 100644 ---- a/net/wireless/core.c -+++ b/net/wireless/core.c -@@ -216,7 +216,9 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data) - { - struct cfg80211_registered_device *rdev = data; - -+ wiphy_lock(&rdev->wiphy); - rdev_rfkill_poll(rdev); -+ wiphy_unlock(&rdev->wiphy); - } - - void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev, -diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh -index 564c5632e1a24..bfe5a4082d8ea 100755 ---- a/scripts/decode_stacktrace.sh -+++ b/scripts/decode_stacktrace.sh -@@ -16,6 +16,21 @@ elif type c++filt >/dev/null 2>&1 ; then - cppfilt_opts=-i - fi - -+UTIL_SUFFIX= -+if [[ -z ${LLVM:-} ]]; then -+ UTIL_PREFIX=${CROSS_COMPILE:-} -+else -+ UTIL_PREFIX=llvm- -+ if [[ ${LLVM} == */ ]]; then -+ UTIL_PREFIX=${LLVM}${UTIL_PREFIX} -+ elif [[ ${LLVM} == -* ]]; then -+ UTIL_SUFFIX=${LLVM} -+ fi -+fi -+ -+READELF=${UTIL_PREFIX}readelf${UTIL_SUFFIX} -+ADDR2LINE=${UTIL_PREFIX}addr2line${UTIL_SUFFIX} -+ - if [[ $1 == "-r" ]] ; then - vmlinux="" - basepath="auto" -@@ -75,7 +90,7 @@ find_module() { - - if [[ "$modpath" != "" ]] ; then - for fn in $(find "$modpath" -name "${module//_/[-_]}.ko*") ; do -- if readelf -WS "$fn" | grep -qwF .debug_line ; then -+ if ${READELF} -WS "$fn" | grep -qwF .debug_line ; then - echo $fn - return - fi -@@ -169,7 +184,7 @@ parse_symbol() { - if [[ $aarray_support == true && "${cache[$module,$address]+isset}" == "isset" ]]; then - local code=${cache[$module,$address]} - else -- local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address" 2>/dev/null) -+ local code=$(${ADDR2LINE} -i -e "$objfile" "$address" 2>/dev/null) - if [[ $aarray_support == true ]]; then - cache[$module,$address]=$code - fi -diff --git a/scripts/pahole-flags.sh b/scripts/pahole-flags.sh -index 0d99ef17e4a52..728d55190d97a 100755 ---- a/scripts/pahole-flags.sh -+++ b/scripts/pahole-flags.sh -@@ -19,5 +19,12 @@ fi - if [ "${pahole_ver}" -ge "122" ]; then - extra_paholeopt="${extra_paholeopt} -j" - fi -+if [ "${pahole_ver}" -ge "124" ]; then -+ # see PAHOLE_HAS_LANG_EXCLUDE -+ extra_paholeopt="${extra_paholeopt} --lang_exclude=rust" -+fi -+if [ "${pahole_ver}" -ge "125" ]; then -+ extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_inconsistent_proto --btf_gen_optimized" -+fi - - echo ${extra_paholeopt} -diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c -index 2c4dfc0b7e342..696a958d93e9c 100644 ---- a/sound/hda/intel-nhlt.c -+++ b/sound/hda/intel-nhlt.c -@@ -238,7 +238,7 @@ EXPORT_SYMBOL(intel_nhlt_ssp_mclk_mask); - - static struct nhlt_specific_cfg * - nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch, -- u32 rate, u8 vbps, u8 bps) -+ u32 rate, u8 vbps, u8 bps, bool ignore_vbps) - { - struct nhlt_fmt_cfg *cfg = fmt->fmt_config; - struct wav_fmt *wfmt; -@@ -255,8 +255,12 @@ nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch, - dev_dbg(dev, "Endpoint format: ch=%d fmt=%d/%d rate=%d\n", - wfmt->channels, _vbps, _bps, wfmt->samples_per_sec); - -+ /* -+ * When looking for exact match of configuration ignore the vbps -+ * from NHLT table when ignore_vbps is true -+ */ - if (wfmt->channels == num_ch && wfmt->samples_per_sec == rate && -- vbps == _vbps && bps == _bps) -+ (ignore_vbps || vbps == _vbps) && bps == _bps) - return &cfg->config; - - cfg = (struct nhlt_fmt_cfg *)(cfg->config.caps + cfg->config.size); -@@ -289,6 +293,7 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, - { - struct nhlt_specific_cfg *cfg; - struct nhlt_endpoint *epnt; -+ bool ignore_vbps = false; - struct nhlt_fmt *fmt; - int i; - -@@ -298,7 +303,26 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, - dev_dbg(dev, "Looking for configuration:\n"); - dev_dbg(dev, " vbus_id=%d link_type=%d dir=%d, dev_type=%d\n", - bus_id, link_type, dir, dev_type); -- dev_dbg(dev, " ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate); -+ if (link_type == NHLT_LINK_DMIC && bps == 32 && (vbps == 24 || vbps == 32)) { -+ /* -+ * The DMIC hardware supports only one type of 32 bits sample -+ * size, which is 24 bit sampling on the MSB side and bits[1:0] -+ * are used for indicating the channel number. -+ * It has been observed that some NHLT tables have the vbps -+ * specified as 32 while some uses 24. -+ * The format these variations describe are identical, the -+ * hardware is configured and behaves the same way. -+ * Note: when the samples assumed to be vbps=32 then the 'noise' -+ * introduced by the lower two bits (channel number) have no -+ * real life implication on audio quality. -+ */ -+ dev_dbg(dev, -+ " ch=%d fmt=%d rate=%d (vbps is ignored for DMIC 32bit format)\n", -+ num_ch, bps, rate); -+ ignore_vbps = true; -+ } else { -+ dev_dbg(dev, " ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate); -+ } - dev_dbg(dev, "Endpoint count=%d\n", nhlt->endpoint_count); - - epnt = (struct nhlt_endpoint *)nhlt->desc; -@@ -307,7 +331,8 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, - if (nhlt_check_ep_match(dev, epnt, bus_id, link_type, dir, dev_type)) { - fmt = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size); - -- cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, vbps, bps); -+ cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, -+ vbps, bps, ignore_vbps); - if (cfg) - return cfg; - } -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 1c8ffc5cf97f6..5efb3adee48d9 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -7108,6 +7108,7 @@ enum { - ALC290_FIXUP_SUBWOOFER_HSJACK, - ALC269_FIXUP_THINKPAD_ACPI, - ALC269_FIXUP_DMIC_THINKPAD_ACPI, -+ ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO, - ALC255_FIXUP_ACER_MIC_NO_PRESENCE, - ALC255_FIXUP_ASUS_MIC_NO_PRESENCE, - ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -@@ -7454,6 +7455,14 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc269_fixup_pincfg_U7x7_headset_mic, - }, -+ [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x18, 0x03a19020 }, /* headset mic */ -+ { 0x1b, 0x90170150 }, /* speaker */ -+ { } -+ }, -+ }, - [ALC269_FIXUP_AMIC] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -9598,6 +9607,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x8735, "HP ProBook 435 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), - SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED), -+ SND_PCI_QUIRK(0x103c, 0x876e, "HP ENVY x360 Convertible 13-ay0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS), - SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x8780, "HP ZBook Fury 17 G7 Mobile Workstation", -@@ -9770,17 +9780,20 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), -+ SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), -- SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), - SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), - SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), -+ SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), - SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2), -+ SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), - SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), - SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2), -@@ -10032,6 +10045,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), -+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), - SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC), - SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), - SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), -diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c -index 1dde1f3196acc..808d002826233 100644 ---- a/sound/soc/amd/yc/acp6x-mach.c -+++ b/sound/soc/amd/yc/acp6x-mach.c -@@ -353,6 +353,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { - DMI_MATCH(DMI_PRODUCT_VERSION, "pang12"), - } - }, -+ { -+ .driver_data = &acp6x_card, -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "System76"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "pang13"), -+ } -+ }, - {} - }; - -diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c -index db39abb2a31b5..0b8ecd917a086 100644 ---- a/sound/soc/codecs/cs43130.c -+++ b/sound/soc/codecs/cs43130.c -@@ -579,7 +579,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk, - break; - case SND_SOC_DAIFMT_LEFT_J: - hi_size = bitwidth_sclk; -- frm_delay = 2; -+ frm_delay = 0; - frm_phase = 1; - break; - case SND_SOC_DAIFMT_DSP_A: -@@ -1683,7 +1683,7 @@ static ssize_t hpload_dc_r_show(struct device *dev, - return cs43130_show_dc(dev, buf, HP_RIGHT); - } - --static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = { -+static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = { - 24, - 43, - 93, -@@ -2363,7 +2363,7 @@ static const struct regmap_config cs43130_regmap = { - .use_single_write = true, - }; - --static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { -+static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { - 50, - 120, - }; -diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c -index 9251490548e8c..c8410769188a0 100644 ---- a/sound/soc/codecs/da7219-aad.c -+++ b/sound/soc/codecs/da7219-aad.c -@@ -663,7 +663,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) - aad_pdata->mic_det_thr = - da7219_aad_fw_mic_det_thr(dev, fw_val32); - else -- aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; -+ aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS; - - if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0) - aad_pdata->jack_ins_deb = -diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c -index 8af434e14bfba..21a00c86a1398 100644 ---- a/sound/soc/codecs/hdac_hda.c -+++ b/sound/soc/codecs/hdac_hda.c -@@ -124,6 +124,9 @@ static struct snd_soc_dai_driver hdac_hda_dais[] = { - .sig_bits = 24, - }, - }, -+}; -+ -+static struct snd_soc_dai_driver hdac_hda_hdmi_dais[] = { - { - .id = HDAC_HDMI_0_DAI_ID, - .name = "intel-hdmi-hifi1", -@@ -578,8 +581,16 @@ static const struct snd_soc_component_driver hdac_hda_codec = { - .endianness = 1, - }; - -+static const struct snd_soc_component_driver hdac_hda_hdmi_codec = { -+ .probe = hdac_hda_codec_probe, -+ .remove = hdac_hda_codec_remove, -+ .idle_bias_on = false, -+ .endianness = 1, -+}; -+ - static int hdac_hda_dev_probe(struct hdac_device *hdev) - { -+ struct hdac_hda_priv *hda_pvt = dev_get_drvdata(&hdev->dev); - struct hdac_ext_link *hlink; - int ret; - -@@ -592,9 +603,15 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev) - snd_hdac_ext_bus_link_get(hdev->bus, hlink); - - /* ASoC specific initialization */ -- ret = devm_snd_soc_register_component(&hdev->dev, -- &hdac_hda_codec, hdac_hda_dais, -- ARRAY_SIZE(hdac_hda_dais)); -+ if (hda_pvt->need_display_power) -+ ret = devm_snd_soc_register_component(&hdev->dev, -+ &hdac_hda_hdmi_codec, hdac_hda_hdmi_dais, -+ ARRAY_SIZE(hdac_hda_hdmi_dais)); -+ else -+ ret = devm_snd_soc_register_component(&hdev->dev, -+ &hdac_hda_codec, hdac_hda_dais, -+ ARRAY_SIZE(hdac_hda_dais)); -+ - if (ret < 0) { - dev_err(&hdev->dev, "failed to register HDA codec %d\n", ret); - return ret; -diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c -index 1aef281a99727..cd5053cfd5213 100644 ---- a/sound/soc/codecs/nau8822.c -+++ b/sound/soc/codecs/nau8822.c -@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, - struct soc_bytes_ext *params = (void *)kcontrol->private_value; - int i, reg; - u16 reg_val, *val; -+ __be16 tmp; - - val = (u16 *)ucontrol->value.bytes.data; - reg = NAU8822_REG_EQ1; -@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, - /* conversion of 16-bit integers between native CPU format - * and big endian format - */ -- reg_val = cpu_to_be16(reg_val); -- memcpy(val + i, ®_val, sizeof(reg_val)); -+ tmp = cpu_to_be16(reg_val); -+ memcpy(val + i, &tmp, sizeof(tmp)); - } - - return 0; -@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, - void *data; - u16 *val, value; - int i, reg, ret; -+ __be16 *tmp; - - data = kmemdup(ucontrol->value.bytes.data, - params->max, GFP_KERNEL | GFP_DMA); -@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, - /* conversion of 16-bit integers between native CPU format - * and big endian format - */ -- value = be16_to_cpu(*(val + i)); -+ tmp = (__be16 *)(val + i); -+ value = be16_to_cpup(tmp); - ret = snd_soc_component_write(component, reg + i, value); - if (ret) { - dev_err(component->dev, -diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c -index f86fc7cd104d4..60518ee5a86e7 100644 ---- a/sound/soc/codecs/rt5645.c -+++ b/sound/soc/codecs/rt5645.c -@@ -448,6 +448,7 @@ struct rt5645_priv { - struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)]; - struct rt5645_eq_param_s *eq_param; - struct timer_list btn_check_timer; -+ struct mutex jd_mutex; - - int codec_type; - int sysclk; -@@ -3189,6 +3190,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse - rt5645_enable_push_button_irq(component, true); - } - } else { -+ if (rt5645->en_button_func) -+ rt5645_enable_push_button_irq(component, false); - snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); - snd_soc_dapm_sync(dapm); - rt5645->jack_type = SND_JACK_HEADPHONE; -@@ -3269,6 +3272,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) - if (!rt5645->component) - return; - -+ mutex_lock(&rt5645->jd_mutex); -+ - switch (rt5645->pdata.jd_mode) { - case 0: /* Not using rt5645 JD */ - if (rt5645->gpiod_hp_det) { -@@ -3295,7 +3300,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) - - if (!val && (rt5645->jack_type == 0)) { /* jack in */ - report = rt5645_jack_detect(rt5645->component, 1); -- } else if (!val && rt5645->jack_type != 0) { -+ } else if (!val && rt5645->jack_type == SND_JACK_HEADSET) { - /* for push button and jack out */ - btn_type = 0; - if (snd_soc_component_read(rt5645->component, RT5645_INT_IRQ_ST) & 0x4) { -@@ -3351,6 +3356,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) - rt5645_jack_detect(rt5645->component, 0); - } - -+ mutex_unlock(&rt5645->jd_mutex); -+ - snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE); - snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); - if (rt5645->en_button_func) -@@ -4119,6 +4126,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c) - } - timer_setup(&rt5645->btn_check_timer, rt5645_btn_check_callback, 0); - -+ mutex_init(&rt5645->jd_mutex); - INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); - INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work); - -diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c -index 010a394c705c1..1becbf2c6ffad 100644 ---- a/sound/soc/codecs/wm8974.c -+++ b/sound/soc/codecs/wm8974.c -@@ -186,7 +186,7 @@ SOC_DAPM_SINGLE("PCM Playback Switch", WM8974_MONOMIX, 0, 1, 0), - - /* Boost mixer */ - static const struct snd_kcontrol_new wm8974_boost_mixer[] = { --SOC_DAPM_SINGLE("Aux Switch", WM8974_INPPGA, 6, 1, 1), -+SOC_DAPM_SINGLE("PGA Switch", WM8974_INPPGA, 6, 1, 1), - }; - - /* Input PGA */ -@@ -246,8 +246,8 @@ static const struct snd_soc_dapm_route wm8974_dapm_routes[] = { - - /* Boost Mixer */ - {"ADC", NULL, "Boost Mixer"}, -- {"Boost Mixer", "Aux Switch", "Aux Input"}, -- {"Boost Mixer", NULL, "Input PGA"}, -+ {"Boost Mixer", NULL, "Aux Input"}, -+ {"Boost Mixer", "PGA Switch", "Input PGA"}, - {"Boost Mixer", NULL, "MICP"}, - - /* Input PGA */ -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index 783c201259921..797d0a48d6066 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -83,6 +83,7 @@ enum { - #define BYT_RT5640_HSMIC2_ON_IN1 BIT(27) - #define BYT_RT5640_JD_HP_ELITEP_1000G2 BIT(28) - #define BYT_RT5640_USE_AMCR0F28 BIT(29) -+#define BYT_RT5640_SWAPPED_SPEAKERS BIT(30) - - #define BYTCR_INPUT_DEFAULTS \ - (BYT_RT5640_IN3_MAP | \ -@@ -157,6 +158,8 @@ static void log_quirks(struct device *dev) - dev_info(dev, "quirk MONO_SPEAKER enabled\n"); - if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) - dev_info(dev, "quirk NO_SPEAKERS enabled\n"); -+ if (byt_rt5640_quirk & BYT_RT5640_SWAPPED_SPEAKERS) -+ dev_info(dev, "quirk SWAPPED_SPEAKERS enabled\n"); - if (byt_rt5640_quirk & BYT_RT5640_LINEOUT) - dev_info(dev, "quirk LINEOUT enabled\n"); - if (byt_rt5640_quirk & BYT_RT5640_LINEOUT_AS_HP2) -@@ -884,6 +887,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { - BYT_RT5640_SSP0_AIF1 | - BYT_RT5640_MCLK_EN), - }, -+ { -+ /* Medion Lifetab S10346 */ -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), -+ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), -+ /* Above strings are much too generic, also match on BIOS date */ -+ DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"), -+ }, -+ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | -+ BYT_RT5640_SWAPPED_SPEAKERS | -+ BYT_RT5640_SSP0_AIF1 | -+ BYT_RT5640_MCLK_EN), -+ }, - { /* Mele PCG03 Mini PC */ - .matches = { - DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Mini PC"), -@@ -1609,11 +1625,11 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) - const char *platform_name; - struct acpi_device *adev; - struct device *codec_dev; -+ const char *cfg_spk; - bool sof_parent; - int ret_val = 0; - int dai_index = 0; -- int i, cfg_spk; -- int aif; -+ int i, aif; - - is_bytcr = false; - priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); -@@ -1773,13 +1789,16 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) - } - - if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) { -- cfg_spk = 0; -+ cfg_spk = "0"; - spk_type = "none"; - } else if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) { -- cfg_spk = 1; -+ cfg_spk = "1"; - spk_type = "mono"; -+ } else if (byt_rt5640_quirk & BYT_RT5640_SWAPPED_SPEAKERS) { -+ cfg_spk = "swapped"; -+ spk_type = "swapped"; - } else { -- cfg_spk = 2; -+ cfg_spk = "2"; - spk_type = "stereo"; - } - -@@ -1794,7 +1813,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) - headset2_string = " cfg-hs2:in1"; - - snprintf(byt_rt5640_components, sizeof(byt_rt5640_components), -- "cfg-spk:%d cfg-mic:%s aif:%d%s%s", cfg_spk, -+ "cfg-spk:%s cfg-mic:%s aif:%d%s%s", cfg_spk, - map_name[BYT_RT5640_MAP(byt_rt5640_quirk)], aif, - lineout_string, headset2_string); - byt_rt5640_card.components = byt_rt5640_components; -diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c -index 879ebba528322..463ffb85121d3 100644 ---- a/sound/soc/intel/boards/skl_hda_dsp_generic.c -+++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c -@@ -157,6 +157,8 @@ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params) - card->dapm_widgets = skl_hda_widgets; - card->num_dapm_widgets = ARRAY_SIZE(skl_hda_widgets); - if (!ctx->idisp_codec) { -+ card->dapm_routes = &skl_hda_map[IDISP_ROUTE_COUNT]; -+ num_route -= IDISP_ROUTE_COUNT; - for (i = 0; i < IDISP_DAI_COUNT; i++) { - skl_hda_be_dai_links[i].codecs = dummy_codec; - skl_hda_be_dai_links[i].num_codecs = -diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c -index 1015716f93361..adee4be2dea71 100644 ---- a/sound/soc/intel/skylake/skl-pcm.c -+++ b/sound/soc/intel/skylake/skl-pcm.c -@@ -251,8 +251,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream, - snd_pcm_set_sync(substream); - - mconfig = skl_tplg_fe_get_cpr_module(dai, substream->stream); -- if (!mconfig) -+ if (!mconfig) { -+ kfree(dma_params); - return -EINVAL; -+ } - - skl_tplg_d0i3_get(skl, mconfig->d0i3_caps); - -@@ -1471,6 +1473,7 @@ int skl_platform_register(struct device *dev) - dais = krealloc(skl->dais, sizeof(skl_fe_dai) + - sizeof(skl_platform_dai), GFP_KERNEL); - if (!dais) { -+ kfree(skl->dais); - ret = -ENOMEM; - goto err; - } -@@ -1483,8 +1486,10 @@ int skl_platform_register(struct device *dev) - - ret = devm_snd_soc_register_component(dev, &skl_component, - skl->dais, num_dais); -- if (ret) -+ if (ret) { -+ kfree(skl->dais); - dev_err(dev, "soc component registration failed %d\n", ret); -+ } - err: - return ret; - } -diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c -index 7a425271b08b1..fd9624ad5f72b 100644 ---- a/sound/soc/intel/skylake/skl-sst-ipc.c -+++ b/sound/soc/intel/skylake/skl-sst-ipc.c -@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, - - reply.size = (reply.header >> 32) & IPC_DATA_OFFSET_SZ_MASK; - buf = krealloc(reply.data, reply.size, GFP_KERNEL); -- if (!buf) -+ if (!buf) { -+ kfree(reply.data); - return -ENOMEM; -+ } - *payload = buf; - *bytes = reply.size; - -diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c -index 55b009d3c6815..2d25748ca7066 100644 ---- a/sound/soc/soc-ops.c -+++ b/sound/soc/soc-ops.c -@@ -661,7 +661,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card, - kctl = snd_soc_card_get_kcontrol(card, name); - if (kctl) { - struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -- if (max <= mc->max) { -+ if (max <= mc->max - mc->min) { - mc->platform_max = max; - ret = 0; - } -diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c -index f2ec2a6c2e0f3..a0dfd7de431fe 100644 ---- a/sound/soc/sof/intel/hda-codec.c -+++ b/sound/soc/sof/intel/hda-codec.c -@@ -54,8 +54,16 @@ static int request_codec_module(struct hda_codec *codec) - - static int hda_codec_load_module(struct hda_codec *codec) - { -- int ret = request_codec_module(codec); -+ int ret; -+ -+ ret = snd_hdac_device_register(&codec->core); -+ if (ret) { -+ dev_err(&codec->core.dev, "failed to register hdac device\n"); -+ put_device(&codec->core.dev); -+ return ret; -+ } - -+ ret = request_codec_module(codec); - if (ret <= 0) { - codec->probe_id = HDA_CODEC_ID_GENERIC; - ret = request_codec_module(codec); -@@ -112,7 +120,6 @@ EXPORT_SYMBOL_NS(hda_codec_jack_check, SND_SOC_SOF_HDA_AUDIO_CODEC); - static struct hda_codec *hda_codec_device_init(struct hdac_bus *bus, int addr, int type) - { - struct hda_codec *codec; -- int ret; - - codec = snd_hda_codec_device_init(to_hda_bus(bus), addr, "ehdaudio%dD%d", bus->idx, addr); - if (IS_ERR(codec)) { -@@ -122,13 +129,6 @@ static struct hda_codec *hda_codec_device_init(struct hdac_bus *bus, int addr, i - - codec->core.type = type; - -- ret = snd_hdac_device_register(&codec->core); -- if (ret) { -- dev_err(bus->dev, "failed to register hdac device\n"); -- put_device(&codec->core.dev); -- return ERR_PTR(ret); -- } -- - return codec; - } - -diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c -index a38b89c280306..37da902545a41 100644 ---- a/tools/testing/selftests/alsa/mixer-test.c -+++ b/tools/testing/selftests/alsa/mixer-test.c -@@ -177,7 +177,7 @@ static void find_controls(void) - err = snd_ctl_elem_info(card_data->handle, - ctl_data->info); - if (err < 0) { -- ksft_print_msg("%s getting info for %d\n", -+ ksft_print_msg("%s getting info for %s\n", - snd_strerror(err), - ctl_data->name); - } diff --git a/patch/kernel/odroidxu4-current/patch-6.1.74-75.patch b/patch/kernel/odroidxu4-current/patch-6.1.74-75.patch deleted file mode 100644 index 467e3c0a56..0000000000 --- a/patch/kernel/odroidxu4-current/patch-6.1.74-75.patch +++ /dev/null @@ -1,15017 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml b/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml -index f333ee2288e76..11ae8ec3c7394 100644 ---- a/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml -+++ b/Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml -@@ -126,7 +126,7 @@ examples: - - | - #include - -- gpio@e000a000 { -+ gpio@a0020000 { - compatible = "xlnx,xps-gpio-1.00.a"; - reg = <0xa0020000 0x10000>; - #gpio-cells = <2>; -diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml -index 9cfc0c7d23e06..46730687c6624 100644 ---- a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml -+++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml -@@ -61,6 +61,9 @@ properties: - - description: used for 1st data pipe from RDMA - - description: used for 2nd data pipe from RDMA - -+ '#dma-cells': -+ const: 1 -+ - required: - - compatible - - reg -@@ -70,6 +73,7 @@ required: - - clocks - - iommus - - mboxes -+ - '#dma-cells' - - additionalProperties: false - -@@ -80,16 +84,17 @@ examples: - #include - #include - -- mdp3_rdma0: mdp3-rdma0@14001000 { -- compatible = "mediatek,mt8183-mdp3-rdma"; -- reg = <0x14001000 0x1000>; -- mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>; -- mediatek,gce-events = , -- ; -- power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -- clocks = <&mmsys CLK_MM_MDP_RDMA0>, -- <&mmsys CLK_MM_MDP_RSZ1>; -- iommus = <&iommu>; -- mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>, -- <&gce 21 CMDQ_THR_PRIO_LOWEST>; -+ dma-controller@14001000 { -+ compatible = "mediatek,mt8183-mdp3-rdma"; -+ reg = <0x14001000 0x1000>; -+ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>; -+ mediatek,gce-events = , -+ ; -+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -+ clocks = <&mmsys CLK_MM_MDP_RDMA0>, -+ <&mmsys CLK_MM_MDP_RSZ1>; -+ iommus = <&iommu>; -+ mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>, -+ <&gce 21 CMDQ_THR_PRIO_LOWEST>; -+ #dma-cells = <1>; - }; -diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml -index 0baa77198fa21..64ea98aa05928 100644 ---- a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml -+++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml -@@ -50,6 +50,9 @@ properties: - iommus: - maxItems: 1 - -+ '#dma-cells': -+ const: 1 -+ - required: - - compatible - - reg -@@ -58,6 +61,7 @@ required: - - power-domains - - clocks - - iommus -+ - '#dma-cells' - - additionalProperties: false - -@@ -68,13 +72,14 @@ examples: - #include - #include - -- mdp3_wrot0: mdp3-wrot0@14005000 { -- compatible = "mediatek,mt8183-mdp3-wrot"; -- reg = <0x14005000 0x1000>; -- mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>; -- mediatek,gce-events = , -- ; -- power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -- clocks = <&mmsys CLK_MM_MDP_WROT0>; -- iommus = <&iommu>; -+ dma-controller@14005000 { -+ compatible = "mediatek,mt8183-mdp3-wrot"; -+ reg = <0x14005000 0x1000>; -+ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>; -+ mediatek,gce-events = , -+ ; -+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; -+ clocks = <&mmsys CLK_MM_MDP_WROT0>; -+ iommus = <&iommu>; -+ #dma-cells = <1>; - }; -diff --git a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml -index b3661d7d43572..2a0ad332f5ced 100644 ---- a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml -+++ b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml -@@ -90,15 +90,16 @@ properties: - description: connection point for input on the parallel interface - - properties: -- bus-type: -- enum: [5, 6] -- - endpoint: - $ref: video-interfaces.yaml# - unevaluatedProperties: false - -- required: -- - bus-type -+ properties: -+ bus-type: -+ enum: [5, 6] -+ -+ required: -+ - bus-type - - anyOf: - - required: -diff --git a/Documentation/driver-api/pci/p2pdma.rst b/Documentation/driver-api/pci/p2pdma.rst -index 44deb52beeb47..d0b241628cf13 100644 ---- a/Documentation/driver-api/pci/p2pdma.rst -+++ b/Documentation/driver-api/pci/p2pdma.rst -@@ -83,19 +83,9 @@ this to include other types of resources like doorbells. - Client Drivers - -------------- - --A client driver typically only has to conditionally change its DMA map --routine to use the mapping function :c:func:`pci_p2pdma_map_sg()` instead --of the usual :c:func:`dma_map_sg()` function. Memory mapped in this --way does not need to be unmapped. -- --The client may also, optionally, make use of --:c:func:`is_pci_p2pdma_page()` to determine when to use the P2P mapping --functions and when to use the regular mapping functions. In some --situations, it may be more appropriate to use a flag to indicate a --given request is P2P memory and map appropriately. It is important to --ensure that struct pages that back P2P memory stay out of code that --does not have support for them as other code may treat the pages as --regular memory which may not be appropriate. -+A client driver only has to use the mapping API :c:func:`dma_map_sg()` -+and :c:func:`dma_unmap_sg()` functions as usual, and the implementation -+will do the right thing for the P2P capable memory. - - - Orchestrator Drivers -diff --git a/Makefile b/Makefile -index 63125d1ffd9cf..7cd49d9eadbfc 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 6 - PATCHLEVEL = 1 --SUBLEVEL = 74 -+SUBLEVEL = 75 - EXTRAVERSION = - NAME = Curry Ramen - -diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi -index 4b57e9f5bc648..2b3927a829b70 100644 ---- a/arch/arm/boot/dts/qcom-apq8064.dtsi -+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi -@@ -750,7 +750,7 @@ - - xoadc: xoadc@197 { - compatible = "qcom,pm8921-adc"; -- reg = <197>; -+ reg = <0x197>; - interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>; - #address-cells = <2>; - #size-cells = <0>; -diff --git a/arch/arm/boot/dts/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom-sdx65.dtsi -index ecb9171e4da5f..ebb78b489e638 100644 ---- a/arch/arm/boot/dts/qcom-sdx65.dtsi -+++ b/arch/arm/boot/dts/qcom-sdx65.dtsi -@@ -401,7 +401,7 @@ - reg = <0x0c264000 0x1000>; - }; - -- spmi_bus: qcom,spmi@c440000 { -+ spmi_bus: spmi@c440000 { - compatible = "qcom,spmi-pmic-arb"; - reg = <0xc440000 0xd00>, - <0xc600000 0x2000000>, -diff --git a/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts b/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts -index e539cc80bef81..942a6ca38d97e 100644 ---- a/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts -+++ b/arch/arm/boot/dts/stm32mp157a-dk1-scmi.dts -@@ -11,7 +11,7 @@ - - / { - model = "STMicroelectronics STM32MP157A-DK1 SCMI Discovery Board"; -- compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157a-dk1", "st,stm32mp157"; -+ compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157"; - - reserved-memory { - optee@de000000 { -diff --git a/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts b/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts -index 97e4f94b0a24e..99c4ff1f5c214 100644 ---- a/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts -+++ b/arch/arm/boot/dts/stm32mp157c-dk2-scmi.dts -@@ -11,7 +11,7 @@ - - / { - model = "STMicroelectronics STM32MP157C-DK2 SCMI Discovery Board"; -- compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157c-dk2", "st,stm32mp157"; -+ compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157"; - - reserved-memory { - optee@de000000 { -diff --git a/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts b/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts -index 9cf0a44d2f47e..21010458b36f5 100644 ---- a/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts -+++ b/arch/arm/boot/dts/stm32mp157c-ed1-scmi.dts -@@ -11,7 +11,7 @@ - - / { - model = "STMicroelectronics STM32MP157C-ED1 SCMI eval daughter"; -- compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157"; -+ compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157"; - - reserved-memory { - optee@fe000000 { -diff --git a/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts b/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts -index 3b9dd6f4ccc96..d376371499193 100644 ---- a/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts -+++ b/arch/arm/boot/dts/stm32mp157c-ev1-scmi.dts -@@ -11,8 +11,7 @@ - - / { - model = "STMicroelectronics STM32MP157C-EV1 SCMI eval daughter on eval mother"; -- compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ev1", "st,stm32mp157c-ed1", -- "st,stm32mp157"; -+ compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157"; - - reserved-memory { - optee@fe000000 { -diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig -index c8cbd9a307914..672ffb0b5f3af 100644 ---- a/arch/arm/mach-davinci/Kconfig -+++ b/arch/arm/mach-davinci/Kconfig -@@ -4,12 +4,14 @@ menuconfig ARCH_DAVINCI - bool "TI DaVinci" - depends on ARCH_MULTI_V5 - depends on CPU_LITTLE_ENDIAN -+ select CPU_ARM926T - select DAVINCI_TIMER - select ZONE_DMA - select PM_GENERIC_DOMAINS if PM - select PM_GENERIC_DOMAINS_OF if PM && OF - select REGMAP_MMIO - select RESET_CONTROLLER -+ select PINCTRL - select PINCTRL_SINGLE - - if ARCH_DAVINCI -diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi -index d583db18f74cc..7a410d73600b1 100644 ---- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi -+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi -@@ -1303,7 +1303,7 @@ - assigned-clocks = <&clk IMX8MM_CLK_GPU3D_CORE>, - <&clk IMX8MM_GPU_PLL_OUT>; - assigned-clock-parents = <&clk IMX8MM_GPU_PLL_OUT>; -- assigned-clock-rates = <0>, <1000000000>; -+ assigned-clock-rates = <0>, <800000000>; - power-domains = <&pgc_gpu>; - }; - -@@ -1318,7 +1318,7 @@ - assigned-clocks = <&clk IMX8MM_CLK_GPU2D_CORE>, - <&clk IMX8MM_GPU_PLL_OUT>; - assigned-clock-parents = <&clk IMX8MM_GPU_PLL_OUT>; -- assigned-clock-rates = <0>, <1000000000>; -+ assigned-clock-rates = <0>, <800000000>; - power-domains = <&pgc_gpu>; - }; - -diff --git a/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi b/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi -index 970047f2dabd5..c06e011a6c3ff 100644 ---- a/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi -+++ b/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi -@@ -25,9 +25,6 @@ - gpios = <&gpio28 0 0>; - - regulators { -- #address-cells = <1>; -- #size-cells = <0>; -- - ldo3: ldo3 { /* HDMI */ - regulator-name = "ldo3"; - regulator-min-microvolt = <1500000>; -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -index 200f97e1c4c9c..37350e5fa253a 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -@@ -130,7 +130,7 @@ - compatible = "microchip,mcp7940x"; - reg = <0x6f>; - interrupt-parent = <&gpiosb>; -- interrupts = <5 0>; /* GPIO2_5 */ -+ interrupts = <5 IRQ_TYPE_EDGE_FALLING>; /* GPIO2_5 */ - }; - }; - -diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -index 10779a9947fe2..d5d9b954c449a 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi -@@ -1586,7 +1586,7 @@ - mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0 0x1000>; - }; - -- mdp3-rdma0@14001000 { -+ dma-controller0@14001000 { - compatible = "mediatek,mt8183-mdp3-rdma"; - reg = <0 0x14001000 0 0x1000>; - mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>; -@@ -1598,6 +1598,7 @@ - iommus = <&iommu M4U_PORT_MDP_RDMA0>; - mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST 0>, - <&gce 21 CMDQ_THR_PRIO_LOWEST 0>; -+ #dma-cells = <1>; - }; - - mdp3-rsz0@14003000 { -@@ -1618,7 +1619,7 @@ - clocks = <&mmsys CLK_MM_MDP_RSZ1>; - }; - -- mdp3-wrot0@14005000 { -+ dma-controller@14005000 { - compatible = "mediatek,mt8183-mdp3-wrot"; - reg = <0 0x14005000 0 0x1000>; - mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>; -@@ -1627,6 +1628,7 @@ - power-domains = <&spm MT8183_POWER_DOMAIN_DISP>; - clocks = <&mmsys CLK_MM_MDP_WROT0>; - iommus = <&iommu M4U_PORT_MDP_WROT0>; -+ #dma-cells = <1>; - }; - - mdp3-wdma@14006000 { -diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi -index 43ff8f1f1475c..1533c61cb106c 100644 ---- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi -+++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi -@@ -146,7 +146,7 @@ - ranges; - - rpm_msg_ram: memory@60000 { -- reg = <0x0 0x60000 0x0 0x6000>; -+ reg = <0x0 0x00060000 0x0 0x6000>; - no-map; - }; - -@@ -181,7 +181,7 @@ - - prng: qrng@e1000 { - compatible = "qcom,prng-ee"; -- reg = <0x0 0xe3000 0x0 0x1000>; -+ reg = <0x0 0x000e3000 0x0 0x1000>; - clocks = <&gcc GCC_PRNG_AHB_CLK>; - clock-names = "core"; - }; -@@ -201,8 +201,8 @@ - compatible = "qcom,crypto-v5.1"; - reg = <0x0 0x0073a000 0x0 0x6000>; - clocks = <&gcc GCC_CRYPTO_AHB_CLK>, -- <&gcc GCC_CRYPTO_AXI_CLK>, -- <&gcc GCC_CRYPTO_CLK>; -+ <&gcc GCC_CRYPTO_AXI_CLK>, -+ <&gcc GCC_CRYPTO_CLK>; - clock-names = "iface", "bus", "core"; - dmas = <&cryptobam 2>, <&cryptobam 3>; - dma-names = "rx", "tx"; -@@ -272,7 +272,7 @@ - reg = <0x0 0x078b1000 0x0 0x200>; - interrupts = ; - clocks = <&gcc GCC_BLSP1_UART3_APPS_CLK>, -- <&gcc GCC_BLSP1_AHB_CLK>; -+ <&gcc GCC_BLSP1_AHB_CLK>; - clock-names = "core", "iface"; - status = "disabled"; - }; -@@ -285,7 +285,7 @@ - interrupts = ; - spi-max-frequency = <50000000>; - clocks = <&gcc GCC_BLSP1_QUP1_SPI_APPS_CLK>, -- <&gcc GCC_BLSP1_AHB_CLK>; -+ <&gcc GCC_BLSP1_AHB_CLK>; - clock-names = "core", "iface"; - dmas = <&blsp_dma 12>, <&blsp_dma 13>; - dma-names = "tx", "rx"; -@@ -300,7 +300,7 @@ - interrupts = ; - spi-max-frequency = <50000000>; - clocks = <&gcc GCC_BLSP1_QUP2_SPI_APPS_CLK>, -- <&gcc GCC_BLSP1_AHB_CLK>; -+ <&gcc GCC_BLSP1_AHB_CLK>; - clock-names = "core", "iface"; - dmas = <&blsp_dma 14>, <&blsp_dma 15>; - dma-names = "tx", "rx"; -@@ -358,8 +358,8 @@ - clock-names = "core", "aon"; - - dmas = <&qpic_bam 0>, -- <&qpic_bam 1>, -- <&qpic_bam 2>; -+ <&qpic_bam 1>, -+ <&qpic_bam 2>; - dma-names = "tx", "rx", "cmd"; - pinctrl-0 = <&qpic_pins>; - pinctrl-names = "default"; -@@ -372,10 +372,10 @@ - #size-cells = <2>; - interrupt-controller; - #interrupt-cells = <0x3>; -- reg = <0x0 0x0b000000 0x0 0x1000>, /*GICD*/ -- <0x0 0x0b002000 0x0 0x1000>, /*GICC*/ -- <0x0 0x0b001000 0x0 0x1000>, /*GICH*/ -- <0x0 0x0b004000 0x0 0x1000>; /*GICV*/ -+ reg = <0x0 0x0b000000 0x0 0x1000>, /*GICD*/ -+ <0x0 0x0b002000 0x0 0x1000>, /*GICC*/ -+ <0x0 0x0b001000 0x0 0x1000>, /*GICH*/ -+ <0x0 0x0b004000 0x0 0x1000>; /*GICV*/ - interrupts = ; - ranges = <0 0 0 0xb00a000 0 0xffd>; - -@@ -388,7 +388,7 @@ - - pcie_phy: phy@84000 { - compatible = "qcom,ipq6018-qmp-pcie-phy"; -- reg = <0x0 0x84000 0x0 0x1bc>; /* Serdes PLL */ -+ reg = <0x0 0x00084000 0x0 0x1bc>; /* Serdes PLL */ - status = "disabled"; - #address-cells = <2>; - #size-cells = <2>; -@@ -404,9 +404,10 @@ - "common"; - - pcie_phy0: phy@84200 { -- reg = <0x0 0x84200 0x0 0x16c>, /* Serdes Tx */ -- <0x0 0x84400 0x0 0x200>, /* Serdes Rx */ -- <0x0 0x84800 0x0 0x4f4>; /* PCS: Lane0, COM, PCIE */ -+ reg = <0x0 0x00084200 0x0 0x16c>, /* Serdes Tx */ -+ <0x0 0x00084400 0x0 0x200>, /* Serdes Rx */ -+ <0x0 0x00084800 0x0 0x1f0>, /* PCS: Lane0, COM, PCIE */ -+ <0x0 0x00084c00 0x0 0xf4>; /* pcs_misc */ - #phy-cells = <0>; - - clocks = <&gcc GCC_PCIE0_PIPE_CLK>; -@@ -628,7 +629,7 @@ - #address-cells = <1>; - #size-cells = <0>; - compatible = "qcom,ipq6018-mdio", "qcom,ipq4019-mdio"; -- reg = <0x0 0x90000 0x0 0x64>; -+ reg = <0x0 0x00090000 0x0 0x64>; - clocks = <&gcc GCC_MDIO_AHB_CLK>; - clock-names = "gcc_mdio_ahb_clk"; - status = "disabled"; -@@ -636,7 +637,7 @@ - - qusb_phy_1: qusb@59000 { - compatible = "qcom,ipq6018-qusb2-phy"; -- reg = <0x0 0x059000 0x0 0x180>; -+ reg = <0x0 0x00059000 0x0 0x180>; - #phy-cells = <0>; - - clocks = <&gcc GCC_USB1_PHY_CFG_AHB_CLK>, -@@ -668,23 +669,23 @@ - status = "disabled"; - - dwc_1: usb@7000000 { -- compatible = "snps,dwc3"; -- reg = <0x0 0x7000000 0x0 0xcd00>; -- interrupts = ; -- phys = <&qusb_phy_1>; -- phy-names = "usb2-phy"; -- tx-fifo-resize; -- snps,is-utmi-l1-suspend; -- snps,hird-threshold = /bits/ 8 <0x0>; -- snps,dis_u2_susphy_quirk; -- snps,dis_u3_susphy_quirk; -- dr_mode = "host"; -+ compatible = "snps,dwc3"; -+ reg = <0x0 0x07000000 0x0 0xcd00>; -+ interrupts = ; -+ phys = <&qusb_phy_1>; -+ phy-names = "usb2-phy"; -+ tx-fifo-resize; -+ snps,is-utmi-l1-suspend; -+ snps,hird-threshold = /bits/ 8 <0x0>; -+ snps,dis_u2_susphy_quirk; -+ snps,dis_u3_susphy_quirk; -+ dr_mode = "host"; - }; - }; - - ssphy_0: ssphy@78000 { - compatible = "qcom,ipq6018-qmp-usb3-phy"; -- reg = <0x0 0x78000 0x0 0x1C4>; -+ reg = <0x0 0x00078000 0x0 0x1c4>; - #address-cells = <2>; - #size-cells = <2>; - ranges; -@@ -701,7 +702,7 @@ - usb0_ssphy: phy@78200 { - reg = <0x0 0x00078200 0x0 0x130>, /* Tx */ - <0x0 0x00078400 0x0 0x200>, /* Rx */ -- <0x0 0x00078800 0x0 0x1F8>, /* PCS */ -+ <0x0 0x00078800 0x0 0x1f8>, /* PCS */ - <0x0 0x00078600 0x0 0x044>; /* PCS misc */ - #phy-cells = <0>; - #clock-cells = <0>; -@@ -713,7 +714,7 @@ - - qusb_phy_0: qusb@79000 { - compatible = "qcom,ipq6018-qusb2-phy"; -- reg = <0x0 0x079000 0x0 0x180>; -+ reg = <0x0 0x00079000 0x0 0x180>; - #phy-cells = <0>; - - clocks = <&gcc GCC_USB0_PHY_CFG_AHB_CLK>, -@@ -726,7 +727,7 @@ - - usb3: usb@8af8800 { - compatible = "qcom,ipq6018-dwc3", "qcom,dwc3"; -- reg = <0x0 0x8AF8800 0x0 0x400>; -+ reg = <0x0 0x8af8800 0x0 0x400>; - #address-cells = <2>; - #size-cells = <2>; - ranges; -@@ -745,14 +746,14 @@ - <&gcc GCC_USB0_MOCK_UTMI_CLK>; - assigned-clock-rates = <133330000>, - <133330000>, -- <20000000>; -+ <24000000>; - - resets = <&gcc GCC_USB0_BCR>; - status = "disabled"; - - dwc_0: usb@8a00000 { - compatible = "snps,dwc3"; -- reg = <0x0 0x8A00000 0x0 0xcd00>; -+ reg = <0x0 0x8a00000 0x0 0xcd00>; - interrupts = ; - phys = <&qusb_phy_0>, <&usb0_ssphy>; - phy-names = "usb2-phy", "usb3-phy"; -diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts -index 9731a7c63d53b..1defbe0404e2e 100644 ---- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts -+++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts -@@ -63,8 +63,8 @@ - function = LED_FUNCTION_INDICATOR; - color = ; - gpios = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>; -- linux,default-trigger = "panic-indicator"; - default-state = "off"; -+ panic-indicator; - }; - - led-wlan { -diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi -index 6f0ee4e13ef1d..78e537f1d7965 100644 ---- a/arch/arm64/boot/dts/qcom/sc7180.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi -@@ -3378,7 +3378,7 @@ - compatible = "qcom,apss-wdt-sc7180", "qcom,kpss-wdt"; - reg = <0 0x17c10000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; - }; - - timer@17c20000{ -diff --git a/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi b/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi -index 25f31c81b2b74..efe6ea538ad21 100644 ---- a/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7280-chrome-common.dtsi -@@ -56,6 +56,26 @@ - }; - }; - -+&lpass_aon { -+ status = "okay"; -+}; -+ -+&lpass_core { -+ status = "okay"; -+}; -+ -+&lpass_hm { -+ status = "okay"; -+}; -+ -+&lpasscc { -+ status = "okay"; -+}; -+ -+&pdc_reset { -+ status = "okay"; -+}; -+ - /* The PMIC PON code isn't compatible w/ how Chrome EC/BIOS handle things. */ - &pmk8350_pon { - status = "disabled"; -@@ -93,6 +113,10 @@ - reg = <0x0 0x9c900000 0x0 0x800000>; - }; - -+&watchdog { -+ status = "okay"; -+}; -+ - &wifi { - status = "okay"; - -diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi -index aea356c63b9a3..7fc8c20450223 100644 ---- a/arch/arm64/boot/dts/qcom/sc7280.