commit: 9b7255e698c2352b7aec0c360fd67210dcff664e Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Oct 10 11:17:55 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Nov 14 14:00:41 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9b7255e6
Linux patch 4.14.75 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1074_linux-4.14.75.patch | 3396 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3400 insertions(+) diff --git a/0000_README b/0000_README index db32f2e..0684007 100644 --- a/0000_README +++ b/0000_README @@ -339,6 +339,10 @@ Patch: 1073_linux-4.14.74.patch From: http://www.kernel.org Desc: Linux 4.14.74 +Patch: 1074_linux-4.14.75.patch +From: http://www.kernel.org +Desc: Linux 4.14.75 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1074_linux-4.14.75.patch b/1074_linux-4.14.75.patch new file mode 100644 index 0000000..a13dbf4 --- /dev/null +++ b/1074_linux-4.14.75.patch @@ -0,0 +1,3396 @@ +diff --git a/Makefile b/Makefile +index cc0e65a8d7bf..7fc373c011c0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 74 ++SUBLEVEL = 75 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h +index 11859287c52a..c98b59ac0612 100644 +--- a/arch/arc/include/asm/atomic.h ++++ b/arch/arc/include/asm/atomic.h +@@ -84,7 +84,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v) \ + "1: llock %[orig], [%[ctr]] \n" \ + " " #asm_op " %[val], %[orig], %[i] \n" \ + " scond %[val], [%[ctr]] \n" \ +- " \n" \ ++ " bnz 1b \n" \ + : [val] "=&r" (val), \ + [orig] "=&r" (orig) \ + : [ctr] "r" (&v->counter), \ +diff --git a/arch/arm64/include/asm/jump_label.h b/arch/arm64/include/asm/jump_label.h +index 1b5e0e843c3a..7e2b3e360086 100644 +--- a/arch/arm64/include/asm/jump_label.h ++++ b/arch/arm64/include/asm/jump_label.h +@@ -28,7 +28,7 @@ + + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) + { +- asm goto("1: nop\n\t" ++ asm_volatile_goto("1: nop\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + ".align 3\n\t" + ".quad 1b, %l[l_yes], %c0\n\t" +@@ -42,7 +42,7 @@ l_yes: + + static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) + { +- asm goto("1: b %l[l_yes]\n\t" ++ asm_volatile_goto("1: b %l[l_yes]\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + ".align 3\n\t" + ".quad 1b, %l[l_yes], %c0\n\t" +diff --git a/arch/hexagon/include/asm/bitops.h b/arch/hexagon/include/asm/bitops.h +index 5e4a59b3ec1b..2691a1857d20 100644 +--- a/arch/hexagon/include/asm/bitops.h ++++ b/arch/hexagon/include/asm/bitops.h +@@ -211,7 +211,7 @@ static inline long ffz(int x) + * This is defined the same way as ffs. + * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. + */ +-static inline long fls(int x) ++static inline int fls(int x) + { + int r; + +@@ -232,7 +232,7 @@ static inline long fls(int x) + * the libc and compiler builtin ffs routines, therefore + * differs in spirit from the above ffz (man ffs). + */ +-static inline long ffs(int x) ++static inline int ffs(int x) + { + int r; + +diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c +index 546792d176a4..564651bded42 100644 +--- a/arch/hexagon/kernel/dma.c ++++ b/arch/hexagon/kernel/dma.c +@@ -59,7 +59,7 @@ static void *hexagon_dma_alloc_coherent(struct device *dev, size_t size, + panic("Can't create %s() memory pool!", __func__); + else + gen_pool_add(coherent_pool, +- pfn_to_virt(max_low_pfn), ++ (unsigned long)pfn_to_virt(max_low_pfn), + hexagon_coherent_pool_size, -1); + } + +diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c +index df9b53f40b1e..7ac7e21b137e 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c +@@ -355,7 +355,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr, + unsigned long pp, key; + unsigned long v, orig_v, gr; + __be64 *hptep; +- int index; ++ long int index; + int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR); + + /* Get SLB entry */ +diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c +index a4170048a30b..17fbd07e4245 100644 +--- a/arch/x86/events/intel/lbr.c ++++ b/arch/x86/events/intel/lbr.c +@@ -1250,4 +1250,8 @@ void intel_pmu_lbr_init_knl(void) + + x86_pmu.lbr_sel_mask = LBR_SEL_MASK; + x86_pmu.lbr_sel_map = snb_lbr_sel_map; ++ ++ /* Knights Landing does have MISPREDICT bit */ ++ if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_LIP) ++ x86_pmu.intel_cap.lbr_format = LBR_FORMAT_EIP_FLAGS; + } +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index a8a2a271b63d..43fe195f6dca 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -1511,8 +1511,8 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + edesc->src_nents = src_nents; + edesc->dst_nents = dst_nents; + edesc->sec4_sg_bytes = sec4_sg_bytes; +- edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) + +- desc_bytes; ++ edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc + ++ desc_bytes); + edesc->iv_dir = DMA_TO_DEVICE; + + /* Make sure IV is located in a DMAable area */ +@@ -1715,8 +1715,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + edesc->src_nents = src_nents; + edesc->dst_nents = dst_nents; + edesc->sec4_sg_bytes = sec4_sg_bytes; +- edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) + +- desc_bytes; ++ edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc + ++ desc_bytes); + edesc->iv_dir = DMA_FROM_DEVICE; + + /* Make sure IV is located in a DMAable area */ +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 764be3e6933c..a98a25733a22 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -63,7 +63,7 @@ struct dcp { + struct dcp_coherent_block *coh; + + struct completion completion[DCP_MAX_CHANS]; +- struct mutex mutex[DCP_MAX_CHANS]; ++ spinlock_t lock[DCP_MAX_CHANS]; + struct task_struct *thread[DCP_MAX_CHANS]; + struct crypto_queue queue[DCP_MAX_CHANS]; + }; +@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *data) + + int ret; + +- do { +- __set_current_state(TASK_INTERRUPTIBLE); ++ while (!kthread_should_stop()) { ++ set_current_state(TASK_INTERRUPTIBLE); + +- mutex_lock(&sdcp->mutex[chan]); ++ spin_lock(&sdcp->lock[chan]); + backlog = crypto_get_backlog(&sdcp->queue[chan]); + arq = crypto_dequeue_request(&sdcp->queue[chan]); +- mutex_unlock(&sdcp->mutex[chan]); ++ spin_unlock(&sdcp->lock[chan]); ++ ++ if (!backlog && !arq) { ++ schedule(); ++ continue; ++ } ++ ++ set_current_state(TASK_RUNNING); + + if (backlog) + backlog->complete(backlog, -EINPROGRESS); +@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *data) + if (arq) { + ret = mxs_dcp_aes_block_crypt(arq); + arq->complete(arq, ret); +- continue; + } +- +- schedule(); +- } while (!kthread_should_stop()); ++ } + + return 0; + } +@@ -409,9 +413,9 @@ static int mxs_dcp_aes_enqueue(struct ablkcipher_request *req, int enc, int ecb) + rctx->ecb = ecb; + actx->chan = DCP_CHAN_CRYPTO; + +- mutex_lock(&sdcp->mutex[actx->chan]); ++ spin_lock(&sdcp->lock[actx->chan]); + ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base); +- mutex_unlock(&sdcp->mutex[actx->chan]); ++ spin_unlock(&sdcp->lock[actx->chan]); + + wake_up_process(sdcp->thread[actx->chan]); + +@@ -640,13 +644,20 @@ static int dcp_chan_thread_sha(void *data) + struct ahash_request *req; + int ret, fini; + +- do { +- __set_current_state(TASK_INTERRUPTIBLE); ++ while (!kthread_should_stop()) { ++ set_current_state(TASK_INTERRUPTIBLE); + +- mutex_lock(&sdcp->mutex[chan]); ++ spin_lock(&sdcp->lock[chan]); + backlog = crypto_get_backlog(&sdcp->queue[chan]); + arq = crypto_dequeue_request(&sdcp->queue[chan]); +- mutex_unlock(&sdcp->mutex[chan]); ++ spin_unlock(&sdcp->lock[chan]); ++ ++ if (!backlog && !arq) { ++ schedule(); ++ continue; ++ } ++ ++ set_current_state(TASK_RUNNING); + + if (backlog) + backlog->complete(backlog, -EINPROGRESS); +@@ -658,12 +669,8 @@ static int dcp_chan_thread_sha(void *data) + ret = dcp_sha_req_to_buf(arq); + fini = rctx->fini; + arq->complete(arq, ret); +- if (!fini) +- continue; + } +- +- schedule(); +- } while (!kthread_should_stop()); ++ } + + return 0; + } +@@ -721,9 +728,9 @@ static int dcp_sha_update_fx(struct ahash_request *req, int fini) + rctx->init = 1; + } + +- mutex_lock(&sdcp->mutex[actx->chan]); ++ spin_lock(&sdcp->lock[actx->chan]); + ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base); +- mutex_unlock(&sdcp->mutex[actx->chan]); ++ spin_unlock(&sdcp->lock[actx->chan]); + + wake_up_process(sdcp->thread[actx->chan]); + mutex_unlock(&actx->mutex); +@@ -983,7 +990,7 @@ static int mxs_dcp_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, sdcp); + + for (i = 0; i < DCP_MAX_CHANS; i++) { +- mutex_init(&sdcp->mutex[i]); ++ spin_lock_init(&sdcp->lock[i]); + init_completion(&sdcp->completion[i]); + crypto_init_queue(&sdcp->queue[i], 50); + } +diff --git a/drivers/crypto/qat/qat_c3xxx/adf_drv.c b/drivers/crypto/qat/qat_c3xxx/adf_drv.c +index f172171668ee..7c470ae97f60 100644 +--- a/drivers/crypto/qat/qat_c3xxx/adf_drv.c ++++ b/drivers/crypto/qat/qat_c3xxx/adf_drv.c +@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + struct adf_hw_device_data *hw_data; + char name[ADF_DEVICE_NAME_LENGTH]; + unsigned int i, bar_nr; +- int ret, bar_mask; ++ unsigned long bar_mask; ++ int ret; + + switch (ent->device) { + case ADF_C3XXX_PCI_DEVICE_ID: +@@ -235,8 +236,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /* Find and map all the device's BARS */ + i = 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); +- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, +- ADF_PCI_MAX_BARS * 2) { ++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) { + struct adf_bar *bar = &accel_pci_dev->pci_bars[i++]; + + bar->base_addr = pci_resource_start(pdev, bar_nr); +diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +index 24ec908eb26c..613c7d5644ce 100644 +--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + struct adf_hw_device_data *hw_data; + char name[ADF_DEVICE_NAME_LENGTH]; + unsigned int i, bar_nr; +- int ret, bar_mask; ++ unsigned long bar_mask; ++ int ret; + + switch (ent->device) { + case ADF_C3XXXIOV_PCI_DEVICE_ID: +@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /* Find and map all the device's BARS */ + i = 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); +- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, +- ADF_PCI_MAX_BARS * 2) { ++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) { + struct adf_bar *bar = &accel_pci_dev->pci_bars[i++]; + + bar->base_addr = pci_resource_start(pdev, bar_nr); +diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c +index 58a984c9c3ec..cb11d85d7bb3 100644 +--- a/drivers/crypto/qat/qat_c62x/adf_drv.c ++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c +@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + struct adf_hw_device_data *hw_data; + char name[ADF_DEVICE_NAME_LENGTH]; + unsigned int i, bar_nr; +- int ret, bar_mask; ++ unsigned long bar_mask; ++ int ret; + + switch (ent->device) { + case ADF_C62X_PCI_DEVICE_ID: +@@ -235,8 +236,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /* Find and map all the device's BARS */ + i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); +- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, +- ADF_PCI_MAX_BARS * 2) { ++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) { + struct adf_bar *bar = &accel_pci_dev->pci_bars[i++]; + + bar->base_addr = pci_resource_start(pdev, bar_nr); +diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +index b9f3e0e4fde9..278452b8ef81 100644 +--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + struct adf_hw_device_data *hw_data; + char name[ADF_DEVICE_NAME_LENGTH]; + unsigned int i, bar_nr; +- int ret, bar_mask; ++ unsigned long bar_mask; ++ int ret; + + switch (ent->device) { + case ADF_C62XIOV_PCI_DEVICE_ID: +@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /* Find and map all the device's BARS */ + i = 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); +- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, +- ADF_PCI_MAX_BARS * 2) { ++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) { + struct adf_bar *bar = &accel_pci_dev->pci_bars[i++]; + + bar->base_addr = pci_resource_start(pdev, bar_nr); +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c +index 2ce01f010c74..07b741aed108 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c +@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + struct adf_hw_device_data *hw_data; + char name[ADF_DEVICE_NAME_LENGTH]; + unsigned int i, bar_nr; +- int ret, bar_mask; ++ unsigned long bar_mask; ++ int ret; + + switch (ent->device) { + case ADF_DH895XCC_PCI_DEVICE_ID: +@@ -237,8 +238,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /* Find and map all the device's BARS */ + i = 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); +- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, +- ADF_PCI_MAX_BARS * 2) { ++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) { + struct adf_bar *bar = &accel_pci_dev->pci_bars[i++]; + + bar->base_addr = pci_resource_start(pdev, bar_nr); +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +index 26ab17bfc6da..3da0f951cb59 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + struct adf_hw_device_data *hw_data; + char name[ADF_DEVICE_NAME_LENGTH]; + unsigned int i, bar_nr; +- int ret, bar_mask; ++ unsigned long bar_mask; ++ int ret; + + switch (ent->device) { + case ADF_DH895XCCIOV_PCI_DEVICE_ID: +@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /* Find and map all the device's BARS */ + i = 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); +- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, +- ADF_PCI_MAX_BARS * 2) { ++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) { + struct adf_bar *bar = &accel_pci_dev->pci_bars[i++]; + + bar->base_addr = pci_resource_start(pdev, bar_nr); +diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c +index e717f8dc3966..202d367a21e4 100644 +--- a/drivers/gpio/gpio-adp5588.c ++++ b/drivers/gpio/gpio-adp5588.c +@@ -41,6 +41,8 @@ struct adp5588_gpio { + uint8_t int_en[3]; + uint8_t irq_mask[3]; + uint8_t irq_stat[3]; ++ uint8_t int_input_en[3]; ++ uint8_t int_lvl_cached[3]; + }; + + static int adp5588_gpio_read(struct i2c_client *client, u8 reg) +@@ -173,12 +175,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d) + struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d); + int i; + +- for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) ++ for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) { ++ if (dev->int_input_en[i]) { ++ mutex_lock(&dev->lock); ++ dev->dir[i] &= ~dev->int_input_en[i]; ++ dev->int_input_en[i] = 0; ++ adp5588_gpio_write(dev->client, GPIO_DIR1 + i, ++ dev->dir[i]); ++ mutex_unlock(&dev->lock); ++ } ++ ++ if (dev->int_lvl_cached[i] != dev->int_lvl[i]) { ++ dev->int_lvl_cached[i] = dev->int_lvl[i]; ++ adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i, ++ dev->int_lvl[i]); ++ } ++ + if (dev->int_en[i] ^ dev->irq_mask[i]) { + dev->int_en[i] = dev->irq_mask[i]; + adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i, + dev->int_en[i]); + } ++ } + + mutex_unlock(&dev->irq_lock); + } +@@ -221,9 +239,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type) + else + return -EINVAL; + +- adp5588_gpio_direction_input(&dev->gpio_chip, gpio); +- adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank, +- dev->int_lvl[bank]); ++ dev->int_input_en[bank] |= bit; + + return 0; + } +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 70b3c556f6cf..33d4bd505b5b 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -25,7 +25,6 @@ + + struct acpi_gpio_event { + struct list_head node; +- struct list_head initial_sync_list; + acpi_handle handle; + unsigned int pin; + unsigned int irq; +@@ -49,10 +48,19 @@ struct acpi_gpio_chip { + struct mutex conn_lock; + struct gpio_chip *chip; + struct list_head events; ++ struct list_head deferred_req_irqs_list_entry; + }; + +-static LIST_HEAD(acpi_gpio_initial_sync_list); +-static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock); ++/* ++ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init ++ * (so builtin drivers) we register the ACPI GpioInt event handlers from a ++ * late_initcall_sync handler, so that other builtin drivers can register their ++ * OpRegions before the event handlers can run. This list contains gpiochips ++ * for which the acpi_gpiochip_request_interrupts() has been deferred. ++ */ ++static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock); ++static LIST_HEAD(acpi_gpio_deferred_req_irqs_list); ++static bool acpi_gpio_deferred_req_irqs_done; + + static int acpi_gpiochip_find(struct gpio_chip *gc, void *data) + { +@@ -146,21 +154,6 @@ static struct gpio_desc *acpi_get_gpiod(char *path, int pin) + return gpiochip_get_desc(chip, offset); + } + +-static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event) +-{ +- mutex_lock(&acpi_gpio_initial_sync_list_lock); +- list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list); +- mutex_unlock(&acpi_gpio_initial_sync_list_lock); +-} +- +-static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event) +-{ +- mutex_lock(&acpi_gpio_initial_sync_list_lock); +- if (!list_empty(&event->initial_sync_list)) +- list_del_init(&event->initial_sync_list); +- mutex_unlock(&acpi_gpio_initial_sync_list_lock); +-} +- + static irqreturn_t acpi_gpio_irq_handler(int irq, void *data) + { + struct acpi_gpio_event *event = data; +@@ -247,7 +240,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, + + gpiod_direction_input(desc); + +- value = gpiod_get_value(desc); ++ value = gpiod_get_value_cansleep(desc); + + ret = gpiochip_lock_as_irq(chip, pin); + if (ret) { +@@ -290,7 +283,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, + event->irq = irq; + event->pin = pin; + event->desc = desc; +- INIT_LIST_HEAD(&event->initial_sync_list); + + ret = request_threaded_irq(event->irq, NULL, handler, irqflags, + "ACPI:Event", event); +@@ -312,10 +304,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, + * may refer to OperationRegions from other (builtin) drivers which + * may be probed after us. + */ +- if (handler == acpi_gpio_irq_handler && +- (((irqflags & IRQF_TRIGGER_RISING) && value == 1) || +- ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))) +- acpi_gpio_add_to_initial_sync_list(event); ++ if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) || ++ ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)) ++ handler(event->irq, event); + + return AE_OK; + +@@ -344,6 +335,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip) + struct acpi_gpio_chip *acpi_gpio; + acpi_handle handle; + acpi_status status; ++ bool defer; + + if (!chip->parent || !chip->to_irq) + return; +@@ -356,6 +348,16 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip) + if (ACPI_FAILURE(status)) + return; + ++ mutex_lock(&acpi_gpio_deferred_req_irqs_lock); ++ defer = !acpi_gpio_deferred_req_irqs_done; ++ if (defer) ++ list_add(&acpi_gpio->deferred_req_irqs_list_entry, ++ &acpi_gpio_deferred_req_irqs_list); ++ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock); ++ ++ if (defer) ++ return; ++ + acpi_walk_resources(handle, "_AEI", + acpi_gpiochip_request_interrupt, acpi_gpio); + } +@@ -386,11 +388,14 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip) + if (ACPI_FAILURE(status)) + return; + ++ mutex_lock(&acpi_gpio_deferred_req_irqs_lock); ++ if (!list_empty(&acpi_gpio->deferred_req_irqs_list_entry)) ++ list_del_init(&acpi_gpio->deferred_req_irqs_list_entry); ++ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock); ++ + list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) { + struct gpio_desc *desc; + +- acpi_gpio_del_from_initial_sync_list(event); +- + if (irqd_is_wakeup_set(irq_get_irq_data(event->irq))) + disable_irq_wake(event->irq); + +@@ -1101,6 +1106,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip) + + acpi_gpio->chip = chip; + INIT_LIST_HEAD(&acpi_gpio->events); ++ INIT_LIST_HEAD(&acpi_gpio->deferred_req_irqs_list_entry); + + status = acpi_attach_data(handle, acpi_gpio_chip_dh, acpi_gpio); + if (ACPI_FAILURE(status)) { +@@ -1247,20 +1253,28 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id) + return con_id == NULL; + } + +-/* Sync the initial state of handlers after all builtin drivers have probed */ +-static int acpi_gpio_initial_sync(void) ++/* Run deferred acpi_gpiochip_request_interrupts() */ ++static int acpi_gpio_handle_deferred_request_interrupts(void) + { +- struct acpi_gpio_event *event, *ep; ++ struct acpi_gpio_chip *acpi_gpio, *tmp; ++ ++ mutex_lock(&acpi_gpio_deferred_req_irqs_lock); ++ list_for_each_entry_safe(acpi_gpio, tmp, ++ &acpi_gpio_deferred_req_irqs_list, ++ deferred_req_irqs_list_entry) { ++ acpi_handle handle; + +- mutex_lock(&acpi_gpio_initial_sync_list_lock); +- list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list, +- initial_sync_list) { +- acpi_evaluate_object(event->handle, NULL, NULL, NULL); +- list_del_init(&event->initial_sync_list); ++ handle = ACPI_HANDLE(acpi_gpio->chip->parent); ++ acpi_walk_resources(handle, "_AEI", ++ acpi_gpiochip_request_interrupt, acpi_gpio); ++ ++ list_del_init(&acpi_gpio->deferred_req_irqs_list_entry); + } +- mutex_unlock(&acpi_gpio_initial_sync_list_lock); ++ ++ acpi_gpio_deferred_req_irqs_done = true; ++ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock); + + return 0; + } + /* We must use _sync so that this runs after the first deferred_probe run */ +-late_initcall_sync(acpi_gpio_initial_sync); ++late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts); +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index ba38f530e403..ee8c046cab62 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -31,6 +31,7 @@ static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data) + struct of_phandle_args *gpiospec = data; + + return chip->gpiodev->dev.of_node == gpiospec->np && ++ chip->of_xlate && + chip->of_xlate(chip, gpiospec, NULL) >= 0; + } + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 7e0bfd7347f6..7d5de4ef4f22 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -489,7 +489,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) + if (ret) + goto out_free_descs; + lh->descs[i] = desc; +- count = i; ++ count = i + 1; + + if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW) + set_bit(FLAG_ACTIVE_LOW, &desc->flags); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +index 1ae5ae8c45a4..1a75a6b9ab2f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +@@ -569,6 +569,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = { + { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX }, ++ { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0x1002, 0x67DF, 0x1028, 0x0774, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0, 0, 0, 0, 0 }, + }; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 5f892ad6476e..44aa58ab55d0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -37,6 +37,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, + { + struct drm_gem_object *gobj; + unsigned long size; ++ int r; + + gobj = drm_gem_object_lookup(p->filp, data->handle); + if (gobj == NULL) +@@ -48,20 +49,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, + p->uf_entry.tv.shared = true; + p->uf_entry.user_pages = NULL; + +- size = amdgpu_bo_size(p->uf_entry.robj); +- if (size != PAGE_SIZE || (data->offset + 8) > size) +- return -EINVAL; +- +- *offset = data->offset; +- + drm_gem_object_put_unlocked(gobj); + ++ size = amdgpu_bo_size(p->uf_entry.robj); ++ if (size != PAGE_SIZE || (data->offset + 8) > size) { ++ r = -EINVAL; ++ goto error_unref; ++ } ++ + if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) { +- amdgpu_bo_unref(&p->uf_entry.robj); +- return -EINVAL; ++ r = -EINVAL; ++ goto error_unref; + } + ++ *offset = data->offset; ++ + return 0; ++ ++error_unref: ++ amdgpu_bo_unref(&p->uf_entry.robj); ++ return r; + } + + static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c +index e7fa67063cdc..cb9e1cd456b8 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c +@@ -1142,7 +1142,7 @@ static int vega10_enable_psm_gc_edc_config(struct pp_hwmgr *hwmgr) + for (count = 0; count < num_se; count++) { + data = GRBM_GFX_INDEX__INSTANCE_BROADCAST_WRITES_MASK | GRBM_GFX_INDEX__SH_BROADCAST_WRITES_MASK | ( count << GRBM_GFX_INDEX__SE_INDEX__SHIFT); + cgs_write_register(hwmgr->device, reg, data); +- result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCStallPatternConfig_Vega10, VEGA10_CONFIGREG_DIDT); ++ result = vega10_program_didt_config_registers(hwmgr, PSMSEEDCStallPatternConfig_Vega10, VEGA10_CONFIGREG_DIDT); + result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCStallDelayConfig_Vega10, VEGA10_CONFIGREG_DIDT); + result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCCtrlResetConfig_Vega10, VEGA10_CONFIGREG_DIDT); + result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCCtrlConfig_Vega10, VEGA10_CONFIGREG_DIDT); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c +index 7c5bed29ffef..6160a6158cf2 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c +@@ -412,14 +412,10 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps) + } + + static void +-nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior) ++nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior) + { + struct nvkm_dp *dp = nvkm_dp(outp); + +- /* Prevent link from being retrained if sink sends an IRQ. */ +- atomic_set(&dp->lt.done, 0); +- ior->dp.nr = 0; +- + /* Execute DisableLT script from DP Info Table. */ + nvbios_init(&ior->disp->engine.subdev, dp->info.script[4], + init.outp = &dp->outp.info; +@@ -428,6 +424,16 @@ nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior) + ); + } + ++static void ++nvkm_dp_release(struct nvkm_outp *outp) ++{ ++ struct nvkm_dp *dp = nvkm_dp(outp); ++ ++ /* Prevent link from being retrained if sink sends an IRQ. */ ++ atomic_set(&dp->lt.done, 0); ++ dp->outp.ior->dp.nr = 0; ++} ++ + static int + nvkm_dp_acquire(struct nvkm_outp *outp) + { +@@ -576,6 +582,7 @@ nvkm_dp_func = { + .fini = nvkm_dp_fini, + .acquire = nvkm_dp_acquire, + .release = nvkm_dp_release, ++ .disable = nvkm_dp_disable, + }; + + static int +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c +index 0c570dbd3021..bc18a96bc61a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c +@@ -436,11 +436,11 @@ nv50_disp_super_2_0(struct nv50_disp *disp, struct nvkm_head *head) + nv50_disp_super_ied_off(head, ior, 2); + + /* If we're shutting down the OR's only active head, execute +- * the output path's release function. ++ * the output path's disable function. + */ + if (ior->arm.head == (1 << head->id)) { +- if ((outp = ior->arm.outp) && outp->func->release) +- outp->func->release(outp, ior); ++ if ((outp = ior->arm.outp) && outp->func->disable) ++ outp->func->disable(outp, ior); + } + } + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c +index be9e7f8c3b23..bbba77ff9385 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c +@@ -93,6 +93,8 @@ nvkm_outp_release(struct nvkm_outp *outp, u8 user) + if (ior) { + outp->acquired &= ~user; + if (!outp->acquired) { ++ if (outp->func->release && outp->ior) ++ outp->func->release(outp); + outp->ior->asy.outp = NULL; + outp->ior = NULL; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h +index ea84d7d5741a..97196f802924 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h +@@ -41,7 +41,8 @@ struct nvkm_outp_func { + void (*init)(struct nvkm_outp *); + void (*fini)(struct nvkm_outp *); + int (*acquire)(struct nvkm_outp *); +- void (*release)(struct nvkm_outp *, struct nvkm_ior *); ++ void (*release)(struct nvkm_outp *); ++ void (*disable)(struct nvkm_outp *, struct nvkm_ior *); + }; + + #define OUTP_MSG(o,l,f,a...) do { \ +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c +index 1730371933df..be0dd6074b57 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c +@@ -158,7 +158,8 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post) + } + + /* load and execute some other ucode image (bios therm?) */ +- return pmu_load(init, 0x01, post, NULL, NULL); ++ pmu_load(init, 0x01, post, NULL, NULL); ++ return 0; + } + + static const struct nvkm_devinit_func +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 25b7bd56ae11..1cb41992aaa1 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -335,7 +335,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) + { +- if (usage->hid == (HID_UP_CUSTOM | 0x0003)) { ++ if (usage->hid == (HID_UP_CUSTOM | 0x0003) || ++ usage->hid == (HID_UP_MSVENDOR | 0x0003)) { + /* The fn key on Apple USB keyboards */ + set_bit(EV_REP, hi->input->evbit); + hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); +@@ -472,6 +473,12 @@ static const struct hid_device_id apple_devices[] = { + .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI), + .driver_data = APPLE_HAS_FN }, ++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI), ++ .driver_data = APPLE_HAS_FN }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI), ++ .driver_data = APPLE_HAS_FN }, ++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI), ++ .driver_data = APPLE_HAS_FN }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI), + .driver_data = APPLE_HAS_FN }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ISO), +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 81ee1d026648..3fc8c0d67592 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -85,6 +85,7 @@ + #define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101 + + #define USB_VENDOR_ID_APPLE 0x05ac ++#define BT_VENDOR_ID_APPLE 0x004c + #define USB_DEVICE_ID_APPLE_MIGHTYMOUSE 0x0304 + #define USB_DEVICE_ID_APPLE_MAGICMOUSE 0x030d + #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD 0x030e +@@ -154,6 +155,7 @@ + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO 0x0256 + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS 0x0257 + #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI 0x0267 ++#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI 0x026c + #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290 + #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291 + #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292 +@@ -924,6 +926,7 @@ + #define USB_DEVICE_ID_SAITEK_RUMBLEPAD 0xff17 + #define USB_DEVICE_ID_SAITEK_PS1000 0x0621 + #define USB_DEVICE_ID_SAITEK_RAT7_OLD 0x0ccb ++#define USB_DEVICE_ID_SAITEK_RAT7_CONTAGION 0x0ccd + #define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7 + #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa + #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0 +diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c +index 39e642686ff0..683861f324e3 100644 +--- a/drivers/hid/hid-saitek.c ++++ b/drivers/hid/hid-saitek.c +@@ -183,6 +183,8 @@ static const struct hid_device_id saitek_devices[] = { + .driver_data = SAITEK_RELEASE_MODE_RAT7 }, + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7), + .driver_data = SAITEK_RELEASE_MODE_RAT7 }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_CONTAGION), ++ .driver_data = SAITEK_RELEASE_MODE_RAT7 }, + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT9), + .driver_data = SAITEK_RELEASE_MODE_RAT7 }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9), +diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c +index 25363fc571bc..faba542d1b07 100644 +--- a/drivers/hid/hid-sensor-hub.c ++++ b/drivers/hid/hid-sensor-hub.c +@@ -579,6 +579,28 @@ void sensor_hub_device_close(struct hid_sensor_hub_device *hsdev) + } + EXPORT_SYMBOL_GPL(sensor_hub_device_close); + ++static __u8 *sensor_hub_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ /* ++ * Checks if the report descriptor of Thinkpad Helix 2 has a logical ++ * minimum for magnetic flux axis greater than the maximum. ++ */ ++ if (hdev->product == USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA && ++ *rsize == 2558 && rdesc[913] == 0x17 && rdesc[914] == 0x40 && ++ rdesc[915] == 0x81 && rdesc[916] == 0x08 && ++ rdesc[917] == 0x00 && rdesc[918] == 0x27 && ++ rdesc[921] == 0x07 && rdesc[922] == 0x00) { ++ /* Sets negative logical minimum for mag x, y and z */ ++ rdesc[914] = rdesc[935] = rdesc[956] = 0xc0; ++ rdesc[915] = rdesc[936] = rdesc[957] = 0x7e; ++ rdesc[916] = rdesc[937] = rdesc[958] = 0xf7; ++ rdesc[917] = rdesc[938] = rdesc[959] = 0xff; ++ } ++ ++ return rdesc; ++} ++ + static int sensor_hub_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +@@ -742,6 +764,7 @@ static struct hid_driver sensor_hub_driver = { + .probe = sensor_hub_probe, + .remove = sensor_hub_remove, + .raw_event = sensor_hub_raw_event, ++ .report_fixup = sensor_hub_report_fixup, + #ifdef CONFIG_PM + .suspend = sensor_hub_suspend, + .resume = sensor_hub_resume, +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index f41901f80b64..5449fc59b7f5 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -74,6 +74,7 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, + __u32 version) + { + int ret = 0; ++ unsigned int cur_cpu; + struct vmbus_channel_initiate_contact *msg; + unsigned long flags; + +@@ -96,9 +97,10 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, + * the CPU attempting to connect may not be CPU 0. + */ + if (version >= VERSION_WIN8_1) { +- msg->target_vcpu = +- hv_cpu_number_to_vp_number(smp_processor_id()); +- vmbus_connection.connect_cpu = smp_processor_id(); ++ cur_cpu = get_cpu(); ++ msg->target_vcpu = hv_cpu_number_to_vp_number(cur_cpu); ++ vmbus_connection.connect_cpu = cur_cpu; ++ put_cpu(); + } else { + msg->target_vcpu = 0; + vmbus_connection.connect_cpu = 0; +diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c +index 9918bdd81619..a403e8579b65 100644 +--- a/drivers/i2c/busses/i2c-uniphier-f.c ++++ b/drivers/i2c/busses/i2c-uniphier-f.c +@@ -401,11 +401,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap, + return ret; + + for (msg = msgs; msg < emsg; msg++) { +- /* If next message is read, skip the stop condition */ +- bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD); +- /* but, force it if I2C_M_STOP is set */ +- if (msg->flags & I2C_M_STOP) +- stop = true; ++ /* Emit STOP if it is the last message or I2C_M_STOP is set. */ ++ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP); + + ret = uniphier_fi2c_master_xfer_one(adap, msg, stop); + if (ret) +diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c +index bb181b088291..454f914ae66d 100644 +--- a/drivers/i2c/busses/i2c-uniphier.c ++++ b/drivers/i2c/busses/i2c-uniphier.c +@@ -248,11 +248,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap, + return ret; + + for (msg = msgs; msg < emsg; msg++) { +- /* If next message is read, skip the stop condition */ +- bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD); +- /* but, force it if I2C_M_STOP is set */ +- if (msg->flags & I2C_M_STOP) +- stop = true; ++ /* Emit STOP if it is the last message or I2C_M_STOP is set. */ ++ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP); + + ret = uniphier_i2c_master_xfer_one(adap, msg, stop); + if (ret) +diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c +index d70e2e53d6a7..557214202eff 100644 +--- a/drivers/iio/temperature/maxim_thermocouple.c ++++ b/drivers/iio/temperature/maxim_thermocouple.c +@@ -267,7 +267,6 @@ static int maxim_thermocouple_remove(struct spi_device *spi) + static const struct spi_device_id maxim_thermocouple_id[] = { + {"max6675", MAX6675}, + {"max31855", MAX31855}, +- {"max31856", MAX31855}, + {}, + }; + MODULE_DEVICE_TABLE(spi, maxim_thermocouple_id); +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index a22b992cde38..16423d7ab599 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut); + static DEFINE_IDR(ctx_idr); + static DEFINE_IDR(multicast_idr); + ++static const struct file_operations ucma_fops; ++ + static inline struct ucma_context *_ucma_find_context(int id, + struct ucma_file *file) + { +@@ -1564,6 +1566,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, + f = fdget(cmd.fd); + if (!f.file) + return -ENOENT; ++ if (f.file->f_op != &ucma_fops) { ++ ret = -EINVAL; ++ goto file_put; ++ } + + /* Validate current fd and prevent destruction of id. */ + ctx = ucma_get_ctx(f.file->private_data, cmd.id); +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 01746e7b90de..9137030423cd 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -3071,7 +3071,7 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom, + return 0; + + offset_mask = pte_pgsize - 1; +- __pte = *pte & PM_ADDR_MASK; ++ __pte = __sme_clr(*pte & PM_ADDR_MASK); + + return (__pte & ~offset_mask) | (iova & offset_mask); + } +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 38a2ac24428e..151211b4cb1b 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3061,6 +3061,11 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) + set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags); + rs_set_new(rs); + } else if (rs_is_recovering(rs)) { ++ /* Rebuild particular devices */ ++ if (test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags)) { ++ set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags); ++ rs_setup_recovery(rs, MaxSector); ++ } + /* A recovering raid set may be resized */ + ; /* skip setup rs */ + } else if (rs_is_reshaping(rs)) { +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index 36ef284ad086..45ff8fd00248 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -188,6 +188,12 @@ struct dm_pool_metadata { + unsigned long flags; + sector_t data_block_size; + ++ /* ++ * We reserve a section of the metadata for commit