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi -@@ -888,6 +888,7 @@ - - bus-width = <8>; - supports-cqe; -+ dma-coherent; - - qcom,dll-config = <0x0007642c>; - qcom,ddr-config = <0x80040868>; -@@ -2187,6 +2188,7 @@ - clocks = <&gcc GCC_CFG_NOC_LPASS_CLK>; - clock-names = "iface"; - #clock-cells = <1>; -+ status = "reserved"; /* Owned by ADSP firmware */ - }; - - lpass_rx_macro: codec@3200000 { -@@ -2339,6 +2341,7 @@ - clock-names = "bi_tcxo", "bi_tcxo_ao", "iface"; - #clock-cells = <1>; - #power-domain-cells = <1>; -+ status = "reserved"; /* Owned by ADSP firmware */ - }; - - lpass_core: clock-controller@3900000 { -@@ -2349,6 +2352,7 @@ - power-domains = <&lpass_hm LPASS_CORE_CC_LPASS_CORE_HM_GDSC>; - #clock-cells = <1>; - #power-domain-cells = <1>; -+ status = "reserved"; /* Owned by ADSP firmware */ - }; - - lpass_cpu: audio@3987000 { -@@ -2419,6 +2423,7 @@ - clock-names = "bi_tcxo"; - #clock-cells = <1>; - #power-domain-cells = <1>; -+ status = "reserved"; /* Owned by ADSP firmware */ - }; - - lpass_ag_noc: interconnect@3c40000 { -@@ -2529,7 +2534,8 @@ - "cx_mem", - "cx_dbgc"; - interrupts = ; -- iommus = <&adreno_smmu 0 0x401>; -+ iommus = <&adreno_smmu 0 0x400>, -+ <&adreno_smmu 1 0x400>; - operating-points-v2 = <&gpu_opp_table>; - qcom,gmu = <&gmu>; - interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>; -@@ -2696,6 +2702,7 @@ - "gpu_cc_hub_aon_clk"; - - power-domains = <&gpucc GPU_CC_CX_GDSC>; -+ dma-coherent; - }; - - remoteproc_mpss: remoteproc@4080000 { -@@ -3265,6 +3272,7 @@ - operating-points-v2 = <&sdhc2_opp_table>; - - bus-width = <4>; -+ dma-coherent; - - qcom,dll-config = <0x0007642c>; - -@@ -3386,8 +3394,8 @@ - assigned-clock-rates = <19200000>, <200000000>; - - interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, -- <&pdc 12 IRQ_TYPE_EDGE_RISING>, -- <&pdc 13 IRQ_TYPE_EDGE_RISING>; -+ <&pdc 12 IRQ_TYPE_EDGE_BOTH>, -+ <&pdc 13 IRQ_TYPE_EDGE_BOTH>; - interrupt-names = "hs_phy_irq", - "dp_hs_phy_irq", - "dm_hs_phy_irq"; -@@ -4195,6 +4203,7 @@ - compatible = "qcom,sc7280-pdc-global"; - reg = <0 0x0b5e0000 0 0x20000>; - #reset-cells = <1>; -+ status = "reserved"; /* Owned by firmware */ - }; - - tsens0: thermal-sensor@c263000 { -@@ -5186,11 +5195,12 @@ - }; - }; - -- watchdog@17c10000 { -+ watchdog: watchdog@17c10000 { - compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt"; - reg = <0 0x17c10000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; -+ status = "reserved"; /* Owned by Gunyah hyp */ - }; - - timer@17c20000 { -diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi -index 405835ad28bcd..7e3aaf5de3f5c 100644 ---- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi -+++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi -@@ -1653,7 +1653,7 @@ - compatible = "qcom,apss-wdt-sc8280xp", "qcom,kpss-wdt"; - reg = <0 0x17c10000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; - }; - - timer@17c20000 { -diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts -index 8c9ccf5b4ea41..135ff4368c4a6 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts -+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts -@@ -66,8 +66,8 @@ - function = LED_FUNCTION_INDICATOR; - color = ; - gpios = <&pm8998_gpio 13 GPIO_ACTIVE_HIGH>; -- linux,default-trigger = "panic-indicator"; - default-state = "off"; -+ panic-indicator; - }; - - led-1 { -diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi -index 52c9f5639f8a2..1e6841902900c 100644 ---- a/arch/arm64/boot/dts/qcom/sdm845.dtsi -+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi -@@ -5019,7 +5019,7 @@ - compatible = "qcom,apss-wdt-sdm845", "qcom,kpss-wdt"; - reg = <0 0x17980000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; - }; - - apss_shared: mailbox@17990000 { -diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi -index cea7ca3f326fc..9da373090593c 100644 ---- a/arch/arm64/boot/dts/qcom/sm6350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi -@@ -1462,7 +1462,7 @@ - compatible = "qcom,apss-wdt-sm6350", "qcom,kpss-wdt"; - reg = <0 0x17c10000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; - }; - - timer@17c20000 { -diff --git a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts -index 3331ee957d648..368da4c7f41be 100644 ---- a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts -+++ b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts -@@ -126,8 +126,6 @@ - vdda_sp_sensor: - vdda_ufs_2ln_core_1: - vdda_ufs_2ln_core_2: -- vdda_usb_ss_dp_core_1: -- vdda_usb_ss_dp_core_2: - vdda_qlink_lv: - vdda_qlink_lv_ck: - vreg_l5a_0p875: ldo5 { -@@ -209,6 +207,12 @@ - regulator-max-microvolt = <3008000>; - regulator-initial-mode = ; - }; -+ -+ vreg_l18a_0p8: ldo18 { -+ regulator-min-microvolt = <880000>; -+ regulator-max-microvolt = <880000>; -+ regulator-initial-mode = ; -+ }; - }; - - pm8150l-rpmh-regulators { -@@ -439,13 +443,13 @@ - &usb_1_qmpphy { - status = "okay"; - vdda-phy-supply = <&vreg_l3c_1p2>; -- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>; -+ vdda-pll-supply = <&vreg_l18a_0p8>; - }; - - &usb_2_qmpphy { - status = "okay"; - vdda-phy-supply = <&vreg_l3c_1p2>; -- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>; -+ vdda-pll-supply = <&vreg_l5a_0p875>; - }; - - &usb_1 { -diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi -index c586378fc6bc7..c3c12b0cd4168 100644 ---- a/arch/arm64/boot/dts/qcom/sm8150.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi -@@ -3940,7 +3940,7 @@ - compatible = "qcom,apss-wdt-sm8150", "qcom,kpss-wdt"; - reg = <0 0x17c10000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; - }; - - timer@17c20000 { -diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi -index 4d9b30f0b2841..3d02adbc0b62f 100644 ---- a/arch/arm64/boot/dts/qcom/sm8250.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi -@@ -4879,7 +4879,7 @@ - compatible = "qcom,apss-wdt-sm8250", "qcom,kpss-wdt"; - reg = <0 0x17c10000 0 0x1000>; - clocks = <&sleep_clk>; -- interrupts = ; -+ interrupts = ; - }; - - timer@17c20000 { -diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi -index 793768a2c9e1e..888bf4cd73c31 100644 ---- a/arch/arm64/boot/dts/qcom/sm8350.dtsi -+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi -@@ -903,9 +903,9 @@ - }; - }; - -- gpi_dma0: dma-controller@9800000 { -+ gpi_dma0: dma-controller@900000 { - compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma"; -- reg = <0 0x09800000 0 0x60000>; -+ reg = <0 0x00900000 0 0x60000>; - interrupts = , - , - , -diff --git a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi -index 895f0bd9f7540..541b1e73b65e0 100644 ---- a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi -+++ b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi -@@ -125,6 +125,9 @@ - }; - - &hscif0 { -+ pinctrl-0 = <&hscif0_pins>; -+ pinctrl-names = "default"; -+ - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -index bc4b50bcd1773..9301ea3888021 100644 ---- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi -@@ -245,7 +245,7 @@ - <193>, <194>, <195>; - interrupt-controller; - #interrupt-cells = <2>; -- ti,ngpio = <87>; -+ ti,ngpio = <92>; - ti,davinci-gpio-unbanked = <0>; - power-domains = <&k3_pds 77 TI_SCI_PD_EXCLUSIVE>; - clocks = <&k3_clks 77 0>; -@@ -263,7 +263,7 @@ - <183>, <184>, <185>; - interrupt-controller; - #interrupt-cells = <2>; -- ti,ngpio = <88>; -+ ti,ngpio = <52>; - ti,davinci-gpio-unbanked = <0>; - power-domains = <&k3_pds 78 TI_SCI_PD_EXCLUSIVE>; - clocks = <&k3_clks 78 0>; -diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi -index ebb1c5ce7aece..83dd8993027ab 100644 ---- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi -+++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi -@@ -856,7 +856,7 @@ - assigned-clocks = <&k3_clks 67 2>; - assigned-clock-parents = <&k3_clks 67 5>; - -- interrupts = ; -+ interrupts = ; - - dma-coherent; - -diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c -index 00ad6587bee9a..3c344e4cd4cad 100644 ---- a/arch/arm64/kvm/vgic/vgic-its.c -+++ b/arch/arm64/kvm/vgic/vgic-its.c -@@ -584,7 +584,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, - unsigned long flags; - - raw_spin_lock_irqsave(&dist->lpi_list_lock, flags); -+ - irq = __vgic_its_check_cache(dist, db, devid, eventid); -+ if (irq) -+ vgic_get_irq_kref(irq); -+ - raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags); - - return irq; -@@ -763,6 +767,7 @@ int vgic_its_inject_cached_translation(struct kvm *kvm, struct kvm_msi *msi) - raw_spin_lock_irqsave(&irq->irq_lock, flags); - irq->pending_latch = true; - vgic_queue_irq_unlock(kvm, irq, flags); -+ vgic_put_irq(kvm, irq); - - return 0; - } -diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c -index 871a45d4fc84c..ae5a3a717655e 100644 ---- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c -+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c -@@ -365,19 +365,26 @@ static int vgic_v3_uaccess_write_pending(struct kvm_vcpu *vcpu, - struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); - - raw_spin_lock_irqsave(&irq->irq_lock, flags); -- if (test_bit(i, &val)) { -- /* -- * pending_latch is set irrespective of irq type -- * (level or edge) to avoid dependency that VM should -- * restore irq config before pending info. -- */ -- irq->pending_latch = true; -- vgic_queue_irq_unlock(vcpu->kvm, irq, flags); -- } else { -+ -+ /* -+ * pending_latch is set irrespective of irq type -+ * (level or edge) to avoid dependency that VM should -+ * restore irq config before pending info. -+ */ -+ irq->pending_latch = test_bit(i, &val); -+ -+ if (irq->hw && vgic_irq_is_sgi(irq->intid)) { -+ irq_set_irqchip_state(irq->host_irq, -+ IRQCHIP_STATE_PENDING, -+ irq->pending_latch); - irq->pending_latch = false; -- raw_spin_unlock_irqrestore(&irq->irq_lock, flags); - } - -+ if (irq->pending_latch) -+ vgic_queue_irq_unlock(vcpu->kvm, irq, flags); -+ else -+ raw_spin_unlock_irqrestore(&irq->irq_lock, flags); -+ - vgic_put_irq(vcpu->kvm, irq); - } - -diff --git a/arch/csky/include/asm/jump_label.h b/arch/csky/include/asm/jump_label.h -index d488ba6084bc6..98a3f4b168bd2 100644 ---- a/arch/csky/include/asm/jump_label.h -+++ b/arch/csky/include/asm/jump_label.h -@@ -43,5 +43,10 @@ label: - return true; - } - -+enum jump_label_type; -+void arch_jump_label_transform_static(struct jump_entry *entry, -+ enum jump_label_type type); -+#define arch_jump_label_transform_static arch_jump_label_transform_static -+ - #endif /* __ASSEMBLY__ */ - #endif /* __ASM_CSKY_JUMP_LABEL_H */ -diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h -index 9b16a3b8e7060..f16bd42456e4c 100644 ---- a/arch/loongarch/include/asm/elf.h -+++ b/arch/loongarch/include/asm/elf.h -@@ -241,8 +241,6 @@ void loongarch_dump_regs64(u64 *uregs, const struct pt_regs *regs); - do { \ - current->thread.vdso = &vdso_info; \ - \ -- loongarch_set_personality_fcsr(state); \ -- \ - if (personality(current->personality) != PER_LINUX) \ - set_personality(PER_LINUX); \ - } while (0) -@@ -259,7 +257,6 @@ do { \ - clear_thread_flag(TIF_32BIT_ADDR); \ - \ - current->thread.vdso = &vdso_info; \ -- loongarch_set_personality_fcsr(state); \ - \ - p = personality(current->personality); \ - if (p != PER_LINUX32 && p != PER_LINUX) \ -@@ -340,6 +337,4 @@ extern int arch_elf_pt_proc(void *ehdr, void *phdr, struct file *elf, - extern int arch_check_elf(void *ehdr, bool has_interpreter, void *interp_ehdr, - struct arch_elf_state *state); - --extern void loongarch_set_personality_fcsr(struct arch_elf_state *state); -- - #endif /* _ASM_ELF_H */ -diff --git a/arch/loongarch/kernel/elf.c b/arch/loongarch/kernel/elf.c -index 183e94fc9c69c..0fa81ced28dcd 100644 ---- a/arch/loongarch/kernel/elf.c -+++ b/arch/loongarch/kernel/elf.c -@@ -23,8 +23,3 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr, - { - return 0; - } -- --void loongarch_set_personality_fcsr(struct arch_elf_state *state) --{ -- current->thread.fpu.fcsr = boot_cpu_data.fpu_csr0; --} -diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c -index 90a5de7463326..1259bc3129790 100644 ---- a/arch/loongarch/kernel/process.c -+++ b/arch/loongarch/kernel/process.c -@@ -82,6 +82,7 @@ void start_thread(struct pt_regs *regs, unsigned long pc, unsigned long sp) - euen = regs->csr_euen & ~(CSR_EUEN_FPEN); - regs->csr_euen = euen; - lose_fpu(0); -+ current->thread.fpu.fcsr = boot_cpu_data.fpu_csr0; - - clear_thread_flag(TIF_LSX_CTX_LIVE); - clear_thread_flag(TIF_LASX_CTX_LIVE); -diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c -index 40ed49d9adff5..4e86441e63196 100644 ---- a/arch/loongarch/net/bpf_jit.c -+++ b/arch/loongarch/net/bpf_jit.c -@@ -402,7 +402,6 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - const u8 dst = regmap[insn->dst_reg]; - const s16 off = insn->off; - const s32 imm = insn->imm; -- const u64 imm64 = (u64)(insn + 1)->imm << 32 | (u32)insn->imm; - const bool is32 = BPF_CLASS(insn->code) == BPF_ALU || BPF_CLASS(insn->code) == BPF_JMP32; - - switch (code) { -@@ -806,8 +805,12 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext - - /* dst = imm64 */ - case BPF_LD | BPF_IMM | BPF_DW: -+ { -+ const u64 imm64 = (u64)(insn + 1)->imm << 32 | (u32)insn->imm; -+ - move_imm(ctx, dst, imm64, is32); - return 1; -+ } - - /* dst = *(size *)(src + off) */ - case BPF_LDX | BPF_MEM | BPF_B: -diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c -index f521874ebb07b..67f067706af27 100644 ---- a/arch/mips/alchemy/devboards/db1200.c -+++ b/arch/mips/alchemy/devboards/db1200.c -@@ -847,7 +847,7 @@ int __init db1200_dev_setup(void) - i2c_register_board_info(0, db1200_i2c_devs, - ARRAY_SIZE(db1200_i2c_devs)); - spi_register_board_info(db1200_spi_devs, -- ARRAY_SIZE(db1200_i2c_devs)); -+ ARRAY_SIZE(db1200_spi_devs)); - - /* SWITCHES: S6.8 I2C/SPI selector (OFF=I2C ON=SPI) - * S6.7 AC97/I2S selector (OFF=AC97 ON=I2S) -diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c -index fd91d9c9a2525..6c6837181f555 100644 ---- a/arch/mips/alchemy/devboards/db1550.c -+++ b/arch/mips/alchemy/devboards/db1550.c -@@ -589,7 +589,7 @@ int __init db1550_dev_setup(void) - i2c_register_board_info(0, db1550_i2c_devs, - ARRAY_SIZE(db1550_i2c_devs)); - spi_register_board_info(db1550_spi_devs, -- ARRAY_SIZE(db1550_i2c_devs)); -+ ARRAY_SIZE(db1550_spi_devs)); - - c = clk_get(NULL, "psc0_intclk"); - if (!IS_ERR(c)) { -diff --git a/arch/mips/include/asm/dmi.h b/arch/mips/include/asm/dmi.h -index 27415a288adf5..dc397f630c660 100644 ---- a/arch/mips/include/asm/dmi.h -+++ b/arch/mips/include/asm/dmi.h -@@ -5,7 +5,7 @@ - #include - #include - --#define dmi_early_remap(x, l) ioremap_cache(x, l) -+#define dmi_early_remap(x, l) ioremap(x, l) - #define dmi_early_unmap(x, l) iounmap(x) - #define dmi_remap(x, l) ioremap_cache(x, l) - #define dmi_unmap(x) iounmap(x) -diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c -index 7c540572f1f72..e46e7ec76b4f4 100644 ---- a/arch/mips/kernel/setup.c -+++ b/arch/mips/kernel/setup.c -@@ -326,11 +326,11 @@ static void __init bootmem_init(void) - panic("Incorrect memory mapping !!!"); - - if (max_pfn > PFN_DOWN(HIGHMEM_START)) { -+ max_low_pfn = PFN_DOWN(HIGHMEM_START); - #ifdef CONFIG_HIGHMEM -- highstart_pfn = PFN_DOWN(HIGHMEM_START); -+ highstart_pfn = max_low_pfn; - highend_pfn = max_pfn; - #else -- max_low_pfn = PFN_DOWN(HIGHMEM_START); - max_pfn = max_low_pfn; - #endif - } -diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c -index 1d93b85271ba8..002c91fcb842e 100644 ---- a/arch/mips/kernel/smp.c -+++ b/arch/mips/kernel/smp.c -@@ -333,10 +333,11 @@ early_initcall(mips_smp_ipi_init); - */ - asmlinkage void start_secondary(void) - { -- unsigned int cpu; -+ unsigned int cpu = raw_smp_processor_id(); - - cpu_probe(); - per_cpu_trap_init(false); -+ rcu_cpu_starting(cpu); - mips_clockevent_init(); - mp_ops->init_secondary(); - cpu_report(); -@@ -348,7 +349,6 @@ asmlinkage void start_secondary(void) - */ - - calibrate_delay(); -- cpu = smp_processor_id(); - cpu_data[cpu].udelay_val = loops_per_jiffy; - - set_cpu_sibling_map(cpu); -diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig -index 6050e6e10d321..2c94f9cf1ce00 100644 ---- a/arch/powerpc/Kconfig -+++ b/arch/powerpc/Kconfig -@@ -806,6 +806,7 @@ config THREAD_SHIFT - int "Thread shift" if EXPERT - range 13 15 - default "15" if PPC_256K_PAGES -+ default "15" if PPC_PSERIES || PPC_POWERNV - default "14" if PPC64 - default "13" - help -diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile -index 054844153b1fd..487e4967b60d2 100644 ---- a/arch/powerpc/Makefile -+++ b/arch/powerpc/Makefile -@@ -42,18 +42,13 @@ machine-$(CONFIG_PPC64) += 64 - machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le - UTS_MACHINE := $(subst $(space),,$(machine-y)) - --# XXX This needs to be before we override LD below --ifdef CONFIG_PPC32 --KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o --else --ifeq ($(call ld-ifversion, -ge, 22500, y),y) -+ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy) - # Have the linker provide sfpr if possible. - # There is a corresponding test in arch/powerpc/lib/Makefile - KBUILD_LDFLAGS_MODULE += --save-restore-funcs - else - KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o - endif --endif - - ifdef CONFIG_CPU_LITTLE_ENDIAN - KBUILD_CFLAGS += -mlittle-endian -@@ -391,17 +386,7 @@ endif - endif - - PHONY += checkbin --# Check toolchain versions: --# - gcc-4.6 is the minimum kernel-wide version so nothing required. - checkbin: -- @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \ -- "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \ -- echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \ -- echo 'in some circumstances.' ; \ -- echo '*** binutils 2.23 do not define the TOC symbol ' ; \ -- echo -n '*** Please use a different binutils version.' ; \ -- false ; \ -- fi - @if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \ - "x${CONFIG_LD_IS_BFD}" = "xy" -a \ - "${CONFIG_LD_VERSION}" = "23700" ; then \ -diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile -index 8560c912186df..9b394bab17eba 100644 ---- a/arch/powerpc/lib/Makefile -+++ b/arch/powerpc/lib/Makefile -@@ -42,8 +42,8 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o - # 64-bit linker creates .sfpr on demand for final link (vmlinux), - # so it is only needed for modules, and only for older linkers which - # do not support --save-restore-funcs --ifeq ($(call ld-ifversion, -lt, 22500, y),y) --extra-$(CONFIG_PPC64) += crtsavres.o -+ifndef CONFIG_LD_IS_BFD -+always-$(CONFIG_PPC64) += crtsavres.o - endif - - obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \ -diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c -index ada817c49b722..56d82f7f9734e 100644 ---- a/arch/powerpc/perf/imc-pmu.c -+++ b/arch/powerpc/perf/imc-pmu.c -@@ -299,6 +299,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) - attr_group->attrs = attrs; - do { - ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); -+ if (!ev_val_str) -+ continue; - dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); - if (!dev_str) - continue; -@@ -306,6 +308,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) - attrs[j++] = dev_str; - if (pmu->events[i].scale) { - ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); -+ if (!ev_scale_str) -+ continue; - dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); - if (!dev_str) - continue; -@@ -315,6 +319,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) - - if (pmu->events[i].unit) { - ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); -+ if (!ev_unit_str) -+ continue; - dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); - if (!dev_str) - continue; -diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig -index 25b80cd558f8d..fc79f84669335 100644 ---- a/arch/powerpc/platforms/44x/Kconfig -+++ b/arch/powerpc/platforms/44x/Kconfig -@@ -173,6 +173,7 @@ config ISS4xx - config CURRITUCK - bool "IBM Currituck (476fpe) Support" - depends on PPC_47x -+ select I2C - select SWIOTLB - select 476FPE - select FORCE_PCI -diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c -index d55652b5f6fa4..391f505352007 100644 ---- a/arch/powerpc/platforms/powernv/opal-irqchip.c -+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c -@@ -275,6 +275,8 @@ int __init opal_event_init(void) - else - name = kasprintf(GFP_KERNEL, "opal"); - -+ if (!name) -+ continue; - /* Install interrupt handler */ - rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK, - name, NULL); -diff --git a/arch/powerpc/platforms/powernv/opal-powercap.c b/arch/powerpc/platforms/powernv/opal-powercap.c -index 7bfe4cbeb35a9..ea917266aa172 100644 ---- a/arch/powerpc/platforms/powernv/opal-powercap.c -+++ b/arch/powerpc/platforms/powernv/opal-powercap.c -@@ -196,6 +196,12 @@ void __init opal_powercap_init(void) - - j = 0; - pcaps[i].pg.name = kasprintf(GFP_KERNEL, "%pOFn", node); -+ if (!pcaps[i].pg.name) { -+ kfree(pcaps[i].pattrs); -+ kfree(pcaps[i].pg.attrs); -+ goto out_pcaps_pattrs; -+ } -+ - if (has_min) { - powercap_add_attr(min, "powercap-min", - &pcaps[i].pattrs[j]); -diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c -index 6b4eed2ef4fa9..f67235d1ba2c5 100644 ---- a/arch/powerpc/platforms/powernv/opal-xscom.c -+++ b/arch/powerpc/platforms/powernv/opal-xscom.c -@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn, - ent->chip = chip; - snprintf(ent->name, 16, "%08x", chip); - ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn); -+ if (!ent->path.data) { -+ kfree(ent); -+ return -ENOMEM; -+ } -+ - ent->path.size = strlen((char *)ent->path.data); - - dir = debugfs_create_dir(ent->name, root); -diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c -index 2e3a317722a81..051a777ba1b27 100644 ---- a/arch/powerpc/platforms/pseries/hotplug-memory.c -+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c -@@ -500,14 +500,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index) - } - } - -- if (!lmb_found) -+ if (!lmb_found) { -+ pr_debug("Failed to look up LMB for drc index %x\n", drc_index); - rc = -EINVAL; -- -- if (rc) -+ } else if (rc) { - pr_debug("Failed to hot-remove memory at %llx\n", - lmb->base_addr); -- else -+ } else { - pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr); -+ } - - return rc; - } -diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h -index 32336e8a17cb0..a393d5035c543 100644 ---- a/arch/riscv/include/asm/sections.h -+++ b/arch/riscv/include/asm/sections.h -@@ -13,6 +13,7 @@ extern char _start_kernel[]; - extern char __init_data_begin[], __init_data_end[]; - extern char __init_text_begin[], __init_text_end[]; - extern char __alt_start[], __alt_end[]; -+extern char __exittext_begin[], __exittext_end[]; - - static inline bool is_va_kernel_text(uintptr_t va) - { -diff --git a/arch/riscv/include/asm/xip_fixup.h b/arch/riscv/include/asm/xip_fixup.h -index d4ffc3c37649f..b65bf6306f69c 100644 ---- a/arch/riscv/include/asm/xip_fixup.h -+++ b/arch/riscv/include/asm/xip_fixup.h -@@ -13,7 +13,7 @@ - add \reg, \reg, t0 - .endm - .macro XIP_FIXUP_FLASH_OFFSET reg -- la t1, __data_loc -+ la t0, __data_loc - REG_L t1, _xip_phys_offset - sub \reg, \reg, t1 - add \reg, \reg, t0 -diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c -index 91fe16bfaa07c..a331001e33e66 100644 ---- a/arch/riscv/kernel/module.c -+++ b/arch/riscv/kernel/module.c -@@ -424,7 +424,8 @@ void *module_alloc(unsigned long size) - { - return __vmalloc_node_range(size, 1, MODULES_VADDR, - MODULES_END, GFP_KERNEL, -- PAGE_KERNEL, 0, NUMA_NO_NODE, -+ PAGE_KERNEL, VM_FLUSH_RESET_PERMS, -+ NUMA_NO_NODE, - __builtin_return_address(0)); - } - #endif -diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c -index e099961453cca..160e5c1caa9c4 100644 ---- a/arch/riscv/kernel/patch.c -+++ b/arch/riscv/kernel/patch.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - - struct patch_insn { - void *addr; -@@ -23,6 +24,14 @@ struct patch_insn { - int riscv_patch_in_stop_machine = false; - - #ifdef CONFIG_MMU -+ -+static inline bool is_kernel_exittext(uintptr_t addr) -+{ -+ return system_state < SYSTEM_RUNNING && -+ addr >= (uintptr_t)__exittext_begin && -+ addr < (uintptr_t)__exittext_end; -+} -+ - /* - * The fix_to_virt(, idx) needs a const value (not a dynamic variable of - * reg-a0) or BUILD_BUG_ON failed with "idx >= __end_of_fixed_addresses". -@@ -33,7 +42,7 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap) - uintptr_t uintaddr = (uintptr_t) addr; - struct page *page; - -- if (core_kernel_text(uintaddr)) -+ if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) - page = phys_to_page(__pa_symbol(addr)); - else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) - page = vmalloc_to_page(addr); -diff --git a/arch/riscv/kernel/vmlinux-xip.lds.S b/arch/riscv/kernel/vmlinux-xip.lds.S -index 75e0fa8a700ae..24a2fdd3be6a0 100644 ---- a/arch/riscv/kernel/vmlinux-xip.lds.S -+++ b/arch/riscv/kernel/vmlinux-xip.lds.S -@@ -29,10 +29,12 @@ SECTIONS - HEAD_TEXT_SECTION - INIT_TEXT_SECTION(PAGE_SIZE) - /* we have to discard exit text and such at runtime, not link time */ -+ __exittext_begin = .; - .exit.text : - { - EXIT_TEXT - } -+ __exittext_end = .; - - .text : { - _text = .; -diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S -index 4e6c88aa4d870..d478e063b8785 100644 ---- a/arch/riscv/kernel/vmlinux.lds.S -+++ b/arch/riscv/kernel/vmlinux.lds.S -@@ -72,10 +72,12 @@ SECTIONS - __soc_builtin_dtb_table_end = .; - } - /* we have to discard exit text and such at runtime, not link time */ -+ __exittext_begin = .; - .exit.text : - { - EXIT_TEXT - } -+ __exittext_end = .; - - __init_text_end = .; - . = ALIGN(SECTION_ALIGN); -diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c -index ea3d61de065b3..9587e44874152 100644 ---- a/arch/riscv/mm/pageattr.c -+++ b/arch/riscv/mm/pageattr.c -@@ -5,6 +5,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -25,19 +26,6 @@ static unsigned long set_pageattr_masks(unsigned long val, struct mm_walk *walk) - return new_val; - } - --static int pageattr_pgd_entry(pgd_t *pgd, unsigned long addr, -- unsigned long next, struct mm_walk *walk) --{ -- pgd_t val = READ_ONCE(*pgd); -- -- if (pgd_leaf(val)) { -- val = __pgd(set_pageattr_masks(pgd_val(val), walk)); -- set_pgd(pgd, val); -- } -- -- return 0; --} -- - static int pageattr_p4d_entry(p4d_t *p4d, unsigned long addr, - unsigned long next, struct mm_walk *walk) - { -@@ -96,7 +84,6 @@ static int pageattr_pte_hole(unsigned long addr, unsigned long next, - } - - static const struct mm_walk_ops pageattr_ops = { -- .pgd_entry = pageattr_pgd_entry, - .p4d_entry = pageattr_p4d_entry, - .pud_entry = pageattr_pud_entry, - .pmd_entry = pageattr_pmd_entry, -@@ -104,12 +91,181 @@ static const struct mm_walk_ops pageattr_ops = { - .pte_hole = pageattr_pte_hole, - }; - -+#ifdef CONFIG_64BIT -+static int __split_linear_mapping_pmd(pud_t *pudp, -+ unsigned long vaddr, unsigned long end) -+{ -+ pmd_t *pmdp; -+ unsigned long next; -+ -+ pmdp = pmd_offset(pudp, vaddr); -+ -+ do { -+ next = pmd_addr_end(vaddr, end); -+ -+ if (next - vaddr >= PMD_SIZE && -+ vaddr <= (vaddr & PMD_MASK) && end >= next) -+ continue; -+ -+ if (pmd_leaf(*pmdp)) { -+ struct page *pte_page; -+ unsigned long pfn = _pmd_pfn(*pmdp); -+ pgprot_t prot = __pgprot(pmd_val(*pmdp) & ~_PAGE_PFN_MASK); -+ pte_t *ptep_new; -+ int i; -+ -+ pte_page = alloc_page(GFP_KERNEL); -+ if (!pte_page) -+ return -ENOMEM; -+ -+ ptep_new = (pte_t *)page_address(pte_page); -+ for (i = 0; i < PTRS_PER_PTE; ++i, ++ptep_new) -+ set_pte(ptep_new, pfn_pte(pfn + i, prot)); -+ -+ smp_wmb(); -+ -+ set_pmd(pmdp, pfn_pmd(page_to_pfn(pte_page), PAGE_TABLE)); -+ } -+ } while (pmdp++, vaddr = next, vaddr != end); -+ -+ return 0; -+} -+ -+static int __split_linear_mapping_pud(p4d_t *p4dp, -+ unsigned long vaddr, unsigned long end) -+{ -+ pud_t *pudp; -+ unsigned long next; -+ int ret; -+ -+ pudp = pud_offset(p4dp, vaddr); -+ -+ do { -+ next = pud_addr_end(vaddr, end); -+ -+ if (next - vaddr >= PUD_SIZE && -+ vaddr <= (vaddr & PUD_MASK) && end >= next) -+ continue; -+ -+ if (pud_leaf(*pudp)) { -+ struct page *pmd_page; -+ unsigned long pfn = _pud_pfn(*pudp); -+ pgprot_t prot = __pgprot(pud_val(*pudp) & ~_PAGE_PFN_MASK); -+ pmd_t *pmdp_new; -+ int i; -+ -+ pmd_page = alloc_page(GFP_KERNEL); -+ if (!pmd_page) -+ return -ENOMEM; -+ -+ pmdp_new = (pmd_t *)page_address(pmd_page); -+ for (i = 0; i < PTRS_PER_PMD; ++i, ++pmdp_new) -+ set_pmd(pmdp_new, -+ pfn_pmd(pfn + ((i * PMD_SIZE) >> PAGE_SHIFT), prot)); -+ -+ smp_wmb(); -+ -+ set_pud(pudp, pfn_pud(page_to_pfn(pmd_page), PAGE_TABLE)); -+ } -+ -+ ret = __split_linear_mapping_pmd(pudp, vaddr, next); -+ if (ret) -+ return ret; -+ } while (pudp++, vaddr = next, vaddr != end); -+ -+ return 0; -+} -+ -+static int __split_linear_mapping_p4d(pgd_t *pgdp, -+ unsigned long vaddr, unsigned long end) -+{ -+ p4d_t *p4dp; -+ unsigned long next; -+ int ret; -+ -+ p4dp = p4d_offset(pgdp, vaddr); -+ -+ do { -+ next = p4d_addr_end(vaddr, end); -+ -+ /* -+ * If [vaddr; end] contains [vaddr & P4D_MASK; next], we don't -+ * need to split, we'll change the protections on the whole P4D. -+ */ -+ if (next - vaddr >= P4D_SIZE && -+ vaddr <= (vaddr & P4D_MASK) && end >= next) -+ continue; -+ -+ if (p4d_leaf(*p4dp)) { -+ struct page *pud_page; -+ unsigned long pfn = _p4d_pfn(*p4dp); -+ pgprot_t prot = __pgprot(p4d_val(*p4dp) & ~_PAGE_PFN_MASK); -+ pud_t *pudp_new; -+ int i; -+ -+ pud_page = alloc_page(GFP_KERNEL); -+ if (!pud_page) -+ return -ENOMEM; -+ -+ /* -+ * Fill the pud level with leaf puds that have the same -+ * protections as the leaf p4d. -+ */ -+ pudp_new = (pud_t *)page_address(pud_page); -+ for (i = 0; i < PTRS_PER_PUD; ++i, ++pudp_new) -+ set_pud(pudp_new, -+ pfn_pud(pfn + ((i * PUD_SIZE) >> PAGE_SHIFT), prot)); -+ -+ /* -+ * Make sure the pud filling is not reordered with the -+ * p4d store which could result in seeing a partially -+ * filled pud level. -+ */ -+ smp_wmb(); -+ -+ set_p4d(p4dp, pfn_p4d(page_to_pfn(pud_page), PAGE_TABLE)); -+ } -+ -+ ret = __split_linear_mapping_pud(p4dp, vaddr, next); -+ if (ret) -+ return ret; -+ } while (p4dp++, vaddr = next, vaddr != end); -+ -+ return 0; -+} -+ -+static int __split_linear_mapping_pgd(pgd_t *pgdp, -+ unsigned long vaddr, -+ unsigned long end) -+{ -+ unsigned long next; -+ int ret; -+ -+ do { -+ next = pgd_addr_end(vaddr, end); -+ /* We never use PGD mappings for the linear mapping */ -+ ret = __split_linear_mapping_p4d(pgdp, vaddr, next); -+ if (ret) -+ return ret; -+ } while (pgdp++, vaddr = next, vaddr != end); -+ -+ return 0; -+} -+ -+static int split_linear_mapping(unsigned long start, unsigned long end) -+{ -+ return __split_linear_mapping_pgd(pgd_offset_k(start), start, end); -+} -+#endif /* CONFIG_64BIT */ -+ - static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, - pgprot_t clear_mask) - { - int ret; - unsigned long start = addr; - unsigned long end = start + PAGE_SIZE * numpages; -+ unsigned long __maybe_unused lm_start; -+ unsigned long __maybe_unused lm_end; - struct pageattr_masks masks = { - .set_mask = set_mask, - .clear_mask = clear_mask -@@ -119,11 +275,72 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, - return 0; - - mmap_write_lock(&init_mm); -+ -+#ifdef CONFIG_64BIT -+ /* -+ * We are about to change the permissions of a kernel mapping, we must -+ * apply the same changes to its linear mapping alias, which may imply -+ * splitting a huge mapping. -+ */ -+ -+ if (is_vmalloc_or_module_addr((void *)start)) { -+ struct vm_struct *area = NULL; -+ int i, page_start; -+ -+ area = find_vm_area((void *)start); -+ page_start = (start - (unsigned long)area->addr) >> PAGE_SHIFT; -+ -+ for (i = page_start; i < page_start + numpages; ++i) { -+ lm_start = (unsigned long)page_address(area->pages[i]); -+ lm_end = lm_start + PAGE_SIZE; -+ -+ ret = split_linear_mapping(lm_start, lm_end); -+ if (ret) -+ goto unlock; -+ -+ ret = walk_page_range_novma(&init_mm, lm_start, lm_end, -+ &pageattr_ops, NULL, &masks); -+ if (ret) -+ goto unlock; -+ } -+ } else if (is_kernel_mapping(start) || is_linear_mapping(start)) { -+ if (is_kernel_mapping(start)) { -+ lm_start = (unsigned long)lm_alias(start); -+ lm_end = (unsigned long)lm_alias(end); -+ } else { -+ lm_start = start; -+ lm_end = end; -+ } -+ -+ ret = split_linear_mapping(lm_start, lm_end); -+ if (ret) -+ goto unlock; -+ -+ ret = walk_page_range_novma(&init_mm, lm_start, lm_end, -+ &pageattr_ops, NULL, &masks); -+ if (ret) -+ goto unlock; -+ } -+ - ret = walk_page_range_novma(&init_mm, start, end, &pageattr_ops, NULL, - &masks); -+ -+unlock: -+ mmap_write_unlock(&init_mm); -+ -+ /* -+ * We can't use flush_tlb_kernel_range() here as we may have split a -+ * hugepage that is larger than that, so let's flush everything. -+ */ -+ flush_tlb_all(); -+#else -+ ret = walk_page_range_novma(&init_mm, start, end, &pageattr_ops, NULL, -+ &masks); -+ - mmap_write_unlock(&init_mm); - - flush_tlb_kernel_range(start, end); -+#endif - - return ret; - } -@@ -158,36 +375,14 @@ int set_memory_nx(unsigned long addr, int numpages) - - int set_direct_map_invalid_noflush(struct page *page) - { -- int ret; -- unsigned long start = (unsigned long)page_address(page); -- unsigned long end = start + PAGE_SIZE; -- struct pageattr_masks masks = { -- .set_mask = __pgprot(0), -- .clear_mask = __pgprot(_PAGE_PRESENT) -- }; -- -- mmap_read_lock(&init_mm); -- ret = walk_page_range(&init_mm, start, end, &pageattr_ops, &masks); -- mmap_read_unlock(&init_mm); -- -- return ret; -+ return __set_memory((unsigned long)page_address(page), 1, -+ __pgprot(0), __pgprot(_PAGE_PRESENT)); - } - - int set_direct_map_default_noflush(struct page *page) - { -- int ret; -- unsigned long start = (unsigned long)page_address(page); -- unsigned long end = start + PAGE_SIZE; -- struct pageattr_masks masks = { -- .set_mask = PAGE_KERNEL, -- .clear_mask = __pgprot(0) -- }; -- -- mmap_read_lock(&init_mm); -- ret = walk_page_range(&init_mm, start, end, &pageattr_ops, &masks); -- mmap_read_unlock(&init_mm); -- -- return ret; -+ return __set_memory((unsigned long)page_address(page), 1, -+ PAGE_KERNEL, __pgprot(_PAGE_EXEC)); - } - - #ifdef CONFIG_DEBUG_PAGEALLOC -diff --git a/arch/s390/include/asm/pci_io.h b/arch/s390/include/asm/pci_io.h -index 287bb88f76986..2686bee800e3d 100644 ---- a/arch/s390/include/asm/pci_io.h -+++ b/arch/s390/include/asm/pci_io.h -@@ -11,6 +11,8 @@ - /* I/O size constraints */ - #define ZPCI_MAX_READ_SIZE 8 - #define ZPCI_MAX_WRITE_SIZE 128 -+#define ZPCI_BOUNDARY_SIZE (1 << 12) -+#define ZPCI_BOUNDARY_MASK (ZPCI_BOUNDARY_SIZE - 1) - - /* I/O Map */ - #define ZPCI_IOMAP_SHIFT 48 -@@ -125,16 +127,18 @@ out: - int zpci_write_block(volatile void __iomem *dst, const void *src, - unsigned long len); - --static inline u8 zpci_get_max_write_size(u64 src, u64 dst, int len, int max) -+static inline int zpci_get_max_io_size(u64 src, u64 dst, int len, int max) - { -- int count = len > max ? max : len, size = 1; -+ int offset = dst & ZPCI_BOUNDARY_MASK; -+ int size; - -- while (!(src & 0x1) && !(dst & 0x1) && ((size << 1) <= count)) { -- dst = dst >> 1; -- src = src >> 1; -- size = size << 1; -- } -- return size; -+ size = min3(len, ZPCI_BOUNDARY_SIZE - offset, max); -+ if (IS_ALIGNED(src, 8) && IS_ALIGNED(dst, 8) && IS_ALIGNED(size, 8)) -+ return size; -+ -+ if (size >= 8) -+ return 8; -+ return rounddown_pow_of_two(size); - } - - static inline int zpci_memcpy_fromio(void *dst, -@@ -144,9 +148,9 @@ static inline int zpci_memcpy_fromio(void *dst, - int size, rc = 0; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) src, -- (u64) dst, n, -- ZPCI_MAX_READ_SIZE); -+ size = zpci_get_max_io_size((u64 __force) src, -+ (u64) dst, n, -+ ZPCI_MAX_READ_SIZE); - rc = zpci_read_single(dst, src, size); - if (rc) - break; -@@ -166,9 +170,9 @@ static inline int zpci_memcpy_toio(volatile void __iomem *dst, - return -EINVAL; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) dst, -- (u64) src, n, -- ZPCI_MAX_WRITE_SIZE); -+ size = zpci_get_max_io_size((u64 __force) dst, -+ (u64) src, n, -+ ZPCI_MAX_WRITE_SIZE); - if (size > 8) /* main path */ - rc = zpci_write_block(dst, src, size); - else -diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c -index 5880893329310..a90499c087f0c 100644 ---- a/arch/s390/pci/pci_mmio.c -+++ b/arch/s390/pci/pci_mmio.c -@@ -97,9 +97,9 @@ static inline int __memcpy_toio_inuser(void __iomem *dst, - return -EINVAL; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) dst, -- (u64 __force) src, n, -- ZPCI_MAX_WRITE_SIZE); -+ size = zpci_get_max_io_size((u64 __force) dst, -+ (u64 __force) src, n, -+ ZPCI_MAX_WRITE_SIZE); - if (size > 8) /* main path */ - rc = __pcistb_mio_inuser(dst, src, size, &status); - else -@@ -242,9 +242,9 @@ static inline int __memcpy_fromio_inuser(void __user *dst, - u8 status; - - while (n > 0) { -- size = zpci_get_max_write_size((u64 __force) src, -- (u64 __force) dst, n, -- ZPCI_MAX_READ_SIZE); -+ size = zpci_get_max_io_size((u64 __force) src, -+ (u64 __force) dst, n, -+ ZPCI_MAX_READ_SIZE); - rc = __pcilg_mio_inuser(dst, src, size, &status); - if (rc) - break; -diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c -index 12cf2e7ca33cc..87c15ab896517 100644 ---- a/arch/x86/kernel/cpu/mce/inject.c -+++ b/arch/x86/kernel/cpu/mce/inject.c -@@ -747,6 +747,7 @@ static void check_hw_inj_possible(void) - - wrmsrl_safe(mca_msr_reg(bank, MCA_STATUS), status); - rdmsrl_safe(mca_msr_reg(bank, MCA_STATUS), &status); -+ wrmsrl_safe(mca_msr_reg(bank, MCA_STATUS), 0); - - if (!status) { - hw_injection_possible = false; -diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c -index 16333ba1904ba..c067887d42df5 100644 ---- a/arch/x86/kernel/kvmclock.c -+++ b/arch/x86/kernel/kvmclock.c -@@ -24,8 +24,8 @@ - - static int kvmclock __initdata = 1; - static int kvmclock_vsyscall __initdata = 1; --static int msr_kvm_system_time __ro_after_init = MSR_KVM_SYSTEM_TIME; --static int msr_kvm_wall_clock __ro_after_init = MSR_KVM_WALL_CLOCK; -+static int msr_kvm_system_time __ro_after_init; -+static int msr_kvm_wall_clock __ro_after_init; - static u64 kvm_sched_clock_offset __ro_after_init; - - static int __init parse_no_kvmclock(char *arg) -@@ -195,7 +195,8 @@ static void kvm_setup_secondary_clock(void) - - void kvmclock_disable(void) - { -- native_write_msr(msr_kvm_system_time, 0, 0); -+ if (msr_kvm_system_time) -+ native_write_msr(msr_kvm_system_time, 0, 0); - } - - static void __init kvmclock_init_mem(void) -@@ -294,7 +295,10 @@ void __init kvmclock_init(void) - if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE2)) { - msr_kvm_system_time = MSR_KVM_SYSTEM_TIME_NEW; - msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK_NEW; -- } else if (!kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) { -+ } else if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) { -+ msr_kvm_system_time = MSR_KVM_SYSTEM_TIME; -+ msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK; -+ } else { - return; - } - -diff --git a/arch/x86/lib/misc.c b/arch/x86/lib/misc.c -index a018ec4fba53e..c97be9a1430a0 100644 ---- a/arch/x86/lib/misc.c -+++ b/arch/x86/lib/misc.c -@@ -6,7 +6,7 @@ - */ - int num_digits(int val) - { -- int m = 10; -+ long long m = 10; - int d = 1; - - if (val < 0) { -diff --git a/block/bio.c b/block/bio.c -index 9ec72a78f1149..6c22dd7b6f278 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -1109,13 +1109,22 @@ bool bio_add_folio(struct bio *bio, struct folio *folio, size_t len, - - void __bio_release_pages(struct bio *bio, bool mark_dirty) - { -- struct bvec_iter_all iter_all; -- struct bio_vec *bvec; -+ struct folio_iter fi; - -- bio_for_each_segment_all(bvec, bio, iter_all) { -- if (mark_dirty && !PageCompound(bvec->bv_page)) -- set_page_dirty_lock(bvec->bv_page); -- put_page(bvec->bv_page); -+ bio_for_each_folio_all(fi, bio) { -+ struct page *page; -+ size_t done = 0; -+ -+ if (mark_dirty) { -+ folio_lock(fi.folio); -+ folio_mark_dirty(fi.folio); -+ folio_unlock(fi.folio); -+ } -+ page = folio_page(fi.folio, fi.offset / PAGE_SIZE); -+ do { -+ folio_put(fi.folio); -+ done += PAGE_SIZE; -+ } while (done < fi.length); - } - } - EXPORT_SYMBOL_GPL(__bio_release_pages); -@@ -1414,12 +1423,12 @@ EXPORT_SYMBOL(bio_free_pages); - */ - void bio_set_pages_dirty(struct bio *bio) - { -- struct bio_vec *bvec; -- struct bvec_iter_all iter_all; -+ struct folio_iter fi; - -- bio_for_each_segment_all(bvec, bio, iter_all) { -- if (!PageCompound(bvec->bv_page)) -- set_page_dirty_lock(bvec->bv_page); -+ bio_for_each_folio_all(fi, bio) { -+ folio_lock(fi.folio); -+ folio_mark_dirty(fi.folio); -+ folio_unlock(fi.folio); - } - } - -@@ -1462,12 +1471,11 @@ static void bio_dirty_fn(struct work_struct *work) - - void bio_check_pages_dirty(struct bio *bio) - { -- struct bio_vec *bvec; -+ struct folio_iter fi; - unsigned long flags; -- struct bvec_iter_all iter_all; - -- bio_for_each_segment_all(bvec, bio, iter_all) { -- if (!PageDirty(bvec->bv_page) && !PageCompound(bvec->bv_page)) -+ bio_for_each_folio_all(fi, bio) { -+ if (!folio_test_dirty(fi.folio)) - goto defer; - } - -diff --git a/block/blk-mq.c b/block/blk-mq.c -index 368f1947c8956..b3f99dda45300 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -2946,12 +2946,6 @@ void blk_mq_submit_bio(struct bio *bio) - blk_status_t ret; - - bio = blk_queue_bounce(bio, q); -- if (bio_may_exceed_limits(bio, &q->limits)) { -- bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); -- if (!bio) -- return; -- } -- - bio_set_ioprio(bio); - - if (plug) { -@@ -2960,6 +2954,11 @@ void blk_mq_submit_bio(struct bio *bio) - rq = NULL; - } - if (rq) { -+ if (unlikely(bio_may_exceed_limits(bio, &q->limits))) { -+ bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); -+ if (!bio) -+ return; -+ } - if (!bio_integrity_prep(bio)) - return; - if (blk_mq_attempt_bio_merge(q, bio, nr_segs)) -@@ -2970,6 +2969,11 @@ void blk_mq_submit_bio(struct bio *bio) - } else { - if (unlikely(bio_queue_enter(bio))) - return; -+ if (unlikely(bio_may_exceed_limits(bio, &q->limits))) { -+ bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); -+ if (!bio) -+ goto fail; -+ } - if (!bio_integrity_prep(bio)) - goto fail; - } -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 86ff375c00ce4..bbca4ce77a2d3 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -135,7 +135,7 @@ void blk_queue_max_hw_sectors(struct request_queue *q, unsigned int max_hw_secto - limits->max_hw_sectors = max_hw_sectors; - - max_sectors = min_not_zero(max_hw_sectors, limits->max_dev_sectors); -- max_sectors = min_t(unsigned int, max_sectors, BLK_DEF_MAX_SECTORS); -+ max_sectors = min(max_sectors, BLK_DEF_MAX_SECTORS); - max_sectors = round_down(max_sectors, - limits->logical_block_size >> SECTOR_SHIFT); - limits->max_sectors = max_sectors; -diff --git a/block/genhd.c b/block/genhd.c -index afab646d12c85..ddb17c4adc8a2 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -444,7 +444,9 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, - DISK_MAX_PARTS); - disk->minors = DISK_MAX_PARTS; - } -- if (disk->first_minor + disk->minors > MINORMASK + 1) -+ if (disk->first_minor > MINORMASK || -+ disk->minors > MINORMASK + 1 || -+ disk->first_minor + disk->minors > MINORMASK + 1) - goto out_exit_elevator; - } else { - if (WARN_ON(disk->minors)) -@@ -567,6 +569,7 @@ out_del_integrity: - out_del_block_link: - if (!sysfs_deprecated) - sysfs_remove_link(block_depr, dev_name(ddev)); -+ pm_runtime_set_memalloc_noio(ddev, false); - out_device_del: - device_del(ddev); - out_free_ext_minor: -diff --git a/block/ioctl.c b/block/ioctl.c -index 3c475e4166e9f..ebe4a2653622b 100644 ---- a/block/ioctl.c -+++ b/block/ioctl.c -@@ -18,7 +18,7 @@ static int blkpg_do_ioctl(struct block_device *bdev, - { - struct gendisk *disk = bdev->bd_disk; - struct blkpg_partition p; -- long long start, length; -+ sector_t start, length; - - if (disk->flags & GENHD_FL_NO_PART) - return -EINVAL; -@@ -35,14 +35,17 @@ static int blkpg_do_ioctl(struct block_device *bdev, - if (op == BLKPG_DEL_PARTITION) - return bdev_del_partition(disk, p.pno); - -+ if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) -+ return -EINVAL; -+ /* Check that the partition is aligned to the block size */ -+ if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) -+ return -EINVAL; -+ - start = p.start >> SECTOR_SHIFT; - length = p.length >> SECTOR_SHIFT; - - switch (op) { - case BLKPG_ADD_PARTITION: -- /* check if partition is aligned to blocksize */ -- if (p.start & (bdev_logical_block_size(bdev) - 1)) -- return -EINVAL; - return bdev_add_partition(disk, p.pno, start, length); - case BLKPG_RESIZE_PARTITION: - return bdev_resize_partition(disk, p.pno, start, length); -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index e893c0f6c8799..fef69d2a6b183 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -1045,9 +1045,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage); - void af_alg_free_resources(struct af_alg_async_req *areq) - { - struct sock *sk = areq->sk; -+ struct af_alg_ctx *ctx; - - af_alg_free_areq_sgls(areq); - sock_kfree_s(sk, areq, areq->areqlen); -+ -+ ctx = alg_sk(sk)->private; -+ ctx->inflight = false; - } - EXPORT_SYMBOL_GPL(af_alg_free_resources); - -@@ -1117,11 +1121,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll); - struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, - unsigned int areqlen) - { -- struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL); -+ struct af_alg_ctx *ctx = alg_sk(sk)->private; -+ struct af_alg_async_req *areq; -+ -+ /* Only one AIO request can be in flight. */ -+ if (ctx->inflight) -+ return ERR_PTR(-EBUSY); - -+ areq = sock_kmalloc(sk, areqlen, GFP_KERNEL); - if (unlikely(!areq)) - return ERR_PTR(-ENOMEM); - -+ ctx->inflight = true; -+ - areq->areqlen = areqlen; - areq->sk = sk; - areq->last_rsgl = NULL; -diff --git a/crypto/scompress.c b/crypto/scompress.c -index 738f4f8f0f41a..4d6366a444007 100644 ---- a/crypto/scompress.c -+++ b/crypto/scompress.c -@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) - struct crypto_scomp *scomp = *tfm_ctx; - void **ctx = acomp_request_ctx(req); - struct scomp_scratch *scratch; -+ unsigned int dlen; - int ret; - - if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) -@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) - if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) - req->dlen = SCOMP_SCRATCH_SIZE; - -+ dlen = req->dlen; -+ - scratch = raw_cpu_ptr(&scomp_scratch); - spin_lock(&scratch->lock); - -@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) - ret = -ENOMEM; - goto out; - } -+ } else if (req->dlen > dlen) { -+ ret = -ENOSPC; -+ goto out; - } - scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, - 1); -diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c -index e648158368a7d..088db2356998f 100644 ---- a/drivers/acpi/acpi_extlog.c -+++ b/drivers/acpi/acpi_extlog.c -@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, - static u32 err_seq; - - estatus = extlog_elog_entry_check(cpu, bank); -- if (estatus == NULL || (mce->kflags & MCE_HANDLED_CEC)) -+ if (!estatus) - return NOTIFY_DONE; - -+ if (mce->kflags & MCE_HANDLED_CEC) { -+ estatus->block_status = 0; -+ return NOTIFY_DONE; -+ } -+ - memcpy(elog_buf, (void *)estatus, ELOG_ENTRY_LEN); - /* clear record status to enable BIOS to update it again */ - estatus->block_status = 0; -diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c -index 50540d4d4948e..2c015ecf71853 100644 ---- a/drivers/acpi/acpi_lpit.c -+++ b/drivers/acpi/acpi_lpit.c -@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, - struct acpi_lpit_native *lpit_native) - { - info->frequency = lpit_native->counter_frequency ? -- lpit_native->counter_frequency : tsc_khz * 1000; -+ lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U); - if (!info->frequency) - info->frequency = 1; - -diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c -index f08ffa75f4a76..8b44743945c8b 100644 ---- a/drivers/acpi/acpi_lpss.c -+++ b/drivers/acpi/acpi_lpss.c -@@ -450,8 +450,9 @@ static int register_device_clock(struct acpi_device *adev, - if (!clk_name) - return -ENOMEM; - clk = clk_register_fractional_divider(NULL, clk_name, parent, -+ 0, prv_base, 1, 15, 16, 15, - CLK_FRAC_DIVIDER_POWER_OF_TWO_PS, -- prv_base, 1, 15, 16, 15, 0, NULL); -+ NULL); - parent = clk_name; - - clk_name = kasprintf(GFP_KERNEL, "%s-update", devname); -diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c -index ed318485eb192..f7852fb75ab39 100644 ---- a/drivers/acpi/acpi_video.c -+++ b/drivers/acpi/acpi_video.c -@@ -1726,12 +1726,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device) - return; - count++; - -- acpi_get_parent(device->dev->handle, &acpi_parent); -- -- pdev = acpi_get_pci_dev(acpi_parent); -- if (pdev) { -- parent = &pdev->dev; -- pci_dev_put(pdev); -+ if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) { -+ pdev = acpi_get_pci_dev(acpi_parent); -+ if (pdev) { -+ parent = &pdev->dev; -+ pci_dev_put(pdev); -+ } - } - - memset(&props, 0, sizeof(struct backlight_properties)); -diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c -index 0565c18c2ee31..62aee900af3df 100644 ---- a/drivers/acpi/property.c -+++ b/drivers/acpi/property.c -@@ -851,6 +851,7 @@ static int acpi_get_ref_args(struct fwnode_reference_args *args, - * @index: Index of the reference to return - * @num_args: Maximum number of arguments after each reference - * @args: Location to store the returned reference with optional arguments -+ * (may be NULL) - * - * Find property with @name, verifify that it is a package containing at least - * one object reference and if so, store the ACPI device object pointer to the -@@ -907,6 +908,9 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode, - if (!device) - return -EINVAL; - -+ if (!args) -+ return 0; -+ - args->fwnode = acpi_fwnode_handle(device); - args->nargs = 0; - return 0; -diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c -index ed607850f87fb..fcbb750b1ccc3 100644 ---- a/drivers/android/binder_alloc.c -+++ b/drivers/android/binder_alloc.c -@@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, - } - if (mm) { - mmap_write_unlock(mm); -- mmput(mm); -+ mmput_async(mm); - } - return 0; - -@@ -304,7 +304,7 @@ err_page_ptr_cleared: - err_no_vma: - if (mm) { - mmap_write_unlock(mm); -- mmput(mm); -+ mmput_async(mm); - } - return vma ? -ENOMEM : -ESRCH; - } -@@ -344,8 +344,7 @@ static bool debug_low_async_space_locked(struct binder_alloc *alloc, int pid) - continue; - if (!buffer->async_transaction) - continue; -- total_alloc_size += binder_alloc_buffer_size(alloc, buffer) -- + sizeof(struct binder_buffer); -+ total_alloc_size += binder_alloc_buffer_size(alloc, buffer); - num_buffers++; - } - -@@ -407,17 +406,17 @@ static struct binder_buffer *binder_alloc_new_buf_locked( - alloc->pid, extra_buffers_size); - return ERR_PTR(-EINVAL); - } -- if (is_async && -- alloc->free_async_space < size + sizeof(struct binder_buffer)) { -+ -+ /* Pad 0-size buffers so they get assigned unique addresses */ -+ size = max(size, sizeof(void *)); -+ -+ if (is_async && alloc->free_async_space < size) { - binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC, - "%d: binder_alloc_buf size %zd failed, no async space left\n", - alloc->pid, size); - return ERR_PTR(-ENOSPC); - } - -- /* Pad 0-size buffers so they get assigned unique addresses */ -- size = max(size, sizeof(void *)); -- - while (n) { - buffer = rb_entry(n, struct binder_buffer, rb_node); - BUG_ON(!buffer->free); -@@ -519,7 +518,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( - buffer->pid = pid; - buffer->oneway_spam_suspect = false; - if (is_async) { -- alloc->free_async_space -= size + sizeof(struct binder_buffer); -+ alloc->free_async_space -= size; - binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, - "%d: binder_alloc_buf size %zd async free %zd\n", - alloc->pid, size, alloc->free_async_space); -@@ -657,8 +656,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, - BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); - - if (buffer->async_transaction) { -- alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); -- -+ alloc->free_async_space += buffer_size; - binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, - "%d: binder_free_buf size %zd async free %zd\n", - alloc->pid, size, alloc->free_async_space); -diff --git a/drivers/base/node.c b/drivers/base/node.c -index faf3597a96da9..a4141b57b1478 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -859,11 +859,15 @@ int __register_one_node(int nid) - { - int error; - int cpu; -+ struct node *node; - -- node_devices[nid] = kzalloc(sizeof(struct node), GFP_KERNEL); -- if (!node_devices[nid]) -+ node = kzalloc(sizeof(struct node), GFP_KERNEL); -+ if (!node) - return -ENOMEM; - -+ INIT_LIST_HEAD(&node->access_list); -+ node_devices[nid] = node; -+ - error = register_node(node_devices[nid], nid); - - /* link cpu under this node */ -@@ -872,7 +876,6 @@ int __register_one_node(int nid) - register_cpu_under_node(cpu, nid); - } - -- INIT_LIST_HEAD(&node_devices[nid]->access_list); - node_init_caches(nid); - - return error; -diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c -index 0a482212c7e8e..44153caa893ad 100644 ---- a/drivers/base/swnode.c -+++ b/drivers/base/swnode.c -@@ -541,6 +541,9 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, - if (nargs > NR_FWNODE_REFERENCE_ARGS) - return -EINVAL; - -+ if (!args) -+ return 0; -+ - args->fwnode = software_node_get(refnode); - args->nargs = nargs; - -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 127e3ceb59799..12ff6f58b8a90 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -165,39 +165,37 @@ static loff_t get_loop_size(struct loop_device *lo, struct file *file) - return get_size(lo->lo_offset, lo->lo_sizelimit, file); - } - -+/* -+ * We support direct I/O only if lo_offset is aligned with the logical I/O size -+ * of backing device, and the logical block size of loop is bigger than that of -+ * the backing device. -+ */ -+static bool lo_bdev_can_use_dio(struct loop_device *lo, -+ struct block_device *backing_bdev) -+{ -+ unsigned short sb_bsize = bdev_logical_block_size(backing_bdev); -+ -+ if (queue_logical_block_size(lo->lo_queue) < sb_bsize) -+ return false; -+ if (lo->lo_offset & (sb_bsize - 1)) -+ return false; -+ return true; -+} -+ - static void __loop_update_dio(struct loop_device *lo, bool dio) - { - struct file *file = lo->lo_backing_file; -- struct address_space *mapping = file->f_mapping; -- struct inode *inode = mapping->host; -- unsigned short sb_bsize = 0; -- unsigned dio_align = 0; -+ struct inode *inode = file->f_mapping->host; -+ struct block_device *backing_bdev = NULL; - bool use_dio; - -- if (inode->i_sb->s_bdev) { -- sb_bsize = bdev_logical_block_size(inode->i_sb->s_bdev); -- dio_align = sb_bsize - 1; -- } -+ if (S_ISBLK(inode->i_mode)) -+ backing_bdev = I_BDEV(inode); -+ else if (inode->i_sb->s_bdev) -+ backing_bdev = inode->i_sb->s_bdev; - -- /* -- * We support direct I/O only if lo_offset is aligned with the -- * logical I/O size of backing device, and the logical block -- * size of loop is bigger than the backing device's. -- * -- * TODO: the above condition may be loosed in the future, and -- * direct I/O may be switched runtime at that time because most -- * of requests in sane applications should be PAGE_SIZE aligned -- */ -- if (dio) { -- if (queue_logical_block_size(lo->lo_queue) >= sb_bsize && -- !(lo->lo_offset & dio_align) && -- (file->f_mode & FMODE_CAN_ODIRECT)) -- use_dio = true; -- else -- use_dio = false; -- } else { -- use_dio = false; -- } -+ use_dio = dio && (file->f_mode & FMODE_CAN_ODIRECT) && -+ (!backing_bdev || lo_bdev_can_use_dio(lo, backing_bdev)); - - if (lo->use_dio == use_dio) - return; -diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c -index e9f38eba2f133..959952e8ede38 100644 ---- a/drivers/block/null_blk/main.c -+++ b/drivers/block/null_blk/main.c -@@ -2114,11 +2114,8 @@ static int null_add_dev(struct nullb_device *dev) - - blk_queue_logical_block_size(nullb->q, dev->blocksize); - blk_queue_physical_block_size(nullb->q, dev->blocksize); -- if (!dev->max_sectors) -- dev->max_sectors = queue_max_hw_sectors(nullb->q); -- dev->max_sectors = min_t(unsigned int, dev->max_sectors, -- BLK_DEF_MAX_SECTORS); -- blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); -+ if (dev->max_sectors) -+ blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); - - if (dev->virt_boundary) - blk_queue_virt_boundary(nullb->q, PAGE_SIZE - 1); -@@ -2218,12 +2215,6 @@ static int __init null_init(void) - g_bs = PAGE_SIZE; - } - -- if (g_max_sectors > BLK_DEF_MAX_SECTORS) { -- pr_warn("invalid max sectors\n"); -- pr_warn("defaults max sectors to %u\n", BLK_DEF_MAX_SECTORS); -- g_max_sectors = BLK_DEF_MAX_SECTORS; -- } -- - if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) { - pr_err("invalid home_node value\n"); - g_home_node = NUMA_NO_NODE; -diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c -index c98691cdbbd55..04b72394dda5b 100644 ---- a/drivers/bluetooth/btmtkuart.c -+++ b/drivers/bluetooth/btmtkuart.c -@@ -337,7 +337,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count, - return data; - } - --static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) -+static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) - { - struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); - const unsigned char *p_left = data, *p_h4; -@@ -376,25 +376,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) - bt_dev_err(bdev->hdev, - "Frame reassembly failed (%d)", err); - bdev->rx_skb = NULL; -- return err; -+ return; - } - - sz_left -= sz_h4; - p_left += sz_h4; - } -- -- return 0; - } - - static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data, - size_t count) - { - struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev); -- int err; - -- err = btmtkuart_recv(bdev->hdev, data, count); -- if (err < 0) -- return err; -+ btmtkuart_recv(bdev->hdev, data, count); - - bdev->hdev->stat.byte_rx += count; - -diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c -index c7d8cbd22bacc..5acb35236c58d 100644 ---- a/drivers/clk/clk-si5341.c -+++ b/drivers/clk/clk-si5341.c -@@ -892,10 +892,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate, - r[0] = r_div ? (r_div & 0xff) : 1; - r[1] = (r_div >> 8) & 0xff; - r[2] = (r_div >> 16) & 0xff; -- err = regmap_bulk_write(output->data->regmap, -+ return regmap_bulk_write(output->data->regmap, - SI5341_OUT_R_REG(output), r, 3); -- -- return 0; - } - - static int si5341_output_reparent(struct clk_si5341_output *output, u8 index) -diff --git a/drivers/clk/qcom/gpucc-sm8150.c b/drivers/clk/qcom/gpucc-sm8150.c -index 8422fd0474932..c89a5b59ddb7c 100644 ---- a/drivers/clk/qcom/gpucc-sm8150.c -+++ b/drivers/clk/qcom/gpucc-sm8150.c -@@ -37,8 +37,8 @@ static struct alpha_pll_config gpu_cc_pll1_config = { - .config_ctl_hi_val = 0x00002267, - .config_ctl_hi1_val = 0x00000024, - .test_ctl_val = 0x00000000, -- .test_ctl_hi_val = 0x00000002, -- .test_ctl_hi1_val = 0x00000000, -+ .test_ctl_hi_val = 0x00000000, -+ .test_ctl_hi1_val = 0x00000020, - .user_ctl_val = 0x00000000, - .user_ctl_hi_val = 0x00000805, - .user_ctl_hi1_val = 0x000000d0, -diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c -index 1afdbe4a249d6..52a9a453a1432 100644 ---- a/drivers/clk/qcom/videocc-sm8150.c -+++ b/drivers/clk/qcom/videocc-sm8150.c -@@ -33,6 +33,7 @@ static struct alpha_pll_config video_pll0_config = { - .config_ctl_val = 0x20485699, - .config_ctl_hi_val = 0x00002267, - .config_ctl_hi1_val = 0x00000024, -+ .test_ctl_hi1_val = 0x00000020, - .user_ctl_val = 0x00000000, - .user_ctl_hi_val = 0x00000805, - .user_ctl_hi1_val = 0x000000D0, -@@ -214,6 +215,10 @@ static const struct regmap_config video_cc_sm8150_regmap_config = { - - static const struct qcom_reset_map video_cc_sm8150_resets[] = { - [VIDEO_CC_MVSC_CORE_CLK_BCR] = { 0x850, 2 }, -+ [VIDEO_CC_INTERFACE_BCR] = { 0x8f0 }, -+ [VIDEO_CC_MVS0_BCR] = { 0x870 }, -+ [VIDEO_CC_MVS1_BCR] = { 0x8b0 }, -+ [VIDEO_CC_MVSC_BCR] = { 0x810 }, - }; - - static const struct qcom_cc_desc video_cc_sm8150_desc = { -diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c -index 84767cfc1e739..473feb36a38f2 100644 ---- a/drivers/clk/renesas/rzg2l-cpg.c -+++ b/drivers/clk/renesas/rzg2l-cpg.c -@@ -1115,41 +1115,33 @@ fail: - - #define rcdev_to_priv(x) container_of(x, struct rzg2l_cpg_priv, rcdev) - --static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev, -- unsigned long id) --{ -- struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); -- const struct rzg2l_cpg_info *info = priv->info; -- unsigned int reg = info->resets[id].off; -- u32 dis = BIT(info->resets[id].bit); -- u32 we = dis << 16; -- -- dev_dbg(rcdev->dev, "reset id:%ld offset:0x%x\n", id, CLK_RST_R(reg)); -- -- /* Reset module */ -- writel(we, priv->base + CLK_RST_R(reg)); -- -- /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -- udelay(35); -- -- /* Release module from reset state */ -- writel(we | dis, priv->base + CLK_RST_R(reg)); -- -- return 0; --} -- - static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev, - unsigned long id) - { - struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); - const struct rzg2l_cpg_info *info = priv->info; - unsigned int reg = info->resets[id].off; -- u32 value = BIT(info->resets[id].bit) << 16; -+ u32 mask = BIT(info->resets[id].bit); -+ s8 monbit = info->resets[id].monbit; -+ u32 value = mask << 16; - - dev_dbg(rcdev->dev, "assert id:%ld offset:0x%x\n", id, CLK_RST_R(reg)); - - writel(value, priv->base + CLK_RST_R(reg)); -- return 0; -+ -+ if (info->has_clk_mon_regs) { -+ reg = CLK_MRST_R(reg); -+ } else if (monbit >= 0) { -+ reg = CPG_RST_MON; -+ mask = BIT(monbit); -+ } else { -+ /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -+ udelay(35); -+ return 0; -+ } -+ -+ return readl_poll_timeout_atomic(priv->base + reg, value, -+ value & mask, 10, 200); - } - - static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev, -@@ -1158,14 +1150,40 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev, - struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); - const struct rzg2l_cpg_info *info = priv->info; - unsigned int reg = info->resets[id].off; -- u32 dis = BIT(info->resets[id].bit); -- u32 value = (dis << 16) | dis; -+ u32 mask = BIT(info->resets[id].bit); -+ s8 monbit = info->resets[id].monbit; -+ u32 value = (mask << 16) | mask; - - dev_dbg(rcdev->dev, "deassert id:%ld offset:0x%x\n", id, - CLK_RST_R(reg)); - - writel(value, priv->base + CLK_RST_R(reg)); -- return 0; -+ -+ if (info->has_clk_mon_regs) { -+ reg = CLK_MRST_R(reg); -+ } else if (monbit >= 0) { -+ reg = CPG_RST_MON; -+ mask = BIT(monbit); -+ } else { -+ /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */ -+ udelay(35); -+ return 0; -+ } -+ -+ return readl_poll_timeout_atomic(priv->base + reg, value, -+ !(value & mask), 10, 200); -+} -+ -+static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev, -+ unsigned long id) -+{ -+ int ret; -+ -+ ret = rzg2l_cpg_assert(rcdev, id); -+ if (ret) -+ return ret; -+ -+ return rzg2l_cpg_deassert(rcdev, id); - } - - static int rzg2l_cpg_status(struct reset_controller_dev *rcdev, -@@ -1173,18 +1191,21 @@ static int rzg2l_cpg_status(struct reset_controller_dev *rcdev, - { - struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev); - const struct rzg2l_cpg_info *info = priv->info; -- unsigned int reg = info->resets[id].off; -- u32 bitmask = BIT(info->resets[id].bit); - s8 monbit = info->resets[id].monbit; -+ unsigned int reg; -+ u32 bitmask; - - if (info->has_clk_mon_regs) { -- return !!(readl(priv->base + CLK_MRST_R(reg)) & bitmask); -+ reg = CLK_MRST_R(info->resets[id].off); -+ bitmask = BIT(info->resets[id].bit); - } else if (monbit >= 0) { -- u32 monbitmask = BIT(monbit); -- -- return !!(readl(priv->base + CPG_RST_MON) & monbitmask); -+ reg = CPG_RST_MON; -+ bitmask = BIT(monbit); -+ } else { -+ return -ENOTSUPP; - } -- return -ENOTSUPP; -+ -+ return !!(readl(priv->base + reg) & bitmask); - } - - static const struct reset_control_ops rzg2l_cpg_reset_ops = { -diff --git a/drivers/clk/zynqmp/clk-mux-zynqmp.c b/drivers/clk/zynqmp/clk-mux-zynqmp.c -index 60359333f26db..9b5d3050b7422 100644 ---- a/drivers/clk/zynqmp/clk-mux-zynqmp.c -+++ b/drivers/clk/zynqmp/clk-mux-zynqmp.c -@@ -89,7 +89,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index) - static const struct clk_ops zynqmp_clk_mux_ops = { - .get_parent = zynqmp_clk_mux_get_parent, - .set_parent = zynqmp_clk_mux_set_parent, -- .determine_rate = __clk_mux_determine_rate, -+ .determine_rate = __clk_mux_determine_rate_closest, - }; - - static const struct clk_ops zynqmp_clk_mux_ro_ops = { -diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c -index 33a3b2a226595..5a00487ae408b 100644 ---- a/drivers/clk/zynqmp/divider.c -+++ b/drivers/clk/zynqmp/divider.c -@@ -110,52 +110,6 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw, - return DIV_ROUND_UP_ULL(parent_rate, value); - } - --static void zynqmp_get_divider2_val(struct clk_hw *hw, -- unsigned long rate, -- struct zynqmp_clk_divider *divider, -- u32 *bestdiv) --{ -- int div1; -- int div2; -- long error = LONG_MAX; -- unsigned long div1_prate; -- struct clk_hw *div1_parent_hw; -- struct zynqmp_clk_divider *pdivider; -- struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw); -- -- if (!div2_parent_hw) -- return; -- -- pdivider = to_zynqmp_clk_divider(div2_parent_hw); -- if (!pdivider) -- return; -- -- div1_parent_hw = clk_hw_get_parent(div2_parent_hw); -- if (!div1_parent_hw) -- return; -- -- div1_prate = clk_hw_get_rate(div1_parent_hw); -- *bestdiv = 1; -- for (div1 = 1; div1 <= pdivider->max_div;) { -- for (div2 = 1; div2 <= divider->max_div;) { -- long new_error = ((div1_prate / div1) / div2) - rate; -- -- if (abs(new_error) < abs(error)) { -- *bestdiv = div2; -- error = new_error; -- } -- if (divider->flags & CLK_DIVIDER_POWER_OF_TWO) -- div2 = div2 << 1; -- else -- div2++; -- } -- if (pdivider->flags & CLK_DIVIDER_POWER_OF_TWO) -- div1 = div1 << 1; -- else -- div1++; -- } --} -- - /** - * zynqmp_clk_divider_round_rate() - Round rate of divider clock - * @hw: handle between common and hardware-specific interfaces -@@ -174,6 +128,7 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw, - u32 div_type = divider->div_type; - u32 bestdiv; - int ret; -+ u8 width; - - /* if read only, just return current value */ - if (divider->flags & CLK_DIVIDER_READ_ONLY) { -@@ -193,23 +148,12 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw, - return DIV_ROUND_UP_ULL((u64)*prate, bestdiv); - } - -- bestdiv = zynqmp_divider_get_val(*prate, rate, divider->flags); -- -- /* -- * In case of two divisors, compute best divider values and return -- * divider2 value based on compute value. div1 will be automatically -- * set to optimum based on required total divider value. -- */ -- if (div_type == TYPE_DIV2 && -- (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) { -- zynqmp_get_divider2_val(hw, rate, divider, &bestdiv); -- } -+ width = fls(divider->max_div); - -- if ((clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && divider->is_frac) -- bestdiv = rate % *prate ? 1 : bestdiv; -+ rate = divider_round_rate(hw, rate, prate, NULL, width, divider->flags); - -- bestdiv = min_t(u32, bestdiv, divider->max_div); -- *prate = rate * bestdiv; -+ if (divider->is_frac && (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && (rate % *prate)) -+ *prate = rate; - - return rate; - } -diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c -index ec86aecb748f1..7f9c1f58a9477 100644 ---- a/drivers/clocksource/timer-ti-dm.c -+++ b/drivers/clocksource/timer-ti-dm.c -@@ -184,7 +184,7 @@ static inline u32 dmtimer_read(struct dmtimer *timer, u32 reg) - * dmtimer_write - write timer registers in posted and non-posted mode - * @timer: timer pointer over which write operation is to perform - * @reg: lowest byte holds the register offset -- * @value: data to write into the register -+ * @val: data to write into the register - * - * The posted mode bit is encoded in reg. Note that in posted mode, the write - * pending bit must be checked. Otherwise a write on a register which has a -@@ -937,7 +937,7 @@ static int omap_dm_timer_set_int_enable(struct omap_dm_timer *cookie, - - /** - * omap_dm_timer_set_int_disable - disable timer interrupts -- * @timer: pointer to timer handle -+ * @cookie: pointer to timer cookie - * @mask: bit mask of interrupts to be disabled - * - * Disables the specified timer interrupts for a timer. -diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c -index 69a8742c0a7a3..8514bb62dd10b 100644 ---- a/drivers/cpufreq/cpufreq-dt-platdev.c -+++ b/drivers/cpufreq/cpufreq-dt-platdev.c -@@ -176,7 +176,7 @@ static bool __init cpu0_node_has_opp_v2_prop(void) - struct device_node *np = of_cpu_device_node_get(0); - bool ret = false; - -- if (of_get_property(np, "operating-points-v2", NULL)) -+ if (of_property_present(np, "operating-points-v2")) - ret = true; - - of_node_put(np); -diff --git a/drivers/cpufreq/imx-cpufreq-dt.c b/drivers/cpufreq/imx-cpufreq-dt.c -index 76e553af20711..535867a7dfdde 100644 ---- a/drivers/cpufreq/imx-cpufreq-dt.c -+++ b/drivers/cpufreq/imx-cpufreq-dt.c -@@ -89,7 +89,7 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev) - - cpu_dev = get_cpu_device(0); - -- if (!of_find_property(cpu_dev->of_node, "cpu-supply", NULL)) -+ if (!of_property_present(cpu_dev->of_node, "cpu-supply")) - return -ENODEV; - - if (of_machine_is_compatible("fsl,imx7ulp")) { -diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c -index 925fc17eaacb2..39b0362a3b9ac 100644 ---- a/drivers/cpufreq/imx6q-cpufreq.c -+++ b/drivers/cpufreq/imx6q-cpufreq.c -@@ -230,7 +230,7 @@ static int imx6q_opp_check_speed_grading(struct device *dev) - u32 val; - int ret; - -- if (of_find_property(dev->of_node, "nvmem-cells", NULL)) { -+ if (of_property_present(dev->of_node, "nvmem-cells")) { - ret = nvmem_cell_read_u32(dev, "speed_grade", &val); - if (ret) - return ret; -@@ -285,7 +285,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev) - u32 val; - int ret = 0; - -- if (of_find_property(dev->of_node, "nvmem-cells", NULL)) { -+ if (of_property_present(dev->of_node, "nvmem-cells")) { - ret = nvmem_cell_read_u32(dev, "speed_grade", &val); - if (ret) - return ret; -diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c -index 513a071845c26..028df8a5f537a 100644 ---- a/drivers/cpufreq/scmi-cpufreq.c -+++ b/drivers/cpufreq/scmi-cpufreq.c -@@ -310,8 +310,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) - - #ifdef CONFIG_COMMON_CLK - /* dummy clock provider as needed by OPP if clocks property is used */ -- if (of_find_property(dev->of_node, "#clock-cells", NULL)) -- devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); -+ if (of_property_present(dev->of_node, "#clock-cells")) { -+ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); -+ if (ret) -+ return dev_err_probe(dev, ret, "%s: registering clock provider failed\n", __func__); -+ } - #endif - - ret = cpufreq_register_driver(&scmi_cpufreq_driver); -diff --git a/drivers/cpufreq/tegra20-cpufreq.c b/drivers/cpufreq/tegra20-cpufreq.c -index ab7ac7df9e62e..dfd2de4f8e07e 100644 ---- a/drivers/cpufreq/tegra20-cpufreq.c -+++ b/drivers/cpufreq/tegra20-cpufreq.c -@@ -25,7 +25,7 @@ static bool cpu0_node_has_opp_v2_prop(void) - struct device_node *np = of_cpu_device_node_get(0); - bool ret = false; - -- if (of_get_property(np, "operating-points-v2", NULL)) -+ if (of_property_present(np, "operating-points-v2")) - ret = true; - - of_node_put(np); -diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c -index aa4e1a5006919..cb8e99936abb7 100644 ---- a/drivers/crypto/ccp/ccp-ops.c -+++ b/drivers/crypto/ccp/ccp-ops.c -@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, - - wa->dma.address = dma_map_single(wa->dev, wa->address, len, - dir); -- if (dma_mapping_error(wa->dev, wa->dma.address)) -+ if (dma_mapping_error(wa->dev, wa->dma.address)) { -+ kfree(wa->address); -+ wa->address = NULL; - return -ENOMEM; -+ } - - wa->dma.length = len; - } -diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c -index ff8a5f20a5df0..269df4ec148ba 100644 ---- a/drivers/crypto/hisilicon/hpre/hpre_main.c -+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c -@@ -118,8 +118,6 @@ - #define HPRE_DFX_COMMON2_LEN 0xE - #define HPRE_DFX_CORE_LEN 0x43 - --#define HPRE_DEV_ALG_MAX_LEN 256 -- - static const char hpre_name[] = "hisi_hpre"; - static struct dentry *hpre_debugfs_root; - static const struct pci_device_id hpre_dev_ids[] = { -@@ -135,12 +133,7 @@ struct hpre_hw_error { - const char *msg; - }; - --struct hpre_dev_alg { -- u32 alg_msk; -- const char *alg; --}; -- --static const struct hpre_dev_alg hpre_dev_algs[] = { -+static const struct qm_dev_alg hpre_dev_algs[] = { - { - .alg_msk = BIT(0), - .alg = "rsa\n" -@@ -233,6 +226,20 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = { - {HPRE_CORE10_ALG_BITMAP_CAP, 0x3170, 0, GENMASK(31, 0), 0x0, 0x10, 0x10} - }; - -+enum hpre_pre_store_cap_idx { -+ HPRE_CLUSTER_NUM_CAP_IDX = 0x0, -+ HPRE_CORE_ENABLE_BITMAP_CAP_IDX, -+ HPRE_DRV_ALG_BITMAP_CAP_IDX, -+ HPRE_DEV_ALG_BITMAP_CAP_IDX, -+}; -+ -+static const u32 hpre_pre_store_caps[] = { -+ HPRE_CLUSTER_NUM_CAP, -+ HPRE_CORE_ENABLE_BITMAP_CAP, -+ HPRE_DRV_ALG_BITMAP_CAP, -+ HPRE_DEV_ALG_BITMAP_CAP, -+}; -+ - static const struct hpre_hw_error hpre_hw_errors[] = { - { - .int_msk = BIT(0), -@@ -352,42 +359,13 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg) - { - u32 cap_val; - -- cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DRV_ALG_BITMAP_CAP, qm->cap_ver); -+ cap_val = qm->cap_tables.dev_cap_table[HPRE_DRV_ALG_BITMAP_CAP_IDX].cap_val; - if (alg & cap_val) - return true; - - return false; - } - --static int hpre_set_qm_algs(struct hisi_qm *qm) --{ -- struct device *dev = &qm->pdev->dev; -- char *algs, *ptr; -- u32 alg_msk; -- int i; -- -- if (!qm->use_sva) -- return 0; -- -- algs = devm_kzalloc(dev, HPRE_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -- if (!algs) -- return -ENOMEM; -- -- alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver); -- -- for (i = 0; i < ARRAY_SIZE(hpre_dev_algs); i++) -- if (alg_msk & hpre_dev_algs[i].alg_msk) -- strcat(algs, hpre_dev_algs[i].alg); -- -- ptr = strrchr(algs, '\n'); -- if (ptr) -- *ptr = '\0'; -- -- qm->uacce->algs = algs; -- -- return 0; --} -- - static int hpre_diff_regs_show(struct seq_file *s, void *unused) - { - struct hisi_qm *qm = s->private; -@@ -457,16 +435,6 @@ static u32 vfs_num; - module_param_cb(vfs_num, &vfs_num_ops, &vfs_num, 0444); - MODULE_PARM_DESC(vfs_num, "Number of VFs to enable(1-63), 0(default)"); - --static inline int hpre_cluster_num(struct hisi_qm *qm) --{ -- return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CLUSTER_NUM_CAP, qm->cap_ver); --} -- --static inline int hpre_cluster_core_mask(struct hisi_qm *qm) --{ -- return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CORE_ENABLE_BITMAP_CAP, qm->cap_ver); --} -- - struct hisi_qp *hpre_create_qp(u8 type) - { - int node = cpu_to_node(smp_processor_id()); -@@ -533,13 +501,15 @@ static int hpre_cfg_by_dsm(struct hisi_qm *qm) - - static int hpre_set_cluster(struct hisi_qm *qm) - { -- u32 cluster_core_mask = hpre_cluster_core_mask(qm); -- u8 clusters_num = hpre_cluster_num(qm); - struct device *dev = &qm->pdev->dev; - unsigned long offset; -+ u32 cluster_core_mask; -+ u8 clusters_num; - u32 val = 0; - int ret, i; - -+ cluster_core_mask = qm->cap_tables.dev_cap_table[HPRE_CORE_ENABLE_BITMAP_CAP_IDX].cap_val; -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - offset = i * HPRE_CLSTR_ADDR_INTRVL; - -@@ -734,11 +704,12 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) - - static void hpre_cnt_regs_clear(struct hisi_qm *qm) - { -- u8 clusters_num = hpre_cluster_num(qm); - unsigned long offset; -+ u8 clusters_num; - int i; - - /* clear clusterX/cluster_ctrl */ -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - offset = HPRE_CLSTR_BASE + i * HPRE_CLSTR_ADDR_INTRVL; - writel(0x0, qm->io_base + offset + HPRE_CLUSTER_INQURY); -@@ -1025,13 +996,14 @@ static int hpre_pf_comm_regs_debugfs_init(struct hisi_qm *qm) - - static int hpre_cluster_debugfs_init(struct hisi_qm *qm) - { -- u8 clusters_num = hpre_cluster_num(qm); - struct device *dev = &qm->pdev->dev; - char buf[HPRE_DBGFS_VAL_MAX_LEN]; - struct debugfs_regset32 *regset; - struct dentry *tmp_d; -+ u8 clusters_num; - int i, ret; - -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - ret = snprintf(buf, HPRE_DBGFS_VAL_MAX_LEN, "cluster%d", i); - if (ret >= HPRE_DBGFS_VAL_MAX_LEN) -@@ -1136,8 +1108,37 @@ static void hpre_debugfs_exit(struct hisi_qm *qm) - debugfs_remove_recursive(qm->debug.debug_root); - } - -+static int hpre_pre_store_cap_reg(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *hpre_cap; -+ struct device *dev = &qm->pdev->dev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(hpre_pre_store_caps); -+ hpre_cap = devm_kzalloc(dev, sizeof(*hpre_cap) * size, GFP_KERNEL); -+ if (!hpre_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ hpre_cap[i].type = hpre_pre_store_caps[i]; -+ hpre_cap[i].cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info, -+ hpre_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ if (hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val > HPRE_CLUSTERS_NUM_MAX) { -+ dev_err(dev, "Device cluster num %u is out of range for driver supports %d!\n", -+ hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val, HPRE_CLUSTERS_NUM_MAX); -+ return -EINVAL; -+ } -+ -+ qm->cap_tables.dev_cap_table = hpre_cap; -+ -+ return 0; -+} -+ - static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { -+ u64 alg_msk; - int ret; - - if (pdev->revision == QM_HW_V1) { -@@ -1168,7 +1169,16 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- ret = hpre_set_qm_algs(qm); -+ /* Fetch and save the value of capability registers */ -+ ret = hpre_pre_store_cap_reg(qm); -+ if (ret) { -+ pci_err(pdev, "Failed to pre-store capability registers!\n"); -+ hisi_qm_uninit(qm); -+ return ret; -+ } -+ -+ alg_msk = qm->cap_tables.dev_cap_table[HPRE_DEV_ALG_BITMAP_CAP_IDX].cap_val; -+ ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs)); - if (ret) { - pci_err(pdev, "Failed to set hpre algs!\n"); - hisi_qm_uninit(qm); -@@ -1181,11 +1191,12 @@ static int hpre_show_last_regs_init(struct hisi_qm *qm) - { - int cluster_dfx_regs_num = ARRAY_SIZE(hpre_cluster_dfx_regs); - int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs); -- u8 clusters_num = hpre_cluster_num(qm); - struct qm_debug *debug = &qm->debug; - void __iomem *io_base; -+ u8 clusters_num; - int i, j, idx; - -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - debug->last_words = kcalloc(cluster_dfx_regs_num * clusters_num + - com_dfx_regs_num, sizeof(unsigned int), GFP_KERNEL); - if (!debug->last_words) -@@ -1222,10 +1233,10 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm) - { - int cluster_dfx_regs_num = ARRAY_SIZE(hpre_cluster_dfx_regs); - int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs); -- u8 clusters_num = hpre_cluster_num(qm); - struct qm_debug *debug = &qm->debug; - struct pci_dev *pdev = qm->pdev; - void __iomem *io_base; -+ u8 clusters_num; - int i, j, idx; - u32 val; - -@@ -1240,6 +1251,7 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm) - hpre_com_dfx_regs[i].name, debug->last_words[i], val); - } - -+ clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val; - for (i = 0; i < clusters_num; i++) { - io_base = qm->io_base + hpre_cluster_offsets[i]; - for (j = 0; j < cluster_dfx_regs_num; j++) { -diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c -index f9acf7ecc41be..5539be1bfb402 100644 ---- a/drivers/crypto/hisilicon/qm.c -+++ b/drivers/crypto/hisilicon/qm.c -@@ -237,6 +237,8 @@ - #define QM_QOS_MAX_CIR_S 11 - #define QM_AUTOSUSPEND_DELAY 3000 - -+#define QM_DEV_ALG_MAX_LEN 256 -+ - #define QM_MK_CQC_DW3_V1(hop_num, pg_sz, buf_sz, cqe_sz) \ - (((hop_num) << QM_CQ_HOP_NUM_SHIFT) | \ - ((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT) | \ -@@ -315,6 +317,13 @@ enum qm_basic_type { - QM_VF_IRQ_NUM_CAP, - }; - -+enum qm_pre_store_cap_idx { -+ QM_EQ_IRQ_TYPE_CAP_IDX = 0x0, -+ QM_AEQ_IRQ_TYPE_CAP_IDX, -+ QM_ABN_IRQ_TYPE_CAP_IDX, -+ QM_PF2VF_IRQ_TYPE_CAP_IDX, -+}; -+ - static const struct hisi_qm_cap_info qm_cap_info_comm[] = { - {QM_SUPPORT_DB_ISOLATION, 0x30, 0, BIT(0), 0x0, 0x0, 0x0}, - {QM_SUPPORT_FUNC_QOS, 0x3100, 0, BIT(8), 0x0, 0x0, 0x1}, -@@ -344,6 +353,13 @@ static const struct hisi_qm_cap_info qm_basic_info[] = { - {QM_VF_IRQ_NUM_CAP, 0x311c, 0, GENMASK(15, 0), 0x1, 0x2, 0x3}, - }; - -+static const u32 qm_pre_store_caps[] = { -+ QM_EQ_IRQ_TYPE_CAP, -+ QM_AEQ_IRQ_TYPE_CAP, -+ QM_ABN_IRQ_TYPE_CAP, -+ QM_PF2VF_IRQ_TYPE_CAP, -+}; -+ - struct qm_mailbox { - __le16 w0; - __le16 queue_num; -@@ -781,6 +797,40 @@ static void qm_get_xqc_depth(struct hisi_qm *qm, u16 *low_bits, - *high_bits = (depth >> QM_XQ_DEPTH_SHIFT) & QM_XQ_DEPTH_MASK; - } - -+int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs, -+ u32 dev_algs_size) -+{ -+ struct device *dev = &qm->pdev->dev; -+ char *algs, *ptr; -+ int i; -+ -+ if (!qm->uacce) -+ return 0; -+ -+ if (dev_algs_size >= QM_DEV_ALG_MAX_LEN) { -+ dev_err(dev, "algs size %u is equal or larger than %d.\n", -+ dev_algs_size, QM_DEV_ALG_MAX_LEN); -+ return -EINVAL; -+ } -+ -+ algs = devm_kzalloc(dev, QM_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -+ if (!algs) -+ return -ENOMEM; -+ -+ for (i = 0; i < dev_algs_size; i++) -+ if (alg_msk & dev_algs[i].alg_msk) -+ strcat(algs, dev_algs[i].alg); -+ -+ ptr = strrchr(algs, '\n'); -+ if (ptr) { -+ *ptr = '\0'; -+ qm->uacce->algs = algs; -+ } -+ -+ return 0; -+} -+EXPORT_SYMBOL_GPL(hisi_qm_set_algs); -+ - static u32 qm_get_irq_num(struct hisi_qm *qm) - { - if (qm->fun_type == QM_HW_PF) -@@ -4804,7 +4854,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm) - if (qm->fun_type == QM_HW_VF) - return; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK)) - return; - -@@ -4821,7 +4871,7 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm) - if (qm->fun_type == QM_HW_VF) - return 0; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK)) - return 0; - -@@ -4838,7 +4888,7 @@ static void qm_unregister_mb_cmd_irq(struct hisi_qm *qm) - struct pci_dev *pdev = qm->pdev; - u32 irq_vector, val; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return; - -@@ -4852,7 +4902,7 @@ static int qm_register_mb_cmd_irq(struct hisi_qm *qm) - u32 irq_vector, val; - int ret; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return 0; - -@@ -4869,7 +4919,7 @@ static void qm_unregister_aeq_irq(struct hisi_qm *qm) - struct pci_dev *pdev = qm->pdev; - u32 irq_vector, val; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return; - -@@ -4883,7 +4933,7 @@ static int qm_register_aeq_irq(struct hisi_qm *qm) - u32 irq_vector, val; - int ret; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return 0; - -@@ -4901,7 +4951,7 @@ static void qm_unregister_eq_irq(struct hisi_qm *qm) - struct pci_dev *pdev = qm->pdev; - u32 irq_vector, val; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return; - -@@ -4915,7 +4965,7 @@ static int qm_register_eq_irq(struct hisi_qm *qm) - u32 irq_vector, val; - int ret; - -- val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver); -+ val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val; - if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK)) - return 0; - -@@ -5003,7 +5053,29 @@ static int qm_get_qp_num(struct hisi_qm *qm) - return 0; - } - --static void qm_get_hw_caps(struct hisi_qm *qm) -+static int qm_pre_store_irq_type_caps(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *qm_cap; -+ struct pci_dev *pdev = qm->pdev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(qm_pre_store_caps); -+ qm_cap = devm_kzalloc(&pdev->dev, sizeof(*qm_cap) * size, GFP_KERNEL); -+ if (!qm_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ qm_cap[i].type = qm_pre_store_caps[i]; -+ qm_cap[i].cap_val = hisi_qm_get_hw_info(qm, qm_basic_info, -+ qm_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ qm->cap_tables.qm_cap_table = qm_cap; -+ -+ return 0; -+} -+ -+static int qm_get_hw_caps(struct hisi_qm *qm) - { - const struct hisi_qm_cap_info *cap_info = qm->fun_type == QM_HW_PF ? - qm_cap_info_pf : qm_cap_info_vf; -@@ -5034,6 +5106,9 @@ static void qm_get_hw_caps(struct hisi_qm *qm) - if (val) - set_bit(cap_info[i].type, &qm->caps); - } -+ -+ /* Fetch and save the value of irq type related capability registers */ -+ return qm_pre_store_irq_type_caps(qm); - } - - static int qm_get_pci_res(struct hisi_qm *qm) -@@ -5055,7 +5130,10 @@ static int qm_get_pci_res(struct hisi_qm *qm) - goto err_request_mem_regions; - } - -- qm_get_hw_caps(qm); -+ ret = qm_get_hw_caps(qm); -+ if (ret) -+ goto err_ioremap; -+ - if (test_bit(QM_SUPPORT_DB_ISOLATION, &qm->caps)) { - qm->db_interval = QM_QP_DB_INTERVAL; - qm->db_phys_base = pci_resource_start(pdev, PCI_BAR_4); -diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h -index 3e57fc04b3770..410c83712e285 100644 ---- a/drivers/crypto/hisilicon/sec2/sec.h -+++ b/drivers/crypto/hisilicon/sec2/sec.h -@@ -220,6 +220,13 @@ enum sec_cap_type { - SEC_CORE4_ALG_BITMAP_HIGH, - }; - -+enum sec_cap_reg_record_idx { -+ SEC_DRV_ALG_BITMAP_LOW_IDX = 0x0, -+ SEC_DRV_ALG_BITMAP_HIGH_IDX, -+ SEC_DEV_ALG_BITMAP_LOW_IDX, -+ SEC_DEV_ALG_BITMAP_HIGH_IDX, -+}; -+ - void sec_destroy_qps(struct hisi_qp **qps, int qp_num); - struct hisi_qp **sec_create_qps(void); - int sec_register_to_crypto(struct hisi_qm *qm); -diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c -index 84ae8ddd1a131..cae7c414bdaf4 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_crypto.c -+++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c -@@ -2546,8 +2546,12 @@ err: - - int sec_register_to_crypto(struct hisi_qm *qm) - { -- u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW); -- int ret; -+ u64 alg_mask; -+ int ret = 0; -+ -+ alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX, -+ SEC_DRV_ALG_BITMAP_LOW_IDX); -+ - - ret = sec_register_skcipher(alg_mask); - if (ret) -@@ -2562,7 +2566,10 @@ int sec_register_to_crypto(struct hisi_qm *qm) - - void sec_unregister_from_crypto(struct hisi_qm *qm) - { -- u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW); -+ u64 alg_mask; -+ -+ alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX, -+ SEC_DRV_ALG_BITMAP_LOW_IDX); - - sec_unregister_aead(alg_mask, ARRAY_SIZE(sec_aeads)); - sec_unregister_skcipher(alg_mask, ARRAY_SIZE(sec_skciphers)); -diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c -index e384988bda917..4bab5000a13e5 100644 ---- a/drivers/crypto/hisilicon/sec2/sec_main.c -+++ b/drivers/crypto/hisilicon/sec2/sec_main.c -@@ -121,7 +121,6 @@ - GENMASK_ULL(42, 25)) - #define SEC_AEAD_BITMAP (GENMASK_ULL(7, 6) | GENMASK_ULL(18, 17) | \ - GENMASK_ULL(45, 43)) --#define SEC_DEV_ALG_MAX_LEN 256 - - struct sec_hw_error { - u32 int_msk; -@@ -133,11 +132,6 @@ struct sec_dfx_item { - u32 offset; - }; - --struct sec_dev_alg { -- u64 alg_msk; -- const char *algs; --}; -- - static const char sec_name[] = "hisi_sec2"; - static struct dentry *sec_debugfs_root; - -@@ -174,15 +168,22 @@ static const struct hisi_qm_cap_info sec_basic_info[] = { - {SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF}, - }; - --static const struct sec_dev_alg sec_dev_algs[] = { { -+static const u32 sec_pre_store_caps[] = { -+ SEC_DRV_ALG_BITMAP_LOW, -+ SEC_DRV_ALG_BITMAP_HIGH, -+ SEC_DEV_ALG_BITMAP_LOW, -+ SEC_DEV_ALG_BITMAP_HIGH, -+}; -+ -+static const struct qm_dev_alg sec_dev_algs[] = { { - .alg_msk = SEC_CIPHER_BITMAP, -- .algs = "cipher\n", -+ .alg = "cipher\n", - }, { - .alg_msk = SEC_DIGEST_BITMAP, -- .algs = "digest\n", -+ .alg = "digest\n", - }, { - .alg_msk = SEC_AEAD_BITMAP, -- .algs = "aead\n", -+ .alg = "aead\n", - }, - }; - -@@ -395,8 +396,8 @@ u64 sec_get_alg_bitmap(struct hisi_qm *qm, u32 high, u32 low) - { - u32 cap_val_h, cap_val_l; - -- cap_val_h = hisi_qm_get_hw_info(qm, sec_basic_info, high, qm->cap_ver); -- cap_val_l = hisi_qm_get_hw_info(qm, sec_basic_info, low, qm->cap_ver); -+ cap_val_h = qm->cap_tables.dev_cap_table[high].cap_val; -+ cap_val_l = qm->cap_tables.dev_cap_table[low].cap_val; - - return ((u64)cap_val_h << SEC_ALG_BITMAP_SHIFT) | (u64)cap_val_l; - } -@@ -1079,37 +1080,31 @@ static int sec_pf_probe_init(struct sec_dev *sec) - return ret; - } - --static int sec_set_qm_algs(struct hisi_qm *qm) -+static int sec_pre_store_cap_reg(struct hisi_qm *qm) - { -- struct device *dev = &qm->pdev->dev; -- char *algs, *ptr; -- u64 alg_mask; -- int i; -- -- if (!qm->use_sva) -- return 0; -+ struct hisi_qm_cap_record *sec_cap; -+ struct pci_dev *pdev = qm->pdev; -+ size_t i, size; - -- algs = devm_kzalloc(dev, SEC_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -- if (!algs) -+ size = ARRAY_SIZE(sec_pre_store_caps); -+ sec_cap = devm_kzalloc(&pdev->dev, sizeof(*sec_cap) * size, GFP_KERNEL); -+ if (!sec_cap) - return -ENOMEM; - -- alg_mask = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW); -- -- for (i = 0; i < ARRAY_SIZE(sec_dev_algs); i++) -- if (alg_mask & sec_dev_algs[i].alg_msk) -- strcat(algs, sec_dev_algs[i].algs); -- -- ptr = strrchr(algs, '\n'); -- if (ptr) -- *ptr = '\0'; -+ for (i = 0; i < size; i++) { -+ sec_cap[i].type = sec_pre_store_caps[i]; -+ sec_cap[i].cap_val = hisi_qm_get_hw_info(qm, sec_basic_info, -+ sec_pre_store_caps[i], qm->cap_ver); -+ } - -- qm->uacce->algs = algs; -+ qm->cap_tables.dev_cap_table = sec_cap; - - return 0; - } - - static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { -+ u64 alg_msk; - int ret; - - qm->pdev = pdev; -@@ -1144,7 +1139,16 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- ret = sec_set_qm_algs(qm); -+ /* Fetch and save the value of capability registers */ -+ ret = sec_pre_store_cap_reg(qm); -+ if (ret) { -+ pci_err(qm->pdev, "Failed to pre-store capability registers!\n"); -+ hisi_qm_uninit(qm); -+ return ret; -+ } -+ -+ alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH_IDX, SEC_DEV_ALG_BITMAP_LOW_IDX); -+ ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs)); - if (ret) { - pci_err(qm->pdev, "Failed to set sec algs!