overhead. ++ * All reported space does *not* include this. ++ */ ++ dm_block_t metadata_reserve; ++ + /* + * Set if a transaction has to be aborted but the attempt to roll back + * to the previous (good) transaction failed. The only pool metadata +@@ -825,6 +831,20 @@ static int __commit_transaction(struct dm_pool_metadata *pmd) + return dm_tm_commit(pmd->tm, sblock); + } + ++static void __set_metadata_reserve(struct dm_pool_metadata *pmd) ++{ ++ int r; ++ dm_block_t total; ++ dm_block_t max_blocks = 4096; /* 16M */ ++ ++ r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total); ++ if (r) { ++ DMERR("could not get size of metadata device"); ++ pmd->metadata_reserve = max_blocks; ++ } else ++ pmd->metadata_reserve = min(max_blocks, div_u64(total, 10)); ++} ++ + struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, + sector_t data_block_size, + bool format_device) +@@ -858,6 +878,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, + return ERR_PTR(r); + } + ++ __set_metadata_reserve(pmd); ++ + return pmd; + } + +@@ -1829,6 +1851,13 @@ int dm_pool_get_free_metadata_block_count(struct dm_pool_metadata *pmd, + down_read(&pmd->root_lock); + if (!pmd->fail_io) + r = dm_sm_get_nr_free(pmd->metadata_sm, result); ++ ++ if (!r) { ++ if (*result < pmd->metadata_reserve) ++ *result = 0; ++ else ++ *result -= pmd->metadata_reserve; ++ } + up_read(&pmd->root_lock); + + return r; +@@ -1941,8 +1970,11 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_cou + int r = -EINVAL; + + down_write(&pmd->root_lock); +- if (!pmd->fail_io) ++ if (!pmd->fail_io) { + r = __resize_space_map(pmd->metadata_sm, new_count); ++ if (!r) ++ __set_metadata_reserve(pmd); ++ } + up_write(&pmd->root_lock); + + return r; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 6cf9ad4e4e16..699c40c7fe60 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -200,7 +200,13 @@ struct dm_thin_new_mapping; + enum pool_mode { + PM_WRITE, /* metadata may be changed */ + PM_OUT_OF_DATA_SPACE, /* metadata may be changed, though data may not be allocated */ ++ ++ /* ++ * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY. ++ */ ++ PM_OUT_OF_METADATA_SPACE, + PM_READ_ONLY, /* metadata may not be changed */ ++ + PM_FAIL, /* all I/O fails */ + }; + +@@ -1382,7 +1388,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode); + + static void requeue_bios(struct pool *pool); + +-static void check_for_space(struct pool *pool) ++static bool is_read_only_pool_mode(enum pool_mode mode) ++{ ++ return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY); ++} ++ ++static bool is_read_only(struct pool *pool) ++{ ++ return is_read_only_pool_mode(get_pool_mode(pool)); ++} ++ ++static void check_for_metadata_space(struct pool *pool) ++{ ++ int r; ++ const char *ooms_reason = NULL; ++ dm_block_t nr_free; ++ ++ r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free); ++ if (r) ++ ooms_reason = "Could not get free metadata blocks"; ++ else if (!nr_free) ++ ooms_reason = "No free metadata blocks"; ++ ++ if (ooms_reason && !is_read_only(pool)) { ++ DMERR("%s", ooms_reason); ++ set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE); ++ } ++} ++ ++static void check_for_data_space(struct pool *pool) + { + int r; + dm_block_t nr_free; +@@ -1408,14 +1442,16 @@ static int commit(struct pool *pool) + { + int r; + +- if (get_pool_mode(pool) >= PM_READ_ONLY) ++ if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) + return -EINVAL; + + r = dm_pool_commit_metadata(pool->pmd); + if (r) + metadata_operation_failed(pool, "dm_pool_commit_metadata", r); +- else +- check_for_space(pool); ++ else { ++ check_for_metadata_space(pool); ++ check_for_data_space(pool); ++ } + + return r; + } +@@ -1481,6 +1517,19 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result) + return r; + } + ++ r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks); ++ if (r) { ++ metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r); ++ return r; ++ } ++ ++ if (!free_blocks) { ++ /* Let's commit before we use up the metadata reserve. */ ++ r = commit(pool); ++ if (r) ++ return r; ++ } ++ + return 0; + } + +@@ -1512,6 +1561,7 @@ static blk_status_t should_error_unserviceable_bio(struct pool *pool) + case PM_OUT_OF_DATA_SPACE: + return pool->pf.error_if_no_space ? BLK_STS_NOSPC : 0; + ++ case PM_OUT_OF_METADATA_SPACE: + case PM_READ_ONLY: + case PM_FAIL: + return BLK_STS_IOERR; +@@ -2475,8 +2525,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode) + error_retry_list(pool); + break; + ++ case PM_OUT_OF_METADATA_SPACE: + case PM_READ_ONLY: +- if (old_mode != new_mode) ++ if (!is_read_only_pool_mode(old_mode)) + notify_of_pool_mode_change(pool, "read-only"); + dm_pool_metadata_read_only(pool->pmd); + pool->process_bio = process_bio_read_only; +@@ -3412,6 +3463,10 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit) + DMINFO("%s: growing the metadata device from %llu to %llu blocks", + dm_device_name(pool->pool_md), + sb_metadata_dev_size, metadata_dev_size); ++ ++ if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE) ++ set_pool_mode(pool, PM_WRITE); ++ + r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size); + if (r) { + metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r); +@@ -3715,7 +3770,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv) + struct pool_c *pt = ti->private; + struct pool *pool = pt->pool; + +- if (get_pool_mode(pool) >= PM_READ_ONLY) { ++ if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) { + DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode", + dm_device_name(pool->pool_md)); + return -EOPNOTSUPP; +@@ -3789,6 +3844,7 @@ static void pool_status(struct dm_target *ti, status_type_t type, + dm_block_t nr_blocks_data; + dm_block_t nr_blocks_metadata; + dm_block_t held_root; ++ enum pool_mode mode; + char buf[BDEVNAME_SIZE]; + char buf2[BDEVNAME_SIZE]; + struct pool_c *pt = ti->private; +@@ -3859,9 +3915,10 @@ static void pool_status(struct dm_target *ti, status_type_t type, + else + DMEMIT("- "); + +- if (pool->pf.mode == PM_OUT_OF_DATA_SPACE) ++ mode = get_pool_mode(pool); ++ if (mode == PM_OUT_OF_DATA_SPACE) + DMEMIT("out_of_data_space "); +- else if (pool->pf.mode == PM_READ_ONLY) ++ else if (is_read_only_pool_mode(mode)) + DMEMIT("ro "); + else + DMEMIT("rw "); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 262a0f0f8fd5..927b60e9d3ca 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4394,11 +4394,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, + allow_barrier(conf); + } + ++ raise_barrier(conf, 0); + read_more: + /* Now schedule reads for blocks from sector_nr to last */ + r10_bio = raid10_alloc_init_r10buf(conf); + r10_bio->state = 0; +- raise_barrier(conf, sectors_done != 0); ++ raise_barrier(conf, 1); + atomic_set(&r10_bio->remaining, 0); + r10_bio->mddev = mddev; + r10_bio->sector = sector_nr; +@@ -4494,6 +4495,8 @@ read_more: + if (sector_nr <= last) + goto read_more; + ++ lower_barrier(conf); ++ + /* Now that we have done the whole section we can + * update reshape_progress + */ +diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h +index 284578b0a349..5c908c510c77 100644 +--- a/drivers/md/raid5-log.h ++++ b/drivers/md/raid5-log.h +@@ -43,6 +43,11 @@ extern void ppl_write_stripe_run(struct r5conf *conf); + extern void ppl_stripe_write_finished(struct stripe_head *sh); + extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add); + ++static inline bool raid5_has_log(struct r5conf *conf) ++{ ++ return test_bit(MD_HAS_JOURNAL, &conf->mddev->flags); ++} ++ + static inline bool raid5_has_ppl(struct r5conf *conf) + { + return test_bit(MD_HAS_PPL, &conf->mddev->flags); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 5018fb2352c2..dbf51b4c21b3 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -736,7 +736,7 @@ static bool stripe_can_batch(struct stripe_head *sh) + { + struct r5conf *conf = sh->raid_conf; + +- if (conf->log || raid5_has_ppl(conf)) ++ if (raid5_has_log(conf) || raid5_has_ppl(conf)) + return false; + return test_bit(STRIPE_BATCH_READY, &sh->state) && + !test_bit(STRIPE_BITMAP_PENDING, &sh->state) && +@@ -7717,7 +7717,7 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors) + sector_t newsize; + struct r5conf *conf = mddev->private; + +- if (conf->log || raid5_has_ppl(conf)) ++ if (raid5_has_log(conf) || raid5_has_ppl(conf)) + return -EINVAL; + sectors &= ~((sector_t)conf->chunk_sectors - 1); + newsize = raid5_size(mddev, sectors, mddev->raid_disks); +@@ -7768,7 +7768,7 @@ static int check_reshape(struct mddev *mddev) + { + struct r5conf *conf = mddev->private; + +- if (conf->log || raid5_has_ppl(conf)) ++ if (raid5_has_log(conf) || raid5_has_ppl(conf)) + return -EINVAL; + if (mddev->delta_disks == 0 && + mddev->new_layout == mddev->layout && +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c +index e3b7a71fcad9..1a4ffc5d3da4 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_com.c +@@ -457,7 +457,7 @@ static void ena_com_handle_admin_completion(struct ena_com_admin_queue *admin_qu + cqe = &admin_queue->cq.entries[head_masked]; + + /* Go over all the completions */ +- while ((cqe->acq_common_descriptor.flags & ++ while ((READ_ONCE(cqe->acq_common_descriptor.flags) & + ENA_ADMIN_ACQ_COMMON_DESC_PHASE_MASK) == phase) { + /* Do not read the rest of the completion entry before the + * phase bit was validated +@@ -633,7 +633,7 @@ static u32 ena_com_reg_bar_read32(struct ena_com_dev *ena_dev, u16 offset) + writel(mmio_read_reg, ena_dev->reg_bar + ENA_REGS_MMIO_REG_READ_OFF); + + for (i = 0; i < timeout; i++) { +- if (read_resp->req_id == mmio_read->seq_num) ++ if (READ_ONCE(read_resp->req_id) == mmio_read->seq_num) + break; + + udelay(1); +@@ -1790,8 +1790,8 @@ void ena_com_aenq_intr_handler(struct ena_com_dev *dev, void *data) + aenq_common = &aenq_e->aenq_common_desc; + + /* Go over all the events */ +- while ((aenq_common->flags & ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == +- phase) { ++ while ((READ_ONCE(aenq_common->flags) & ++ ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == phase) { + pr_debug("AENQ! Group[%x] Syndrom[%x] timestamp: [%llus]\n", + aenq_common->group, aenq_common->syndrom, + (u64)aenq_common->timestamp_low + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 67df5053dc30..60b3ee29d82c 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -456,7 +456,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring, + return -ENOMEM; + } + +- dma = dma_map_page(rx_ring->dev, page, 0, PAGE_SIZE, ++ dma = dma_map_page(rx_ring->dev, page, 0, ENA_PAGE_SIZE, + DMA_FROM_DEVICE); + if (unlikely(dma_mapping_error(rx_ring->dev, dma))) { + u64_stats_update_begin(&rx_ring->syncp); +@@ -473,7 +473,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring, + rx_info->page_offset = 0; + ena_buf = &rx_info->ena_buf; + ena_buf->paddr = dma; +- ena_buf->len = PAGE_SIZE; ++ ena_buf->len = ENA_PAGE_SIZE; + + return 0; + } +@@ -490,7 +490,7 @@ static void ena_free_rx_page(struct ena_ring *rx_ring, + return; + } + +- dma_unmap_page(rx_ring->dev, ena_buf->paddr, PAGE_SIZE, ++ dma_unmap_page(rx_ring->dev, ena_buf->paddr, ENA_PAGE_SIZE, + DMA_FROM_DEVICE); + + __free_page(page); +@@ -910,10 +910,10 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring, + do { + dma_unmap_page(rx_ring->dev, + dma_unmap_addr(&rx_info->ena_buf, paddr), +- PAGE_SIZE, DMA_FROM_DEVICE); ++ ENA_PAGE_SIZE, DMA_FROM_DEVICE); + + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page, +- rx_info->page_offset, len, PAGE_SIZE); ++ rx_info->page_offset, len, ENA_PAGE_SIZE); + + netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev, + "rx skb updated. len %d. data_len %d\n", +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h +index 29bb5704260b..3404376c28ca 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h +@@ -350,4 +350,15 @@ void ena_dump_stats_to_buf(struct ena_adapter *adapter, u8 *buf); + + int ena_get_sset_count(struct net_device *netdev, int sset); + ++/* The ENA buffer length fields is 16 bit long. So when PAGE_SIZE == 64kB the ++ * driver passas 0. ++ * Since the max packet size the ENA handles is ~9kB limit the buffer length to ++ * 16kB. ++ */ ++#if PAGE_SIZE > SZ_16K ++#define ENA_PAGE_SIZE SZ_16K ++#else ++#define ENA_PAGE_SIZE PAGE_SIZE ++#endif ++ + #endif /* !(ENA_H) */ +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index dfef4ec167c1..c1787be6a258 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -642,7 +642,7 @@ static int macb_halt_tx(struct macb *bp) + if (!(status & MACB_BIT(TGO))) + return 0; + +- usleep_range(10, 250); ++ udelay(250); + } while (time_before(halt_time, timeout)); + + return -ETIMEDOUT; +diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h +index cad52bd331f7..08a750fb60c4 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hnae.h ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h +@@ -486,6 +486,8 @@ struct hnae_ae_ops { + u8 *auto_neg, u16 *speed, u8 *duplex); + void (*toggle_ring_irq)(struct hnae_ring *ring, u32 val); + void (*adjust_link)(struct hnae_handle *handle, int speed, int duplex); ++ bool (*need_adjust_link)(struct hnae_handle *handle, ++ int speed, int duplex); + int (*set_loopback)(struct hnae_handle *handle, + enum hnae_loop loop_mode, int en); + void (*get_ring_bdnum_limit)(struct hnae_queue *queue, +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +index bd68379d2bea..bf930ab3c2bd 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +@@ -155,6 +155,41 @@ static void hns_ae_put_handle(struct hnae_handle *handle) + hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0; + } + ++static int hns_ae_wait_flow_down(struct hnae_handle *handle) ++{ ++ struct dsaf_device *dsaf_dev; ++ struct hns_ppe_cb *ppe_cb; ++ struct hnae_vf_cb *vf_cb; ++ int ret; ++ int i; ++ ++ for (i = 0; i < handle->q_num; i++) { ++ ret = hns_rcb_wait_tx_ring_clean(handle->qs[i]); ++ if (ret) ++ return ret; ++ } ++ ++ ppe_cb = hns_get_ppe_cb(handle); ++ ret = hns_ppe_wait_tx_fifo_clean(ppe_cb); ++ if (ret) ++ return ret; ++ ++ dsaf_dev = hns_ae_get_dsaf_dev(handle->dev); ++ if (!dsaf_dev) ++ return -EINVAL; ++ ret = hns_dsaf_wait_pkt_clean(dsaf_dev, handle->dport_id); ++ if (ret) ++ return ret; ++ ++ vf_cb = hns_ae_get_vf_cb(handle); ++ ret = hns_mac_wait_fifo_clean(vf_cb->mac_cb); ++ if (ret) ++ return ret; ++ ++ mdelay(10); ++ return 0; ++} ++ + static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val) + { + int q_num = handle->q_num; +@@ -399,12 +434,41 @@ static int hns_ae_get_mac_info(struct hnae_handle *handle, + return hns_mac_get_port_info(mac_cb, auto_neg, speed, duplex); + } + ++static bool hns_ae_need_adjust_link(struct hnae_handle *handle, int speed, ++ int duplex) ++{ ++ struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle); ++ ++ return hns_mac_need_adjust_link(mac_cb, speed, duplex); ++} ++ + static void hns_ae_adjust_link(struct hnae_handle *handle, int speed, + int