\n"); - hisi_qm_uninit(qm); -diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c -index 190b4fecfc747..9e3f5bca27dee 100644 ---- a/drivers/crypto/hisilicon/zip/zip_main.c -+++ b/drivers/crypto/hisilicon/zip/zip_main.c -@@ -74,7 +74,6 @@ - #define HZIP_AXI_SHUTDOWN_ENABLE BIT(14) - #define HZIP_WR_PORT BIT(11) - --#define HZIP_DEV_ALG_MAX_LEN 256 - #define HZIP_ALG_ZLIB_BIT GENMASK(1, 0) - #define HZIP_ALG_GZIP_BIT GENMASK(3, 2) - #define HZIP_ALG_DEFLATE_BIT GENMASK(5, 4) -@@ -107,6 +106,14 @@ - #define HZIP_CLOCK_GATED_EN (HZIP_CORE_GATED_EN | \ - HZIP_CORE_GATED_OOO_EN) - -+/* zip comp high performance */ -+#define HZIP_HIGH_PERF_OFFSET 0x301208 -+ -+enum { -+ HZIP_HIGH_COMP_RATE, -+ HZIP_HIGH_COMP_PERF, -+}; -+ - static const char hisi_zip_name[] = "hisi_zip"; - static struct dentry *hzip_debugfs_root; - -@@ -120,23 +127,18 @@ struct zip_dfx_item { - u32 offset; - }; - --struct zip_dev_alg { -- u32 alg_msk; -- const char *algs; --}; -- --static const struct zip_dev_alg zip_dev_algs[] = { { -+static const struct qm_dev_alg zip_dev_algs[] = { { - .alg_msk = HZIP_ALG_ZLIB_BIT, -- .algs = "zlib\n", -+ .alg = "zlib\n", - }, { - .alg_msk = HZIP_ALG_GZIP_BIT, -- .algs = "gzip\n", -+ .alg = "gzip\n", - }, { - .alg_msk = HZIP_ALG_DEFLATE_BIT, -- .algs = "deflate\n", -+ .alg = "deflate\n", - }, { - .alg_msk = HZIP_ALG_LZ77_BIT, -- .algs = "lz77_zstd\n", -+ .alg = "lz77_zstd\n", - }, - }; - -@@ -247,6 +249,26 @@ static struct hisi_qm_cap_info zip_basic_cap_info[] = { - {ZIP_CAP_MAX, 0x317c, 0, GENMASK(0, 0), 0x0, 0x0, 0x0} - }; - -+enum zip_pre_store_cap_idx { -+ ZIP_CORE_NUM_CAP_IDX = 0x0, -+ ZIP_CLUSTER_COMP_NUM_CAP_IDX, -+ ZIP_CLUSTER_DECOMP_NUM_CAP_IDX, -+ ZIP_DECOMP_ENABLE_BITMAP_IDX, -+ ZIP_COMP_ENABLE_BITMAP_IDX, -+ ZIP_DRV_ALG_BITMAP_IDX, -+ ZIP_DEV_ALG_BITMAP_IDX, -+}; -+ -+static const u32 zip_pre_store_caps[] = { -+ ZIP_CORE_NUM_CAP, -+ ZIP_CLUSTER_COMP_NUM_CAP, -+ ZIP_CLUSTER_DECOMP_NUM_CAP, -+ ZIP_DECOMP_ENABLE_BITMAP, -+ ZIP_COMP_ENABLE_BITMAP, -+ ZIP_DRV_ALG_BITMAP, -+ ZIP_DEV_ALG_BITMAP, -+}; -+ - enum { - HZIP_COMP_CORE0, - HZIP_COMP_CORE1, -@@ -352,6 +374,37 @@ static int hzip_diff_regs_show(struct seq_file *s, void *unused) - return 0; - } - DEFINE_SHOW_ATTRIBUTE(hzip_diff_regs); -+ -+static int perf_mode_set(const char *val, const struct kernel_param *kp) -+{ -+ int ret; -+ u32 n; -+ -+ if (!val) -+ return -EINVAL; -+ -+ ret = kstrtou32(val, 10, &n); -+ if (ret != 0 || (n != HZIP_HIGH_COMP_PERF && -+ n != HZIP_HIGH_COMP_RATE)) -+ return -EINVAL; -+ -+ return param_set_int(val, kp); -+} -+ -+static const struct kernel_param_ops zip_com_perf_ops = { -+ .set = perf_mode_set, -+ .get = param_get_int, -+}; -+ -+/* -+ * perf_mode = 0 means enable high compression rate mode, -+ * perf_mode = 1 means enable high compression performance mode. -+ * These two modes only apply to the compression direction. -+ */ -+static u32 perf_mode = HZIP_HIGH_COMP_RATE; -+module_param_cb(perf_mode, &zip_com_perf_ops, &perf_mode, 0444); -+MODULE_PARM_DESC(perf_mode, "ZIP high perf mode 0(default), 1(enable)"); -+ - static const struct kernel_param_ops zip_uacce_mode_ops = { - .set = uacce_mode_set, - .get = param_get_int, -@@ -410,40 +463,33 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) - { - u32 cap_val; - -- cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DRV_ALG_BITMAP, qm->cap_ver); -+ cap_val = qm->cap_tables.dev_cap_table[ZIP_DRV_ALG_BITMAP_IDX].cap_val; - if ((alg & cap_val) == alg) - return true; - - return false; - } - --static int hisi_zip_set_qm_algs(struct hisi_qm *qm) -+static int hisi_zip_set_high_perf(struct hisi_qm *qm) - { -- struct device *dev = &qm->pdev->dev; -- char *algs, *ptr; -- u32 alg_mask; -- int i; -- -- if (!qm->use_sva) -- return 0; -- -- algs = devm_kzalloc(dev, HZIP_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL); -- if (!algs) -- return -ENOMEM; -- -- alg_mask = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver); -- -- for (i = 0; i < ARRAY_SIZE(zip_dev_algs); i++) -- if (alg_mask & zip_dev_algs[i].alg_msk) -- strcat(algs, zip_dev_algs[i].algs); -- -- ptr = strrchr(algs, '\n'); -- if (ptr) -- *ptr = '\0'; -+ u32 val; -+ int ret; - -- qm->uacce->algs = algs; -+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); -+ if (perf_mode == HZIP_HIGH_COMP_PERF) -+ val |= HZIP_HIGH_COMP_PERF; -+ else -+ val &= ~HZIP_HIGH_COMP_PERF; -+ -+ /* Set perf mode */ -+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); -+ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, -+ val, val == perf_mode, HZIP_DELAY_1_US, -+ HZIP_POLL_TIMEOUT_US); -+ if (ret) -+ pci_err(qm->pdev, "failed to set perf mode\n"); - -- return 0; -+ return ret; - } - - static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) -@@ -542,10 +588,8 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) - } - - /* let's open all compression/decompression cores */ -- dcomp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info, -- ZIP_DECOMP_ENABLE_BITMAP, qm->cap_ver); -- comp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info, -- ZIP_COMP_ENABLE_BITMAP, qm->cap_ver); -+ dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; -+ comp_bm = qm->cap_tables.dev_cap_table[ZIP_COMP_ENABLE_BITMAP_IDX].cap_val; - writel(HZIP_DECOMP_CHECK_ENABLE | dcomp_bm | comp_bm, base + HZIP_CLOCK_GATE_CTRL); - - /* enable sqc,cqc writeback */ -@@ -772,9 +816,8 @@ static int hisi_zip_core_debug_init(struct hisi_qm *qm) - char buf[HZIP_BUF_SIZE]; - int i; - -- zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver); -- zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP, -- qm->cap_ver); -+ zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val; -+ zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val; - - for (i = 0; i < zip_core_num; i++) { - if (i < zip_comp_core_num) -@@ -916,7 +959,7 @@ static int hisi_zip_show_last_regs_init(struct hisi_qm *qm) - u32 zip_core_num; - int i, j, idx; - -- zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver); -+ zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val; - - debug->last_words = kcalloc(core_dfx_regs_num * zip_core_num + com_dfx_regs_num, - sizeof(unsigned int), GFP_KERNEL); -@@ -972,9 +1015,9 @@ static void hisi_zip_show_last_dfx_regs(struct hisi_qm *qm) - hzip_com_dfx_regs[i].name, debug->last_words[i], val); - } - -- zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver); -- zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP, -- qm->cap_ver); -+ zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val; -+ zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val; -+ - for (i = 0; i < zip_core_num; i++) { - if (i < zip_comp_core_num) - scnprintf(buf, sizeof(buf), "Comp_core-%d", i); -@@ -1115,6 +1158,10 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) - if (ret) - return ret; - -+ ret = hisi_zip_set_high_perf(qm); -+ if (ret) -+ return ret; -+ - hisi_zip_open_sva_prefetch(qm); - hisi_qm_dev_err_init(qm); - hisi_zip_debug_regs_clear(qm); -@@ -1126,8 +1173,31 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) - return ret; - } - -+static int zip_pre_store_cap_reg(struct hisi_qm *qm) -+{ -+ struct hisi_qm_cap_record *zip_cap; -+ struct pci_dev *pdev = qm->pdev; -+ size_t i, size; -+ -+ size = ARRAY_SIZE(zip_pre_store_caps); -+ zip_cap = devm_kzalloc(&pdev->dev, sizeof(*zip_cap) * size, GFP_KERNEL); -+ if (!zip_cap) -+ return -ENOMEM; -+ -+ for (i = 0; i < size; i++) { -+ zip_cap[i].type = zip_pre_store_caps[i]; -+ zip_cap[i].cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info, -+ zip_pre_store_caps[i], qm->cap_ver); -+ } -+ -+ qm->cap_tables.dev_cap_table = zip_cap; -+ -+ return 0; -+} -+ - static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - { -+ u64 alg_msk; - int ret; - - qm->pdev = pdev; -@@ -1163,7 +1233,16 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev) - return ret; - } - -- ret = hisi_zip_set_qm_algs(qm); -+ /* Fetch and save the value of capability registers */ -+ ret = zip_pre_store_cap_reg(qm); -+ if (ret) { -+ pci_err(qm->pdev, "Failed to pre-store capability registers!\n"); -+ hisi_qm_uninit(qm); -+ return ret; -+ } -+ -+ alg_msk = qm->cap_tables.dev_cap_table[ZIP_DEV_ALG_BITMAP_IDX].cap_val; -+ ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs)); - if (ret) { - pci_err(qm->pdev, "Failed to set zip algs!\n"); - hisi_qm_uninit(qm); -diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c -index 32a37e3850c58..f59e32115268b 100644 ---- a/drivers/crypto/inside-secure/safexcel_cipher.c -+++ b/drivers/crypto/inside-secure/safexcel_cipher.c -@@ -742,9 +742,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring, - max(totlen_src, totlen_dst)); - return -EINVAL; - } -- if (sreq->nr_src > 0) -- dma_map_sg(priv->dev, src, sreq->nr_src, -- DMA_BIDIRECTIONAL); -+ if (sreq->nr_src > 0 && -+ !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_BIDIRECTIONAL)) -+ return -EIO; - } else { - if (unlikely(totlen_src && (sreq->nr_src <= 0))) { - dev_err(priv->dev, "Source buffer not large enough (need %d bytes)!", -@@ -752,8 +752,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring, - return -EINVAL; - } - -- if (sreq->nr_src > 0) -- dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE); -+ if (sreq->nr_src > 0 && -+ !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE)) -+ return -EIO; - - if (unlikely(totlen_dst && (sreq->nr_dst <= 0))) { - dev_err(priv->dev, "Dest buffer not large enough (need %d bytes)!", -@@ -762,9 +763,11 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring, - goto unmap; - } - -- if (sreq->nr_dst > 0) -- dma_map_sg(priv->dev, dst, sreq->nr_dst, -- DMA_FROM_DEVICE); -+ if (sreq->nr_dst > 0 && -+ !dma_map_sg(priv->dev, dst, sreq->nr_dst, DMA_FROM_DEVICE)) { -+ ret = -EIO; -+ goto unmap; -+ } - } - - memcpy(ctx->base.ctxr->data, ctx->key, ctx->key_len); -diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c -index f4bc06c24ad8f..e7efebf8127f0 100644 ---- a/drivers/crypto/sa2ul.c -+++ b/drivers/crypto/sa2ul.c -@@ -1868,9 +1868,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc, - crypto_aead_set_flags(ctx->fallback.aead, - crypto_aead_get_flags(authenc) & - CRYPTO_TFM_REQ_MASK); -- crypto_aead_setkey(ctx->fallback.aead, key, keylen); - -- return 0; -+ return crypto_aead_setkey(ctx->fallback.aead, key, keylen); - } - - static int sa_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize) -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index 7ab20fb95166e..3b946f1313ed7 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -44,7 +44,6 @@ - #define FLAGS_MODE_MASK 0x000f - #define FLAGS_ENCRYPT BIT(0) - #define FLAGS_CBC BIT(1) --#define FLAGS_NEW_KEY BIT(3) - - #define SAHARA_HDR_BASE 0x00800000 - #define SAHARA_HDR_SKHA_ALG_AES 0 -@@ -142,8 +141,6 @@ struct sahara_hw_link { - }; - - struct sahara_ctx { -- unsigned long flags; -- - /* AES-specific context */ - int keylen; - u8 key[AES_KEYSIZE_128]; -@@ -152,6 +149,7 @@ struct sahara_ctx { - - struct sahara_aes_reqctx { - unsigned long mode; -+ u8 iv_out[AES_BLOCK_SIZE]; - struct skcipher_request fallback_req; // keep at the end - }; - -@@ -447,27 +445,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - int ret; - int i, j; - int idx = 0; -+ u32 len; - -- /* Copy new key if necessary */ -- if (ctx->flags & FLAGS_NEW_KEY) { -- memcpy(dev->key_base, ctx->key, ctx->keylen); -- ctx->flags &= ~FLAGS_NEW_KEY; -+ memcpy(dev->key_base, ctx->key, ctx->keylen); - -- if (dev->flags & FLAGS_CBC) { -- dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE; -- dev->hw_desc[idx]->p1 = dev->iv_phys_base; -- } else { -- dev->hw_desc[idx]->len1 = 0; -- dev->hw_desc[idx]->p1 = 0; -- } -- dev->hw_desc[idx]->len2 = ctx->keylen; -- dev->hw_desc[idx]->p2 = dev->key_phys_base; -- dev->hw_desc[idx]->next = dev->hw_phys_desc[1]; -+ if (dev->flags & FLAGS_CBC) { -+ dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE; -+ dev->hw_desc[idx]->p1 = dev->iv_phys_base; -+ } else { -+ dev->hw_desc[idx]->len1 = 0; -+ dev->hw_desc[idx]->p1 = 0; -+ } -+ dev->hw_desc[idx]->len2 = ctx->keylen; -+ dev->hw_desc[idx]->p2 = dev->key_phys_base; -+ dev->hw_desc[idx]->next = dev->hw_phys_desc[1]; -+ dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev); - -- dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev); -+ idx++; - -- idx++; -- } - - dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total); - if (dev->nb_in_sg < 0) { -@@ -489,24 +484,27 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - DMA_TO_DEVICE); - if (!ret) { - dev_err(dev->device, "couldn't map in sg\n"); -- goto unmap_in; -+ return -EINVAL; - } -+ - ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg, - DMA_FROM_DEVICE); - if (!ret) { - dev_err(dev->device, "couldn't map out sg\n"); -- goto unmap_out; -+ goto unmap_in; - } - - /* Create input links */ - dev->hw_desc[idx]->p1 = dev->hw_phys_link[0]; - sg = dev->in_sg; -+ len = dev->total; - for (i = 0; i < dev->nb_in_sg; i++) { -- dev->hw_link[i]->len = sg->length; -+ dev->hw_link[i]->len = min(len, sg->length); - dev->hw_link[i]->p = sg->dma_address; - if (i == (dev->nb_in_sg - 1)) { - dev->hw_link[i]->next = 0; - } else { -+ len -= min(len, sg->length); - dev->hw_link[i]->next = dev->hw_phys_link[i + 1]; - sg = sg_next(sg); - } -@@ -515,12 +513,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - /* Create output links */ - dev->hw_desc[idx]->p2 = dev->hw_phys_link[i]; - sg = dev->out_sg; -+ len = dev->total; - for (j = i; j < dev->nb_out_sg + i; j++) { -- dev->hw_link[j]->len = sg->length; -+ dev->hw_link[j]->len = min(len, sg->length); - dev->hw_link[j]->p = sg->dma_address; - if (j == (dev->nb_out_sg + i - 1)) { - dev->hw_link[j]->next = 0; - } else { -+ len -= min(len, sg->length); - dev->hw_link[j]->next = dev->hw_phys_link[j + 1]; - sg = sg_next(sg); - } -@@ -539,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) - - return 0; - --unmap_out: -- dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg, -- DMA_FROM_DEVICE); - unmap_in: - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); -@@ -549,8 +546,24 @@ unmap_in: - return -EINVAL; - } - -+static void sahara_aes_cbc_update_iv(struct skcipher_request *req) -+{ -+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); -+ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher); -+ -+ /* Update IV buffer to contain the last ciphertext block */ -+ if (rctx->mode & FLAGS_ENCRYPT) { -+ sg_pcopy_to_buffer(req->dst, sg_nents(req->dst), req->iv, -+ ivsize, req->cryptlen - ivsize); -+ } else { -+ memcpy(req->iv, rctx->iv_out, ivsize); -+ } -+} -+ - static int sahara_aes_process(struct skcipher_request *req) - { -+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); - struct sahara_dev *dev = dev_ptr; - struct sahara_ctx *ctx; - struct sahara_aes_reqctx *rctx; -@@ -572,8 +585,17 @@ static int sahara_aes_process(struct skcipher_request *req) - rctx->mode &= FLAGS_MODE_MASK; - dev->flags = (dev->flags & ~FLAGS_MODE_MASK) | rctx->mode; - -- if ((dev->flags & FLAGS_CBC) && req->iv) -- memcpy(dev->iv_base, req->iv, AES_KEYSIZE_128); -+ if ((dev->flags & FLAGS_CBC) && req->iv) { -+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher); -+ -+ memcpy(dev->iv_base, req->iv, ivsize); -+ -+ if (!(dev->flags & FLAGS_ENCRYPT)) { -+ sg_pcopy_to_buffer(req->src, sg_nents(req->src), -+ rctx->iv_out, ivsize, -+ req->cryptlen - ivsize); -+ } -+ } - - /* assign new context to device */ - dev->ctx = ctx; -@@ -586,16 +608,20 @@ static int sahara_aes_process(struct skcipher_request *req) - - timeout = wait_for_completion_timeout(&dev->dma_completion, - msecs_to_jiffies(SAHARA_TIMEOUT_MS)); -- if (!timeout) { -- dev_err(dev->device, "AES timeout\n"); -- return -ETIMEDOUT; -- } - - dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg, - DMA_FROM_DEVICE); - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); - -+ if (!timeout) { -+ dev_err(dev->device, "AES timeout\n"); -+ return -ETIMEDOUT; -+ } -+ -+ if ((dev->flags & FLAGS_CBC) && req->iv) -+ sahara_aes_cbc_update_iv(req); -+ - return 0; - } - -@@ -609,7 +635,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, - /* SAHARA only supports 128bit keys */ - if (keylen == AES_KEYSIZE_128) { - memcpy(ctx->key, key, keylen); -- ctx->flags |= FLAGS_NEW_KEY; - return 0; - } - -@@ -625,12 +650,40 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, - return crypto_skcipher_setkey(ctx->fallback, key, keylen); - } - -+static int sahara_aes_fallback(struct skcipher_request *req, unsigned long mode) -+{ -+ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -+ struct sahara_ctx *ctx = crypto_skcipher_ctx( -+ crypto_skcipher_reqtfm(req)); -+ -+ skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -+ skcipher_request_set_callback(&rctx->fallback_req, -+ req->base.flags, -+ req->base.complete, -+ req->base.data); -+ skcipher_request_set_crypt(&rctx->fallback_req, req->src, -+ req->dst, req->cryptlen, req->iv); -+ -+ if (mode & FLAGS_ENCRYPT) -+ return crypto_skcipher_encrypt(&rctx->fallback_req); -+ -+ return crypto_skcipher_decrypt(&rctx->fallback_req); -+} -+ - static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) - { - struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -+ struct sahara_ctx *ctx = crypto_skcipher_ctx( -+ crypto_skcipher_reqtfm(req)); - struct sahara_dev *dev = dev_ptr; - int err = 0; - -+ if (!req->cryptlen) -+ return 0; -+ -+ if (unlikely(ctx->keylen != AES_KEYSIZE_128)) -+ return sahara_aes_fallback(req, mode); -+ - dev_dbg(dev->device, "nbytes: %d, enc: %d, cbc: %d\n", - req->cryptlen, !!(mode & FLAGS_ENCRYPT), !!(mode & FLAGS_CBC)); - -@@ -653,81 +706,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) - - static int sahara_aes_ecb_encrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_encrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, FLAGS_ENCRYPT); - } - - static int sahara_aes_ecb_decrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_decrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, 0); - } - - static int sahara_aes_cbc_encrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_encrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, FLAGS_ENCRYPT | FLAGS_CBC); - } - - static int sahara_aes_cbc_decrypt(struct skcipher_request *req) - { -- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); -- struct sahara_ctx *ctx = crypto_skcipher_ctx( -- crypto_skcipher_reqtfm(req)); -- -- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { -- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); -- skcipher_request_set_callback(&rctx->fallback_req, -- req->base.flags, -- req->base.complete, -- req->base.data); -- skcipher_request_set_crypt(&rctx->fallback_req, req->src, -- req->dst, req->cryptlen, req->iv); -- return crypto_skcipher_decrypt(&rctx->fallback_req); -- } -- - return sahara_aes_crypt(req, FLAGS_CBC); - } - -@@ -784,6 +777,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, - int start) - { - struct scatterlist *sg; -+ unsigned int len; - unsigned int i; - int ret; - -@@ -805,12 +799,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, - if (!ret) - return -EFAULT; - -+ len = rctx->total; - for (i = start; i < dev->nb_in_sg + start; i++) { -- dev->hw_link[i]->len = sg->length; -+ dev->hw_link[i]->len = min(len, sg->length); - dev->hw_link[i]->p = sg->dma_address; - if (i == (dev->nb_in_sg + start - 1)) { - dev->hw_link[i]->next = 0; - } else { -+ len -= min(len, sg->length); - dev->hw_link[i]->next = dev->hw_phys_link[i + 1]; - sg = sg_next(sg); - } -@@ -891,24 +887,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev, - return 0; - } - --static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes) --{ -- if (!sg || !sg->length) -- return nbytes; -- -- while (nbytes && sg) { -- if (nbytes <= sg->length) { -- sg->length = nbytes; -- sg_mark_end(sg); -- break; -- } -- nbytes -= sg->length; -- sg = sg_next(sg); -- } -- -- return nbytes; --} -- - static int sahara_sha_prepare_request(struct ahash_request *req) - { - struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); -@@ -945,36 +923,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req) - hash_later, 0); - } - -- /* nbytes should now be multiple of blocksize */ -- req->nbytes = req->nbytes - hash_later; -- -- sahara_walk_and_recalc(req->src, req->nbytes); -- -+ rctx->total = len - hash_later; - /* have data from previous operation and current */ - if (rctx->buf_cnt && req->nbytes) { - sg_init_table(rctx->in_sg_chain, 2); - sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt); -- - sg_chain(rctx->in_sg_chain, 2, req->src); -- -- rctx->total = req->nbytes + rctx->buf_cnt; - rctx->in_sg = rctx->in_sg_chain; -- -- req->src = rctx->in_sg_chain; - /* only data from previous operation */ - } else if (rctx->buf_cnt) { -- if (req->src) -- rctx->in_sg = req->src; -- else -- rctx->in_sg = rctx->in_sg_chain; -- /* buf was copied into rembuf above */ -+ rctx->in_sg = rctx->in_sg_chain; - sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt); -- rctx->total = rctx->buf_cnt; - /* no data from previous operation */ - } else { - rctx->in_sg = req->src; -- rctx->total = req->nbytes; -- req->src = rctx->in_sg; - } - - /* on next call, we only have the remaining data in the buffer */ -@@ -995,7 +957,10 @@ static int sahara_sha_process(struct ahash_request *req) - return ret; - - if (rctx->first) { -- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0); -+ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0); -+ if (ret) -+ return ret; -+ - dev->hw_desc[0]->next = 0; - rctx->first = 0; - } else { -@@ -1003,7 +968,10 @@ static int sahara_sha_process(struct ahash_request *req) - - sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0); - dev->hw_desc[0]->next = dev->hw_phys_desc[1]; -- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1); -+ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1); -+ if (ret) -+ return ret; -+ - dev->hw_desc[1]->next = 0; - } - -@@ -1016,18 +984,19 @@ static int sahara_sha_process(struct ahash_request *req) - - timeout = wait_for_completion_timeout(&dev->dma_completion, - msecs_to_jiffies(SAHARA_TIMEOUT_MS)); -- if (!timeout) { -- dev_err(dev->device, "SHA timeout\n"); -- return -ETIMEDOUT; -- } - - if (rctx->sg_in_idx) - dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, - DMA_TO_DEVICE); - -+ if (!timeout) { -+ dev_err(dev->device, "SHA timeout\n"); -+ return -ETIMEDOUT; -+ } -+ - memcpy(rctx->context, dev->context_base, rctx->context_size); - -- if (req->result) -+ if (req->result && rctx->last) - memcpy(req->result, rctx->context, rctx->digest_size); - - return 0; -@@ -1171,8 +1140,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in) - static int sahara_sha_cra_init(struct crypto_tfm *tfm) - { - crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm), -- sizeof(struct sahara_sha_reqctx) + -- SHA_BUFFER_LEN + SHA256_BLOCK_SIZE); -+ sizeof(struct sahara_sha_reqctx)); - - return 0; - } -diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h -index 154590e1f7643..7059bbe5a2eba 100644 ---- a/drivers/crypto/virtio/virtio_crypto_common.h -+++ b/drivers/crypto/virtio/virtio_crypto_common.h -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -28,6 +29,7 @@ struct data_queue { - char name[32]; - - struct crypto_engine *engine; -+ struct tasklet_struct done_task; - }; - - struct virtio_crypto { -diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c -index 3842915ea7437..56dc0935c774a 100644 ---- a/drivers/crypto/virtio/virtio_crypto_core.c -+++ b/drivers/crypto/virtio/virtio_crypto_core.c -@@ -72,27 +72,28 @@ int virtio_crypto_ctrl_vq_request(struct virtio_crypto *vcrypto, struct scatterl - return 0; - } - --static void virtcrypto_dataq_callback(struct virtqueue *vq) -+static void virtcrypto_done_task(unsigned long data) - { -- struct virtio_crypto *vcrypto = vq->vdev->priv; -+ struct data_queue *data_vq = (struct data_queue *)data; -+ struct virtqueue *vq = data_vq->vq; - struct virtio_crypto_request *vc_req; -- unsigned long flags; - unsigned int len; -- unsigned int qid = vq->index; - -- spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags); - do { - virtqueue_disable_cb(vq); - while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) { -- spin_unlock_irqrestore( -- &vcrypto->data_vq[qid].lock, flags); - if (vc_req->alg_cb) - vc_req->alg_cb(vc_req, len); -- spin_lock_irqsave( -- &vcrypto->data_vq[qid].lock, flags); - } - } while (!virtqueue_enable_cb(vq)); -- spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags); -+} -+ -+static void virtcrypto_dataq_callback(struct virtqueue *vq) -+{ -+ struct virtio_crypto *vcrypto = vq->vdev->priv; -+ struct data_queue *dq = &vcrypto->data_vq[vq->index]; -+ -+ tasklet_schedule(&dq->done_task); - } - - static int virtcrypto_find_vqs(struct virtio_crypto *vi) -@@ -150,6 +151,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi) - ret = -ENOMEM; - goto err_engine; - } -+ tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task, -+ (unsigned long)&vi->data_vq[i]); - } - - kfree(names); -@@ -496,12 +499,15 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto) - static void virtcrypto_remove(struct virtio_device *vdev) - { - struct virtio_crypto *vcrypto = vdev->priv; -+ int i; - - dev_info(&vdev->dev, "Start virtcrypto_remove.\n"); - - flush_work(&vcrypto->config_work); - if (virtcrypto_dev_started(vcrypto)) - virtcrypto_dev_stop(vcrypto); -+ for (i = 0; i < vcrypto->max_data_queues; i++) -+ tasklet_kill(&vcrypto->data_vq[i].done_task); - virtio_reset_device(vdev); - virtcrypto_free_unused_reqs(vcrypto); - virtcrypto_clear_crypto_engines(vcrypto); -diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c -index bd41424319807..1f1483a9e5252 100644 ---- a/drivers/cxl/core/port.c -+++ b/drivers/cxl/core/port.c -@@ -1403,7 +1403,7 @@ static int decoder_populate_targets(struct cxl_switch_decoder *cxlsd, - return -EINVAL; - - write_seqlock(&cxlsd->target_lock); -- for (i = 0; i < cxlsd->nr_targets; i++) { -+ for (i = 0; i < cxlsd->cxld.interleave_ways; i++) { - struct cxl_dport *dport = find_dport(port, target_map[i]); - - if (!dport) { -diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c -index ebc1b028555ca..2f7187dbfa2d9 100644 ---- a/drivers/cxl/core/region.c -+++ b/drivers/cxl/core/region.c -@@ -331,7 +331,7 @@ static ssize_t interleave_ways_store(struct device *dev, - return rc; - - /* -- * Even for x3, x9, and x12 interleaves the region interleave must be a -+ * Even for x3, x6, and x12 interleaves the region interleave must be a - * power of 2 multiple of the host bridge interleave. - */ - if (!is_power_of_2(val / cxld->interleave_ways) || -diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c -index f13674081cb6b..4dca21b39bf73 100644 ---- a/drivers/edac/thunderx_edac.c -+++ b/drivers/edac/thunderx_edac.c -@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) - decode_register(other, OCX_OTHER_SIZE, - ocx_com_errors, ctx->reg_com_int); - -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - - for (lane = 0; lane < OCX_RX_LANES; lane++) - if (ctx->reg_com_int & BIT(lane)) { -@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) - lane, ctx->reg_lane_int[lane], - lane, ctx->reg_lane_stat11[lane]); - -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - - decode_register(other, OCX_OTHER_SIZE, - ocx_lane_errors, - ctx->reg_lane_int[lane]); -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - } - - if (ctx->reg_com_int & OCX_COM_INT_CE) -@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) - decode_register(other, OCX_OTHER_SIZE, - ocx_com_link_errors, ctx->reg_com_link_int); - -- strncat(msg, other, OCX_MESSAGE_SIZE); -+ strlcat(msg, other, OCX_MESSAGE_SIZE); - - if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) - edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); -@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) - - decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - -- strncat(msg, other, L2C_MESSAGE_SIZE); -+ strlcat(msg, other, L2C_MESSAGE_SIZE); - - if (ctx->reg_int & mask_ue) - edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c -index d081a6312627b..bf19dd66c2137 100644 ---- a/drivers/firmware/meson/meson_sm.c -+++ b/drivers/firmware/meson/meson_sm.c -@@ -313,11 +313,14 @@ static int __init meson_sm_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, fw); - -- pr_info("secure-monitor enabled\n"); -+ if (devm_of_platform_populate(dev)) -+ goto out_in_base; - - if (sysfs_create_group(&pdev->dev.kobj, &meson_sm_sysfs_attr_group)) - goto out_in_base; - -+ pr_info("secure-monitor enabled\n"); -+ - return 0; - - out_in_base: -diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c -index 597d1a367d96d..6231c98ba291a 100644 ---- a/drivers/firmware/ti_sci.c -+++ b/drivers/firmware/ti_sci.c -@@ -161,7 +161,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, - { - struct device *dev = &pdev->dev; - struct resource *res; -- char debug_name[50] = "ti_sci_debug@"; -+ char debug_name[50]; - - /* Debug region is optional */ - res = platform_get_resource_byname(pdev, IORESOURCE_MEM, -@@ -178,10 +178,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, - /* Setup NULL termination */ - info->debug_buffer[info->debug_region_size] = 0; - -- info->d = debugfs_create_file(strncat(debug_name, dev_name(dev), -- sizeof(debug_name) - -- sizeof("ti_sci_debug@")), -- 0444, NULL, info, &ti_sci_debug_fops); -+ snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s", -+ dev_name(dev)); -+ info->d = debugfs_create_file(debug_name, 0444, NULL, info, -+ &ti_sci_debug_fops); - if (IS_ERR(info->d)) - return PTR_ERR(info->d); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -index 8123feb1a1161..06ab6066da61a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c -@@ -596,7 +596,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf, - int r; - - if (!adev->smc_rreg) -- return -EPERM; -+ return -EOPNOTSUPP; - - if (size & 0x3 || *pos & 0x3) - return -EINVAL; -@@ -655,7 +655,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user * - int r; - - if (!adev->smc_wreg) -- return -EPERM; -+ return -EOPNOTSUPP; - - if (size & 0x3 || *pos & 0x3) - return -EINVAL; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index b9983ca99eb7d..a8e1f2cfe12dc 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -2202,6 +2202,8 @@ retry_init: - - pci_wake_from_d3(pdev, TRUE); - -+ pci_wake_from_d3(pdev, TRUE); -+ - /* - * For runpm implemented via BACO, PMFW will handle the - * timing for BACO in and out: -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -index 88bf6221d4bef..8a7705db0b9a6 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c -@@ -1019,7 +1019,7 @@ int svm_migrate_init(struct amdgpu_device *adev) - } else { - res = devm_request_free_mem_region(adev->dev, &iomem_resource, size); - if (IS_ERR(res)) -- return -ENOMEM; -+ return PTR_ERR(res); - pgmap->range.start = res->start; - pgmap->range.end = res->end; - pgmap->type = MEMORY_DEVICE_PRIVATE; -@@ -1035,11 +1035,10 @@ int svm_migrate_init(struct amdgpu_device *adev) - r = devm_memremap_pages(adev->dev, pgmap); - if (IS_ERR(r)) { - pr_err("failed to register HMM device memory\n"); -+ if (pgmap->type == MEMORY_DEVICE_PRIVATE) -+ devm_release_mem_region(adev->dev, res->start, resource_size(res)); - /* Disable SVM support capability */ - pgmap->type = 0; -- if (pgmap->type == MEMORY_DEVICE_PRIVATE) -- devm_release_mem_region(adev->dev, res->start, -- res->end - res->start + 1); - return PTR_ERR(r); - } - -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -index 713f893d25302..705d9e91b5aa3 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -@@ -1403,10 +1403,11 @@ static int kfd_create_indirect_link_prop(struct kfd_topology_device *kdev, int g - num_cpu++; - } - -+ if (list_empty(&kdev->io_link_props)) -+ return -ENODATA; -+ - gpu_link = list_first_entry(&kdev->io_link_props, -- struct kfd_iolink_properties, list); -- if (!gpu_link) -- return -ENOMEM; -+ struct kfd_iolink_properties, list); - - for (i = 0; i < num_cpu; i++) { - /* CPU <--> GPU */ -@@ -1484,15 +1485,17 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev, - peer->gpu->adev)) - return ret; - -+ if (list_empty(&kdev->io_link_props)) -+ return -ENODATA; -+ - iolink1 = list_first_entry(&kdev->io_link_props, -- struct kfd_iolink_properties, list); -- if (!iolink1) -- return -ENOMEM; -+ struct kfd_iolink_properties, list); -+ -+ if (list_empty(&peer->io_link_props)) -+ return -ENODATA; - - iolink2 = list_first_entry(&peer->io_link_props, -- struct kfd_iolink_properties, list); -- if (!iolink2) -- return -ENOMEM; -+ struct kfd_iolink_properties, list); - - props = kfd_alloc_struct(props); - if (!props) -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -index f5e08b60f66ef..d17bfa111aa74 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c -@@ -2748,10 +2748,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; - ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL); -- if (ps == NULL) { -- kfree(adev->pm.dpm.ps); -+ if (ps == NULL) - return -ENOMEM; -- } - adev->pm.dpm.ps[i].ps_priv = ps; - k = 0; - idx = (u8 *)&power_state->v2.clockInfoIndex[0]; -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -index d3fe149d84765..291223ea7ba7d 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c -@@ -272,10 +272,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usVddcDependencyOnSCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_sclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usVddciDependencyOnMCLKOffset) { - dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *) -@@ -283,10 +281,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usVddciDependencyOnMCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddci_dependency_on_mclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usVddcDependencyOnMCLKOffset) { - dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *) -@@ -294,10 +290,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usVddcDependencyOnMCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_mclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usMvddDependencyOnMCLKOffset) { - dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *) -@@ -305,10 +299,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(power_info->pplib4.usMvddDependencyOnMCLKOffset)); - ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.mvdd_dependency_on_mclk, - dep_table); -- if (ret) { -- amdgpu_free_extended_power_table(adev); -+ if (ret) - return ret; -- } - } - if (power_info->pplib4.usMaxClockVoltageOnDCOffset) { - ATOM_PPLIB_Clock_Voltage_Limit_Table *clk_v = -@@ -339,10 +331,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - kcalloc(psl->ucNumEntries, - sizeof(struct amdgpu_phase_shedding_limits_entry), - GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) - return -ENOMEM; -- } - - entry = &psl->entries[0]; - for (i = 0; i < psl->ucNumEntries; i++) { -@@ -383,10 +373,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - ATOM_PPLIB_CAC_Leakage_Record *entry; - u32 size = cac_table->ucNumEntries * sizeof(struct amdgpu_cac_leakage_table); - adev->pm.dpm.dyn_state.cac_leakage_table.entries = kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries) - return -ENOMEM; -- } - entry = &cac_table->entries[0]; - for (i = 0; i < cac_table->ucNumEntries; i++) { - if (adev->pm.dpm.platform_caps & ATOM_PP_PLATFORM_CAP_EVV) { -@@ -438,10 +426,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_vce_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -493,10 +479,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_uvd_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -525,10 +509,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -548,10 +530,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - le16_to_cpu(ext_hdr->usPPMTableOffset)); - adev->pm.dpm.dyn_state.ppm_table = - kzalloc(sizeof(struct amdgpu_ppm_table), GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.ppm_table) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.ppm_table) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.ppm_table->ppm_design = ppm->ucPpmDesign; - adev->pm.dpm.dyn_state.ppm_table->cpu_core_number = - le16_to_cpu(ppm->usCpuCoreNumber); -@@ -583,10 +563,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - sizeof(struct amdgpu_clock_voltage_dependency_entry); - adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries = - kzalloc(size, GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries) - return -ENOMEM; -- } - adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.count = - limits->numEntries; - entry = &limits->entries[0]; -@@ -606,10 +584,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - ATOM_PowerTune_Table *pt; - adev->pm.dpm.dyn_state.cac_tdp_table = - kzalloc(sizeof(struct amdgpu_cac_tdp_table), GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.cac_tdp_table) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.cac_tdp_table) - return -ENOMEM; -- } - if (rev > 0) { - ATOM_PPLIB_POWERTUNE_Table_V1 *ppt = (ATOM_PPLIB_POWERTUNE_Table_V1 *) - (mode_info->atom_context->bios + data_offset + -@@ -645,10 +621,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev) - ret = amdgpu_parse_clk_voltage_dep_table( - &adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk, - dep_table); -- if (ret) { -- kfree(adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk.entries); -+ if (ret) - return ret; -- } - } - } - -diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -index c89cfef7cafa1..dc0a6fba7050f 100644 ---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c -@@ -7379,10 +7379,9 @@ static int si_dpm_init(struct amdgpu_device *adev) - kcalloc(4, - sizeof(struct amdgpu_clock_voltage_dependency_entry), - GFP_KERNEL); -- if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { -- amdgpu_free_extended_power_table(adev); -+ if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) - return -ENOMEM; -- } -+ - adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; - adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; - adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0; -diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -index a31a62a1ce0b2..5e9410117712c 100644 ---- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c -@@ -2987,6 +2987,8 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr) - result = smu7_get_evv_voltages(hwmgr); - if (result) { - pr_info("Get EVV Voltage Failed. Abort Driver loading!\n"); -+ kfree(hwmgr->backend); -+ hwmgr->backend = NULL; - return -EINVAL; - } - } else { -@@ -3032,8 +3034,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr) - } - - result = smu7_update_edc_leakage_table(hwmgr); -- if (result) -+ if (result) { -+ smu7_hwmgr_backend_fini(hwmgr); - return result; -+ } - - return 0; - } -diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c -index 946212a955981..5e3b8edcf7948 100644 ---- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c -+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c -@@ -403,7 +403,8 @@ static int _cdns_mhdp_hdcp_disable(struct cdns_mhdp_device *mhdp) - - static int _cdns_mhdp_hdcp_enable(struct cdns_mhdp_device *mhdp, u8 content_type) - { -- int ret, tries = 3; -+ int ret = -EINVAL; -+ int tries = 3; - u32 i; - - for (i = 0; i < tries; i++) { -diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c -index 7ef78283e3d3e..926ab5c3c31ab 100644 ---- a/drivers/gpu/drm/bridge/tc358767.c -+++ b/drivers/gpu/drm/bridge/tc358767.c -@@ -2097,7 +2097,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id) - } else { - if (tc->hpd_pin < 0 || tc->hpd_pin > 1) { - dev_err(dev, "failed to parse HPD number\n"); -- return ret; -+ return -EINVAL; - } - } - -diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c -index e0e015243a602..b588fea12502d 100644 ---- a/drivers/gpu/drm/bridge/ti-tpd12s015.c -+++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c -@@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) - return 0; - } - --static int __exit tpd12s015_remove(struct platform_device *pdev) -+static int tpd12s015_remove(struct platform_device *pdev) - { - struct tpd12s015_device *tpd = platform_get_drvdata(pdev); - -@@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); - - static struct platform_driver tpd12s015_driver = { - .probe = tpd12s015_probe, -- .remove = __exit_p(tpd12s015_remove), -+ .remove = tpd12s015_remove, - .driver = { - .name = "tpd12s015", - .of_match_table = tpd12s015_of_match, -diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c -index 203bf8d6c34c4..d41a5eaa3e892 100644 ---- a/drivers/gpu/drm/drm_drv.c -+++ b/drivers/gpu/drm/drm_drv.c -@@ -895,8 +895,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) - goto err_minors; - } - -- if (drm_core_check_feature(dev, DRIVER_MODESET)) -- drm_modeset_register_all(dev); -+ if (drm_core_check_feature(dev, DRIVER_MODESET)) { -+ ret = drm_modeset_register_all(dev); -+ if (ret) -+ goto err_unload; -+ } - - DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n", - driver->name, driver->major, driver->minor, -@@ -906,6 +909,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) - - goto out_unlock; - -+err_unload: -+ if (dev->driver->unload) -+ dev->driver->unload(dev); - err_minors: - remove_compat_control_link(dev); - drm_minor_unregister(dev, DRM_MINOR_PRIMARY); -diff --git a/drivers/gpu/drm/mediatek/mtk_disp_merge.c b/drivers/gpu/drm/mediatek/mtk_disp_merge.c -index 6428b6203ffe8..211140e87568d 100644 ---- a/drivers/gpu/drm/mediatek/mtk_disp_merge.c -+++ b/drivers/gpu/drm/mediatek/mtk_disp_merge.c -@@ -104,7 +104,7 @@ void mtk_merge_stop_cmdq(struct device *dev, struct cmdq_pkt *cmdq_pkt) - mtk_ddp_write(cmdq_pkt, 0, &priv->cmdq_reg, priv->regs, - DISP_REG_MERGE_CTRL); - -- if (priv->async_clk) -+ if (!cmdq_pkt && priv->async_clk) - reset_control_reset(priv->reset_ctl); - } - -diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c -index 2c850b6d945bc..519e23a2a017c 100644 ---- a/drivers/gpu/drm/mediatek/mtk_dp.c -+++ b/drivers/gpu/drm/mediatek/mtk_dp.c -@@ -2669,3 +2669,4 @@ MODULE_AUTHOR("Markus Schneider-Pargmann "); - MODULE_AUTHOR("Bo-Chen Chen "); - MODULE_DESCRIPTION("MediaTek DisplayPort Driver"); - MODULE_LICENSE("GPL"); -+MODULE_SOFTDEP("pre: phy_mtk_dp"); -diff --git a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c -index eecfa98ff52e8..b288bb6eeecc7 100644 ---- a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c -+++ b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c -@@ -223,8 +223,7 @@ int mtk_mdp_rdma_clk_enable(struct device *dev) - { - struct mtk_mdp_rdma *rdma = dev_get_drvdata(dev); - -- clk_prepare_enable(rdma->clk); -- return 0; -+ return clk_prepare_enable(rdma->clk); - } - - void mtk_mdp_rdma_clk_disable(struct device *dev) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -index 6c0ffe8e4adbd..5a5821e59dc15 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved. - * Copyright (C) 2013 Red Hat - * Author: Rob Clark -@@ -124,7 +124,7 @@ static void dpu_crtc_setup_lm_misr(struct dpu_crtc_state *crtc_state) - continue; - - /* Calculate MISR over 1 frame */ -- m->hw_lm->ops.setup_misr(m->hw_lm, true, 1); -+ m->hw_lm->ops.setup_misr(m->hw_lm); - } - } - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -index 547f9f2b9fcb5..b0eb881f8af13 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c -@@ -2,7 +2,7 @@ - /* - * Copyright (C) 2013 Red Hat - * Copyright (c) 2014-2018, 2020-2021 The Linux Foundation. All rights reserved. -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * - * Author: Rob Clark - */ -@@ -257,7 +257,7 @@ void dpu_encoder_setup_misr(const struct drm_encoder *drm_enc) - if (!phys->hw_intf || !phys->hw_intf->ops.setup_misr) - continue; - -- phys->hw_intf->ops.setup_misr(phys->hw_intf, true, 1); -+ phys->hw_intf->ops.setup_misr(phys->hw_intf); - } - } - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -index b9dddf576c029..384558d2f9602 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. - */ - -@@ -322,9 +322,9 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf) - return DPU_REG_READ(c, INTF_LINE_COUNT); - } - --static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count) -+static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf) - { -- dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count); -+ dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, 0x1); - } - - static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h -index 643dd10bc0306..e75339b96a1d2 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. - */ - -@@ -80,7 +80,7 @@ struct dpu_hw_intf_ops { - void (*bind_pingpong_blk)(struct dpu_hw_intf *intf, - bool enable, - const enum dpu_pingpong pp); -- void (*setup_misr)(struct dpu_hw_intf *intf, bool enable, u32 frame_count); -+ void (*setup_misr)(struct dpu_hw_intf *intf); - int (*collect_misr)(struct dpu_hw_intf *intf, u32 *misr_value); - }; - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -index f5120ea91edee..cc04fb979fb5c 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. - */ - -@@ -99,9 +99,9 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx, - } - } - --static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count) -+static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx) - { -- dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count); -+ dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, 0x0); - } - - static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value) -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h -index 652ddfdedec37..0a050eb247b99 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h -@@ -1,5 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. - */ - -@@ -57,7 +58,7 @@ struct dpu_hw_lm_ops { - /** - * setup_misr: Enable/disable MISR - */ -- void (*setup_misr)(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count); -+ void (*setup_misr)(struct dpu_hw_mixer *ctx); - - /** - * collect_misr: Read MISR signature -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -index 8062228eada68..1b7439ae686a7 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. - */ - #define pr_fmt(fmt) "[drm:%s:%d] " fmt, __func__, __LINE__ -@@ -450,9 +450,11 @@ u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl, - return 0; - } - -+/* -+ * note: Aside from encoders, input_sel should be set to 0x0 by default -+ */ - void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, -- u32 misr_ctrl_offset, -- bool enable, u32 frame_count) -+ u32 misr_ctrl_offset, u8 input_sel) - { - u32 config = 0; - -@@ -461,15 +463,9 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, - /* Clear old MISR value (in case it's read before a new value is calculated)*/ - wmb(); - -- if (enable) { -- config = (frame_count & MISR_FRAME_COUNT_MASK) | -- MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK; -- -- DPU_REG_WRITE(c, misr_ctrl_offset, config); -- } else { -- DPU_REG_WRITE(c, misr_ctrl_offset, 0); -- } -- -+ config = MISR_FRAME_COUNT | MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK | -+ ((input_sel & 0xF) << 24); -+ DPU_REG_WRITE(c, misr_ctrl_offset, config); - } - - int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -index 27f4c39e35ab3..4ae2a434372cf 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h -@@ -1,6 +1,6 @@ - /* SPDX-License-Identifier: GPL-2.0-only */ - /* -- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. - * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. - */ - -@@ -13,7 +13,7 @@ - #include "dpu_hw_catalog.h" - - #define REG_MASK(n) ((BIT(n)) - 1) --#define MISR_FRAME_COUNT_MASK 0xFF -+#define MISR_FRAME_COUNT 0x1 - #define MISR_CTRL_ENABLE BIT(8) - #define MISR_CTRL_STATUS BIT(9) - #define MISR_CTRL_STATUS_CLEAR BIT(10) -@@ -350,9 +350,7 @@ u64 _dpu_hw_get_qos_lut(const struct dpu_qos_lut_tbl *tbl, - u32 total_fl); - - void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c, -- u32 misr_ctrl_offset, -- bool enable, -- u32 frame_count); -+ u32 misr_ctrl_offset, u8 input_sel); - - int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c, - u32 misr_ctrl_offset, -diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c -index 169f9de4a12a7..3100957225a70 100644 ---- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c -+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c -@@ -269,6 +269,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, - { - struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc); - struct mdp4_kms *mdp4_kms = get_kms(crtc); -+ unsigned long flags; - - DBG("%s", mdp4_crtc->name); - -@@ -281,6 +282,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, - mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err); - mdp4_disable(mdp4_kms); - -+ if (crtc->state->event && !crtc->state->active) { -+ WARN_ON(mdp4_crtc->event); -+ spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags); -+ drm_crtc_send_vblank_event(crtc, crtc->state->event); -+ crtc->state->event = NULL; -+ spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags); -+ } -+ - mdp4_crtc->enabled = false; - } - -diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -index 7fc0975cb8693..62bc3756f2e2b 100644 ---- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c -@@ -512,7 +512,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy) - struct device *dev = &phy->pdev->dev; - int ret; - -- pm_runtime_get_sync(dev); -+ ret = pm_runtime_resume_and_get(dev); -+ if (ret) -+ return ret; - - ret = clk_prepare_enable(phy->ahb_clk); - if (ret) { -diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c -index 5b71a5a5cd85c..cdbc75e3d1f66 100644 ---- a/drivers/gpu/drm/nouveau/nv04_fence.c -+++ b/drivers/gpu/drm/nouveau/nv04_fence.c -@@ -39,7 +39,7 @@ struct nv04_fence_priv { - static int - nv04_fence_emit(struct nouveau_fence *fence) - { -- struct nvif_push *push = fence->channel->chan.push; -+ struct nvif_push *push = unrcu_pointer(fence->channel)->chan.push; - int ret = PUSH_WAIT(push, 2); - if (ret == 0) { - PUSH_NVSQ(push, NV_SW, 0x0150, fence->base.seqno); -diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c -index eaf67b9e5f12b..5b6d1668f405c 100644 ---- a/drivers/gpu/drm/omapdrm/omap_drv.c -+++ b/drivers/gpu/drm/omapdrm/omap_drv.c -@@ -68,7 +68,6 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) - { - struct drm_device *dev = old_state->dev; - struct omap_drm_private *priv = dev->dev_private; -- bool fence_cookie = dma_fence_begin_signalling(); - - dispc_runtime_get(priv->dispc); - -@@ -91,6 +90,8 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) - omap_atomic_wait_for_completion(dev, old_state); - - drm_atomic_helper_commit_planes(dev, old_state, 0); -+ -+ drm_atomic_helper_commit_hw_done(old_state); - } else { - /* - * OMAP3 DSS seems to have issues with the work-around above, -@@ -100,11 +101,9 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) - drm_atomic_helper_commit_planes(dev, old_state, 0); - - drm_atomic_helper_commit_modeset_enables(dev, old_state); -- } - -- drm_atomic_helper_commit_hw_done(old_state); -- -- dma_fence_end_signalling(fence_cookie); -+ drm_atomic_helper_commit_hw_done(old_state); -+ } - - /* - * Wait for completion of the page flips to ensure that old buffers -diff --git a/drivers/gpu/drm/panel/panel-elida-kd35t133.c b/drivers/gpu/drm/panel/panel-elida-kd35t133.c -index eee714cf3f490..3a7fc3ca6a6fe 100644 ---- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c -+++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c -@@ -112,6 +112,8 @@ static int kd35t133_unprepare(struct drm_panel *panel) - return ret; - } - -+ gpiod_set_value_cansleep(ctx->reset_gpio, 1); -+ - regulator_disable(ctx->iovcc); - regulator_disable(ctx->vdd); - -diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c -index 225b9884f61a9..54b28992db5d8 100644 ---- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c -+++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c -@@ -288,7 +288,7 @@ static void st7701_init_sequence(struct st7701 *st7701) - FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVDD_MASK, - DIV_ROUND_CLOSEST(desc->avdd_mv - 6200, 200)) | - FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVCL_MASK, -- DIV_ROUND_CLOSEST(-4400 + desc->avcl_mv, 200))); -+ DIV_ROUND_CLOSEST(-4400 - desc->avcl_mv, 200))); - - /* T2D = 0.2us * T2D[3:0] */ - ST7701_DSI(st7701, DSI_CMD2_BK1_SPD1, -diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c -index 6452e4e900dd7..55d2430485168 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_gpu.c -+++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c -@@ -71,7 +71,12 @@ int panfrost_gpu_soft_reset(struct panfrost_device *pfdev) - } - - gpu_write(pfdev, GPU_INT_CLEAR, GPU_IRQ_MASK_ALL); -- gpu_write(pfdev, GPU_INT_MASK, GPU_IRQ_MASK_ALL); -+ -+ /* Only enable the interrupts we care about */ -+ gpu_write(pfdev, GPU_INT_MASK, -+ GPU_IRQ_MASK_ERROR | -+ GPU_IRQ_PERFCNT_SAMPLE_COMPLETED | -+ GPU_IRQ_CLEAN_CACHES_COMPLETED); - - return 0; - } -@@ -313,28 +318,38 @@ static void panfrost_gpu_init_features(struct panfrost_device *pfdev) - pfdev->features.shader_present, pfdev->features.l2_present); - } - -+static u64 panfrost_get_core_mask(struct panfrost_device *pfdev) -+{ -+ u64 core_mask; -+ -+ if (pfdev->features.l2_present == 1) -+ return U64_MAX; -+ -+ /* -+ * Only support one core group now. -+ * ~(l2_present - 1) unsets all bits in l2_present except -+ * the bottom bit. (l2_present - 2) has all the bits in -+ * the first core group set. AND them together to generate -+ * a mask of cores in the first core group. -+ */ -+ core_mask = ~(pfdev->features.l2_present - 1) & -+ (pfdev->features.l2_present - 2); -+ dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n", -+ hweight64(core_mask), -+ hweight64(pfdev->features.shader_present)); -+ -+ return core_mask; -+} -+ - void panfrost_gpu_power_on(struct panfrost_device *pfdev) - { - int ret; - u32 val; -- u64 core_mask = U64_MAX; -+ u64 core_mask; - - panfrost_gpu_init_quirks(pfdev); -+ core_mask = panfrost_get_core_mask(pfdev); - -- if (pfdev->features.l2_present != 1) { -- /* -- * Only support one core group now. -- * ~(l2_present - 1) unsets all bits in l2_present except -- * the bottom bit. (l2_present - 2) has all the bits in -- * the first core group set. AND them together to generate -- * a mask of cores in the first core group. -- */ -- core_mask = ~(pfdev->features.l2_present - 1) & -- (pfdev->features.l2_present - 2); -- dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n", -- hweight64(core_mask), -- hweight64(pfdev->features.shader_present)); -- } - gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present & core_mask); - ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO, - val, val == (pfdev->features.l2_present & core_mask), -@@ -359,9 +374,26 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev) - - void panfrost_gpu_power_off(struct panfrost_device *pfdev) - { -- gpu_write(pfdev, TILER_PWROFF_LO, 0); -- gpu_write(pfdev, SHADER_PWROFF_LO, 0); -- gpu_write(pfdev, L2_PWROFF_LO, 0); -+ int ret; -+ u32 val; -+ -+ gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present); -+ ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO, -+ val, !val, 1, 1000); -+ if (ret) -+ dev_err(pfdev->dev, "shader power transition timeout"); -+ -+ gpu_write(pfdev, TILER_PWROFF_LO, pfdev->features.tiler_present); -+ ret = readl_relaxed_poll_timeout(pfdev->iomem + TILER_PWRTRANS_LO, -+ val, !val, 1, 1000); -+ if (ret) -+ dev_err(pfdev->dev, "tiler power transition timeout"); -+ -+ gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present); -+ ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO, -+ val, !val, 0, 1000); -+ if (ret) -+ dev_err(pfdev->dev, "l2 power transition timeout"); - } - - int panfrost_gpu_init(struct panfrost_device *pfdev) -diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c -index d4f09ecc3d221..f336b5b3b11f4 100644 ---- a/drivers/gpu/drm/radeon/r100.c -+++ b/drivers/gpu/drm/radeon/r100.c -@@ -2321,7 +2321,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) - switch (prim_walk) { - case 1: - for (i = 0; i < track->num_arrays; i++) { -- size = track->arrays[i].esize * track->max_indx * 4; -+ size = track->arrays[i].esize * track->max_indx * 4UL; - if (track->arrays[i].robj == NULL) { - DRM_ERROR("(PW %u) Vertex array %u no buffer " - "bound\n", prim_walk, i); -@@ -2340,7 +2340,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) - break; - case 2: - for (i = 0; i < track->num_arrays; i++) { -- size = track->arrays[i].esize * (nverts - 1) * 4; -+ size = track->arrays[i].esize * (nverts - 1) * 4UL; - if (track->arrays[i].robj == NULL) { - DRM_ERROR("(PW %u) Vertex array %u no buffer " - "bound\n", prim_walk, i); -diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c -index 638f861af80fa..6cf54a747749d 100644 ---- a/drivers/gpu/drm/radeon/r600_cs.c -+++ b/drivers/gpu/drm/radeon/r600_cs.c -@@ -1275,7 +1275,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) - return -EINVAL; - } - tmp = (reg - CB_COLOR0_BASE) / 4; -- track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8; -+ track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8; - ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); - track->cb_color_base_last[tmp] = ib[idx]; - track->cb_color_bo[tmp] = reloc->robj; -@@ -1302,7 +1302,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) - "0x%04X\n", reg); - return -EINVAL; - } -- track->htile_offset = radeon_get_ib_value(p, idx) << 8; -+ track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8; - ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); - track->htile_bo = reloc->robj; - track->db_dirty = true; -diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c -index ca5598ae8bfcf..1814bb8e14f10 100644 ---- a/drivers/gpu/drm/radeon/radeon_display.c -+++ b/drivers/gpu/drm/radeon/radeon_display.c -@@ -687,11 +687,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index) - if (radeon_crtc == NULL) - return; - -+ radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); -+ if (!radeon_crtc->flip_queue) { -+ kfree(radeon_crtc); -+ return; -+ } -+ - drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs); - - drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256); - radeon_crtc->crtc_id = index; -- radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); - rdev->mode_info.crtcs[index] = radeon_crtc; - - if (rdev->family >= CHIP_BONAIRE) { -diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c -index 987cabbf1318e..c38b4d5d6a14f 100644 ---- a/drivers/gpu/drm/radeon/radeon_vm.c -+++ b/drivers/gpu/drm/radeon/radeon_vm.c -@@ -1204,13 +1204,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm) - r = radeon_bo_create(rdev, pd_size, align, true, - RADEON_GEM_DOMAIN_VRAM, 0, NULL, - NULL, &vm->page_directory); -- if (r) -+ if (r) { -+ kfree(vm->page_tables); -+ vm->page_tables = NULL; - return r; -- -+ } - r = radeon_vm_clear_bo(rdev, vm->page_directory); - if (r) { - radeon_bo_unref(&vm->page_directory); - vm->page_directory = NULL; -+ kfree(vm->page_tables); -+ vm->page_tables = NULL; - return r; - } - -diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c -index a91012447b56e..85e9cba49cecb 100644 ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -3611,6 +3611,10 @@ static int si_cp_start(struct radeon_device *rdev) - for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) { - ring = &rdev->ring[i]; - r = radeon_ring_lock(rdev, ring, 2); -+ if (r) { -+ DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r); -+ return r; -+ } - - /* clear the compute context state */ - radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0)); -diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c -index f74f381af05fd..d49c145db4370 100644 ---- a/drivers/gpu/drm/radeon/sumo_dpm.c -+++ b/drivers/gpu/drm/radeon/sumo_dpm.c -@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev) - non_clock_array_index = power_state->v2.nonClockInfoIndex; - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; -- if (!rdev->pm.power_state[i].clock_info) -+ if (!rdev->pm.power_state[i].clock_info) { -+ kfree(rdev->pm.dpm.ps); - return -EINVAL; -+ } - ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(rdev->pm.dpm.ps); -diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c -index 08ea1c864cb23..ef1cc7bad20a7 100644 ---- a/drivers/gpu/drm/radeon/trinity_dpm.c -+++ b/drivers/gpu/drm/radeon/trinity_dpm.c -@@ -1726,8 +1726,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev) - non_clock_array_index = power_state->v2.nonClockInfoIndex; - non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) - &non_clock_info_array->nonClockInfo[non_clock_array_index]; -- if (!rdev->pm.power_state[i].clock_info) -+ if (!rdev->pm.power_state[i].clock_info) { -+ kfree(rdev->pm.dpm.ps); - return -EINVAL; -+ } - ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(rdev->pm.dpm.ps); -diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c -index 16301bdfead12..95b75236fe5e8 100644 ---- a/drivers/gpu/drm/tidss/tidss_dispc.c -+++ b/drivers/gpu/drm/tidss/tidss_dispc.c -@@ -2653,18 +2653,69 @@ static void dispc_init_errata(struct dispc_device *dispc) - } - } - --static void dispc_softreset(struct dispc_device *dispc) -+static int dispc_softreset(struct dispc_device *dispc) - { - u32 val; - int ret = 0; - -+ /* K2G display controller does not support soft reset */ -+ if (dispc->feat->subrev == DISPC_K2G) -+ return 0; -+ - /* Soft reset */ - REG_FLD_MOD(dispc, DSS_SYSCONFIG, 1, 1, 1); - /* Wait for reset to complete */ - ret = readl_poll_timeout(dispc->base_common + DSS_SYSSTATUS, - val, val & 1, 100, 5000); -+ if (ret) { -+ dev_err(dispc->dev, "failed to reset dispc\n"); -+ return ret; -+ } -+ -+ return 0; -+} -+ -+static int dispc_init_hw(struct dispc_device *dispc) -+{ -+ struct device *dev = dispc->dev; -+ int ret; -+ -+ ret = pm_runtime_set_active(dev); -+ if (ret) { -+ dev_err(dev, "Failed to set DSS PM to active\n"); -+ return ret; -+ } -+ -+ ret = clk_prepare_enable(dispc->fclk); -+ if (ret) { -+ dev_err(dev, "Failed to enable DSS fclk\n"); -+ goto err_runtime_suspend; -+ } -+ -+ ret = dispc_softreset(dispc); - if (ret) -- dev_warn(dispc->dev, "failed to reset dispc\n"); -+ goto err_clk_disable; -+ -+ clk_disable_unprepare(dispc->fclk); -+ ret = pm_runtime_set_suspended(dev); -+ if (ret) { -+ dev_err(dev, "Failed to set DSS PM to suspended\n"); -+ return ret; -+ } -+ -+ return 0; -+ -+err_clk_disable: -+ clk_disable_unprepare(dispc->fclk); -+ -+err_runtime_suspend: -+ ret = pm_runtime_set_suspended(dev); -+ if (ret) { -+ dev_err(dev, "Failed to set DSS PM to suspended\n"); -+ return ret; -+ } -+ -+ return ret; - } - - int dispc_init(struct tidss_device *tidss) -@@ -2726,10 +2777,6 @@ int dispc_init(struct tidss_device *tidss) - return r; - } - -- /* K2G display controller does not support soft reset */ -- if (feat->subrev != DISPC_K2G) -- dispc_softreset(dispc); -- - for (i = 0; i < dispc->feat->num_vps; i++) { - u32 gamma_size = dispc->feat->vp_feat.color.gamma_size; - u32 *gamma_table; -@@ -2778,6 +2825,10 @@ int dispc_init(struct tidss_device *tidss) - of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth", - &dispc->memory_bandwidth_limit); - -+ r = dispc_init_hw(dispc); -+ if (r) -+ return r; -+ - tidss->dispc = dispc; - - return 0; -diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c -index afb2879980c6c..995bac488392a 100644 ---- a/drivers/gpu/drm/tidss/tidss_kms.c -+++ b/drivers/gpu/drm/tidss/tidss_kms.c -@@ -4,8 +4,6 @@ - * Author: Tomi Valkeinen - */ - --#include -- - #include - #include - #include -@@ -27,7 +25,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state) - { - struct drm_device *ddev = old_state->dev; - struct tidss_device *tidss = to_tidss(ddev); -- bool fence_cookie = dma_fence_begin_signalling(); - - dev_dbg(ddev->dev, "%s\n", __func__); - -@@ -38,7 +35,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state) - drm_atomic_helper_commit_modeset_enables(ddev, old_state); - - drm_atomic_helper_commit_hw_done(old_state); -- dma_fence_end_signalling(fence_cookie); - drm_atomic_helper_wait_for_flip_done(ddev, old_state); - - drm_atomic_helper_cleanup_planes(ddev, old_state); -diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -index f72755b8ea14c..86d34b77b37db 100644 ---- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c -+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c -@@ -138,7 +138,7 @@ static int tilcdc_irq_install(struct drm_device *dev, unsigned int irq) - if (ret) - return ret; - -- priv->irq_enabled = false; -+ priv->irq_enabled = true; - - return 0; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c -index ae01d22b8f840..c46f380d91499 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c -@@ -595,10 +595,9 @@ static int vmw_user_bo_synccpu_release(struct drm_file *filp, - if (!(flags & drm_vmw_synccpu_allow_cs)) { - atomic_dec(&vmw_bo->cpu_writers); - } -- ttm_bo_put(&vmw_bo->base); -+ vmw_user_bo_unref(&vmw_bo); - } - -- drm_gem_object_put(&vmw_bo->base.base); - return ret; - } - -@@ -638,8 +637,7 @@ int vmw_user_bo_synccpu_ioctl(struct drm_device *dev, void *data, - return ret; - - ret = vmw_user_bo_synccpu_grab(vbo, arg->flags); -- vmw_bo_unreference(&vbo); -- drm_gem_object_put(&vbo->base.base); -+ vmw_user_bo_unref(&vbo); - if (unlikely(ret != 0)) { - if (ret == -ERESTARTSYS || ret == -EBUSY) - return -EBUSY; -@@ -713,7 +711,6 @@ int vmw_user_bo_lookup(struct drm_file *filp, - } - - *out = gem_to_vmw_bo(gobj); -- ttm_bo_get(&(*out)->base); - - return 0; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c -index 79b30dc9d8253..97e56a94eaf80 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c -@@ -407,8 +407,8 @@ static int vmw_cotable_resize(struct vmw_resource *res, size_t new_size) - * for the new COTable. Initially pin the buffer object to make sure - * we can use tryreserve without failure. - */ -- ret = vmw_bo_create(dev_priv, new_size, &vmw_mob_placement, -- true, true, vmw_bo_bo_free, &buf); -+ ret = vmw_gem_object_create(dev_priv, new_size, &vmw_mob_placement, -+ true, true, vmw_bo_bo_free, &buf); - if (ret) { - DRM_ERROR("Failed initializing new cotable MOB.\n"); - return ret; -@@ -475,7 +475,7 @@ static int vmw_cotable_resize(struct vmw_resource *res, size_t new_size) - - vmw_resource_mob_attach(res); - /* Let go of the old mob. */ -- vmw_bo_unreference(&old_buf); -+ vmw_user_bo_unref(&old_buf); - res->id = vcotbl->type; - - ret = dma_resv_reserve_fences(bo->base.resv, 1); -@@ -492,7 +492,7 @@ out_map_new: - out_wait: - ttm_bo_unpin(bo); - ttm_bo_unreserve(bo); -- vmw_bo_unreference(&buf); -+ vmw_user_bo_unref(&buf); - - return ret; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h -index 8459fab9d9797..136f1cdcf8cdf 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h -@@ -969,6 +969,11 @@ static inline void vmw_bo_prio_del(struct vmw_buffer_object *vbo, int prio) - /** - * GEM related functionality - vmwgfx_gem.c - */ -+extern int vmw_gem_object_create(struct vmw_private *dev_priv, -+ size_t size, struct ttm_placement *placement, -+ bool interruptible, bool pin, -+ void (*bo_free)(struct ttm_buffer_object *bo), -+ struct vmw_buffer_object **p_bo); - extern int vmw_gem_object_create_with_handle(struct vmw_private *dev_priv, - struct drm_file *filp, - uint32_t size, -@@ -1600,6 +1605,21 @@ vmw_bo_reference(struct vmw_buffer_object *buf) - return buf; - } - -+static inline struct vmw_buffer_object *vmw_user_bo_ref(struct vmw_buffer_object *vbo) -+{ -+ drm_gem_object_get(&vbo->base.base); -+ return vbo; -+} -+ -+static inline void vmw_user_bo_unref(struct vmw_buffer_object **buf) -+{ -+ struct vmw_buffer_object *tmp_buf = *buf; -+ -+ *buf = NULL; -+ if (tmp_buf) -+ drm_gem_object_put(&tmp_buf->base.base); -+} -+ - static inline void vmw_fifo_resource_inc(struct vmw_private *dev_priv) - { - atomic_inc(&dev_priv->num_fifo_resources); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index 7e59469e1cb9f..bc7f02e4ecebb 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -1147,7 +1147,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv, - SVGAMobId *id, - struct vmw_buffer_object **vmw_bo_p) - { -- struct vmw_buffer_object *vmw_bo; -+ struct vmw_buffer_object *vmw_bo, *tmp_bo; - uint32_t handle = *id; - struct vmw_relocation *reloc; - int ret; -@@ -1159,8 +1159,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv, - return PTR_ERR(vmw_bo); - } - ret = vmw_validation_add_bo(sw_context->ctx, vmw_bo, true, false); -- ttm_bo_put(&vmw_bo->base); -- drm_gem_object_put(&vmw_bo->base.base); -+ tmp_bo = vmw_bo; -+ vmw_user_bo_unref(&tmp_bo); - if (unlikely(ret != 0)) - return ret; - -@@ -1202,7 +1202,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv, - SVGAGuestPtr *ptr, - struct vmw_buffer_object **vmw_bo_p) - { -- struct vmw_buffer_object *vmw_bo; -+ struct vmw_buffer_object *vmw_bo, *tmp_bo; - uint32_t handle = ptr->gmrId; - struct vmw_relocation *reloc; - int ret; -@@ -1214,8 +1214,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv, - return PTR_ERR(vmw_bo); - } - ret = vmw_validation_add_bo(sw_context->ctx, vmw_bo, false, false); -- ttm_bo_put(&vmw_bo->base); -- drm_gem_object_put(&vmw_bo->base.base); -+ tmp_bo = vmw_bo; -+ vmw_user_bo_unref(&tmp_bo); - if (unlikely(ret != 0)) - return ret; - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c -index 4d2c28e39f4e0..e7a533e39155c 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c -@@ -133,6 +133,22 @@ void vmw_gem_destroy(struct ttm_buffer_object *bo) - kfree(vbo); - } - -+int vmw_gem_object_create(struct vmw_private *vmw, -+ size_t size, struct ttm_placement *placement, -+ bool interruptible, bool pin, -+ void (*bo_free)(struct ttm_buffer_object *bo), -+ struct vmw_buffer_object **p_bo) -+{ -+ int ret = vmw_bo_create(vmw, size, placement, interruptible, pin, bo_free, p_bo); -+ -+ if (ret != 0) -+ goto out_no_bo; -+ -+ (*p_bo)->base.base.funcs = &vmw_gem_object_funcs; -+out_no_bo: -+ return ret; -+} -+ - int vmw_gem_object_create_with_handle(struct vmw_private *dev_priv, - struct drm_file *filp, - uint32_t size, -@@ -141,16 +157,14 @@ int vmw_gem_object_create_with_handle(struct vmw_private *dev_priv, - { - int ret; - -- ret = vmw_bo_create(dev_priv, size, -- (dev_priv->has_mob) ? -+ ret = vmw_gem_object_create(dev_priv, size, -+ (dev_priv->has_mob) ? - &vmw_sys_placement : - &vmw_vram_sys_placement, -- true, false, &vmw_gem_destroy, p_vbo); -+ true, false, &vmw_gem_destroy, p_vbo); - if (ret != 0) - goto out_no_bo; - -- (*p_vbo)->base.base.funcs = &vmw_gem_object_funcs; -- - ret = drm_gem_handle_create(filp, &(*p_vbo)->base.base, handle); - out_no_bo: - return ret; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index aab6389cb4aab..aa571b75cd07f 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -1402,8 +1402,8 @@ static int vmw_create_bo_proxy(struct drm_device *dev, - /* Reserve and switch the backing mob. */ - mutex_lock(&res->dev_priv->cmdbuf_mutex); - (void) vmw_resource_reserve(res, false, true); -- vmw_bo_unreference(&res->backup); -- res->backup = vmw_bo_reference(bo_mob); -+ vmw_user_bo_unref(&res->backup); -+ res->backup = vmw_user_bo_ref(bo_mob); - res->backup_offset = 0; - vmw_resource_unreserve(res, false, false, false, NULL, 0); - mutex_unlock(&res->dev_priv->cmdbuf_mutex); -@@ -1599,10 +1599,8 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev, - - err_out: - /* vmw_user_lookup_handle takes one ref so does new_fb */ -- if (bo) { -- vmw_bo_unreference(&bo); -- drm_gem_object_put(&bo->base.base); -- } -+ if (bo) -+ vmw_user_bo_unref(&bo); - if (surface) - vmw_surface_unreference(&surface); - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c -index b5b311f2a91a4..abc354ead4e8b 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c -@@ -457,8 +457,7 @@ int vmw_overlay_ioctl(struct drm_device *dev, void *data, - - ret = vmw_overlay_update_stream(dev_priv, buf, arg, true); - -- vmw_bo_unreference(&buf); -- drm_gem_object_put(&buf->base.base); -+ vmw_user_bo_unref(&buf); - - out_unlock: - mutex_unlock(&overlay->mutex); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c -index c7d645e5ec7bf..30d1c1918bb48 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c -@@ -140,7 +140,7 @@ static void vmw_resource_release(struct kref *kref) - if (res->coherent) - vmw_bo_dirty_release(res->backup); - ttm_bo_unreserve(bo); -- vmw_bo_unreference(&res->backup); -+ vmw_user_bo_unref(&res->backup); - } - - if (likely(res->hw_destroy != NULL)) { -@@ -330,10 +330,10 @@ static int vmw_resource_buf_alloc(struct vmw_resource *res, - return 0; - } - -- ret = vmw_bo_create(res->dev_priv, res->backup_size, -- res->func->backup_placement, -- interruptible, false, -- &vmw_bo_bo_free, &backup); -+ ret = vmw_gem_object_create(res->dev_priv, res->backup_size, -+ res->func->backup_placement, -+ interruptible, false, -+ &vmw_bo_bo_free, &backup); - if (unlikely(ret != 0)) - goto out_no_bo; - -@@ -452,11 +452,11 @@ void vmw_resource_unreserve(struct vmw_resource *res, - vmw_resource_mob_detach(res); - if (res->coherent) - vmw_bo_dirty_release(res->backup); -- vmw_bo_unreference(&res->backup); -+ vmw_user_bo_unref(&res->backup); - } - - if (new_backup) { -- res->backup = vmw_bo_reference(new_backup); -+ res->backup = vmw_user_bo_ref(new_backup); - - /* - * The validation code should already have added a -@@ -544,7 +544,7 @@ out_no_reserve: - ttm_bo_put(val_buf->bo); - val_buf->bo = NULL; - if (backup_dirty) -- vmw_bo_unreference(&res->backup); -+ vmw_user_bo_unref(&res->backup); - - return ret; - } -@@ -719,7 +719,7 @@ int vmw_resource_validate(struct vmw_resource *res, bool intr, - goto out_no_validate; - else if (!res->func->needs_backup && res->backup) { - WARN_ON_ONCE(vmw_resource_mob_attached(res)); -- vmw_bo_unreference(&res->backup); -+ vmw_user_bo_unref(&res->backup); - } - - return 0; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -index 51e83dfa1cace..303f7a82f3509 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c -@@ -177,7 +177,7 @@ static int vmw_gb_shader_init(struct vmw_private *dev_priv, - - res->backup_size = size; - if (byte_code) { -- res->backup = vmw_bo_reference(byte_code); -+ res->backup = vmw_user_bo_ref(byte_code); - res->backup_offset = offset; - } - shader->size = size; -@@ -806,8 +806,7 @@ static int vmw_shader_define(struct drm_device *dev, struct drm_file *file_priv, - shader_type, num_input_sig, - num_output_sig, tfile, shader_handle); - out_bad_arg: -- vmw_bo_unreference(&buffer); -- drm_gem_object_put(&buffer->base.base); -+ vmw_user_bo_unref(&buffer); - return ret; - } - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -index 1a1a286bc749f..50769528c3f3c 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -@@ -683,9 +683,6 @@ static void vmw_user_surface_base_release(struct ttm_base_object **p_base) - container_of(base, struct vmw_user_surface, prime.base); - struct vmw_resource *res = &user_srf->srf.res; - -- if (res && res->backup) -- drm_gem_object_put(&res->backup->base.base); -- - *p_base = NULL; - vmw_resource_unreference(&res); - } -@@ -848,23 +845,17 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, - * expect a backup buffer to be present. - */ - if (dev_priv->has_mob && req->shareable) { -- uint32_t backup_handle; -- -- ret = vmw_gem_object_create_with_handle(dev_priv, -- file_priv, -- res->backup_size, -- &backup_handle, -- &res->backup); -+ ret = vmw_gem_object_create(dev_priv, -+ res->backup_size, -+ &vmw_sys_placement, -+ true, -+ false, -+ &vmw_gem_destroy, -+ &res->backup); - if (unlikely(ret != 0)) { - vmw_resource_unreference(&res); - goto out_unlock; - } -- vmw_bo_reference(res->backup); -- /* -- * We don't expose the handle to the userspace and surface -- * already holds a gem reference -- */ -- drm_gem_handle_delete(file_priv, backup_handle); - } - - tmp = vmw_resource_reference(&srf->res); -@@ -1505,7 +1496,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev, - if (ret == 0) { - if (res->backup->base.base.size < res->backup_size) { - VMW_DEBUG_USER("Surface backup buffer too small.\n"); -- vmw_bo_unreference(&res->backup); -+ vmw_user_bo_unref(&res->backup); - ret = -EINVAL; - goto out_unlock; - } else { -@@ -1519,8 +1510,6 @@ vmw_gb_surface_define_internal(struct drm_device *dev, - res->backup_size, - &backup_handle, - &res->backup); -- if (ret == 0) -- vmw_bo_reference(res->backup); - } - - if (unlikely(ret != 0)) { -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index c1270db121784..165ed872fa4e7 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -2646,8 +2646,8 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac, - { - struct hid_data *hid_data = &wacom_wac->hid_data; - bool mt = wacom_wac->features.touch_max > 1; -- bool prox = hid_data->tipswitch && -- report_touch_events(wacom_wac); -+ bool touch_down = hid_data->tipswitch && hid_data->confidence; -+ bool prox = touch_down && report_touch_events(wacom_wac); - - if (touch_is_muted(wacom_wac)) { - if (!wacom_wac->shared->touch_down) -@@ -2697,24 +2697,6 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac, - } - } - --static bool wacom_wac_slot_is_active(struct input_dev *dev, int key) --{ -- struct input_mt *mt = dev->mt; -- struct input_mt_slot *s; -- -- if (!mt) -- return false; -- -- for (s = mt->slots; s != mt->slots + mt->num_slots; s++) { -- if (s->key == key && -- input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) { -- return true; -- } -- } -- -- return false; --} -- - static void wacom_wac_finger_event(struct hid_device *hdev, - struct hid_field *field, struct hid_usage *usage, __s32 value) - { -@@ -2765,14 +2747,8 @@ static void wacom_wac_finger_event(struct hid_device *hdev, - } - - if (usage->usage_index + 1 == field->report_count) { -- if (equivalent_usage == wacom_wac->hid_data.last_slot_field) { -- bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input, -- wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch; -- -- if (wacom_wac->hid_data.confidence || touch_removed) { -- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); -- } -- } -+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field) -+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); - } - } - -diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index 36dab9cd208cf..8e3838c42a8c2 100644 ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -220,8 +220,17 @@ static bool is_ack(struct s3c24xx_i2c *i2c) - int tries; - - for (tries = 50; tries; --tries) { -- if (readl(i2c->regs + S3C2410_IICCON) -- & S3C2410_IICCON_IRQPEND) { -+ unsigned long tmp = readl(i2c->regs + S3C2410_IICCON); -+ -+ if (!(tmp & S3C2410_IICCON_ACKEN)) { -+ /* -+ * Wait a bit for the bus to stabilize, -+ * delay estimated experimentally. -+ */ -+ usleep_range(100, 200); -+ return true; -+ } -+ if (tmp & S3C2410_IICCON_IRQPEND) { - if (!(readl(i2c->regs + S3C2410_IICSTAT) - & S3C2410_IICSTAT_LASTBIT)) - return true; -@@ -274,16 +283,6 @@ static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c, - - stat |= S3C2410_IICSTAT_START; - writel(stat, i2c->regs + S3C2410_IICSTAT); -- -- if (i2c->quirks & QUIRK_POLL) { -- while ((i2c->msg_num != 0) && is_ack(i2c)) { -- i2c_s3c_irq_nextbyte(i2c, stat); -- stat = readl(i2c->regs + S3C2410_IICSTAT); -- -- if (stat & S3C2410_IICSTAT_ARBITR) -- dev_err(i2c->dev, "deal with arbitration loss\n"); -- } -- } - } - - static inline void s3c24xx_i2c_stop(struct s3c24xx_i2c *i2c, int ret) -@@ -690,7 +689,7 @@ static void s3c24xx_i2c_wait_idle(struct s3c24xx_i2c *i2c) - static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c, - struct i2c_msg *msgs, int num) - { -- unsigned long timeout; -+ unsigned long timeout = 0; - int ret; - - ret = s3c24xx_i2c_set_master(i2c); -@@ -710,16 +709,19 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c, - s3c24xx_i2c_message_start(i2c, msgs); - - if (i2c->quirks & QUIRK_POLL) { -- ret = i2c->msg_idx; -+ while ((i2c->msg_num != 0) && is_ack(i2c)) { -+ unsigned long stat = readl(i2c->regs + S3C2410_IICSTAT); - -- if (ret != num) -- dev_dbg(i2c->dev, "incomplete xfer (%d)\n", ret); -+ i2c_s3c_irq_nextbyte(i2c, stat); - -- goto out; -+ stat = readl(i2c->regs + S3C2410_IICSTAT); -+ if (stat & S3C2410_IICSTAT_ARBITR) -+ dev_err(i2c->dev, "deal with arbitration loss\n"); -+ } -+ } else { -+ timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5); - } - -- timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5); -- - ret = i2c->msg_idx; - - /* -diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c -index 8e252cde735b9..0e5d3d2e9c985 100644 ---- a/drivers/iio/adc/ad7091r-base.c -+++ b/drivers/iio/adc/ad7091r-base.c -@@ -174,8 +174,8 @@ static const struct iio_info ad7091r_info = { - - static irqreturn_t ad7091r_event_handler(int irq, void *private) - { -- struct ad7091r_state *st = (struct ad7091r_state *) private; -- struct iio_dev *iio_dev = dev_get_drvdata(st->dev); -+ struct iio_dev *iio_dev = private; -+ struct ad7091r_state *st = iio_priv(iio_dev); - unsigned int i, read_val; - int ret; - s64 timestamp = iio_get_time_ns(iio_dev); -@@ -234,7 +234,7 @@ int ad7091r_probe(struct device *dev, const char *name, - if (irq) { - ret = devm_request_threaded_irq(dev, irq, NULL, - ad7091r_event_handler, -- IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, st); -+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT, name, iio_dev); - if (ret) - return ret; - } -diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c -index 7534572f74757..811525857d29f 100644 ---- a/drivers/iio/adc/ad9467.c -+++ b/drivers/iio/adc/ad9467.c -@@ -119,9 +119,9 @@ struct ad9467_state { - struct spi_device *spi; - struct clk *clk; - unsigned int output_mode; -+ unsigned int (*scales)[2]; - - struct gpio_desc *pwrdown_gpio; -- struct gpio_desc *reset_gpio; - }; - - static int ad9467_spi_read(struct spi_device *spi, unsigned int reg) -@@ -163,9 +163,10 @@ static int ad9467_reg_access(struct adi_axi_adc_conv *conv, unsigned int reg, - - if (readval == NULL) { - ret = ad9467_spi_write(spi, reg, writeval); -- ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER, -- AN877_ADC_TRANSFER_SYNC); -- return ret; -+ if (ret) -+ return ret; -+ return ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER, -+ AN877_ADC_TRANSFER_SYNC); - } - - ret = ad9467_spi_read(spi, reg); -@@ -212,6 +213,7 @@ static void __ad9467_get_scale(struct adi_axi_adc_conv *conv, int index, - .channel = _chan, \ - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) | \ - BIT(IIO_CHAN_INFO_SAMP_FREQ), \ -+ .info_mask_shared_by_type_available = BIT(IIO_CHAN_INFO_SCALE), \ - .scan_index = _si, \ - .scan_type = { \ - .sign = _sign, \ -@@ -273,10 +275,13 @@ static int ad9467_get_scale(struct adi_axi_adc_conv *conv, int *val, int *val2) - const struct ad9467_chip_info *info1 = to_ad9467_chip_info(info); - struct ad9467_state *st = adi_axi_adc_conv_priv(conv); - unsigned int i, vref_val; -+ int ret; - -- vref_val = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF); -+ ret = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF); -+ if (ret < 0) -+ return ret; - -- vref_val &= info1->vref_mask; -+ vref_val = ret & info1->vref_mask; - - for (i = 0; i < info->num_scales; i++) { - if (vref_val == info->scale_table[i][1]) -@@ -297,6 +302,7 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2) - struct ad9467_state *st = adi_axi_adc_conv_priv(conv); - unsigned int scale_val[2]; - unsigned int i; -+ int ret; - - if (val != 0) - return -EINVAL; -@@ -306,11 +312,13 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2) - if (scale_val[0] != val || scale_val[1] != val2) - continue; - -- ad9467_spi_write(st->spi, AN877_ADC_REG_VREF, -- info->scale_table[i][1]); -- ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, -- AN877_ADC_TRANSFER_SYNC); -- return 0; -+ ret = ad9467_spi_write(st->spi, AN877_ADC_REG_VREF, -+ info->scale_table[i][1]); -+ if (ret < 0) -+ return ret; -+ -+ return ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, -+ AN877_ADC_TRANSFER_SYNC); - } - - return -EINVAL; -@@ -359,6 +367,26 @@ static int ad9467_write_raw(struct adi_axi_adc_conv *conv, - } - } - -+static int ad9467_read_avail(struct adi_axi_adc_conv *conv, -+ struct iio_chan_spec const *chan, -+ const int **vals, int *type, int *length, -+ long mask) -+{ -+ const struct adi_axi_adc_chip_info *info = conv->chip_info; -+ struct ad9467_state *st = adi_axi_adc_conv_priv(conv); -+ -+ switch (mask) { -+ case IIO_CHAN_INFO_SCALE: -+ *vals = (const int *)st->scales; -+ *type = IIO_VAL_INT_PLUS_MICRO; -+ /* Values are stored in a 2D matrix */ -+ *length = info->num_scales * 2; -+ return IIO_AVAIL_LIST; -+ default: -+ return -EINVAL; -+ } -+} -+ - static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode) - { - int ret; -@@ -371,6 +399,26 @@ static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode) - AN877_ADC_TRANSFER_SYNC); - } - -+static int ad9467_scale_fill(struct adi_axi_adc_conv *conv) -+{ -+ const struct adi_axi_adc_chip_info *info = conv->chip_info; -+ struct ad9467_state *st = adi_axi_adc_conv_priv(conv); -+ unsigned int i, val1, val2; -+ -+ st->scales = devm_kmalloc_array(&st->spi->dev, info->num_scales, -+ sizeof(*st->scales), GFP_KERNEL); -+ if (!st->scales) -+ return -ENOMEM; -+ -+ for (i = 0; i < info->num_scales; i++) { -+ __ad9467_get_scale(conv, i, &val1, &val2); -+ st->scales[i][0] = val1; -+ st->scales[i][1] = val2; -+ } -+ -+ return 0; -+} -+ - static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv) - { - struct ad9467_state *st = adi_axi_adc_conv_priv(conv); -@@ -378,6 +426,21 @@ static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv) - return ad9467_outputmode_set(st->spi, st->output_mode); - } - -+static int ad9467_reset(struct device *dev) -+{ -+ struct gpio_desc *gpio; -+ -+ gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); -+ if (IS_ERR_OR_NULL(gpio)) -+ return PTR_ERR_OR_ZERO(gpio); -+ -+ fsleep(1); -+ gpiod_set_value_cansleep(gpio, 0); -+ fsleep(10 * USEC_PER_MSEC); -+ -+ return 0; -+} -+ - static int ad9467_probe(struct spi_device *spi) - { - const struct ad9467_chip_info *info; -@@ -406,21 +469,16 @@ static int ad9467_probe(struct spi_device *spi) - if (IS_ERR(st->pwrdown_gpio)) - return PTR_ERR(st->pwrdown_gpio); - -- st->reset_gpio = devm_gpiod_get_optional(&spi->dev, "reset", -- GPIOD_OUT_LOW); -- if (IS_ERR(st->reset_gpio)) -- return PTR_ERR(st->reset_gpio); -- -- if (st->reset_gpio) { -- udelay(1); -- ret = gpiod_direction_output(st->reset_gpio, 1); -- if (ret) -- return ret; -- mdelay(10); -- } -+ ret = ad9467_reset(&spi->dev); -+ if (ret) -+ return ret; - - conv->chip_info = &info->axi_adc_info; - -+ ret = ad9467_scale_fill(conv); -+ if (ret) -+ return ret; -+ - id = ad9467_spi_read(spi, AN877_ADC_REG_CHIP_ID); - if (id != conv->chip_info->id) { - dev_err(&spi->dev, "Mismatch CHIP_ID, got 0x%X, expected 0x%X\n", -@@ -431,6 +489,7 @@ static int ad9467_probe(struct spi_device *spi) - conv->reg_access = ad9467_reg_access; - conv->write_raw = ad9467_write_raw; - conv->read_raw = ad9467_read_raw; -+ conv->read_avail = ad9467_read_avail; - conv->preenable_setup = ad9467_preenable_setup; - - st->output_mode = info->default_output_mode | -diff --git a/drivers/iio/adc/adi-axi-adc.c b/drivers/iio/adc/adi-axi-adc.c -index e8a8ea4140f16..ad386ac7f03cb 100644 ---- a/drivers/iio/adc/adi-axi-adc.c -+++ b/drivers/iio/adc/adi-axi-adc.c -@@ -143,6 +143,20 @@ static int adi_axi_adc_write_raw(struct iio_dev *indio_dev, - return conv->write_raw(conv, chan, val, val2, mask); - } - -+static int adi_axi_adc_read_avail(struct iio_dev *indio_dev, -+ struct iio_chan_spec const *chan, -+ const int **vals, int *type, int *length, -+ long mask) -+{ -+ struct adi_axi_adc_state *st = iio_priv(indio_dev); -+ struct adi_axi_adc_conv *conv = &st->client->conv; -+ -+ if (!conv->read_avail) -+ return -EOPNOTSUPP; -+ -+ return conv->read_avail(conv, chan, vals, type, length, mask); -+} -+ - static int adi_axi_adc_update_scan_mode(struct iio_dev *indio_dev, - const unsigned long *scan_mask) - { -@@ -227,69 +241,11 @@ struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev, - } - EXPORT_SYMBOL_NS_GPL(devm_adi_axi_adc_conv_register, IIO_ADI_AXI); - --static ssize_t in_voltage_scale_available_show(struct device *dev, -- struct device_attribute *attr, -- char *buf) --{ -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -- struct adi_axi_adc_state *st = iio_priv(indio_dev); -- struct adi_axi_adc_conv *conv = &st->client->conv; -- size_t len = 0; -- int i; -- -- for (i = 0; i < conv->chip_info->num_scales; i++) { -- const unsigned int *s = conv->chip_info->scale_table[i]; -- -- len += scnprintf(buf + len, PAGE_SIZE - len, -- "%u.%06u ", s[0], s[1]); -- } -- buf[len - 1] = '\n'; -- -- return len; --} -- --static IIO_DEVICE_ATTR_RO(in_voltage_scale_available, 0); -- --enum { -- ADI_AXI_ATTR_SCALE_AVAIL, --}; -- --#define ADI_AXI_ATTR(_en_, _file_) \ -- [ADI_AXI_ATTR_##_en_] = &iio_dev_attr_##_file_.dev_attr.attr -- --static struct attribute *adi_axi_adc_attributes[] = { -- ADI_AXI_ATTR(SCALE_AVAIL, in_voltage_scale_available), -- NULL --}; -- --static umode_t axi_adc_attr_is_visible(struct kobject *kobj, -- struct attribute *attr, int n) --{ -- struct device *dev = kobj_to_dev(kobj); -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -- struct adi_axi_adc_state *st = iio_priv(indio_dev); -- struct adi_axi_adc_conv *conv = &st->client->conv; -- -- switch (n) { -- case ADI_AXI_ATTR_SCALE_AVAIL: -- if (!conv->chip_info->num_scales) -- return 0; -- return attr->mode; -- default: -- return attr->mode; -- } --} -- --static const struct attribute_group adi_axi_adc_attribute_group = { -- .attrs = adi_axi_adc_attributes, -- .is_visible = axi_adc_attr_is_visible, --}; -- - static const struct iio_info adi_axi_adc_info = { - .read_raw = &adi_axi_adc_read_raw, - .write_raw = &adi_axi_adc_write_raw, -- .attrs = &adi_axi_adc_attribute_group, - .update_scan_mode = &adi_axi_adc_update_scan_mode, -+ .read_avail = &adi_axi_adc_read_avail, - }; - - static const struct adi_axi_adc_core_info adi_axi_adc_10_0_a_info = { -diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -index c2ee80546d120..58fbb1d3b7f41 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c -@@ -2819,6 +2819,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) - return 0; - - create_failed_qp: -+ for (i--; i >= 0; i--) { -+ hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL); -+ kfree(free_mr->rsv_qp[i]); -+ } - hns_roce_destroy_cq(cq, NULL); - kfree(cq); - -@@ -5791,7 +5795,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq, - - /* Resizing SRQs is not supported yet */ - if (srq_attr_mask & IB_SRQ_MAX_WR) -- return -EINVAL; -+ return -EOPNOTSUPP; - - if (srq_attr_mask & IB_SRQ_LIMIT) { - if (srq_attr->srq_limit > srq->wqe_cnt) -diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c -index 783e71852c503..bd1fe89ca205e 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_pd.c -+++ b/drivers/infiniband/hw/hns/hns_roce_pd.c -@@ -150,7 +150,7 @@ int hns_roce_alloc_xrcd(struct ib_xrcd *ib_xrcd, struct ib_udata *udata) - int ret; - - if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC)) -- return -EINVAL; -+ return -EOPNOTSUPP; - - ret = hns_roce_xrcd_alloc(hr_dev, &xrcd->xrcdn); - if (ret) -diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c -index f330ce895d884..8fe0cef7e2be6 100644 ---- a/drivers/infiniband/hw/mthca/mthca_cmd.c -+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c -@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox) - - int mthca_SYS_EN(struct mthca_dev *dev) - { -- u64 out; -+ u64 out = 0; - int ret; - - ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D); -@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index, - int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox, - u16 *hash) - { -- u64 imm; -+ u64 imm = 0; - int err; - - err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH, -diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c -index b54bc8865daec..1ab268b770968 100644 ---- a/drivers/infiniband/hw/mthca/mthca_main.c -+++ b/drivers/infiniband/hw/mthca/mthca_main.c -@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev, - struct mthca_init_hca_param *init_hca, - u64 icm_size) - { -- u64 aux_pages; -+ u64 aux_pages = 0; - int err; - - err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages); -diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h -index dee8c97ff0568..d967d55324596 100644 ---- a/drivers/infiniband/ulp/iser/iscsi_iser.h -+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h -@@ -317,12 +317,10 @@ struct iser_device { - * - * @mr: memory region - * @sig_mr: signature memory region -- * @mr_valid: is mr valid indicator - */ - struct iser_reg_resources { - struct ib_mr *mr; - struct ib_mr *sig_mr; -- u8 mr_valid:1; - }; - - /** -diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c -index 7b83f48f60c5e..8ec470c519e82 100644 ---- a/drivers/infiniband/ulp/iser/iser_initiator.c -+++ b/drivers/infiniband/ulp/iser/iser_initiator.c -@@ -580,7 +580,10 @@ static inline int iser_inv_desc(struct iser_fr_desc *desc, u32 rkey) - return -EINVAL; - } - -- desc->rsc.mr_valid = 0; -+ if (desc->sig_protected) -+ desc->rsc.sig_mr->need_inval = false; -+ else -+ desc->rsc.mr->need_inval = false; - - return 0; - } -diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c -index 29ae2c6a250a3..6efcb79c8efe3 100644 ---- a/drivers/infiniband/ulp/iser/iser_memory.c -+++ b/drivers/infiniband/ulp/iser/iser_memory.c -@@ -264,7 +264,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task, - - iser_set_prot_checks(iser_task->sc, &sig_attrs->check_mask); - -- if (rsc->mr_valid) -+ if (rsc->sig_mr->need_inval) - iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr); - - ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); -@@ -288,7 +288,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task, - wr->access = IB_ACCESS_LOCAL_WRITE | - IB_ACCESS_REMOTE_READ | - IB_ACCESS_REMOTE_WRITE; -- rsc->mr_valid = 1; -+ rsc->sig_mr->need_inval = true; - - sig_reg->sge.lkey = mr->lkey; - sig_reg->rkey = mr->rkey; -@@ -313,7 +313,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, - struct ib_reg_wr *wr = &tx_desc->reg_wr; - int n; - -- if (rsc->mr_valid) -+ if (rsc->mr->need_inval) - iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr); - - ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); -@@ -336,7 +336,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, - IB_ACCESS_REMOTE_WRITE | - IB_ACCESS_REMOTE_READ; - -- rsc->mr_valid = 1; -+ rsc->mr->need_inval = true; - - reg->sge.lkey = mr->lkey; - reg->rkey = mr->rkey; -diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c -index a00ca117303a9..057e69164e6d7 100644 ---- a/drivers/infiniband/ulp/iser/iser_verbs.c -+++ b/drivers/infiniband/ulp/iser/iser_verbs.c -@@ -135,7 +135,6 @@ iser_create_fastreg_desc(struct iser_device *device, - goto err_alloc_mr_integrity; - } - } -- desc->rsc.mr_valid = 0; - - return desc; - -diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c -index e1e4f1133296a..c4d8caadec59e 100644 ---- a/drivers/input/keyboard/atkbd.c -+++ b/drivers/input/keyboard/atkbd.c -@@ -772,9 +772,9 @@ static bool atkbd_is_portable_device(void) - * not work. So in this case simply assume a keyboard is connected to avoid - * confusing some laptop keyboards. - * -- * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is -- * ok in translated mode, only atkbd_select_set() checks atkbd->id and in -- * translated mode that is a no-op. -+ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using the standard -+ * 0xab83 id is ok in translated mode, only atkbd_select_set() checks atkbd->id -+ * and in translated mode that is a no-op. - */ - static bool atkbd_skip_getid(struct atkbd *atkbd) - { -@@ -792,6 +792,7 @@ static int atkbd_probe(struct atkbd *atkbd) - { - struct ps2dev *ps2dev = &atkbd->ps2dev; - unsigned char param[2]; -+ bool skip_getid; - - /* - * Some systems, where the bit-twiddling when testing the io-lines of the -@@ -813,7 +814,8 @@ static int atkbd_probe(struct atkbd *atkbd) - */ - - param[0] = param[1] = 0xa5; /* initialize with invalid values */ -- if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { -+ skip_getid = atkbd_skip_getid(atkbd); -+ if (skip_getid || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { - - /* - * If the get ID command was skipped or failed, we check if we can at least set -@@ -823,7 +825,7 @@ static int atkbd_probe(struct atkbd *atkbd) - param[0] = 0; - if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) - return -1; -- atkbd->id = 0xabba; -+ atkbd->id = skip_getid ? 0xab83 : 0xabba; - return 0; - } - -diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -index b2708de25ea34..d80065c8105af 100644 ---- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c -@@ -243,6 +243,7 @@ static int qcom_adreno_smmu_init_context(struct arm_smmu_domain *smmu_domain, - - static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = { - { .compatible = "qcom,adreno" }, -+ { .compatible = "qcom,adreno-gmu" }, - { .compatible = "qcom,mdp4" }, - { .compatible = "qcom,mdss" }, - { .compatible = "qcom,sc7180-mdss" }, -diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c -index 9297b741f5e80..aa6d62cc567ae 100644 ---- a/drivers/iommu/dma-iommu.c -+++ b/drivers/iommu/dma-iommu.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - #include "dma-iommu.h" - -@@ -999,6 +1000,8 @@ static dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page, - return DMA_MAPPING_ERROR; - } - -+ trace_swiotlb_bounced(dev, phys, size); -+ - aligned_size = iova_align(iovad, size); - phys = swiotlb_tbl_map_single(dev, phys, size, aligned_size, - iova_mask(iovad), dir, attrs); -diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig -index 2378cfb7443e4..509d03eb3e8d6 100644 ---- a/drivers/leds/Kconfig -+++ b/drivers/leds/Kconfig -@@ -97,6 +97,7 @@ config LEDS_ARIEL - config LEDS_AW2013 - tristate "LED support for Awinic AW2013" - depends on LEDS_CLASS && I2C && OF -+ select REGMAP_I2C - help - This option enables support for the AW2013 3-channel - LED driver. -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 0c2801d770901..6120f26a79696 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -528,6 +528,9 @@ static void md_end_flush(struct bio *bio) - rdev_dec_pending(rdev, mddev); - - if (atomic_dec_and_test(&mddev->flush_pending)) { -+ /* The pair is percpu_ref_get() from md_flush_request() */ -+ percpu_ref_put(&mddev->active_io); -+ - /* The pre-request flush has finished */ - queue_work(md_wq, &mddev->flush_work); - } -@@ -547,12 +550,8 @@ static void submit_flushes(struct work_struct *ws) - rdev_for_each_rcu(rdev, mddev) - if (rdev->raid_disk >= 0 && - !test_bit(Faulty, &rdev->flags)) { -- /* Take two references, one is dropped -- * when request finishes, one after -- * we reclaim rcu_read_lock -- */ - struct bio *bi; -- atomic_inc(&rdev->nr_pending); -+ - atomic_inc(&rdev->nr_pending); - rcu_read_unlock(); - bi = bio_alloc_bioset(rdev->bdev, 0, -@@ -563,7 +562,6 @@ static void submit_flushes(struct work_struct *ws) - atomic_inc(&mddev->flush_pending); - submit_bio(bi); - rcu_read_lock(); -- rdev_dec_pending(rdev, mddev); - } - rcu_read_unlock(); - if (atomic_dec_and_test(&mddev->flush_pending)) -@@ -616,6 +614,18 @@ bool md_flush_request(struct mddev *mddev, struct bio *bio) - /* new request after previous flush is completed */ - if (ktime_after(req_start, mddev->prev_flush_start)) { - WARN_ON(mddev->flush_bio); -+ /* -+ * Grab a reference to make sure mddev_suspend() will wait for -+ * this flush to be done. -+ * -+ * md_flush_reqeust() is called under md_handle_request() and -+ * 'active_io' is already grabbed, hence percpu_ref_is_zero() -+ * won't pass, percpu_ref_tryget_live() can't be used because -+ * percpu_ref_kill() can be called by mddev_suspend() -+ * concurrently. -+ */ -+ WARN_ON(percpu_ref_is_zero(&mddev->active_io)); -+ percpu_ref_get(&mddev->active_io); - mddev->flush_bio = bio; - bio = NULL; - } -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 30f906a67def4..76f7ca53d8123 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1972,12 +1972,12 @@ static void end_sync_write(struct bio *bio) - } - - static int r1_sync_page_io(struct md_rdev *rdev, sector_t sector, -- int sectors, struct page *page, int rw) -+ int sectors, struct page *page, blk_opf_t rw) - { - if (sync_page_io(rdev, sector, sectors << 9, page, rw, false)) - /* success */ - return 1; -- if (rw == WRITE) { -+ if (rw == REQ_OP_WRITE) { - set_bit(WriteErrorSeen, &rdev->flags); - if (!test_and_set_bit(WantReplacement, - &rdev->flags)) -@@ -2094,7 +2094,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) - rdev = conf->mirrors[d].rdev; - if (r1_sync_page_io(rdev, sect, s, - pages[idx], -- WRITE) == 0) { -+ REQ_OP_WRITE) == 0) { - r1_bio->bios[d]->bi_end_io = NULL; - rdev_dec_pending(rdev, mddev); - } -@@ -2109,7 +2109,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) - rdev = conf->mirrors[d].rdev; - if (r1_sync_page_io(rdev, sect, s, - pages[idx], -- READ) != 0) -+ REQ_OP_READ) != 0) - atomic_add(s, &rdev->corrected_errors); - } - sectors -= s; -@@ -2321,7 +2321,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, - atomic_inc(&rdev->nr_pending); - rcu_read_unlock(); - r1_sync_page_io(rdev, sect, s, -- conf->tmppage, WRITE); -+ conf->tmppage, REQ_OP_WRITE); - rdev_dec_pending(rdev, mddev); - } else - rcu_read_unlock(); -@@ -2338,7 +2338,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, - atomic_inc(&rdev->nr_pending); - rcu_read_unlock(); - if (r1_sync_page_io(rdev, sect, s, -- conf->tmppage, READ)) { -+ conf->tmppage, REQ_OP_READ)) { - atomic_add(s, &rdev->corrected_errors); - pr_info("md/raid1:%s: read error corrected (%d sectors at %llu on %pg)\n", - mdname(mddev), s, -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index f7783199f81d4..e4564ca1f2434 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -36,6 +36,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -6832,7 +6833,18 @@ static void raid5d(struct md_thread *thread) - spin_unlock_irq(&conf->device_lock); - md_check_recovery(mddev); - spin_lock_irq(&conf->device_lock); -+ -+ /* -+ * Waiting on MD_SB_CHANGE_PENDING below may deadlock -+ * seeing md_check_recovery() is needed to clear -+ * the flag when using mdmon. -+ */ -+ continue; - } -+ -+ wait_event_lock_irq(mddev->sb_wait, -+ !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags), -+ conf->device_lock); - } - pr_debug("%d stripes handled\n", handled); - -diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c -index 9f9a976527080..d352e028491aa 100644 ---- a/drivers/media/dvb-core/dvbdev.c -+++ b/drivers/media/dvb-core/dvbdev.c -@@ -104,6 +104,8 @@ static int dvb_device_open(struct inode *inode, struct file *file) - err = file->f_op->open(inode, file); - up_read(&minor_rwsem); - mutex_unlock(&dvbdev_mutex); -+ if (err) -+ dvb_device_put(dvbdev); - return err; - } - fail: -diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c -index 9a0d43c7ba9e0..ce99f7dfb5a5e 100644 ---- a/drivers/media/dvb-frontends/m88ds3103.c -+++ b/drivers/media/dvb-frontends/m88ds3103.c -@@ -1894,7 +1894,7 @@ static int m88ds3103_probe(struct i2c_client *client, - /* get frontend address */ - ret = regmap_read(dev->regmap, 0x29, &utmp); - if (ret) -- goto err_kfree; -+ goto err_del_adapters; - dev->dt_addr = ((utmp & 0x80) == 0) ? 0x42 >> 1 : 0x40 >> 1; - dev_dbg(&client->dev, "dt addr is 0x%02x\n", dev->dt_addr); - -@@ -1902,11 +1902,14 @@ static int m88ds3103_probe(struct i2c_client *client, - dev->dt_addr); - if (IS_ERR(dev->dt_client)) { - ret = PTR_ERR(dev->dt_client); -- goto err_kfree; -+ goto err_del_adapters; - } - } - - return 0; -+ -+err_del_adapters: -+ i2c_mux_del_adapters(dev->muxc); - err_kfree: - kfree(dev); - err: -diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -index e9a4f8abd21c5..3071b61946c3b 100644 ---- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c -@@ -1412,7 +1412,6 @@ static int mtk_jpeg_remove(struct platform_device *pdev) - { - struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); - -- cancel_delayed_work_sync(&jpeg->job_timeout_work); - pm_runtime_disable(&pdev->dev); - video_unregister_device(jpeg->vdev); - v4l2_m2m_release(jpeg->m2m_dev); -diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c -index afbbfd5d02bcc..6d200e23754e8 100644 ---- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c -+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c -@@ -188,6 +188,7 @@ int mtk_jpeg_dec_fill_param(struct mtk_jpeg_dec_param *param) - - return 0; - } -+EXPORT_SYMBOL_GPL(mtk_jpeg_dec_fill_param); - - u32 mtk_jpeg_dec_get_int_status(void __iomem *base) - { -@@ -199,6 +200,7 @@ u32 mtk_jpeg_dec_get_int_status(void __iomem *base) - - return ret; - } -+EXPORT_SYMBOL_GPL(mtk_jpeg_dec_get_int_status); - - u32 mtk_jpeg_dec_enum_result(u32 irq_result) - { -@@ -215,11 +217,13 @@ u32 mtk_jpeg_dec_enum_result(u32 irq_result) - - return MTK_JPEG_DEC_RESULT_ERROR_UNKNOWN; - } -+EXPORT_SYMBOL_GPL(mtk_jpeg_dec_enum_result); - - void mtk_jpeg_dec_start(void __iomem *base) - { - writel(0, base + JPGDEC_REG_TRIG); - } -+EXPORT_SYMBOL_GPL(mtk_jpeg_dec_start); - - static void mtk_jpeg_dec_soft_reset(void __iomem *base) - { -@@ -239,6 +243,7 @@ void mtk_jpeg_dec_reset(void __iomem *base) - mtk_jpeg_dec_soft_reset(base); - mtk_jpeg_dec_hard_reset(base); - } -+EXPORT_SYMBOL_GPL(mtk_jpeg_dec_reset); - - static void mtk_jpeg_dec_set_brz_factor(void __iomem *base, u8 yscale_w, - u8 yscale_h, u8 uvscale_w, u8 uvscale_h) -@@ -407,3 +412,4 @@ void mtk_jpeg_dec_set_config(void __iomem *base, - config->dma_last_mcu); - mtk_jpeg_dec_set_pause_mcu_idx(base, config->total_mcu); - } -+EXPORT_SYMBOL_GPL(mtk_jpeg_dec_set_config); -diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c -index 905072871ed2e..196f2bba419f9 100644 ---- a/drivers/media/platform/nxp/imx-mipi-csis.c -+++ b/drivers/media/platform/nxp/imx-mipi-csis.c -@@ -1553,8 +1553,10 @@ static int mipi_csis_remove(struct platform_device *pdev) - v4l2_async_nf_cleanup(&csis->notifier); - v4l2_async_unregister_subdev(&csis->sd); - -+ if (!pm_runtime_enabled(&pdev->dev)) -+ mipi_csis_runtime_suspend(&pdev->dev); -+ - pm_runtime_disable(&pdev->dev); -- mipi_csis_runtime_suspend(&pdev->dev); - mipi_csis_clk_disable(csis); - media_entity_cleanup(&csis->sd.entity); - fwnode_handle_put(csis->sd.fwnode); -diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -index f2475c6235ea7..2b76339f9381c 100644 ---- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c -@@ -582,7 +582,7 @@ static int rkisp1_probe(struct platform_device *pdev) - - ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev); - if (ret) -- goto err_pm_runtime_disable; -+ goto err_media_dev_cleanup; - - ret = media_device_register(&rkisp1->media_dev); - if (ret) { -@@ -617,6 +617,8 @@ err_unreg_media_dev: - media_device_unregister(&rkisp1->media_dev); - err_unreg_v4l2_dev: - v4l2_device_unregister(&rkisp1->v4l2_dev); -+err_media_dev_cleanup: -+ media_device_cleanup(&rkisp1->media_dev); - err_pm_runtime_disable: - pm_runtime_disable(&pdev->dev); - return ret; -@@ -637,6 +639,8 @@ static int rkisp1_remove(struct platform_device *pdev) - media_device_unregister(&rkisp1->media_dev); - v4l2_device_unregister(&rkisp1->v4l2_dev); - -+ media_device_cleanup(&rkisp1->media_dev); -+ - pm_runtime_disable(&pdev->dev); - - return 0; -diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c -index 08840ba313e7a..69a2442f31223 100644 ---- a/drivers/media/platform/verisilicon/hantro_drv.c -+++ b/drivers/media/platform/verisilicon/hantro_drv.c -@@ -813,6 +813,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid) - - if (funcid == MEDIA_ENT_F_PROC_VIDEO_ENCODER) { - vpu->encoder = func; -+ v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD); -+ v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD); - } else { - vpu->decoder = func; - v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD); -diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c -index 30e650edaea8a..b2da48936e3f1 100644 ---- a/drivers/media/platform/verisilicon/hantro_v4l2.c -+++ b/drivers/media/platform/verisilicon/hantro_v4l2.c -@@ -759,6 +759,9 @@ const struct v4l2_ioctl_ops hantro_ioctl_ops = { - .vidioc_g_selection = vidioc_g_selection, - .vidioc_s_selection = vidioc_s_selection, - -+ .vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd, -+ .vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd, -+ - .vidioc_try_encoder_cmd = v4l2_m2m_ioctl_try_encoder_cmd, - .vidioc_encoder_cmd = vidioc_encoder_cmd, - }; -diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c -index 727e6268567f7..f1feccc28bf05 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-core.c -+++ b/drivers/media/usb/cx231xx/cx231xx-core.c -@@ -1024,6 +1024,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets, - if (!dev->video_mode.isoc_ctl.urb) { - dev_err(dev->dev, - "cannot alloc memory for usb buffers\n"); -+ kfree(dma_q->p_left_data); - return -ENOMEM; - } - -@@ -1033,6 +1034,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets, - dev_err(dev->dev, - "cannot allocate memory for usbtransfer\n"); - kfree(dev->video_mode.isoc_ctl.urb); -+ kfree(dma_q->p_left_data); - return -ENOMEM; - } - -diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c -index 14170a5d72b35..1764674de98bc 100644 ---- a/drivers/media/usb/pvrusb2/pvrusb2-context.c -+++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c -@@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) - { - pvr2_hdw_disconnect(mp->hdw); - mp->disconnect_flag = !0; -- pvr2_context_notify(mp); -+ if (!pvr2_context_shutok()) -+ pvr2_context_notify(mp); - } - - -diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c -index cfbee2cfba6b0..c50387600b819 100644 ---- a/drivers/mfd/intel-lpss.c -+++ b/drivers/mfd/intel-lpss.c -@@ -301,8 +301,8 @@ static int intel_lpss_register_clock_divider(struct intel_lpss *lpss, - - snprintf(name, sizeof(name), "%s-div", devname); - tmp = clk_register_fractional_divider(NULL, name, __clk_get_name(tmp), -+ 0, lpss->priv, 1, 15, 16, 15, - CLK_FRAC_DIVIDER_POWER_OF_TWO_PS, -- lpss->priv, 1, 15, 16, 15, 0, - NULL); - if (IS_ERR(tmp)) - return PTR_ERR(tmp); -diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c -index bdb2ce7ff03b9..6196724ef39bb 100644 ---- a/drivers/mfd/syscon.c -+++ b/drivers/mfd/syscon.c -@@ -102,6 +102,10 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk) - } - - syscon_config.name = kasprintf(GFP_KERNEL, "%pOFn@%pa", np, &res.start); -+ if (!syscon_config.name) { -+ ret = -ENOMEM; -+ goto err_regmap; -+ } - syscon_config.reg_stride = reg_io_width; - syscon_config.val_bits = reg_io_width * 8; - syscon_config.max_register = resource_size(&res) - reg_io_width; -diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/misc/habanalabs/common/habanalabs_ioctl.c -index 43afe40966e50..1ea1ae34b7a74 100644 ---- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c -+++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c -@@ -677,7 +677,7 @@ static int sec_attest_info(struct hl_fpriv *hpriv, struct hl_info_args *args) - if (!sec_attest_info) - return -ENOMEM; - -- info = kmalloc(sizeof(*info), GFP_KERNEL); -+ info = kzalloc(sizeof(*info), GFP_KERNEL); - if (!info) { - rc = -ENOMEM; - goto free_sec_attest_info; -diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig -index 9b5a2cb110b3e..d84bdb69f56b0 100644 ---- a/drivers/mmc/host/Kconfig -+++ b/drivers/mmc/host/Kconfig -@@ -1061,14 +1061,15 @@ config MMC_SDHCI_XENON - - config MMC_SDHCI_OMAP - tristate "TI SDHCI Controller Support" -+ depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST - depends on MMC_SDHCI_PLTFM && OF - select THERMAL - imply TI_SOC_THERMAL - select MMC_SDHCI_EXTERNAL_DMA if DMA_ENGINE - help - This selects the Secure Digital Host Controller Interface (SDHCI) -- support present in TI's DRA7 SOCs. The controller supports -- SD/MMC/SDIO devices. -+ support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller -+ supports SD/MMC/SDIO devices. - - If you have a controller with this interface, say Y or M here. - -@@ -1076,14 +1077,15 @@ config MMC_SDHCI_OMAP - - config MMC_SDHCI_AM654 - tristate "Support for the SDHCI Controller in TI's AM654 SOCs" -+ depends on ARCH_K3 || COMPILE_TEST - depends on MMC_SDHCI_PLTFM && OF - select MMC_SDHCI_IO_ACCESSORS - select MMC_CQHCI - select REGMAP_MMIO - help - This selects the Secure Digital Host Controller Interface (SDHCI) -- support present in TI's AM654 SOCs. The controller supports -- SD/MMC/SDIO devices. -+ support present in TI's AM65x/AM64x/AM62x/J721E SOCs. The controller -+ supports SD/MMC/SDIO devices. - - If you have a controller with this interface, say Y or M here. - -diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c -index 60b222799871e..8ee60605a6dcc 100644 ---- a/drivers/mtd/mtd_blkdevs.c -+++ b/drivers/mtd/mtd_blkdevs.c -@@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) - { - struct mtd_blktrans_ops *tr; - -- if (mtd->type == MTD_ABSENT) -+ if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) - return; - - list_for_each_entry(tr, &blktrans_majors, list) -@@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) - mutex_lock(&mtd_table_mutex); - list_add(&tr->list, &blktrans_majors); - mtd_for_each_device(mtd) -- if (mtd->type != MTD_ABSENT) -+ if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) - tr->add_mtd(tr, mtd); - mutex_unlock(&mtd_table_mutex); - return 0; -diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c -index 02d5001768382..bea1a7d3edd78 100644 ---- a/drivers/mtd/nand/raw/fsl_ifc_nand.c -+++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c -@@ -20,7 +20,7 @@ - - #define ERR_BYTE 0xFF /* Value returned for read - bytes when read failed */ --#define IFC_TIMEOUT_MSECS 500 /* Maximum number of mSecs to wait -+#define IFC_TIMEOUT_MSECS 1000 /* Maximum timeout to wait - for IFC NAND Machine */ - - struct fsl_ifc_ctrl; -diff --git a/drivers/net/amt.c b/drivers/net/amt.c -index 2d20be6ffb7e5..ddd087c2c3ed4 100644 ---- a/drivers/net/amt.c -+++ b/drivers/net/amt.c -@@ -11,7 +11,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -80,11 +80,11 @@ static struct mld2_grec mldv2_zero_grec; - - static struct amt_skb_cb *amt_skb_cb(struct sk_buff *skb) - { -- BUILD_BUG_ON(sizeof(struct amt_skb_cb) + sizeof(struct qdisc_skb_cb) > -+ BUILD_BUG_ON(sizeof(struct amt_skb_cb) + sizeof(struct tc_skb_cb) > - sizeof_field(struct sk_buff, cb)); - - return (struct amt_skb_cb *)((void *)skb->cb + -- sizeof(struct qdisc_skb_cb)); -+ sizeof(struct tc_skb_cb)); - } - - static void __amt_source_gc_work(void) -diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c -index ef1a4a7c47b23..3efd556690563 100644 ---- a/drivers/net/dsa/vitesse-vsc73xx-core.c -+++ b/drivers/net/dsa/vitesse-vsc73xx-core.c -@@ -1119,6 +1119,8 @@ static int vsc73xx_gpio_probe(struct vsc73xx *vsc) - - vsc->gc.label = devm_kasprintf(vsc->dev, GFP_KERNEL, "VSC%04x", - vsc->chipid); -+ if (!vsc->gc.label) -+ return -ENOMEM; - vsc->gc.ngpio = 4; - vsc->gc.owner = THIS_MODULE; - vsc->gc.parent = vsc->dev; -diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -index 2292d63a279c1..83c4659390fd5 100644 ---- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c -@@ -130,9 +130,15 @@ static int mlxbf_gige_open(struct net_device *netdev) - { - struct mlxbf_gige *priv = netdev_priv(netdev); - struct phy_device *phydev = netdev->phydev; -+ u64 control; - u64 int_en; - int err; - -+ /* Perform general init of GigE block */ -+ control = readq(priv->base + MLXBF_GIGE_CONTROL); -+ control |= MLXBF_GIGE_CONTROL_PORT_EN; -+ writeq(control, priv->base + MLXBF_GIGE_CONTROL); -+ - err = mlxbf_gige_request_irqs(priv); - if (err) - return err; -@@ -147,14 +153,14 @@ static int mlxbf_gige_open(struct net_device *netdev) - */ - priv->valid_polarity = 0; - -- err = mlxbf_gige_rx_init(priv); -+ phy_start(phydev); -+ -+ err = mlxbf_gige_tx_init(priv); - if (err) - goto free_irqs; -- err = mlxbf_gige_tx_init(priv); -+ err = mlxbf_gige_rx_init(priv); - if (err) -- goto rx_deinit; -- -- phy_start(phydev); -+ goto tx_deinit; - - netif_napi_add(netdev, &priv->napi, mlxbf_gige_poll); - napi_enable(&priv->napi); -@@ -176,8 +182,8 @@ static int mlxbf_gige_open(struct net_device *netdev) - - return 0; - --rx_deinit: -- mlxbf_gige_rx_deinit(priv); -+tx_deinit: -+ mlxbf_gige_tx_deinit(priv); - - free_irqs: - mlxbf_gige_free_irqs(priv); -@@ -279,7 +285,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) - void __iomem *plu_base; - void __iomem *base; - int addr, phy_irq; -- u64 control; - int err; - - base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC); -@@ -294,11 +299,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) - if (IS_ERR(plu_base)) - return PTR_ERR(plu_base); - -- /* Perform general init of GigE block */ -- control = readq(base + MLXBF_GIGE_CONTROL); -- control |= MLXBF_GIGE_CONTROL_PORT_EN; -- writeq(control, base + MLXBF_GIGE_CONTROL); -- - netdev = devm_alloc_etherdev(&pdev->dev, sizeof(*priv)); - if (!netdev) - return -ENOMEM; -diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -index 227d01cace3f0..6999843584934 100644 ---- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c -@@ -142,6 +142,9 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv) - writeq(MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS_EN, - priv->base + MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS); - -+ writeq(ilog2(priv->rx_q_entries), -+ priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2); -+ - /* Clear MLXBF_GIGE_INT_MASK 'receive pkt' bit to - * indicate readiness to receive interrupts - */ -@@ -154,9 +157,6 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv) - data |= MLXBF_GIGE_RX_DMA_EN; - writeq(data, priv->base + MLXBF_GIGE_RX_DMA); - -- writeq(ilog2(priv->rx_q_entries), -- priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2); -- - return 0; - - free_wqe_and_skb: -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c -index 4c98950380d53..d231f4d2888be 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c -@@ -301,6 +301,7 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core, - unsigned long *p_index) - { - unsigned int num_rows, entry_size; -+ unsigned long index; - - /* We only allow allocations of entire rows */ - if (num_erps % erp_core->num_erp_banks != 0) -@@ -309,10 +310,11 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core, - entry_size = erp_core->erpt_entries_size[region_type]; - num_rows = num_erps / erp_core->num_erp_banks; - -- *p_index = gen_pool_alloc(erp_core->erp_tables, num_rows * entry_size); -- if (*p_index == 0) -+ index = gen_pool_alloc(erp_core->erp_tables, num_rows * entry_size); -+ if (!index) - return -ENOBUFS; -- *p_index -= MLXSW_SP_ACL_ERP_GENALLOC_OFFSET; -+ -+ *p_index = index - MLXSW_SP_ACL_ERP_GENALLOC_OFFSET; - - return 0; - } -diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -index 27b1663c476e7..64b209a0ad219 100644 ---- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c -@@ -391,7 +391,7 @@ nla_put_failure: - - struct rtnl_link_ops rmnet_link_ops __read_mostly = { - .kind = "rmnet", -- .maxtype = __IFLA_RMNET_MAX, -+ .maxtype = IFLA_RMNET_MAX, - .priv_size = sizeof(struct rmnet_priv), - .setup = rmnet_vnd_setup, - .validate = rmnet_rtnl_validate, -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index c2c56a5289caf..e7b70006261f7 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1965,7 +1965,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) - struct ravb_tstamp_skb *ts_skb; - struct ravb_tx_desc *desc; - unsigned long flags; -- u32 dma_addr; -+ dma_addr_t dma_addr; - void *buffer; - u32 entry; - u32 len; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h -index bdbf86cb102af..46944c02b45ed 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h -@@ -247,6 +247,7 @@ struct stmmac_priv { - u32 msg_enable; - int wolopts; - int wol_irq; -+ bool wol_irq_disabled; - int clk_csr; - struct timer_list eee_ctrl_timer; - int lpi_irq; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index 35c8dd92d3692..f03aa8a0b8954 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -761,10 +761,16 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - if (wol->wolopts) { - pr_info("stmmac: wakeup enable\n"); - device_set_wakeup_enable(priv->device, 1); -- enable_irq_wake(priv->wol_irq); -+ /* Avoid unbalanced enable_irq_wake calls */ -+ if (priv->wol_irq_disabled) -+ enable_irq_wake(priv->wol_irq); -+ priv->wol_irq_disabled = false; - } else { - device_set_wakeup_enable(priv->device, 0); -- disable_irq_wake(priv->wol_irq); -+ /* Avoid unbalanced disable_irq_wake calls */ -+ if (!priv->wol_irq_disabled) -+ disable_irq_wake(priv->wol_irq); -+ priv->wol_irq_disabled = true; - } - - mutex_lock(&priv->lock); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index deb6e95a1bca6..8f8de14347a94 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -3519,6 +3519,7 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev) - /* Request the Wake IRQ in case of another line - * is used for WoL - */ -+ priv->wol_irq_disabled = true; - if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) { - int_name = priv->int_name_wol; - sprintf(int_name, "%s:%s", dev->name, "wol"); -diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -index 9f2553799895d..76fabeae512db 100644 ---- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c -+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c -@@ -54,7 +54,7 @@ - #define AM65_CPSW_MAX_PORTS 8 - - #define AM65_CPSW_MIN_PACKET_SIZE VLAN_ETH_ZLEN --#define AM65_CPSW_MAX_PACKET_SIZE (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN) -+#define AM65_CPSW_MAX_PACKET_SIZE 2024 - - #define AM65_CPSW_REG_CTL 0x004 - #define AM65_CPSW_REG_STAT_PORT_EN 0x014 -@@ -1990,7 +1990,8 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx) - eth_hw_addr_set(port->ndev, port->slave.mac_addr); - - port->ndev->min_mtu = AM65_CPSW_MIN_PACKET_SIZE; -- port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE; -+ port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE - -+ (VLAN_ETH_HLEN + ETH_FCS_LEN); - port->ndev->hw_features = NETIF_F_SG | - NETIF_F_RXCSUM | - NETIF_F_HW_CSUM | -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 54a17b576eac0..7cbcf51bae924 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -3302,6 +3302,7 @@ static struct phy_driver ksphy_driver[] = { - .flags = PHY_POLL_CABLE_TEST, - .driver_data = &ksz9021_type, - .probe = kszphy_probe, -+ .soft_reset = genphy_soft_reset, - .config_init = ksz9131_config_init, - .config_intr = kszphy_config_intr, - .handle_interrupt = kszphy_handle_interrupt, -diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c -index 76f275ca53e9c..70d468f013383 100644 ---- a/drivers/net/wireless/ath/ath11k/ahb.c -+++ b/drivers/net/wireless/ath/ath11k/ahb.c -@@ -813,8 +813,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab) - - prproc = rproc_get_by_phandle(rproc_phandle); - if (!prproc) { -- ath11k_err(ab, "failed to get rproc\n"); -- return -EINVAL; -+ ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n"); -+ return -EPROBE_DEFER; - } - ab_ahb->tgt_rproc = prproc; - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c -index a3cefbc43e80d..2c14188f34bbc 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c -@@ -99,17 +99,6 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm, - active_cnt = 2; - } - -- /* -- * If the firmware requested it, then we know that it supports -- * getting zero for the values to indicate "use one, but pick -- * which one yourself", which means it can dynamically pick one -- * that e.g. has better RSSI. -- */ -- if (mvm->fw_static_smps_request && active_cnt == 1 && idle_cnt == 1) { -- idle_cnt = 0; -- active_cnt = 0; -- } -- - *rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) << - PHY_RX_CHAIN_VALID_POS); - *rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c -index caaf4d52e2c64..76219486b9c2e 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c -@@ -2200,7 +2200,7 @@ int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids) - WARN_ON(!iwl_mvm_has_new_tx_api(mvm)); - - if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0) -- cmd.flags |= CMD_WANT_SKB; -+ cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL; - - IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n", - sta_id, tids); -diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig -index 6d62ab49aa8d4..c7d02adb3eead 100644 ---- a/drivers/net/wireless/marvell/libertas/Kconfig -+++ b/drivers/net/wireless/marvell/libertas/Kconfig -@@ -2,8 +2,6 @@ - config LIBERTAS - tristate "Marvell 8xxx Libertas WLAN driver support" - depends on CFG80211 -- select WIRELESS_EXT -- select WEXT_SPY - select LIB80211 - select FW_LOADER - help -diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -index bcd564dc3554a..c907da2a4789a 100644 ---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -@@ -2046,6 +2046,8 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy, - - mwifiex_set_sys_config_invalid_data(bss_cfg); - -+ memcpy(bss_cfg->mac_addr, priv->curr_addr, ETH_ALEN); -+ - if (params->beacon_interval) - bss_cfg->beacon_period = params->beacon_interval; - if (params->dtim_period) -diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h -index b4f945a549f71..863f5f2247a08 100644 ---- a/drivers/net/wireless/marvell/mwifiex/fw.h -+++ b/drivers/net/wireless/marvell/mwifiex/fw.h -@@ -165,6 +165,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER { - #define TLV_TYPE_STA_MAC_ADDR (PROPRIETARY_TLV_BASE_ID + 32) - #define TLV_TYPE_BSSID (PROPRIETARY_TLV_BASE_ID + 35) - #define TLV_TYPE_CHANNELBANDLIST (PROPRIETARY_TLV_BASE_ID + 42) -+#define TLV_TYPE_UAP_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 43) - #define TLV_TYPE_UAP_BEACON_PERIOD (PROPRIETARY_TLV_BASE_ID + 44) - #define TLV_TYPE_UAP_DTIM_PERIOD (PROPRIETARY_TLV_BASE_ID + 45) - #define TLV_TYPE_UAP_BCAST_SSID (PROPRIETARY_TLV_BASE_ID + 48) -diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h -index 091e7ca793762..e8825f302de8a 100644 ---- a/drivers/net/wireless/marvell/mwifiex/ioctl.h -+++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h -@@ -107,6 +107,7 @@ struct mwifiex_uap_bss_param { - u8 qos_info; - u8 power_constraint; - struct mwifiex_types_wmm_info wmm_info; -+ u8 mac_addr[ETH_ALEN]; - }; - - enum { -diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c -index e78a201cd1507..491e366119096 100644 ---- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c -+++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c -@@ -468,6 +468,7 @@ void mwifiex_config_uap_11d(struct mwifiex_private *priv, - static int - mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size) - { -+ struct host_cmd_tlv_mac_addr *mac_tlv; - struct host_cmd_tlv_dtim_period *dtim_period; - struct host_cmd_tlv_beacon_period *beacon_period; - struct host_cmd_tlv_ssid *ssid; -@@ -487,6 +488,13 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size) - int i; - u16 cmd_size = *param_size; - -+ mac_tlv = (struct host_cmd_tlv_mac_addr *)tlv; -+ mac_tlv->header.type = cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS); -+ mac_tlv->header.len = cpu_to_le16(ETH_ALEN); -+ memcpy(mac_tlv->mac_addr, bss_cfg->mac_addr, ETH_ALEN); -+ cmd_size += sizeof(struct host_cmd_tlv_mac_addr); -+ tlv += sizeof(struct host_cmd_tlv_mac_addr); -+ - if (bss_cfg->ssid.ssid_len) { - ssid = (struct host_cmd_tlv_ssid *)tlv; - ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID); -diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c -index 9bc8758573fcc..0a88048b89768 100644 ---- a/drivers/net/wireless/mediatek/mt76/eeprom.c -+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c -@@ -62,7 +62,7 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len) - goto out_put_node; - } - -- offset = be32_to_cpup(list); -+ offset += be32_to_cpup(list); - ret = mtd_read(mtd, offset, len, &retlen, eep); - put_mtd_device(mtd); - if (mtd_is_bitflip(ret)) -diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h -index 9c753c6aabeff..60c9f9c56a4f5 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76.h -+++ b/drivers/net/wireless/mediatek/mt76/mt76.h -@@ -564,8 +564,7 @@ struct mt76_sdio { - struct mt76_worker txrx_worker; - struct mt76_worker status_worker; - struct mt76_worker net_worker; -- -- struct work_struct stat_work; -+ struct mt76_worker stat_worker; - - u8 *xmit_buf; - u32 xmit_buf_sz; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c -index 304212f5f8da7..d742b22428f0c 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c -@@ -205,8 +205,8 @@ static int mt7663s_suspend(struct device *dev) - mt76_worker_disable(&mdev->mt76.sdio.txrx_worker); - mt76_worker_disable(&mdev->mt76.sdio.status_worker); - mt76_worker_disable(&mdev->mt76.sdio.net_worker); -+ mt76_worker_disable(&mdev->mt76.sdio.stat_worker); - -- cancel_work_sync(&mdev->mt76.sdio.stat_work); - clear_bit(MT76_READING_STATS, &mdev->mphy.state); - - mt76_tx_status_check(&mdev->mt76, true); -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c -index 10dda1693d7db..19640ff76bdcf 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c -@@ -1036,21 +1036,26 @@ int __mt7921_mcu_set_clc(struct mt7921_dev *dev, u8 *alpha2, - u8 type[2]; - u8 rsvd[64]; - } __packed req = { -+ .ver = 1, - .idx = idx, - .env = env_cap, - }; - int ret, valid_cnt = 0; -- u8 i, *pos; -+ u16 buf_len = 0; -+ u8 *pos; - - if (!clc) - return 0; - -+ buf_len = le16_to_cpu(clc->len) - sizeof(*clc); - pos = clc->data; -- for (i = 0; i < clc->nr_country; i++) { -+ while (buf_len > 16) { - struct mt7921_clc_rule *rule = (struct mt7921_clc_rule *)pos; - u16 len = le16_to_cpu(rule->len); -+ u16 offset = len + sizeof(*rule); - -- pos += len + sizeof(*rule); -+ pos += offset; -+ buf_len -= offset; - if (rule->alpha2[0] != alpha2[0] || - rule->alpha2[1] != alpha2[1]) - continue; -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c -index 3b25a06fd9466..8898ba69b8e97 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c -@@ -222,7 +222,7 @@ static int mt7921s_suspend(struct device *__dev) - mt76_txq_schedule_all(&dev->mphy); - mt76_worker_disable(&mdev->tx_worker); - mt76_worker_disable(&mdev->sdio.status_worker); -- cancel_work_sync(&mdev->sdio.stat_work); -+ mt76_worker_disable(&mdev->sdio.stat_worker); - clear_bit(MT76_READING_STATS, &dev->mphy.state); - mt76_tx_status_check(mdev, true); - -@@ -254,6 +254,7 @@ restore_txrx_worker: - restore_worker: - mt76_worker_enable(&mdev->tx_worker); - mt76_worker_enable(&mdev->sdio.status_worker); -+ mt76_worker_enable(&mdev->sdio.stat_worker); - - if (!pm->ds_enable) - mt76_connac_mcu_set_deep_sleep(mdev, false); -@@ -286,6 +287,7 @@ static int mt7921s_resume(struct device *__dev) - mt76_worker_enable(&mdev->sdio.txrx_worker); - mt76_worker_enable(&mdev->sdio.status_worker); - mt76_worker_enable(&mdev->sdio.net_worker); -+ mt76_worker_enable(&mdev->sdio.stat_worker); - - /* restore previous ds setting */ - if (!pm->ds_enable) -diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c -index 1b3adb3d91e86..fd07b66233920 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c -@@ -107,7 +107,7 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) - mt76_worker_disable(&dev->mt76.sdio.txrx_worker); - mt76_worker_disable(&dev->mt76.sdio.status_worker); - mt76_worker_disable(&dev->mt76.sdio.net_worker); -- cancel_work_sync(&dev->mt76.sdio.stat_work); -+ mt76_worker_disable(&dev->mt76.sdio.stat_worker); - - mt7921s_disable_irq(&dev->mt76); - mt7921s_wfsys_reset(dev); -@@ -115,6 +115,7 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) - mt76_worker_enable(&dev->mt76.sdio.txrx_worker); - mt76_worker_enable(&dev->mt76.sdio.status_worker); - mt76_worker_enable(&dev->mt76.sdio.net_worker); -+ mt76_worker_enable(&dev->mt76.sdio.stat_worker); - - dev->fw_assert = false; - clear_bit(MT76_MCU_RESET, &dev->mphy.state); -diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c -index 176207f3177c4..fc4fb94635645 100644 ---- a/drivers/net/wireless/mediatek/mt76/sdio.c -+++ b/drivers/net/wireless/mediatek/mt76/sdio.c -@@ -481,21 +481,21 @@ static void mt76s_status_worker(struct mt76_worker *w) - if (dev->drv->tx_status_data && ndata_frames > 0 && - !test_and_set_bit(MT76_READING_STATS, &dev->phy.state) && - !test_bit(MT76_STATE_SUSPEND, &dev->phy.state)) -- ieee80211_queue_work(dev->hw, &dev->sdio.stat_work); -+ mt76_worker_schedule(&sdio->stat_worker); - } while (nframes > 0); - - if (resched) - mt76_worker_schedule(&dev->tx_worker); - } - --static void mt76s_tx_status_data(struct work_struct *work) -+static void mt76s_tx_status_data(struct mt76_worker *worker) - { - struct mt76_sdio *sdio; - struct mt76_dev *dev; - u8 update = 1; - u16 count = 0; - -- sdio = container_of(work, struct mt76_sdio, stat_work); -+ sdio = container_of(worker, struct mt76_sdio, stat_worker); - dev = container_of(sdio, struct mt76_dev, sdio); - - while (true) { -@@ -508,7 +508,7 @@ static void mt76s_tx_status_data(struct work_struct *work) - } - - if (count && test_bit(MT76_STATE_RUNNING, &dev->phy.state)) -- ieee80211_queue_work(dev->hw, &sdio->stat_work); -+ mt76_worker_schedule(&sdio->status_worker); - else - clear_bit(MT76_READING_STATS, &dev->phy.state); - } -@@ -600,8 +600,8 @@ void mt76s_deinit(struct mt76_dev *dev) - mt76_worker_teardown(&sdio->txrx_worker); - mt76_worker_teardown(&sdio->status_worker); - mt76_worker_teardown(&sdio->net_worker); -+ mt76_worker_teardown(&sdio->stat_worker); - -- cancel_work_sync(&sdio->stat_work); - clear_bit(MT76_READING_STATS, &dev->phy.state); - - mt76_tx_status_check(dev, true); -@@ -644,10 +644,14 @@ int mt76s_init(struct mt76_dev *dev, struct sdio_func *func, - if (err) - return err; - -+ err = mt76_worker_setup(dev->hw, &sdio->stat_worker, mt76s_tx_status_data, -+ "sdio-sta"); -+ if (err) -+ return err; -+ - sched_set_fifo_low(sdio->status_worker.task); - sched_set_fifo_low(sdio->net_worker.task); -- -- INIT_WORK(&sdio->stat_work, mt76s_tx_status_data); -+ sched_set_fifo_low(sdio->stat_worker.task); - - dev->queue_ops = &sdio_queue_ops; - dev->bus = bus_ops; -diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c -index 76d0a778636a4..311676c1ece0a 100644 ---- a/drivers/net/wireless/purelifi/plfxlc/usb.c -+++ b/drivers/net/wireless/purelifi/plfxlc/usb.c -@@ -493,9 +493,12 @@ int plfxlc_usb_wreq_async(struct plfxlc_usb *usb, const u8 *buffer, - void *context) - { - struct usb_device *udev = interface_to_usbdev(usb->ez_usb); -- struct urb *urb = usb_alloc_urb(0, GFP_ATOMIC); -+ struct urb *urb; - int r; - -+ urb = usb_alloc_urb(0, GFP_ATOMIC); -+ if (!urb) -+ return -ENOMEM; - usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_DATA_OUT), - (void *)buffer, buffer_len, complete_fn, context); - -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index ca79f652fef3c..6116c1bec1558 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -164,21 +164,29 @@ static bool _rtl_pci_platform_switch_device_pci_aspm( - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); - -+ value &= PCI_EXP_LNKCTL_ASPMC; -+ - if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE) -- value |= 0x40; -+ value |= PCI_EXP_LNKCTL_CCC; - -- pci_write_config_byte(rtlpci->pdev, 0x80, value); -+ pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL, -+ PCI_EXP_LNKCTL_ASPMC | value, -+ value); - - return false; - } - --/*When we set 0x01 to enable clk request. Set 0x0 to disable clk req.*/ --static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u8 value) -+/* @value is PCI_EXP_LNKCTL_CLKREQ_EN or 0 to enable/disable clk request. */ -+static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u16 value) - { - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); - -- pci_write_config_byte(rtlpci->pdev, 0x81, value); -+ value &= PCI_EXP_LNKCTL_CLKREQ_EN; -+ -+ pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL, -+ PCI_EXP_LNKCTL_CLKREQ_EN, -+ value); - - if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192SE) - udelay(100); -@@ -192,11 +200,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw) - struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor; -- u8 num4bytes = pcipriv->ndis_adapter.num4bytes; - /*Retrieve original configuration settings. */ - u8 linkctrl_reg = pcipriv->ndis_adapter.linkctrl_reg; -- u16 pcibridge_linkctrlreg = pcipriv->ndis_adapter. -- pcibridge_linkctrlreg; - u16 aspmlevel = 0; - u8 tmp_u1b = 0; - -@@ -221,16 +226,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw) - /*Set corresponding value. */ - aspmlevel |= BIT(0) | BIT(1); - linkctrl_reg &= ~aspmlevel; -- pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1)); - - _rtl_pci_platform_switch_device_pci_aspm(hw, linkctrl_reg); -- udelay(50); -- -- /*4 Disable Pci Bridge ASPM */ -- pci_write_config_byte(rtlpci->pdev, (num4bytes << 2), -- pcibridge_linkctrlreg); -- -- udelay(50); - } - - /*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for -@@ -245,9 +242,7 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) - struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); - struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); - u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor; -- u8 num4bytes = pcipriv->ndis_adapter.num4bytes; - u16 aspmlevel; -- u8 u_pcibridge_aspmsetting; - u8 u_device_aspmsetting; - - if (!ppsc->support_aspm) -@@ -259,25 +254,6 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) - return; - } - -- /*4 Enable Pci Bridge ASPM */ -- -- u_pcibridge_aspmsetting = -- pcipriv->ndis_adapter.pcibridge_linkctrlreg | -- rtlpci->const_hostpci_aspm_setting; -- -- if (pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL) -- u_pcibridge_aspmsetting &= ~BIT(0); -- -- pci_write_config_byte(rtlpci->pdev, (num4bytes << 2), -- u_pcibridge_aspmsetting); -- -- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, -- "PlatformEnableASPM(): Write reg[%x] = %x\n", -- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10), -- u_pcibridge_aspmsetting); -- -- udelay(50); -- - /*Get ASPM level (with/without Clock Req) */ - aspmlevel = rtlpci->const_devicepci_aspm_setting; - u_device_aspmsetting = pcipriv->ndis_adapter.linkctrl_reg; -@@ -291,7 +267,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) - - if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) { - _rtl_pci_switch_clk_req(hw, (ppsc->reg_rfps_level & -- RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0); -+ RT_RF_OFF_LEVL_CLK_REQ) ? -+ PCI_EXP_LNKCTL_CLKREQ_EN : 0); - RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_CLK_REQ); - } - udelay(100); -@@ -358,22 +335,6 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, - return tpriv != NULL; - } - --static void rtl_pci_get_linkcontrol_field(struct ieee80211_hw *hw) --{ -- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); -- struct rtl_pci *rtlpci = rtl_pcidev(pcipriv); -- u8 capabilityoffset = pcipriv->ndis_adapter.pcibridge_pciehdr_offset; -- u8 linkctrl_reg; -- u8 num4bbytes; -- -- num4bbytes = (capabilityoffset + 0x10) / 4; -- -- /*Read Link Control Register */ -- pci_read_config_byte(rtlpci->pdev, (num4bbytes << 2), &linkctrl_reg); -- -- pcipriv->ndis_adapter.pcibridge_linkctrlreg = linkctrl_reg; --} -- - static void rtl_pci_parse_configuration(struct pci_dev *pdev, - struct ieee80211_hw *hw) - { -@@ -2033,12 +1994,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, - PCI_SLOT(bridge_pdev->devfn); - pcipriv->ndis_adapter.pcibridge_funcnum = - PCI_FUNC(bridge_pdev->devfn); -- pcipriv->ndis_adapter.pcibridge_pciehdr_offset = -- pci_pcie_cap(bridge_pdev); -- pcipriv->ndis_adapter.num4bytes = -- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10) / 4; -- -- rtl_pci_get_linkcontrol_field(hw); - - if (pcipriv->ndis_adapter.pcibridge_vendor == - PCI_BRIDGE_VENDOR_AMD) { -@@ -2055,13 +2010,11 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, - pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg); - - rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, -- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n", -+ "pci_bridge busnumber:devnumber:funcnumber:vendor:amd %d:%d:%d:%x:%x\n", - pcipriv->ndis_adapter.pcibridge_busnum, - pcipriv->ndis_adapter.pcibridge_devnum, - pcipriv->ndis_adapter.pcibridge_funcnum, - pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], -- pcipriv->ndis_adapter.pcibridge_pciehdr_offset, -- pcipriv->ndis_adapter.pcibridge_linkctrlreg, - pcipriv->ndis_adapter.amd_l1_patch); - - rtl_pci_parse_configuration(pdev, hw); -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.h b/drivers/net/wireless/realtek/rtlwifi/pci.h -index 866861626a0a1..d6307197dfea0 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.h -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.h -@@ -236,11 +236,6 @@ struct mp_adapter { - u16 pcibridge_vendorid; - u16 pcibridge_deviceid; - -- u8 num4bytes; -- -- u8 pcibridge_pciehdr_offset; -- u8 pcibridge_linkctrlreg; -- - bool amd_l1_patch; - }; - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c -index 12d0b3a87af7c..0fab3a0c7d49d 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c -@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw, - static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset, - u32 data); --static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} - static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw); - static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw); - static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw, -@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask); - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw, - - - original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl88e_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c -index 3d29c8dbb2559..144ee780e1b6a 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c -@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n", - regaddr, bitmask); - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, - } - EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write); - --u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} --EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift); -- - static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw) - { - rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h -index 75afa6253ad02..e64d377dfe9e2 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h -@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw, - void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw); - void rtl92c_phy_set_io(struct ieee80211_hw *hw); - void rtl92c_bb_block_on(struct ieee80211_hw *hw); --u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask); - long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw, - enum wireless_mode wirelessmode, - u8 txpwridx); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c -index da54e51badd3a..fa70a7d5539fd 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c -@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw, - rfpath, regaddr); - } - -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_fw_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h -index 7582a162bd112..c7a0d4c776f0a 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h -@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath, - u32 offset); - u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset); --u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask); - void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset, u32 data); - void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw, -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c -index a8d9fe269f313..0b8cb7e61fd80 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c -@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_fw_rf_serial_read(hw, - rfpath, regaddr); - } -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n", -@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, - original_value = _rtl92c_phy_fw_rf_serial_read(hw, - rfpath, - regaddr); -- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = - ((original_value & (~bitmask)) | - (data << bitshift)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c -index d18c092b61426..d835a27429f0f 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c -@@ -169,13 +169,6 @@ static const u8 channel_all[59] = { - 157, 159, 161, 163, 165 - }; - --static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} -- - u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); -@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - } else { - originalvalue = rtl_read_dword(rtlpriv, regaddr); - } -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "BBR MASK=0x%x Addr[0x%x]=0x%x\n", -@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw, - dbi_direct); - else - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob) -@@ -317,7 +310,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw, - regaddr, rfpath, bitmask); - spin_lock(&rtlpriv->locks.rf_lock); - original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr); -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - spin_unlock(&rtlpriv->locks.rf_lock); - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -343,7 +336,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - if (bitmask != RFREG_OFFSET_MASK) { - original_value = _rtl92d_phy_rf_serial_read(hw, - rfpath, regaddr); -- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((original_value & (~bitmask)) | - (data << bitshift)); - } -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c -index cc0bcaf13e96e..73ef602bfb01a 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c -@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw, - static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, - enum radio_path rfpath, u32 offset, - u32 data); --static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask); - static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw); - static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw); - static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw, -@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, - "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask); - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, -@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -92,7 +91,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw, - spin_lock(&rtlpriv->locks.rf_lock); - - original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -119,7 +118,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw, - - if (bitmask != RFREG_OFFSET_MASK) { - original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr); -- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = (original_value & (~bitmask)) | (data << bitshift); - } - -@@ -201,13 +200,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, - pphyreg->rf3wire_offset, data_and_addr); - } - --static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} -- - bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw) - { - return _rtl92ee_phy_config_mac_with_headerfile(hw); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c -index aaa004d4d6d0a..0e2b9698088bb 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c -@@ -14,13 +14,6 @@ - #include "hw.h" - #include "table.h" - --static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask) --{ -- u32 i = ffs(bitmask); -- -- return i ? i - 1 : 32; --} -- - u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); -@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) - regaddr, bitmask); - - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - returnvalue = (originalvalue & bitmask) >> bitshift; - - rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n", -@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask, - - if (bitmask != MASKDWORD) { - originalvalue = rtl_read_dword(rtlpriv, regaddr); -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((originalvalue & (~bitmask)) | (data << bitshift)); - } - -@@ -160,7 +153,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - - original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr); - -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - readback_value = (original_value & bitmask) >> bitshift; - - spin_unlock(&rtlpriv->locks.rf_lock); -@@ -191,7 +184,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, - if (bitmask != RFREG_OFFSET_MASK) { - original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, - regaddr); -- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); -+ bitshift = calculate_bit_shift(bitmask); - data = ((original_value & (~bitmask)) | (data << bitshift)); - } - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -index 5323ead30db03..fa1839d8ee55f 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw, - u32 data); - static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask) - { -- u32 i = ffs(bitmask); -+ if (WARN_ON_ONCE(!bitmask)) -+ return 0; - -- return i ? i - 1 : 32; -+ return __ffs(bitmask); - } - static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw); - /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/ -diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h -index 31f9e9e5c6804..0bac788ccd6e3 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h -+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h -@@ -3105,4 +3105,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw, - return ieee80211_find_sta(mac->vif, mac_addr); - } - -+static inline u32 calculate_bit_shift(u32 bitmask) -+{ -+ if (WARN_ON_ONCE(!bitmask)) -+ return 0; -+ -+ return __ffs(bitmask); -+} - #endif -diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c -index fabca307867a0..0970d6bcba439 100644 ---- a/drivers/net/wireless/realtek/rtw88/mac80211.c -+++ b/drivers/net/wireless/realtek/rtw88/mac80211.c -@@ -266,9 +266,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw, - - if (changed_flags & FIF_ALLMULTI) { - if (*new_flags & FIF_ALLMULTI) -- rtwdev->hal.rcr |= BIT_AM | BIT_AB; -+ rtwdev->hal.rcr |= BIT_AM; - else -- rtwdev->hal.rcr &= ~(BIT_AM | BIT_AB); -+ rtwdev->hal.rcr &= ~(BIT_AM); - } - if (changed_flags & FIF_FCSFAIL) { - if (*new_flags & FIF_FCSFAIL) -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index c3a8d78a41a7b..2716040985748 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -463,12 +463,25 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - } - - for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS; -- shinfo->nr_frags++, gop++, nr_slots--) { -+ nr_slots--) { -+ if (unlikely(!txp->size)) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&queue->response_lock, flags); -+ make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY); -+ push_tx_responses(queue); -+ spin_unlock_irqrestore(&queue->response_lock, flags); -+ ++txp; -+ continue; -+ } -+ - index = pending_index(queue->pending_cons++); - pending_idx = queue->pending_ring[index]; - xenvif_tx_create_map_op(queue, pending_idx, txp, - txp == first ? extra_count : 0, gop); - frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx); -+ ++shinfo->nr_frags; -+ ++gop; - - if (txp == first) - txp = txfrags; -@@ -481,20 +494,39 @@ static void xenvif_get_requests(struct xenvif_queue *queue, - shinfo = skb_shinfo(nskb); - frags = shinfo->frags; - -- for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; -- shinfo->nr_frags++, txp++, gop++) { -+ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) { -+ if (unlikely(!txp->size)) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&queue->response_lock, flags); -+ make_tx_response(queue, txp, 0, -+ XEN_NETIF_RSP_OKAY); -+ push_tx_responses(queue); -+ spin_unlock_irqrestore(&queue->response_lock, -+ flags); -+ continue; -+ } -+ - index = pending_index(queue->pending_cons++); - pending_idx = queue->pending_ring[index]; - xenvif_tx_create_map_op(queue, pending_idx, txp, 0, - gop); - frag_set_pending_idx(&frags[shinfo->nr_frags], - pending_idx); -+ ++shinfo->nr_frags; -+ ++gop; - } - -- skb_shinfo(skb)->frag_list = nskb; -- } else if (nskb) { -+ if (shinfo->nr_frags) { -+ skb_shinfo(skb)->frag_list = nskb; -+ nskb = NULL; -+ } -+ } -+ -+ if (nskb) { - /* A frag_list skb was allocated but it is no longer needed -- * because enough slots were converted to copy ops above. -+ * because enough slots were converted to copy ops above or some -+ * were empty. - */ - kfree_skb(nskb); - } -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index 355d80323b836..ce42afe8f64ef 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -18,6 +18,7 @@ - #include "nvmet.h" - - #define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE) -+#define NVMET_TCP_MAXH2CDATA 0x400000 /* 16M arbitrary limit */ - - /* Define the socket priority to use for connections were it is desirable - * that the NIC consider performing optimized packet processing or filtering. -@@ -861,7 +862,7 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) - icresp->hdr.pdo = 0; - icresp->hdr.plen = cpu_to_le32(icresp->hdr.hlen); - icresp->pfv = cpu_to_le16(NVME_TCP_PFV_1_0); -- icresp->maxdata = cpu_to_le32(0x400000); /* 16M arbitrary limit */ -+ icresp->maxdata = cpu_to_le32(NVMET_TCP_MAXH2CDATA); - icresp->cpda = 0; - if (queue->hdr_digest) - icresp->digest |= NVME_TCP_HDR_DIGEST_ENABLE; -@@ -914,6 +915,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - { - struct nvme_tcp_data_pdu *data = &queue->pdu.data; - struct nvmet_tcp_cmd *cmd; -+ unsigned int exp_data_len; - - if (likely(queue->nr_cmds)) { - if (unlikely(data->ttag >= queue->nr_cmds)) { -@@ -932,12 +934,24 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) - data->ttag, le32_to_cpu(data->data_offset), - cmd->rbytes_done); - /* FIXME: use path and transport errors */ -- nvmet_req_complete(&cmd->req, -- NVME_SC_INVALID_FIELD | NVME_SC_DNR); -+ nvmet_tcp_fatal_error(queue); - return -EPROTO; - } - -+ exp_data_len = le32_to_cpu(data->hdr.plen) - -+ nvmet_tcp_hdgst_len(queue) - -+ nvmet_tcp_ddgst_len(queue) - -+ sizeof(*data); -+ - cmd->pdu_len = le32_to_cpu(data->data_length); -+ if (unlikely(cmd->pdu_len != exp_data_len || -+ cmd->pdu_len == 0 || -+ cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) { -+ pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len); -+ /* FIXME: use proper transport errors */ -+ nvmet_tcp_fatal_error(queue); -+ return -EPROTO; -+ } - cmd->pdu_recv = 0; - nvmet_tcp_build_pdu_iovec(cmd); - queue->cmd = cmd; -diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h -index 6109b3806b12b..974d99d47f514 100644 ---- a/drivers/nvme/target/trace.h -+++ b/drivers/nvme/target/trace.h -@@ -53,8 +53,7 @@ static inline void __assign_req_name(char *name, struct nvmet_req *req) - return; - } - -- strncpy(name, req->ns->device_path, -- min_t(size_t, DISK_NAME_LEN, strlen(req->ns->device_path))); -+ strscpy_pad(name, req->ns->device_path, DISK_NAME_LEN); - } - #endif - -@@ -85,7 +84,7 @@ TRACE_EVENT(nvmet_req_init, - __entry->flags = cmd->common.flags; - __entry->nsid = le32_to_cpu(cmd->common.nsid); - __entry->metadata = le64_to_cpu(cmd->common.metadata); -- memcpy(__entry->cdw10, &cmd->common.cdw10, -+ memcpy(__entry->cdw10, &cmd->common.cdws, - sizeof(__entry->cdw10)); - ), - TP_printk("nvmet%s: %sqid=%d, cmdid=%u, nsid=%u, flags=%#x, " -diff --git a/drivers/of/base.c b/drivers/of/base.c -index d5a5c35eba72a..f849bbb9ef8c7 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -1646,6 +1646,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np, - out_args->np = new; - of_node_put(cur); - cur = new; -+ new = NULL; - } - put: - of_node_put(cur); -diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi -index 6b33be4c4416c..aa0d7027ffa68 100644 ---- a/drivers/of/unittest-data/tests-phandle.dtsi -+++ b/drivers/of/unittest-data/tests-phandle.dtsi -@@ -38,6 +38,13 @@ - phandle-map-pass-thru = <0x0 0xf0>; - }; - -+ provider5: provider5 { -+ #phandle-cells = <2>; -+ phandle-map = <2 7 &provider4 2 3>; -+ phandle-map-mask = <0xff 0xf>; -+ phandle-map-pass-thru = <0x0 0xf0>; -+ }; -+ - consumer-a { - phandle-list = <&provider1 1>, - <&provider2 2 0>, -@@ -64,7 +71,8 @@ - <&provider4 4 0x100>, - <&provider4 0 0x61>, - <&provider0>, -- <&provider4 19 0x20>; -+ <&provider4 19 0x20>, -+ <&provider5 2 7>; - phandle-list-bad-phandle = <12345678 0 0>; - phandle-list-bad-args = <&provider2 1 0>, - <&provider4 0>; -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index edd2342598e49..e541a8960f1de 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -448,6 +448,9 @@ static void __init of_unittest_parse_phandle_with_args(void) - - unittest(passed, "index %i - data error on node %pOF rc=%i\n", - i, args.np, rc); -+ -+ if (rc == 0) -+ of_node_put(args.np); - } - - /* Check for missing list property */ -@@ -537,8 +540,9 @@ static void __init of_unittest_parse_phandle_with_args(void) - - static void __init of_unittest_parse_phandle_with_args_map(void) - { -- struct device_node *np, *p0, *p1, *p2, *p3; -+ struct device_node *np, *p[6] = {}; - struct of_phandle_args args; -+ unsigned int prefs[6]; - int i, rc; - - np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b"); -@@ -547,34 +551,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - return; - } - -- p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); -- if (!p0) { -- pr_err("missing testcase data\n"); -- return; -- } -- -- p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); -- if (!p1) { -- pr_err("missing testcase data\n"); -- return; -- } -- -- p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); -- if (!p2) { -- pr_err("missing testcase data\n"); -- return; -- } -- -- p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); -- if (!p3) { -- pr_err("missing testcase data\n"); -- return; -+ p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); -+ p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); -+ p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); -+ p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); -+ p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4"); -+ p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5"); -+ for (i = 0; i < ARRAY_SIZE(p); ++i) { -+ if (!p[i]) { -+ pr_err("missing testcase data\n"); -+ return; -+ } -+ prefs[i] = kref_read(&p[i]->kobj.kref); - } - - rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells"); -- unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc); -+ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc); - -- for (i = 0; i < 8; i++) { -+ for (i = 0; i < 9; i++) { - bool passed = true; - - memset(&args, 0, sizeof(args)); -@@ -585,13 +579,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - switch (i) { - case 0: - passed &= !rc; -- passed &= (args.np == p1); -+ passed &= (args.np == p[1]); - passed &= (args.args_count == 1); - passed &= (args.args[0] == 1); - break; - case 1: - passed &= !rc; -- passed &= (args.np == p3); -+ passed &= (args.np == p[3]); - passed &= (args.args_count == 3); - passed &= (args.args[0] == 2); - passed &= (args.args[1] == 5); -@@ -602,28 +596,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - break; - case 3: - passed &= !rc; -- passed &= (args.np == p0); -+ passed &= (args.np == p[0]); - passed &= (args.args_count == 0); - break; - case 4: - passed &= !rc; -- passed &= (args.np == p1); -+ passed &= (args.np == p[1]); - passed &= (args.args_count == 1); - passed &= (args.args[0] == 3); - break; - case 5: - passed &= !rc; -- passed &= (args.np == p0); -+ passed &= (args.np == p[0]); - passed &= (args.args_count == 0); - break; - case 6: - passed &= !rc; -- passed &= (args.np == p2); -+ passed &= (args.np == p[2]); - passed &= (args.args_count == 2); - passed &= (args.args[0] == 15); - passed &= (args.args[1] == 0x20); - break; - case 7: -+ passed &= !rc; -+ passed &= (args.np == p[3]); -+ passed &= (args.args_count == 3); -+ passed &= (args.args[0] == 2); -+ passed &= (args.args[1] == 5); -+ passed &= (args.args[2] == 3); -+ break; -+ case 8: - passed &= (rc == -ENOENT); - break; - default: -@@ -632,6 +634,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - - unittest(passed, "index %i - data error on node %s rc=%i\n", - i, args.np->full_name, rc); -+ -+ if (rc == 0) -+ of_node_put(args.np); - } - - /* Check for missing list property */ -@@ -678,6 +683,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) - "OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found 1"); - - unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); -+ -+ for (i = 0; i < ARRAY_SIZE(p); ++i) { -+ unittest(prefs[i] == kref_read(&p[i]->kobj.kref), -+ "provider%d: expected:%d got:%d\n", -+ i, prefs[i], kref_read(&p[i]->kobj.kref)); -+ of_node_put(p[i]); -+ } - } - - static void __init of_unittest_property_string(void) -diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c -index d2634dafb68e5..7ecad72cff7e7 100644 ---- a/drivers/pci/controller/dwc/pci-keystone.c -+++ b/drivers/pci/controller/dwc/pci-keystone.c -@@ -1219,7 +1219,16 @@ static int ks_pcie_probe(struct platform_device *pdev) - goto err_link; - } - -+ /* Obtain references to the PHYs */ -+ for (i = 0; i < num_lanes; i++) -+ phy_pm_runtime_get_sync(ks_pcie->phy[i]); -+ - ret = ks_pcie_enable_phy(ks_pcie); -+ -+ /* Release references to the PHYs */ -+ for (i = 0; i < num_lanes; i++) -+ phy_pm_runtime_put_sync(ks_pcie->phy[i]); -+ - if (ret) { - dev_err(dev, "failed to enable phy\n"); - goto err_link; -diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c -index 83ddb190292e4..59c164b5c64aa 100644 ---- a/drivers/pci/controller/dwc/pcie-designware-ep.c -+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c -@@ -600,6 +600,7 @@ int dw_pcie_ep_raise_msix_irq(struct dw_pcie_ep *ep, u8 func_no, - } - - aligned_offset = msg_addr & (epc->mem->window.page_size - 1); -+ msg_addr &= ~aligned_offset; - ret = dw_pcie_ep_map_addr(epc, func_no, 0, ep->msi_mem_phys, msg_addr, - epc->mem->window.page_size); - if (ret) -diff --git a/drivers/pci/controller/pcie-mediatek-gen3.c b/drivers/pci/controller/pcie-mediatek-gen3.c -index b8612ce5f4d0c..40c38ca5a42e2 100644 ---- a/drivers/pci/controller/pcie-mediatek-gen3.c -+++ b/drivers/pci/controller/pcie-mediatek-gen3.c -@@ -245,35 +245,60 @@ static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie, - resource_size_t cpu_addr, - resource_size_t pci_addr, - resource_size_t size, -- unsigned long type, int num) -+ unsigned long type, int *num) - { -+ resource_size_t remaining = size; -+ resource_size_t table_size; -+ resource_size_t addr_align; -+ const char *range_type; - void __iomem *table; - u32 val; - -- if (num >= PCIE_MAX_TRANS_TABLES) { -- dev_err(pcie->dev, "not enough translate table for addr: %#llx, limited to [%d]\n", -- (unsigned long long)cpu_addr, PCIE_MAX_TRANS_TABLES); -- return -ENODEV; -- } -+ while (remaining && (*num < PCIE_MAX_TRANS_TABLES)) { -+ /* Table size needs to be a power of 2 */ -+ table_size = BIT(fls(remaining) - 1); -+ -+ if (cpu_addr > 0) { -+ addr_align = BIT(ffs(cpu_addr) - 1); -+ table_size = min(table_size, addr_align); -+ } -+ -+ /* Minimum size of translate table is 4KiB */ -+ if (table_size < 0x1000) { -+ dev_err(pcie->dev, "illegal table size %#llx\n", -+ (unsigned long long)table_size); -+ return -EINVAL; -+ } - -- table = pcie->base + PCIE_TRANS_TABLE_BASE_REG + -- num * PCIE_ATR_TLB_SET_OFFSET; -+ table = pcie->base + PCIE_TRANS_TABLE_BASE_REG + *num * PCIE_ATR_TLB_SET_OFFSET; -+ writel_relaxed(lower_32_bits(cpu_addr) | PCIE_ATR_SIZE(fls(table_size) - 1), table); -+ writel_relaxed(upper_32_bits(cpu_addr), table + PCIE_ATR_SRC_ADDR_MSB_OFFSET); -+ writel_relaxed(lower_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_LSB_OFFSET); -+ writel_relaxed(upper_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_MSB_OFFSET); - -- writel_relaxed(lower_32_bits(cpu_addr) | PCIE_ATR_SIZE(fls(size) - 1), -- table); -- writel_relaxed(upper_32_bits(cpu_addr), -- table + PCIE_ATR_SRC_ADDR_MSB_OFFSET); -- writel_relaxed(lower_32_bits(pci_addr), -- table + PCIE_ATR_TRSL_ADDR_LSB_OFFSET); -- writel_relaxed(upper_32_bits(pci_addr), -- table + PCIE_ATR_TRSL_ADDR_MSB_OFFSET); -+ if (type == IORESOURCE_IO) { -+ val = PCIE_ATR_TYPE_IO | PCIE_ATR_TLP_TYPE_IO; -+ range_type = "IO"; -+ } else { -+ val = PCIE_ATR_TYPE_MEM | PCIE_ATR_TLP_TYPE_MEM; -+ range_type = "MEM"; -+ } - -- if (type == IORESOURCE_IO) -- val = PCIE_ATR_TYPE_IO | PCIE_ATR_TLP_TYPE_IO; -- else -- val = PCIE_ATR_TYPE_MEM | PCIE_ATR_TLP_TYPE_MEM; -+ writel_relaxed(val, table + PCIE_ATR_TRSL_PARAM_OFFSET); - -- writel_relaxed(val, table + PCIE_ATR_TRSL_PARAM_OFFSET); -+ dev_dbg(pcie->dev, "set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n", -+ range_type, *num, (unsigned long long)cpu_addr, -+ (unsigned long long)pci_addr, (unsigned long long)table_size); -+ -+ cpu_addr += table_size; -+ pci_addr += table_size; -+ remaining -= table_size; -+ (*num)++; -+ } -+ -+ if (remaining) -+ dev_warn(pcie->dev, "not enough translate table for addr: %#llx, limited to [%d]\n", -+ (unsigned long long)cpu_addr, PCIE_MAX_TRANS_TABLES); - - return 0; - } -@@ -380,30 +405,20 @@ static int mtk_pcie_startup_port(struct mtk_gen3_pcie *pcie) - resource_size_t cpu_addr; - resource_size_t pci_addr; - resource_size_t size; -- const char *range_type; - -- if (type == IORESOURCE_IO) { -+ if (type == IORESOURCE_IO) - cpu_addr = pci_pio_to_address(res->start); -- range_type = "IO"; -- } else if (type == IORESOURCE_MEM) { -+ else if (type == IORESOURCE_MEM) - cpu_addr = res->start; -- range_type = "MEM"; -- } else { -+ else - continue; -- } - - pci_addr = res->start - entry->offset; - size = resource_size(res); - err = mtk_pcie_set_trans_table(pcie, cpu_addr, pci_addr, size, -- type, table_index); -+ type, &table_index); - if (err) - return err; -- -- dev_dbg(pcie->dev, "set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n", -- range_type, table_index, (unsigned long long)cpu_addr, -- (unsigned long long)pci_addr, (unsigned long long)size); -- -- table_index++; - } - - return 0; -diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c -index ae5ad05ddc1d4..11bdef206d120 100644 ---- a/drivers/pci/controller/pcie-mediatek.c -+++ b/drivers/pci/controller/pcie-mediatek.c -@@ -617,12 +617,18 @@ static void mtk_pcie_intr_handler(struct irq_desc *desc) - if (status & MSI_STATUS){ - unsigned long imsi_status; - -+ /* -+ * The interrupt status can be cleared even if the -+ * MSI status remains pending. As such, given the -+ * edge-triggered interrupt type, its status should -+ * be cleared before being dispatched to the -+ * handler of the underlying device. -+ */ -+ writel(MSI_STATUS, port->base + PCIE_INT_STATUS); - while ((imsi_status = readl(port->base + PCIE_IMSI_STATUS))) { - for_each_set_bit(bit, &imsi_status, MTK_MSI_IRQS_NUM) - generic_handle_domain_irq(port->inner_domain, bit); - } -- /* Clear MSI interrupt status */ -- writel(MSI_STATUS, port->base + PCIE_INT_STATUS); - } - } - -diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c -index 483bb65651665..40477d1d41b59 100644 ---- a/drivers/platform/x86/intel/vsec.c -+++ b/drivers/platform/x86/intel/vsec.c -@@ -124,36 +124,60 @@ static void intel_vsec_remove_aux(void *data) - auxiliary_device_uninit(data); - } - -+static DEFINE_MUTEX(vsec_ida_lock); -+ - static void intel_vsec_dev_release(struct device *dev) - { - struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev); - -+ xa_erase(&auxdev_array, intel_vsec_dev->id); -+ -+ mutex_lock(&vsec_ida_lock); - ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id); -+ mutex_unlock(&vsec_ida_lock); -+ - kfree(intel_vsec_dev->resource); - kfree(intel_vsec_dev); - } - --static int intel_vsec_add_aux(struct pci_dev *pdev, struct intel_vsec_device *intel_vsec_dev, -- const char *name) -+int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent, -+ struct intel_vsec_device *intel_vsec_dev, -+ const char *name) - { - struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev; - int ret, id; - -- ret = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL); -+ ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev, -+ PMT_XA_LIMIT, GFP_KERNEL); - if (ret < 0) { - kfree(intel_vsec_dev->resource); - kfree(intel_vsec_dev); - return ret; - } - -- auxdev->id = ret; -+ mutex_lock(&vsec_ida_lock); -+ id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL); -+ mutex_unlock(&vsec_ida_lock); -+ if (id < 0) { -+ xa_erase(&auxdev_array, intel_vsec_dev->id); -+ kfree(intel_vsec_dev->resource); -+ kfree(intel_vsec_dev); -+ return id; -+ } -+ -+ if (!parent) -+ parent = &pdev->dev; -+ -+ auxdev->id = id; - auxdev->name = name; -- auxdev->dev.parent = &pdev->dev; -+ auxdev->dev.parent = parent; - auxdev->dev.release = intel_vsec_dev_release; - - ret = auxiliary_device_init(auxdev); - if (ret < 0) { -+ mutex_lock(&vsec_ida_lock); - ida_free(intel_vsec_dev->ida, auxdev->id); -+ mutex_unlock(&vsec_ida_lock); - kfree(intel_vsec_dev->resource); - kfree(intel_vsec_dev); - return ret; -@@ -165,19 +189,14 @@ static int intel_vsec_add_aux(struct pci_dev *pdev, struct intel_vsec_device *in - return ret; - } - -- ret = devm_add_action_or_reset(&pdev->dev, intel_vsec_remove_aux, -+ ret = devm_add_action_or_reset(parent, intel_vsec_remove_aux, - auxdev); - if (ret < 0) - return ret; - -- /* Add auxdev to list */ -- ret = xa_alloc(&auxdev_array, &id, intel_vsec_dev, PMT_XA_LIMIT, -- GFP_KERNEL); -- if (ret) -- return ret; -- - return 0; - } -+EXPORT_SYMBOL_NS_GPL(intel_vsec_add_aux, INTEL_VSEC); - - static int intel_vsec_add_dev(struct pci_dev *pdev, struct intel_vsec_header *header, - struct intel_vsec_platform_info *info) -@@ -235,7 +254,8 @@ static int intel_vsec_add_dev(struct pci_dev *pdev, struct intel_vsec_header *he - else - intel_vsec_dev->ida = &intel_vsec_ida; - -- return intel_vsec_add_aux(pdev, intel_vsec_dev, intel_vsec_name(header->id)); -+ return intel_vsec_add_aux(pdev, NULL, intel_vsec_dev, -+ intel_vsec_name(header->id)); - } - - static bool intel_vsec_walk_header(struct pci_dev *pdev, -diff --git a/drivers/platform/x86/intel/vsec.h b/drivers/platform/x86/intel/vsec.h -index 3deeb05cf394d..330672588868d 100644 ---- a/drivers/platform/x86/intel/vsec.h -+++ b/drivers/platform/x86/intel/vsec.h -@@ -38,8 +38,15 @@ struct intel_vsec_device { - struct ida *ida; - struct intel_vsec_platform_info *info; - int num_resources; -+ int id; /* xa */ -+ void *priv_data; -+ size_t priv_data_size; - }; - -+int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent, -+ struct intel_vsec_device *intel_vsec_dev, -+ const char *name); -+ - static inline struct intel_vsec_device *dev_to_ivdev(struct device *dev) - { - return container_of(dev, struct intel_vsec_device, auxdev.dev); -diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c -index 01ad84fd147c8..686eb8d86e221 100644 ---- a/drivers/power/supply/bq256xx_charger.c -+++ b/drivers/power/supply/bq256xx_charger.c -@@ -1514,13 +1514,16 @@ static int bq256xx_hw_init(struct bq256xx_device *bq) - wd_reg_val = i; - break; - } -- if (bq->watchdog_timer > bq256xx_watchdog_time[i] && -+ if (i + 1 < BQ256XX_NUM_WD_VAL && -+ bq->watchdog_timer > bq256xx_watchdog_time[i] && - bq->watchdog_timer < bq256xx_watchdog_time[i + 1]) - wd_reg_val = i; - } - ret = regmap_update_bits(bq->regmap, BQ256XX_CHARGER_CONTROL_1, - BQ256XX_WATCHDOG_MASK, wd_reg_val << - BQ256XX_WDT_BIT_SHIFT); -+ if (ret) -+ return ret; - - ret = power_supply_get_battery_info(bq->charger, &bat_info); - if (ret == -ENOMEM) -diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c -index 473522b4326ad..9d957cf8edf07 100644 ---- a/drivers/power/supply/cw2015_battery.c -+++ b/drivers/power/supply/cw2015_battery.c -@@ -491,7 +491,7 @@ static int cw_battery_get_property(struct power_supply *psy, - - case POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW: - if (cw_battery_valid_time_to_empty(cw_bat)) -- val->intval = cw_bat->time_to_empty; -+ val->intval = cw_bat->time_to_empty * 60; - else - val->intval = 0; - break; -diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c -index d333e7422f4a9..9726f96bf7635 100644 ---- a/drivers/pwm/core.c -+++ b/drivers/pwm/core.c -@@ -171,7 +171,7 @@ of_pwm_single_xlate(struct pwm_chip *pc, const struct of_phandle_args *args) - pwm->args.period = args->args[0]; - pwm->args.polarity = PWM_POLARITY_NORMAL; - -- if (args->args_count == 2 && args->args[2] & PWM_POLARITY_INVERTED) -+ if (args->args_count == 2 && args->args[1] & PWM_POLARITY_INVERTED) - pwm->args.polarity = PWM_POLARITY_INVERSED; - - return pwm; -diff --git a/drivers/pwm/pwm-jz4740.c b/drivers/pwm/pwm-jz4740.c -index a5fdf97c0d2ec..246499128142c 100644 ---- a/drivers/pwm/pwm-jz4740.c -+++ b/drivers/pwm/pwm-jz4740.c -@@ -60,9 +60,10 @@ static int jz4740_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) - snprintf(name, sizeof(name), "timer%u", pwm->hwpwm); - - clk = clk_get(chip->dev, name); -- if (IS_ERR(clk)) -- return dev_err_probe(chip->dev, PTR_ERR(clk), -- "Failed to get clock\n"); -+ if (IS_ERR(clk)) { -+ dev_err(chip->dev, "error %pe: Failed to get clock\n", clk); -+ return PTR_ERR(clk); -+ } - - err = clk_prepare_enable(clk); - if (err < 0) { -diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c -index 794ca5b029681..bdcdb7f38312b 100644 ---- a/drivers/pwm/pwm-stm32.c -+++ b/drivers/pwm/pwm-stm32.c -@@ -115,14 +115,14 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm, - int ret; - - /* Ensure registers have been updated, enable counter and capture */ -- regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG); -- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN); -+ regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG); -+ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); - - /* Use cc1 or cc3 DMA resp for PWM input channels 1 & 2 or 3 & 4 */ - dma_id = pwm->hwpwm < 2 ? STM32_TIMERS_DMA_CH1 : STM32_TIMERS_DMA_CH3; - ccen = pwm->hwpwm < 2 ? TIM_CCER_CC12E : TIM_CCER_CC34E; - ccr = pwm->hwpwm < 2 ? TIM_CCR1 : TIM_CCR3; -- regmap_update_bits(priv->regmap, TIM_CCER, ccen, ccen); -+ regmap_set_bits(priv->regmap, TIM_CCER, ccen); - - /* - * Timer DMA burst mode. Request 2 registers, 2 bursts, to get both -@@ -160,8 +160,8 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm, - } - - stop: -- regmap_update_bits(priv->regmap, TIM_CCER, ccen, 0); -- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0); -+ regmap_clear_bits(priv->regmap, TIM_CCER, ccen); -+ regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); - - return ret; - } -@@ -359,7 +359,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch, - - regmap_write(priv->regmap, TIM_PSC, prescaler); - regmap_write(priv->regmap, TIM_ARR, prd - 1); -- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE); -+ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE); - - /* Calculate the duty cycles */ - dty = prd * duty_ns; -@@ -377,7 +377,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch, - else - regmap_update_bits(priv->regmap, TIM_CCMR2, mask, ccmr); - -- regmap_update_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE, TIM_BDTR_MOE); -+ regmap_set_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE); - - return 0; - } -@@ -411,13 +411,13 @@ static int stm32_pwm_enable(struct stm32_pwm *priv, int ch) - if (priv->have_complementary_output) - mask |= TIM_CCER_CC1NE << (ch * 4); - -- regmap_update_bits(priv->regmap, TIM_CCER, mask, mask); -+ regmap_set_bits(priv->regmap, TIM_CCER, mask); - - /* Make sure that registers are updated */ -- regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG); -+ regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG); - - /* Enable controller */ -- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN); -+ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); - - return 0; - } -@@ -431,11 +431,11 @@ static void stm32_pwm_disable(struct stm32_pwm *priv, int ch) - if (priv->have_complementary_output) - mask |= TIM_CCER_CC1NE << (ch * 4); - -- regmap_update_bits(priv->regmap, TIM_CCER, mask, 0); -+ regmap_clear_bits(priv->regmap, TIM_CCER, mask); - - /* When all channels are disabled, we can disable the controller */ - if (!active_channels(priv)) -- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0); -+ regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); - - clk_disable(priv->clk); - } -@@ -568,41 +568,30 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv) - * If complementary bit doesn't exist writing 1 will have no - * effect so we can detect it. - */ -- regmap_update_bits(priv->regmap, -- TIM_CCER, TIM_CCER_CC1NE, TIM_CCER_CC1NE); -+ regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE); - regmap_read(priv->regmap, TIM_CCER, &ccer); -- regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE, 0); -+ regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE); - - priv->have_complementary_output = (ccer != 0); - } - --static int stm32_pwm_detect_channels(struct stm32_pwm *priv) -+static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv, -+ unsigned int *num_enabled) - { -- u32 ccer; -- int npwm = 0; -+ u32 ccer, ccer_backup; - - /* - * If channels enable bits don't exist writing 1 will have no - * effect so we can detect and count them. - */ -- regmap_update_bits(priv->regmap, -- TIM_CCER, TIM_CCER_CCXE, TIM_CCER_CCXE); -+ regmap_read(priv->regmap, TIM_CCER, &ccer_backup); -+ regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); - regmap_read(priv->regmap, TIM_CCER, &ccer); -- regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE, 0); -- -- if (ccer & TIM_CCER_CC1E) -- npwm++; -+ regmap_write(priv->regmap, TIM_CCER, ccer_backup); - -- if (ccer & TIM_CCER_CC2E) -- npwm++; -+ *num_enabled = hweight32(ccer_backup & TIM_CCER_CCXE); - -- if (ccer & TIM_CCER_CC3E) -- npwm++; -- -- if (ccer & TIM_CCER_CC4E) -- npwm++; -- -- return npwm; -+ return hweight32(ccer & TIM_CCER_CCXE); - } - - static int stm32_pwm_probe(struct platform_device *pdev) -@@ -611,6 +600,8 @@ static int stm32_pwm_probe(struct platform_device *pdev) - struct device_node *np = dev->of_node; - struct stm32_timers *ddata = dev_get_drvdata(pdev->dev.parent); - struct stm32_pwm *priv; -+ unsigned int num_enabled; -+ unsigned int i; - int ret; - - priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); -@@ -633,7 +624,11 @@ static int stm32_pwm_probe(struct platform_device *pdev) - - priv->chip.dev = dev; - priv->chip.ops = &stm32pwm_ops; -- priv->chip.npwm = stm32_pwm_detect_channels(priv); -+ priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled); -+ -+ /* Initialize clock refcount to number of enabled PWM channels. */ -+ for (i = 0; i < num_enabled; i++) -+ clk_enable(priv->clk); - - ret = pwmchip_add(&priv->chip); - if (ret < 0) -diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c -index 6fedc3b7d1ab2..eb895a65ea8fc 100644 ---- a/drivers/scsi/fnic/fnic_debugfs.c -+++ b/drivers/scsi/fnic/fnic_debugfs.c -@@ -52,9 +52,10 @@ int fnic_debugfs_init(void) - fc_trc_flag->fnic_trace = 2; - fc_trc_flag->fc_trace = 3; - fc_trc_flag->fc_clear = 4; -+ return 0; - } - -- return 0; -+ return -ENOMEM; - } - - /* -diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c -index a8142e2b96435..450a8578157cb 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_main.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c -@@ -1502,12 +1502,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done); - static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba) - { - if (!hisi_hba->hw->soft_reset) -- return -1; -+ return -ENOENT; - - down(&hisi_hba->sem); - if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) { - up(&hisi_hba->sem); -- return -1; -+ return -EPERM; - } - - if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) -diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -index c4305ec38ebf3..0c80ff9affa39 100644 ---- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c -@@ -3330,7 +3330,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba) - u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL].data; - int i; - -- for (i = 0; i < debugfs_axi_reg.count; i++, databuf++) -+ for (i = 0; i < debugfs_global_reg.count; i++, databuf++) - *databuf = hisi_sas_read32(hisi_hba, 4 * i); - } - -@@ -4946,6 +4946,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) - { - struct sas_ha_struct *sha = pci_get_drvdata(pdev); - struct hisi_hba *hisi_hba = sha->lldd_ha; -+ struct Scsi_Host *shost = hisi_hba->shost; - struct device *dev = hisi_hba->dev; - int rc; - -@@ -4954,6 +4955,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) - rc = hw_init_v3_hw(hisi_hba); - if (rc) { - dev_err(dev, "FLR: hw init failed rc=%d\n", rc); -+ clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags); -+ scsi_unblock_requests(shost); -+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); -+ up(&hisi_hba->sem); - return; - } - -@@ -4981,7 +4986,7 @@ static int _suspend_v3_hw(struct device *device) - } - - if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) -- return -1; -+ return -EPERM; - - dev_warn(dev, "entering suspend state\n"); - -diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c -index d10c6afb7f9cd..8c662d08706f1 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_app.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c -@@ -223,6 +223,22 @@ static long mpi3mr_bsg_pel_enable(struct mpi3mr_ioc *mrioc, - return rval; - } - -+ if (mrioc->unrecoverable) { -+ dprint_bsg_err(mrioc, "%s: unrecoverable controller\n", -+ __func__); -+ return -EFAULT; -+ } -+ -+ if (mrioc->reset_in_progress) { -+ dprint_bsg_err(mrioc, "%s: reset in progress\n", __func__); -+ return -EAGAIN; -+ } -+ -+ if (mrioc->stop_bsgs) { -+ dprint_bsg_err(mrioc, "%s: bsgs are blocked\n", __func__); -+ return -EAGAIN; -+ } -+ - sg_copy_to_buffer(job->request_payload.sg_list, - job->request_payload.sg_cnt, - &pel_enable, sizeof(pel_enable)); -diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c -index 6d55698ea4d16..85f5b349c7e43 100644 ---- a/drivers/scsi/mpi3mr/mpi3mr_os.c -+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c -@@ -1044,8 +1044,14 @@ void mpi3mr_rfresh_tgtdevs(struct mpi3mr_ioc *mrioc) - tgtdev = NULL; - list_for_each_entry(tgtdev, &mrioc->tgtdev_list, list) { - if ((tgtdev->dev_handle != MPI3MR_INVALID_DEV_HANDLE) && -- !tgtdev->is_hidden && !tgtdev->host_exposed) -- mpi3mr_report_tgtdev_to_host(mrioc, tgtdev->perst_id); -+ !tgtdev->is_hidden) { -+ if (!tgtdev->host_exposed) -+ mpi3mr_report_tgtdev_to_host(mrioc, -+ tgtdev->perst_id); -+ else if (tgtdev->starget) -+ starget_for_each_device(tgtdev->starget, -+ (void *)tgtdev, mpi3mr_update_sdev); -+ } - } - } - -diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c -index bc400669ee022..16a05143d0d62 100644 ---- a/drivers/soc/qcom/llcc-qcom.c -+++ b/drivers/soc/qcom/llcc-qcom.c -@@ -680,14 +680,14 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config, - u32 disable_cap_alloc, retain_pc; - - disable_cap_alloc = config->dis_cap_alloc << config->slice_id; -- ret = regmap_write(drv_data->bcast_regmap, -- LLCC_TRP_SCID_DIS_CAP_ALLOC, disable_cap_alloc); -+ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_SCID_DIS_CAP_ALLOC, -+ BIT(config->slice_id), disable_cap_alloc); - if (ret) - return ret; - - retain_pc = config->retain_on_pc << config->slice_id; -- ret = regmap_write(drv_data->bcast_regmap, -- LLCC_TRP_PCB_ACT, retain_pc); -+ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_PCB_ACT, -+ BIT(config->slice_id), retain_pc); - if (ret) - return ret; - } -diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig -index 946e2186d2448..15ea11ebcbe09 100644 ---- a/drivers/spi/Kconfig -+++ b/drivers/spi/Kconfig -@@ -1101,9 +1101,10 @@ config SPI_ZYNQ_QSPI - - config SPI_ZYNQMP_GQSPI - tristate "Xilinx ZynqMP GQSPI controller" -- depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST -+ depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST - help - Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC. -+ This controller only supports SPI memory interface. - - config SPI_AMD - tristate "AMD SPI controller" -diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c -index 9bca3d076f053..51ceaa4857249 100644 ---- a/drivers/spi/spi-sh-msiof.c -+++ b/drivers/spi/spi-sh-msiof.c -@@ -30,12 +30,15 @@ - - #include - -+#define SH_MSIOF_FLAG_FIXED_DTDL_200 BIT(0) -+ - struct sh_msiof_chipdata { - u32 bits_per_word_mask; - u16 tx_fifo_size; - u16 rx_fifo_size; - u16 ctlr_flags; - u16 min_div_pow; -+ u32 flags; - }; - - struct sh_msiof_spi_priv { -@@ -1073,6 +1076,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = { - .min_div_pow = 1, - }; - -+static const struct sh_msiof_chipdata rcar_r8a7795_data = { -+ .bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16) | -+ SPI_BPW_MASK(24) | SPI_BPW_MASK(32), -+ .tx_fifo_size = 64, -+ .rx_fifo_size = 64, -+ .ctlr_flags = SPI_CONTROLLER_MUST_TX, -+ .min_div_pow = 1, -+ .flags = SH_MSIOF_FLAG_FIXED_DTDL_200, -+}; -+ - static const struct of_device_id sh_msiof_match[] = { - { .compatible = "renesas,sh-mobile-msiof", .data = &sh_data }, - { .compatible = "renesas,msiof-r8a7743", .data = &rcar_gen2_data }, -@@ -1083,6 +1096,7 @@ static const struct of_device_id sh_msiof_match[] = { - { .compatible = "renesas,msiof-r8a7793", .data = &rcar_gen2_data }, - { .compatible = "renesas,msiof-r8a7794", .data = &rcar_gen2_data }, - { .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data }, -+ { .compatible = "renesas,msiof-r8a7795", .data = &rcar_r8a7795_data }, - { .compatible = "renesas,msiof-r8a7796", .data = &rcar_gen3_data }, - { .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data }, - { .compatible = "renesas,rcar-gen4-msiof", .data = &rcar_gen3_data }, -@@ -1280,6 +1294,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev) - return -ENXIO; - } - -+ if (chipdata->flags & SH_MSIOF_FLAG_FIXED_DTDL_200) -+ info->dtdl = 200; -+ - if (info->mode == MSIOF_SPI_SLAVE) - ctlr = spi_alloc_slave(&pdev->dev, - sizeof(struct sh_msiof_spi_priv)); -diff --git a/drivers/spmi/spmi-mtk-pmif.c b/drivers/spmi/spmi-mtk-pmif.c -index ad511f2c3324e..01e8851e639d5 100644 ---- a/drivers/spmi/spmi-mtk-pmif.c -+++ b/drivers/spmi/spmi-mtk-pmif.c -@@ -50,6 +50,7 @@ struct pmif { - struct clk_bulk_data clks[PMIF_MAX_CLKS]; - size_t nclks; - const struct pmif_data *data; -+ raw_spinlock_t lock; - }; - - static const char * const pmif_clock_names[] = { -@@ -314,6 +315,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - struct ch_reg *inf_reg; - int ret; - u32 data, cmd; -+ unsigned long flags; - - /* Check for argument validation. */ - if (sid & ~0xf) { -@@ -334,6 +336,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - else - return -EINVAL; - -+ raw_spin_lock_irqsave(&arb->lock, flags); - /* Wait for Software Interface FSM state to be IDLE. */ - inf_reg = &arb->chan; - ret = readl_poll_timeout_atomic(arb->base + arb->data->regs[inf_reg->ch_sta], -@@ -343,6 +346,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - /* set channel ready if the data has transferred */ - if (pmif_is_fsm_vldclr(arb)) - pmif_writel(arb, 1, inf_reg->ch_rdy); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - dev_err(&ctrl->dev, "failed to wait for SWINF_IDLE\n"); - return ret; - } -@@ -350,6 +354,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - /* Send the command. */ - cmd = (opc << 30) | (sid << 24) | ((len - 1) << 16) | addr; - pmif_writel(arb, cmd, inf_reg->ch_send); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - - /* - * Wait for Software Interface FSM state to be WFVLDCLR, -@@ -376,7 +381,8 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - struct pmif *arb = spmi_controller_get_drvdata(ctrl); - struct ch_reg *inf_reg; - int ret; -- u32 data, cmd; -+ u32 data, wdata, cmd; -+ unsigned long flags; - - if (len > 4) { - dev_err(&ctrl->dev, "pmif supports 1..4 bytes per trans, but:%zu requested", len); -@@ -394,6 +400,10 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - else - return -EINVAL; - -+ /* Set the write data. */ -+ memcpy(&wdata, buf, len); -+ -+ raw_spin_lock_irqsave(&arb->lock, flags); - /* Wait for Software Interface FSM state to be IDLE. */ - inf_reg = &arb->chan; - ret = readl_poll_timeout_atomic(arb->base + arb->data->regs[inf_reg->ch_sta], -@@ -403,17 +413,17 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid, - /* set channel ready if the data has transferred */ - if (pmif_is_fsm_vldclr(arb)) - pmif_writel(arb, 1, inf_reg->ch_rdy); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - dev_err(&ctrl->dev, "failed to wait for SWINF_IDLE\n"); - return ret; - } - -- /* Set the write data. */ -- memcpy(&data, buf, len); -- pmif_writel(arb, data, inf_reg->wdata); -+ pmif_writel(arb, wdata, inf_reg->wdata); - - /* Send the command. */ - cmd = (opc << 30) | BIT(29) | (sid << 24) | ((len - 1) << 16) | addr; - pmif_writel(arb, cmd, inf_reg->ch_send); -+ raw_spin_unlock_irqrestore(&arb->lock, flags); - - return 0; - } -@@ -488,6 +498,8 @@ static int mtk_spmi_probe(struct platform_device *pdev) - arb->chan.ch_send = PMIF_SWINF_0_ACC + chan_offset; - arb->chan.ch_rdy = PMIF_SWINF_0_VLD_CLR + chan_offset; - -+ raw_spin_lock_init(&arb->lock); -+ - platform_set_drvdata(pdev, ctrl); - - err = spmi_controller_add(ctrl); -diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c -index a9bd1e71ea487..d16cf4115d03a 100644 ---- a/drivers/staging/media/rkvdec/rkvdec.c -+++ b/drivers/staging/media/rkvdec/rkvdec.c -@@ -461,6 +461,9 @@ static const struct v4l2_ioctl_ops rkvdec_ioctl_ops = { - - .vidioc_streamon = v4l2_m2m_ioctl_streamon, - .vidioc_streamoff = v4l2_m2m_ioctl_streamoff, -+ -+ .vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd, -+ .vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd, - }; - - static int rkvdec_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers, -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index 7e81a53dbf3ca..8d74e97c98748 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -338,11 +338,13 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, - } - - iov_iter_bvec(&iter, is_write, bvec, sgl_nents, len); -- if (is_write) -+ if (is_write) { -+ file_start_write(fd); - ret = vfs_iter_write(fd, &iter, &pos, 0); -- else -+ file_end_write(fd); -+ } else { - ret = vfs_iter_read(fd, &iter, &pos, 0); -- -+ } - if (is_write) { - if (ret < 0 || ret != data_length) { - pr_err("%s() write returned %d\n", __func__, ret); -@@ -474,7 +476,9 @@ fd_execute_write_same(struct se_cmd *cmd) - } - - iov_iter_bvec(&iter, ITER_SOURCE, bvec, nolb, len); -+ file_start_write(fd_dev->fd_file); - ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0); -+ file_end_write(fd_dev->fd_file); - - kfree(bvec); - if (ret < 0 || ret != len) { -diff --git a/drivers/tty/serial/8250/8250_bcm2835aux.c b/drivers/tty/serial/8250/8250_bcm2835aux.c -index 15a2387a5b258..4f4502fb5454c 100644 ---- a/drivers/tty/serial/8250/8250_bcm2835aux.c -+++ b/drivers/tty/serial/8250/8250_bcm2835aux.c -@@ -119,6 +119,8 @@ static int bcm2835aux_serial_probe(struct platform_device *pdev) - - /* get the clock - this also enables the HW */ - data->clk = devm_clk_get_optional(&pdev->dev, NULL); -+ if (IS_ERR(data->clk)) -+ return dev_err_probe(&pdev->dev, PTR_ERR(data->clk), "could not get clk\n"); - - /* get the interrupt */ - ret = platform_get_irq(pdev, 0); -diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c -index b406cba10b0eb..dca1abe363248 100644 ---- a/drivers/tty/serial/8250/8250_exar.c -+++ b/drivers/tty/serial/8250/8250_exar.c -@@ -442,7 +442,7 @@ static int generic_rs485_config(struct uart_port *port, struct ktermios *termios - } - - static const struct serial_rs485 generic_rs485_supported = { -- .flags = SER_RS485_ENABLED, -+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND, - }; - - static const struct exar8250_platform exar8250_default_platform = { -@@ -486,7 +486,8 @@ static int iot2040_rs485_config(struct uart_port *port, struct ktermios *termios - } - - static const struct serial_rs485 iot2040_rs485_supported = { -- .flags = SER_RS485_ENABLED | SER_RS485_RX_DURING_TX | SER_RS485_TERMINATE_BUS, -+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | -+ SER_RS485_RX_DURING_TX | SER_RS485_TERMINATE_BUS, - }; - - static const struct property_entry iot2040_gpio_properties[] = { -diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c -index 0b04d810b3e61..037d613006f56 100644 ---- a/drivers/tty/serial/8250/8250_omap.c -+++ b/drivers/tty/serial/8250/8250_omap.c -@@ -1476,7 +1476,7 @@ static int omap8250_remove(struct platform_device *pdev) - - err = pm_runtime_resume_and_get(&pdev->dev); - if (err) -- return err; -+ dev_err(&pdev->dev, "Failed to resume hardware\n"); - - serial8250_unregister_port(priv->line); - priv->line = -ENODEV; -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index d2137f6eff327..f8962a3d44216 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -450,13 +450,13 @@ static void imx_uart_stop_tx(struct uart_port *port) - ucr1 = imx_uart_readl(sport, UCR1); - imx_uart_writel(sport, ucr1 & ~UCR1_TRDYEN, UCR1); - -+ ucr4 = imx_uart_readl(sport, UCR4); - usr2 = imx_uart_readl(sport, USR2); -- if (!(usr2 & USR2_TXDC)) { -+ if ((!(usr2 & USR2_TXDC)) && (ucr4 & UCR4_TCEN)) { - /* The shifter is still busy, so retry once TC triggers */ - return; - } - -- ucr4 = imx_uart_readl(sport, UCR4); - ucr4 &= ~UCR4_TCEN; - imx_uart_writel(sport, ucr4, UCR4); - -@@ -2229,7 +2229,6 @@ static enum hrtimer_restart imx_trigger_stop_tx(struct hrtimer *t) - return HRTIMER_NORESTART; - } - --static const struct serial_rs485 imx_no_rs485 = {}; /* No RS485 if no RTS */ - static const struct serial_rs485 imx_rs485_supported = { - .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND | - SER_RS485_RX_DURING_TX, -@@ -2319,8 +2318,6 @@ static int imx_uart_probe(struct platform_device *pdev) - /* RTS is required to control the RS485 transmitter */ - if (sport->have_rtscts || sport->have_rtsgpio) - sport->port.rs485_supported = imx_rs485_supported; -- else -- sport->port.rs485_supported = imx_no_rs485; - sport->port.flags = UPF_BOOT_AUTOCONF; - timer_setup(&sport->timer, imx_uart_timeout, 0); - -@@ -2347,7 +2344,7 @@ static int imx_uart_probe(struct platform_device *pdev) - /* For register access, we only need to enable the ipg clock. */ - ret = clk_prepare_enable(sport->clk_ipg); - if (ret) { -- dev_err(&pdev->dev, "failed to enable per clk: %d\n", ret); -+ dev_err(&pdev->dev, "failed to enable ipg clk: %d\n", ret); - return ret; - } - -@@ -2359,14 +2356,8 @@ static int imx_uart_probe(struct platform_device *pdev) - sport->ufcr = readl(sport->port.membase + UFCR); - - ret = uart_get_rs485_mode(&sport->port); -- if (ret) { -- clk_disable_unprepare(sport->clk_ipg); -- return ret; -- } -- -- if (sport->port.rs485.flags & SER_RS485_ENABLED && -- (!sport->have_rtscts && !sport->have_rtsgpio)) -- dev_err(&pdev->dev, "no RTS control, disabling rs485\n"); -+ if (ret) -+ goto err_clk; - - /* - * If using the i.MX UART RTS/CTS control then the RTS (CTS_B) -@@ -2446,8 +2437,6 @@ static int imx_uart_probe(struct platform_device *pdev) - imx_uart_writel(sport, ucr3, UCR3); - } - -- clk_disable_unprepare(sport->clk_ipg); -- - hrtimer_init(&sport->trigger_start_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - hrtimer_init(&sport->trigger_stop_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - sport->trigger_start_tx.function = imx_trigger_start_tx; -@@ -2463,7 +2452,7 @@ static int imx_uart_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "failed to request rx irq: %d\n", - ret); -- return ret; -+ goto err_clk; - } - - ret = devm_request_irq(&pdev->dev, txirq, imx_uart_txint, 0, -@@ -2471,7 +2460,7 @@ static int imx_uart_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "failed to request tx irq: %d\n", - ret); -- return ret; -+ goto err_clk; - } - - ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0, -@@ -2479,14 +2468,14 @@ static int imx_uart_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, "failed to request rts irq: %d\n", - ret); -- return ret; -+ goto err_clk; - } - } else { - ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0, - dev_name(&pdev->dev), sport); - if (ret) { - dev_err(&pdev->dev, "failed to request irq: %d\n", ret); -- return ret; -+ goto err_clk; - } - } - -@@ -2494,7 +2483,12 @@ static int imx_uart_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, sport); - -- return uart_add_one_port(&imx_uart_uart_driver, &sport->port); -+ ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port); -+ -+err_clk: -+ clk_disable_unprepare(sport->clk_ipg); -+ -+ return ret; - } - - static int imx_uart_remove(struct platform_device *pdev) -diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c -index 7d0d2718ef595..beb7896ebf8ae 100644 ---- a/drivers/tty/serial/omap-serial.c -+++ b/drivers/tty/serial/omap-serial.c -@@ -1512,6 +1512,13 @@ static struct omap_uart_port_info *of_get_uart_port_info(struct device *dev) - return omap_up_info; - } - -+static const struct serial_rs485 serial_omap_rs485_supported = { -+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND | -+ SER_RS485_RX_DURING_TX, -+ .delay_rts_before_send = 1, -+ .delay_rts_after_send = 1, -+}; -+ - static int serial_omap_probe_rs485(struct uart_omap_port *up, - struct device *dev) - { -@@ -1526,6 +1533,9 @@ static int serial_omap_probe_rs485(struct uart_omap_port *up, - if (!np) - return 0; - -+ up->port.rs485_config = serial_omap_config_rs485; -+ up->port.rs485_supported = serial_omap_rs485_supported; -+ - ret = uart_get_rs485_mode(&up->port); - if (ret) - return ret; -@@ -1560,13 +1570,6 @@ static int serial_omap_probe_rs485(struct uart_omap_port *up, - return 0; - } - --static const struct serial_rs485 serial_omap_rs485_supported = { -- .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND | -- SER_RS485_RX_DURING_TX, -- .delay_rts_before_send = 1, -- .delay_rts_after_send = 1, --}; -- - static int serial_omap_probe(struct platform_device *pdev) - { - struct omap_uart_port_info *omap_up_info = dev_get_platdata(&pdev->dev); -@@ -1634,17 +1637,11 @@ static int serial_omap_probe(struct platform_device *pdev) - dev_info(up->port.dev, "no wakeirq for uart%d\n", - up->port.line); - -- ret = serial_omap_probe_rs485(up, &pdev->dev); -- if (ret < 0) -- goto err_rs485; -- - sprintf(up->name, "OMAP UART%d", up->port.line); - up->port.mapbase = mem->start; - up->port.membase = base; - up->port.flags = omap_up_info->flags; - up->port.uartclk = omap_up_info->uartclk; -- up->port.rs485_config = serial_omap_config_rs485; -- up->port.rs485_supported = serial_omap_rs485_supported; - if (!up->port.uartclk) { - up->port.uartclk = DEFAULT_CLK_SPEED; - dev_warn(&pdev->dev, -@@ -1652,6 +1649,10 @@ static int serial_omap_probe(struct platform_device *pdev) - DEFAULT_CLK_SPEED); - } - -+ ret = serial_omap_probe_rs485(up, &pdev->dev); -+ if (ret < 0) -+ goto err_rs485; -+ - up->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE; - up->calc_latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE; - cpu_latency_qos_add_request(&up->pm_qos_request, up->latency); -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index b4b849415c503..db33790e66754 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - #include - - #define SC16IS7XX_NAME "sc16is7xx" -@@ -1716,9 +1717,12 @@ static int sc16is7xx_spi_probe(struct spi_device *spi) - - /* Setup SPI bus */ - spi->bits_per_word = 8; -- /* only supports mode 0 on SC16IS762 */ -+ /* For all variants, only mode 0 is supported */ -+ if ((spi->mode & SPI_MODE_X_MASK) != SPI_MODE_0) -+ return dev_err_probe(&spi->dev, -EINVAL, "Unsupported SPI mode\n"); -+ - spi->mode = spi->mode ? : SPI_MODE_0; -- spi->max_speed_hz = spi->max_speed_hz ? : 15000000; -+ spi->max_speed_hz = spi->max_speed_hz ? : 4 * HZ_PER_MHZ; - ret = spi_setup(spi); - if (ret) - return ret; -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index d4e57f9017db9..f0ed30d0a697c 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -1353,19 +1353,27 @@ static void uart_sanitize_serial_rs485(struct uart_port *port, struct serial_rs4 - return; - } - -+ rs485->flags &= supported_flags; -+ - /* Pick sane settings if the user hasn't */ -- if ((supported_flags & (SER_RS485_RTS_ON_SEND|SER_RS485_RTS_AFTER_SEND)) && -- !(rs485->flags & SER_RS485_RTS_ON_SEND) == -+ if (!(rs485->flags & SER_RS485_RTS_ON_SEND) == - !(rs485->flags & SER_RS485_RTS_AFTER_SEND)) { -- dev_warn_ratelimited(port->dev, -- "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n", -- port->name, port->line); -- rs485->flags |= SER_RS485_RTS_ON_SEND; -- rs485->flags &= ~SER_RS485_RTS_AFTER_SEND; -- supported_flags |= SER_RS485_RTS_ON_SEND|SER_RS485_RTS_AFTER_SEND; -- } -+ if (supported_flags & SER_RS485_RTS_ON_SEND) { -+ rs485->flags |= SER_RS485_RTS_ON_SEND; -+ rs485->flags &= ~SER_RS485_RTS_AFTER_SEND; - -- rs485->flags &= supported_flags; -+ dev_warn_ratelimited(port->dev, -+ "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n", -+ port->name, port->line); -+ } else { -+ rs485->flags |= SER_RS485_RTS_AFTER_SEND; -+ rs485->flags &= ~SER_RS485_RTS_ON_SEND; -+ -+ dev_warn_ratelimited(port->dev, -+ "%s (%d): invalid RTS setting, using RTS_AFTER_SEND instead\n", -+ port->name, port->line); -+ } -+ } - - uart_sanitize_serial_rs485_delays(port, rs485); - -@@ -1428,7 +1436,7 @@ static int uart_set_rs485_config(struct tty_struct *tty, struct uart_port *port, - int ret; - unsigned long flags; - -- if (!port->rs485_config) -+ if (!(port->rs485_supported.flags & SER_RS485_ENABLED)) - return -ENOTTY; - - if (copy_from_user(&rs485, rs485_user, sizeof(*rs485_user))) -@@ -3420,6 +3428,9 @@ int uart_get_rs485_mode(struct uart_port *port) - u32 rs485_delay[2]; - int ret; - -+ if (!(port->rs485_supported.flags & SER_RS485_ENABLED)) -+ return 0; -+ - ret = device_property_read_u32_array(dev, "rs485-rts-delay", - rs485_delay, 2); - if (!ret) { -diff --git a/drivers/tty/tty.h b/drivers/tty/tty.h -index c5ee219127555..91515e1ebc8d3 100644 ---- a/drivers/tty/tty.h -+++ b/drivers/tty/tty.h -@@ -63,7 +63,7 @@ int tty_check_change(struct tty_struct *tty); - void __stop_tty(struct tty_struct *tty); - void __start_tty(struct tty_struct *tty); - void tty_write_unlock(struct tty_struct *tty); --int tty_write_lock(struct tty_struct *tty, int ndelay); -+int tty_write_lock(struct tty_struct *tty, bool ndelay); - void tty_vhangup_session(struct tty_struct *tty); - void tty_open_proc_set_tty(struct file *filp, struct tty_struct *tty); - int tty_signal_session_leader(struct tty_struct *tty, int exit_session); -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 8fb6c6853556a..aaf77a5616ff1 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -939,7 +939,7 @@ void tty_write_unlock(struct tty_struct *tty) - wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT); - } - --int tty_write_lock(struct tty_struct *tty, int ndelay) -+int tty_write_lock(struct tty_struct *tty, bool ndelay) - { - if (!mutex_trylock(&tty->atomic_write_lock)) { - if (ndelay) -@@ -1153,7 +1153,7 @@ int tty_send_xchar(struct tty_struct *tty, char ch) - return 0; - } - -- if (tty_write_lock(tty, 0) < 0) -+ if (tty_write_lock(tty, false) < 0) - return -ERESTARTSYS; - - down_read(&tty->termios_rwsem); -@@ -2472,22 +2472,25 @@ static int send_break(struct tty_struct *tty, unsigned int duration) - return 0; - - if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK) -- retval = tty->ops->break_ctl(tty, duration); -- else { -- /* Do the work ourselves */ -- if (tty_write_lock(tty, 0) < 0) -- return -EINTR; -- retval = tty->ops->break_ctl(tty, -1); -- if (retval) -- goto out; -- if (!signal_pending(current)) -- msleep_interruptible(duration); -+ return tty->ops->break_ctl(tty, duration); -+ -+ /* Do the work ourselves */ -+ if (tty_write_lock(tty, false) < 0) -+ return -EINTR; -+ -+ retval = tty->ops->break_ctl(tty, -1); -+ if (!retval) { -+ msleep_interruptible(duration); - retval = tty->ops->break_ctl(tty, 0); --out: -- tty_write_unlock(tty); -- if (signal_pending(current)) -- retval = -EINTR; -+ } else if (retval == -EOPNOTSUPP) { -+ /* some drivers can tell only dynamically */ -+ retval = 0; - } -+ tty_write_unlock(tty); -+ -+ if (signal_pending(current)) -+ retval = -EINTR; -+ - return retval; - } - -diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c -index ad1cf51ecd11d..8767c504b95dd 100644 ---- a/drivers/tty/tty_ioctl.c -+++ b/drivers/tty/tty_ioctl.c -@@ -506,7 +506,7 @@ retry_write_wait: - if (retval < 0) - return retval; - -- if (tty_write_lock(tty, 0) < 0) -+ if (tty_write_lock(tty, false) < 0) - goto retry_write_wait; - - /* Racing writer? */ -diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c -index dc38d1fa77874..474e94a69b185 100644 ---- a/drivers/ufs/core/ufshcd.c -+++ b/drivers/ufs/core/ufshcd.c -@@ -8204,7 +8204,6 @@ static int ufshcd_add_lus(struct ufs_hba *hba) - ufs_bsg_probe(hba); - ufshpb_init(hba); - scsi_scan_host(hba->host); -- pm_runtime_put_sync(hba->dev); - - out: - return ret; -@@ -8331,15 +8330,15 @@ static void ufshcd_async_scan(void *data, async_cookie_t cookie) - - /* Probe and add UFS logical units */ - ret = ufshcd_add_lus(hba); -+ - out: -+ pm_runtime_put_sync(hba->dev); - /* - * If we failed to initialize the device or the device is not - * present, turn off the power/clocks etc. - */ -- if (ret) { -- pm_runtime_put_sync(hba->dev); -+ if (ret) - ufshcd_hba_exit(hba); -- } - } - - static const struct attribute_group *ufshcd_driver_groups[] = { -diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c -index 69a44bd7e5d02..ccdd525bd7c80 100644 ---- a/drivers/usb/cdns3/cdns3-gadget.c -+++ b/drivers/usb/cdns3/cdns3-gadget.c -@@ -1117,6 +1117,8 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, - dma_addr_t trb_dma; - u32 togle_pcs = 1; - int sg_iter = 0; -+ int num_trb_req; -+ int trb_burst; - int num_trb; - int address; - u32 control; -@@ -1125,15 +1127,13 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, - struct scatterlist *s = NULL; - bool sg_supported = !!(request->num_mapped_sgs); - -+ num_trb_req = sg_supported ? request->num_mapped_sgs : 1; -+ -+ /* ISO transfer require each SOF have a TD, each TD include some TRBs */ - if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) -- num_trb = priv_ep->interval; -+ num_trb = priv_ep->interval * num_trb_req; - else -- num_trb = sg_supported ? request->num_mapped_sgs : 1; -- -- if (num_trb > priv_ep->free_trbs) { -- priv_ep->flags |= EP_RING_FULL; -- return -ENOBUFS; -- } -+ num_trb = num_trb_req; - - priv_req = to_cdns3_request(request); - address = priv_ep->endpoint.desc->bEndpointAddress; -@@ -1182,14 +1182,31 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, - - link_trb->control = cpu_to_le32(((priv_ep->pcs) ? TRB_CYCLE : 0) | - TRB_TYPE(TRB_LINK) | TRB_TOGGLE | ch_bit); -+ -+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) { -+ /* -+ * ISO require LINK TRB must be first one of TD. -+ * Fill LINK TRBs for left trb space to simply software process logic. -+ */ -+ while (priv_ep->enqueue) { -+ *trb = *link_trb; -+ trace_cdns3_prepare_trb(priv_ep, trb); -+ -+ cdns3_ep_inc_enq(priv_ep); -+ trb = priv_ep->trb_pool + priv_ep->enqueue; -+ priv_req->trb = trb; -+ } -+ } -+ } -+ -+ if (num_trb > priv_ep->free_trbs) { -+ priv_ep->flags |= EP_RING_FULL; -+ return -ENOBUFS; - } - - if (priv_dev->dev_ver <= DEV_VER_V2) - togle_pcs = cdns3_wa1_update_guard(priv_ep, trb); - -- if (sg_supported) -- s = request->sg; -- - /* set incorrect Cycle Bit for first trb*/ - control = priv_ep->pcs ? 0 : TRB_CYCLE; - trb->length = 0; -@@ -1207,6 +1224,9 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, - do { - u32 length; - -+ if (!(sg_iter % num_trb_req) && sg_supported) -+ s = request->sg; -+ - /* fill TRB */ - control |= TRB_TYPE(TRB_NORMAL); - if (sg_supported) { -@@ -1221,7 +1241,36 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, - total_tdl += DIV_ROUND_UP(length, - priv_ep->endpoint.maxpacket); - -- trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) | -+ trb_burst = priv_ep->trb_burst_size; -+ -+ /* -+ * Supposed DMA cross 4k bounder problem should be fixed at DEV_VER_V2, but still -+ * met problem when do ISO transfer if sg enabled. -+ * -+ * Data pattern likes below when sg enabled, package size is 1k and mult is 2 -+ * [UVC Header(8B) ] [data(3k - 8)] ... -+ * -+ * The received data at offset 0xd000 will get 0xc000 data, len 0x70. Error happen -+ * as below pattern: -+ * 0xd000: wrong -+ * 0xe000: wrong -+ * 0xf000: correct -+ * 0x10000: wrong -+ * 0x11000: wrong -+ * 0x12000: correct -+ * ... -+ * -+ * But it is still unclear about why error have not happen below 0xd000, it should -+ * cross 4k bounder. But anyway, the below code can fix this problem. -+ * -+ * To avoid DMA cross 4k bounder at ISO transfer, reduce burst len according to 16. -+ */ -+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC && priv_dev->dev_ver <= DEV_VER_V2) -+ if (ALIGN_DOWN(trb->buffer, SZ_4K) != -+ ALIGN_DOWN(trb->buffer + length, SZ_4K)) -+ trb_burst = 16; -+ -+ trb->length |= cpu_to_le32(TRB_BURST_LEN(trb_burst) | - TRB_LEN(length)); - pcs = priv_ep->pcs ? TRB_CYCLE : 0; - -@@ -1248,7 +1297,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, - if (sg_supported) { - trb->control |= cpu_to_le32(TRB_ISP); - /* Don't set chain bit for last TRB */ -- if (sg_iter < num_trb - 1) -+ if ((sg_iter % num_trb_req) < num_trb_req - 1) - trb->control |= cpu_to_le32(TRB_CHAIN); - - s = sg_next(s); -@@ -1506,6 +1555,12 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev, - - /* The TRB was changed as link TRB, and the request was handled at ep_dequeue */ - while (TRB_FIELD_TO_TYPE(le32_to_cpu(trb->control)) == TRB_LINK) { -+ -+ /* ISO ep_traddr may stop at LINK TRB */ -+ if (priv_ep->dequeue == cdns3_get_dma_pos(priv_dev, priv_ep) && -+ priv_ep->type == USB_ENDPOINT_XFER_ISOC) -+ break; -+ - trace_cdns3_complete_trb(priv_ep, trb); - cdns3_ep_inc_deq(priv_ep); - trb = priv_ep->trb_pool + priv_ep->dequeue; -@@ -1538,6 +1593,10 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev, - } - - if (request_handled) { -+ /* TRBs are duplicated by priv_ep->interval time for ISO IN */ -+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC && priv_ep->dir) -+ request->actual /= priv_ep->interval; -+ - cdns3_gadget_giveback(priv_ep, priv_req, 0); - request_handled = false; - transfer_end = false; -@@ -2033,11 +2092,10 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable) - bool is_iso_ep = (priv_ep->type == USB_ENDPOINT_XFER_ISOC); - struct cdns3_device *priv_dev = priv_ep->cdns3_dev; - u32 bEndpointAddress = priv_ep->num | priv_ep->dir; -- u32 max_packet_size = 0; -- u8 maxburst = 0; -+ u32 max_packet_size = priv_ep->wMaxPacketSize; -+ u8 maxburst = priv_ep->bMaxBurst; - u32 ep_cfg = 0; - u8 buffering; -- u8 mult = 0; - int ret; - - buffering = priv_dev->ep_buf_size - 1; -@@ -2059,8 +2117,7 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable) - break; - default: - ep_cfg = EP_CFG_EPTYPE(USB_ENDPOINT_XFER_ISOC); -- mult = priv_dev->ep_iso_burst - 1; -- buffering = mult + 1; -+ buffering = (priv_ep->bMaxBurst + 1) * (priv_ep->mult + 1) - 1; - } - - switch (priv_dev->gadget.speed) { -@@ -2071,17 +2128,8 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable) - max_packet_size = is_iso_ep ? 1024 : 512; - break; - case USB_SPEED_SUPER: -- /* It's limitation that driver assumes in driver. */ -- mult = 0; -- max_packet_size = 1024; -- if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) { -- maxburst = priv_dev->ep_iso_burst - 1; -- buffering = (mult + 1) * -- (maxburst + 1); -- -- if (priv_ep->interval > 1) -- buffering++; -- } else { -+ if (priv_ep->type != USB_ENDPOINT_XFER_ISOC) { -+ max_packet_size = 1024; - maxburst = priv_dev->ep_buf_size - 1; - } - break; -@@ -2110,7 +2158,6 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable) - if (priv_dev->dev_ver < DEV_VER_V2) - priv_ep->trb_burst_size = 16; - -- mult = min_t(u8, mult, EP_CFG_MULT_MAX); - buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX); - maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX); - -@@ -2144,7 +2191,7 @@ int cdns3_ep_config(struct cdns3_endpoint *priv_ep, bool enable) - } - - ep_cfg |= EP_CFG_MAXPKTSIZE(max_packet_size) | -- EP_CFG_MULT(mult) | -+ EP_CFG_MULT(priv_ep->mult) | /* must match EP setting */ - EP_CFG_BUFFERING(buffering) | - EP_CFG_MAXBURST(maxburst); - -@@ -2234,6 +2281,13 @@ usb_ep *cdns3_gadget_match_ep(struct usb_gadget *gadget, - priv_ep->type = usb_endpoint_type(desc); - priv_ep->flags |= EP_CLAIMED; - priv_ep->interval = desc->bInterval ? BIT(desc->bInterval - 1) : 0; -+ priv_ep->wMaxPacketSize = usb_endpoint_maxp(desc); -+ priv_ep->mult = USB_EP_MAXP_MULT(priv_ep->wMaxPacketSize); -+ priv_ep->wMaxPacketSize &= USB_ENDPOINT_MAXP_MASK; -+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC && comp_desc) { -+ priv_ep->mult = USB_SS_MULT(comp_desc->bmAttributes) - 1; -+ priv_ep->bMaxBurst = comp_desc->bMaxBurst; -+ } - - spin_unlock_irqrestore(&priv_dev->lock, flags); - return &priv_ep->endpoint; -@@ -3015,22 +3069,40 @@ static int cdns3_gadget_check_config(struct usb_gadget *gadget) - struct cdns3_endpoint *priv_ep; - struct usb_ep *ep; - int n_in = 0; -+ int iso = 0; -+ int out = 1; - int total; -+ int n; - - list_for_each_entry(ep, &gadget->ep_list, ep_list) { - priv_ep = ep_to_cdns3_ep(ep); -- if ((priv_ep->flags & EP_CLAIMED) && (ep->address & USB_DIR_IN)) -- n_in++; -+ if (!(priv_ep->flags & EP_CLAIMED)) -+ continue; -+ -+ n = (priv_ep->mult + 1) * (priv_ep->bMaxBurst + 1); -+ if (ep->address & USB_DIR_IN) { -+ /* -+ * ISO transfer: DMA start move data when get ISO, only transfer -+ * data as min(TD size, iso). No benefit for allocate bigger -+ * internal memory than 'iso'. -+ */ -+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) -+ iso += n; -+ else -+ n_in++; -+ } else { -+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) -+ out = max_t(int, out, n); -+ } - } - - /* 2KB are reserved for EP0, 1KB for out*/ -- total = 2 + n_in + 1; -+ total = 2 + n_in + out + iso; - - if (total > priv_dev->onchip_buffers) - return -ENOMEM; - -- priv_dev->ep_buf_size = priv_dev->ep_iso_burst = -- (priv_dev->onchip_buffers - 2) / (n_in + 1); -+ priv_dev->ep_buf_size = (priv_dev->onchip_buffers - 2 - iso) / (n_in + out); - - return 0; - } -diff --git a/drivers/usb/cdns3/cdns3-gadget.h b/drivers/usb/cdns3/cdns3-gadget.h -index fbe4a8e3aa897..086a7bb838975 100644 ---- a/drivers/usb/cdns3/cdns3-gadget.h -+++ b/drivers/usb/cdns3/cdns3-gadget.h -@@ -1168,6 +1168,9 @@ struct cdns3_endpoint { - u8 dir; - u8 num; - u8 type; -+ u8 mult; -+ u8 bMaxBurst; -+ u16 wMaxPacketSize; - int interval; - - int free_trbs; -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index b9227f41cf1c0..763d6858a8e6f 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -523,6 +523,13 @@ static irqreturn_t ci_irq_handler(int irq, void *data) - u32 otgsc = 0; - - if (ci->in_lpm) { -+ /* -+ * If we already have a wakeup irq pending there, -+ * let's just return to wait resume finished firstly. -+ */ -+ if (ci->wakeup_int) -+ return IRQ_HANDLED; -+ - disable_irq_nosync(irq); - ci->wakeup_int = true; - pm_runtime_get(ci->dev); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 36bf051b345b8..2a7eea4e251a1 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -892,6 +892,9 @@ static int acm_tty_break_ctl(struct tty_struct *tty, int state) - struct acm *acm = tty->driver_data; - int retval; - -+ if (!(acm->ctrl_caps & USB_CDC_CAP_BRK)) -+ return -EOPNOTSUPP; -+ - retval = acm_send_break(acm, state ? 0xffff : 0); - if (retval < 0) - dev_dbg(&acm->control->dev, -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 1f23c96fa94f8..011a3909f9ad1 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -277,48 +277,11 @@ int dwc3_core_soft_reset(struct dwc3 *dwc) - /* - * We're resetting only the device side because, if we're in host mode, - * XHCI driver will reset the host block. If dwc3 was configured for -- * host-only mode or current role is host, then we can return early. -+ * host-only mode, then we can return early. - */ - if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST) - return 0; - -- /* -- * If the dr_mode is host and the dwc->current_dr_role is not the -- * corresponding DWC3_GCTL_PRTCAP_HOST, then the dwc3_core_init_mode -- * isn't executed yet. Ensure the phy is ready before the controller -- * updates the GCTL.PRTCAPDIR or other settings by soft-resetting -- * the phy. -- * -- * Note: GUSB3PIPECTL[n] and GUSB2PHYCFG[n] are port settings where n -- * is port index. If this is a multiport host, then we need to reset -- * all active ports. -- */ -- if (dwc->dr_mode == USB_DR_MODE_HOST) { -- u32 usb3_port; -- u32 usb2_port; -- -- usb3_port = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)); -- usb3_port |= DWC3_GUSB3PIPECTL_PHYSOFTRST; -- dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port); -- -- usb2_port = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); -- usb2_port |= DWC3_GUSB2PHYCFG_PHYSOFTRST; -- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port); -- -- /* Small delay for phy reset assertion */ -- usleep_range(1000, 2000); -- -- usb3_port &= ~DWC3_GUSB3PIPECTL_PHYSOFTRST; -- dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port); -- -- usb2_port &= ~DWC3_GUSB2PHYCFG_PHYSOFTRST; -- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port); -- -- /* Wait for clock synchronization */ -- msleep(50); -- return 0; -- } -- - reg = dwc3_readl(dwc->regs, DWC3_DCTL); - reg |= DWC3_DCTL_CSFTRST; - reg &= ~DWC3_DCTL_RUN_STOP; -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 61de693461da4..ec3c33266547c 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -236,7 +236,10 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc) - struct dwc3_request *req; - - req = next_request(&dep->pending_list); -- dwc3_gadget_giveback(dep, req, -ECONNRESET); -+ if (!dwc->connected) -+ dwc3_gadget_giveback(dep, req, -ESHUTDOWN); -+ else -+ dwc3_gadget_giveback(dep, req, -ECONNRESET); - } - - dwc->eps[0]->trb_enqueue = 0; -diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c -index a0921687444b1..bb4f80627cdc3 100644 ---- a/drivers/usb/host/xhci-mtk.c -+++ b/drivers/usb/host/xhci-mtk.c -@@ -7,6 +7,7 @@ - * Chunfeng Yun - */ - -+#include - #include - #include - #include -@@ -73,6 +74,9 @@ - #define FRMCNT_LEV1_RANG (0x12b << 8) - #define FRMCNT_LEV1_RANG_MASK GENMASK(19, 8) - -+#define HSCH_CFG1 0x960 -+#define SCH3_RXFIFO_DEPTH_MASK GENMASK(21, 20) -+ - #define SS_GEN2_EOF_CFG 0x990 - #define SSG2EOF_OFFSET 0x3c - -@@ -114,6 +118,8 @@ - #define SSC_IP_SLEEP_EN BIT(4) - #define SSC_SPM_INT_EN BIT(1) - -+#define SCH_FIFO_TO_KB(x) ((x) >> 10) -+ - enum ssusb_uwk_vers { - SSUSB_UWK_V1 = 1, - SSUSB_UWK_V2, -@@ -165,6 +171,35 @@ static void xhci_mtk_set_frame_interval(struct xhci_hcd_mtk *mtk) - writel(value, hcd->regs + SS_GEN2_EOF_CFG); - } - -+/* -+ * workaround: usb3.2 gen1 isoc rx hw issue -+ * host send out unexpected ACK afer device fininsh a burst transfer with -+ * a short packet. -+ */ -+static void xhci_mtk_rxfifo_depth_set(struct xhci_hcd_mtk *mtk) -+{ -+ struct usb_hcd *hcd = mtk->hcd; -+ u32 value; -+ -+ if (!mtk->rxfifo_depth) -+ return; -+ -+ value = readl(hcd->regs + HSCH_CFG1); -+ value &= ~SCH3_RXFIFO_DEPTH_MASK; -+ value |= FIELD_PREP(SCH3_RXFIFO_DEPTH_MASK, -+ SCH_FIFO_TO_KB(mtk->rxfifo_depth) - 1); -+ writel(value, hcd->regs + HSCH_CFG1); -+} -+ -+static void xhci_mtk_init_quirk(struct xhci_hcd_mtk *mtk) -+{ -+ /* workaround only for mt8195 */ -+ xhci_mtk_set_frame_interval(mtk); -+ -+ /* workaround for SoCs using SSUSB about before IPM v1.6.0 */ -+ xhci_mtk_rxfifo_depth_set(mtk); -+} -+ - static int xhci_mtk_host_enable(struct xhci_hcd_mtk *mtk) - { - struct mu3c_ippc_regs __iomem *ippc = mtk->ippc_regs; -@@ -453,8 +488,7 @@ static int xhci_mtk_setup(struct usb_hcd *hcd) - if (ret) - return ret; - -- /* workaround only for mt8195 */ -- xhci_mtk_set_frame_interval(mtk); -+ xhci_mtk_init_quirk(mtk); - } - - ret = xhci_gen_setup(hcd, xhci_mtk_quirks); -@@ -531,6 +565,8 @@ static int xhci_mtk_probe(struct platform_device *pdev) - of_property_read_u32(node, "mediatek,u2p-dis-msk", - &mtk->u2p_dis_msk); - -+ of_property_read_u32(node, "rx-fifo-depth", &mtk->rxfifo_depth); -+ - ret = usb_wakeup_of_property_parse(mtk, node); - if (ret) { - dev_err(dev, "failed to parse uwk property\n"); -diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h -index 1174a510dd388..2a6a47d0f09a4 100644 ---- a/drivers/usb/host/xhci-mtk.h -+++ b/drivers/usb/host/xhci-mtk.h -@@ -160,6 +160,8 @@ struct xhci_hcd_mtk { - struct regmap *uwk; - u32 uwk_reg_base; - u32 uwk_vers; -+ /* quirk */ -+ u32 rxfifo_depth; - }; - - static inline struct xhci_hcd_mtk *hcd_to_mtk(struct usb_hcd *hcd) -diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c -index 094e812e9e692..35483217b1f6c 100644 ---- a/drivers/usb/mon/mon_bin.c -+++ b/drivers/usb/mon/mon_bin.c -@@ -1247,14 +1247,19 @@ static vm_fault_t mon_bin_vma_fault(struct vm_fault *vmf) - struct mon_reader_bin *rp = vmf->vma->vm_private_data; - unsigned long offset, chunk_idx; - struct page *pageptr; -+ unsigned long flags; - -+ spin_lock_irqsave(&rp->b_lock, flags); - offset = vmf->pgoff << PAGE_SHIFT; -- if (offset >= rp->b_size) -+ if (offset >= rp->b_size) { -+ spin_unlock_irqrestore(&rp->b_lock, flags); - return VM_FAULT_SIGBUS; -+ } - chunk_idx = offset / CHUNK_SIZE; - pageptr = rp->b_vec[chunk_idx].pg; - get_page(pageptr); - vmf->page = pageptr; -+ spin_unlock_irqrestore(&rp->b_lock, flags); - return 0; - } - -diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c -index 9299df53eb9df..160c9264339f0 100644 ---- a/drivers/usb/phy/phy-mxs-usb.c -+++ b/drivers/usb/phy/phy-mxs-usb.c -@@ -388,8 +388,7 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect) - - static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy) - { -- return IS_ENABLED(CONFIG_USB_OTG) && -- mxs_phy->phy.last_event == USB_EVENT_ID; -+ return mxs_phy->phy.last_event == USB_EVENT_ID; - } - - static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on) -diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c -index 49d6b2388b874..3da404d5178d3 100644 ---- a/drivers/usb/typec/class.c -+++ b/drivers/usb/typec/class.c -@@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode *altmode) - { - struct altmode *partner = altmode->partner; - struct typec_altmode *adev; -+ struct typec_altmode *partner_adev; - - if (!partner) - return; - - adev = &altmode->adev; -+ partner_adev = &partner->adev; - - if (is_typec_plug(adev->dev.parent)) { - struct typec_plug *plug = to_typec_plug(adev->dev.parent); -@@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *altmode) - } else { - partner->partner = NULL; - } -- put_device(&adev->dev); -+ put_device(&partner_adev->dev); - } - - /** -diff --git a/drivers/vdpa/alibaba/eni_vdpa.c b/drivers/vdpa/alibaba/eni_vdpa.c -index 5a09a09cca709..cce3d1837104c 100644 ---- a/drivers/vdpa/alibaba/eni_vdpa.c -+++ b/drivers/vdpa/alibaba/eni_vdpa.c -@@ -497,7 +497,7 @@ static int eni_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) - if (!eni_vdpa->vring) { - ret = -ENOMEM; - ENI_ERR(pdev, "failed to allocate virtqueues\n"); -- goto err; -+ goto err_remove_vp_legacy; - } - - for (i = 0; i < eni_vdpa->queues; i++) { -@@ -509,11 +509,13 @@ static int eni_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) - ret = vdpa_register_device(&eni_vdpa->vdpa, eni_vdpa->queues); - if (ret) { - ENI_ERR(pdev, "failed to register to vdpa bus\n"); -- goto err; -+ goto err_remove_vp_legacy; - } - - return 0; - -+err_remove_vp_legacy: -+ vp_legacy_remove(&eni_vdpa->ldev); - err: - put_device(&eni_vdpa->vdpa.dev); - return ret; -diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c -index a3cf1f764f29b..49883c8012e60 100644 ---- a/drivers/video/fbdev/core/fb_defio.c -+++ b/drivers/video/fbdev/core/fb_defio.c -@@ -132,11 +132,7 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy - return 0; - - inode_lock(inode); -- /* Kill off the delayed work */ -- cancel_delayed_work_sync(&info->deferred_work); -- -- /* Run it immediately */ -- schedule_delayed_work(&info->deferred_work, 0); -+ flush_delayed_work(&info->deferred_work); - inode_unlock(inode); - - return 0; -@@ -321,7 +317,7 @@ static void fb_deferred_io_lastclose(struct fb_info *info) - struct page *page; - int i; - -- cancel_delayed_work_sync(&info->deferred_work); -+ flush_delayed_work(&info->deferred_work); - - /* clear out the mapping that we setup */ - for (i = 0 ; i < info->fix.smem_len; i += PAGE_SIZE) { -diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c -index 36ada87b49a49..32b8374abeca5 100644 ---- a/drivers/video/fbdev/imxfb.c -+++ b/drivers/video/fbdev/imxfb.c -@@ -42,6 +42,7 @@ - #include