duplex) + { + struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle); + +- hns_mac_adjust_link(mac_cb, speed, duplex); ++ switch (mac_cb->dsaf_dev->dsaf_ver) { ++ case AE_VERSION_1: ++ hns_mac_adjust_link(mac_cb, speed, duplex); ++ break; ++ ++ case AE_VERSION_2: ++ /* chip need to clear all pkt inside */ ++ hns_mac_disable(mac_cb, MAC_COMM_MODE_RX); ++ if (hns_ae_wait_flow_down(handle)) { ++ hns_mac_enable(mac_cb, MAC_COMM_MODE_RX); ++ break; ++ } ++ ++ hns_mac_adjust_link(mac_cb, speed, duplex); ++ hns_mac_enable(mac_cb, MAC_COMM_MODE_RX); ++ break; ++ ++ default: ++ break; ++ } ++ ++ return; + } + + static void hns_ae_get_ring_bdnum_limit(struct hnae_queue *queue, +@@ -902,6 +966,7 @@ static struct hnae_ae_ops hns_dsaf_ops = { + .get_status = hns_ae_get_link_status, + .get_info = hns_ae_get_mac_info, + .adjust_link = hns_ae_adjust_link, ++ .need_adjust_link = hns_ae_need_adjust_link, + .set_loopback = hns_ae_config_loopback, + .get_ring_bdnum_limit = hns_ae_get_ring_bdnum_limit, + .get_pauseparam = hns_ae_get_pauseparam, +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +index 74bd260ca02a..8c7bc5cf193c 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +@@ -257,6 +257,16 @@ static void hns_gmac_get_pausefrm_cfg(void *mac_drv, u32 *rx_pause_en, + *tx_pause_en = dsaf_get_bit(pause_en, GMAC_PAUSE_EN_TX_FDFC_B); + } + ++static bool hns_gmac_need_adjust_link(void *mac_drv, enum mac_speed speed, ++ int duplex) ++{ ++ struct mac_driver *drv = (struct mac_driver *)mac_drv; ++ struct hns_mac_cb *mac_cb = drv->mac_cb; ++ ++ return (mac_cb->speed != speed) || ++ (mac_cb->half_duplex == duplex); ++} ++ + static int hns_gmac_adjust_link(void *mac_drv, enum mac_speed speed, + u32 full_duplex) + { +@@ -309,6 +319,30 @@ static void hns_gmac_set_promisc(void *mac_drv, u8 en) + hns_gmac_set_uc_match(mac_drv, en); + } + ++int hns_gmac_wait_fifo_clean(void *mac_drv) ++{ ++ struct mac_driver *drv = (struct mac_driver *)mac_drv; ++ int wait_cnt; ++ u32 val; ++ ++ wait_cnt = 0; ++ while (wait_cnt++ < HNS_MAX_WAIT_CNT) { ++ val = dsaf_read_dev(drv, GMAC_FIFO_STATE_REG); ++ /* bit5~bit0 is not send complete pkts */ ++ if ((val & 0x3f) == 0) ++ break; ++ usleep_range(100, 200); ++ } ++ ++ if (wait_cnt >= HNS_MAX_WAIT_CNT) { ++ dev_err(drv->dev, ++ "hns ge %d fifo was not idle.\n", drv->mac_id); ++ return -EBUSY; ++ } ++ ++ return 0; ++} ++ + static void hns_gmac_init(void *mac_drv) + { + u32 port; +@@ -690,6 +724,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param) + mac_drv->mac_disable = hns_gmac_disable; + mac_drv->mac_free = hns_gmac_free; + mac_drv->adjust_link = hns_gmac_adjust_link; ++ mac_drv->need_adjust_link = hns_gmac_need_adjust_link; + mac_drv->set_tx_auto_pause_frames = hns_gmac_set_tx_auto_pause_frames; + mac_drv->config_max_frame_length = hns_gmac_config_max_frame_length; + mac_drv->mac_pausefrm_cfg = hns_gmac_pause_frm_cfg; +@@ -717,6 +752,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param) + mac_drv->get_strings = hns_gmac_get_strings; + mac_drv->update_stats = hns_gmac_update_stats; + mac_drv->set_promiscuous = hns_gmac_set_promisc; ++ mac_drv->wait_fifo_clean = hns_gmac_wait_fifo_clean; + + return (void *)mac_drv; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +index 8b5cdf490850..5a8dbd72fe45 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +@@ -114,6 +114,26 @@ int hns_mac_get_port_info(struct hns_mac_cb *mac_cb, + return 0; + } + ++/** ++ *hns_mac_is_adjust_link - check is need change mac speed and duplex register ++ *@mac_cb: mac device ++ *@speed: phy device speed ++ *@duplex:phy device duplex ++ * ++ */ ++bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex) ++{ ++ struct mac_driver *mac_ctrl_drv; ++ ++ mac_ctrl_drv = (struct mac_driver *)(mac_cb->priv.mac); ++ ++ if (mac_ctrl_drv->need_adjust_link) ++ return mac_ctrl_drv->need_adjust_link(mac_ctrl_drv, ++ (enum mac_speed)speed, duplex); ++ else ++ return true; ++} ++ + void hns_mac_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex) + { + int ret; +@@ -432,6 +452,16 @@ int hns_mac_vm_config_bc_en(struct hns_mac_cb *mac_cb, u32 vmid, bool enable) + return 0; + } + ++int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb) ++{ ++ struct mac_driver *drv = hns_mac_get_drv(mac_cb); ++ ++ if (drv->wait_fifo_clean) ++ return drv->wait_fifo_clean(drv); ++ ++ return 0; ++} ++ + void hns_mac_reset(struct hns_mac_cb *mac_cb) + { + struct mac_driver *drv = hns_mac_get_drv(mac_cb); +@@ -1001,6 +1031,20 @@ static int hns_mac_get_max_port_num(struct dsaf_device *dsaf_dev) + return DSAF_MAX_PORT_NUM; + } + ++void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode) ++{ ++ struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb); ++ ++ mac_ctrl_drv->mac_enable(mac_cb->priv.mac, mode); ++} ++ ++void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode) ++{ ++ struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb); ++ ++ mac_ctrl_drv->mac_disable(mac_cb->priv.mac, mode); ++} ++ + /** + * hns_mac_init - init mac + * @dsaf_dev: dsa fabric device struct pointer +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h +index bbc0a98e7ca3..fbc75341bef7 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h +@@ -356,6 +356,9 @@ struct mac_driver { + /*adjust mac mode of port,include speed and duplex*/ + int (*adjust_link)(void *mac_drv, enum mac_speed speed, + u32 full_duplex); ++ /* need adjust link */ ++ bool (*need_adjust_link)(void *mac_drv, enum mac_speed speed, ++ int duplex); + /* config autoegotaite mode of port*/ + void (*set_an_mode)(void *mac_drv, u8 enable); + /* config loopbank mode */ +@@ -394,6 +397,7 @@ struct mac_driver { + void (*get_info)(void *mac_drv, struct mac_info *mac_info); + + void (*update_stats)(void *mac_drv); ++ int (*wait_fifo_clean)(void *mac_drv); + + enum mac_mode mac_mode; + u8 mac_id; +@@ -427,6 +431,7 @@ void *hns_xgmac_config(struct hns_mac_cb *mac_cb, + + int hns_mac_init(struct dsaf_device *dsaf_dev); + void mac_adjust_link(struct net_device *net_dev); ++bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex); + void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status); + int hns_mac_change_vf_addr(struct hns_mac_cb *mac_cb, u32 vmid, char *addr); + int hns_mac_set_multi(struct hns_mac_cb *mac_cb, +@@ -463,5 +468,8 @@ int hns_mac_add_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id, + int hns_mac_rm_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id, + const unsigned char *addr); + int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn); ++void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode); ++void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode); ++int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb); + + #endif /* _HNS_DSAF_MAC_H */ +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +index e0bc79ea3d88..1f056a6b167e 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c +@@ -2720,6 +2720,35 @@ void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev, + soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX; + } + ++int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port) ++{ ++ u32 val, val_tmp; ++ int wait_cnt; ++ ++ if (port >= DSAF_SERVICE_NW_NUM) ++ return 0; ++ ++ wait_cnt = 0; ++ while (wait_cnt++ < HNS_MAX_WAIT_CNT) { ++ val = dsaf_read_dev(dsaf_dev, DSAF_VOQ_IN_PKT_NUM_0_REG + ++ (port + DSAF_XGE_NUM) * 0x40); ++ val_tmp = dsaf_read_dev(dsaf_dev, DSAF_VOQ_OUT_PKT_NUM_0_REG + ++ (port + DSAF_XGE_NUM) * 0x40); ++ if (val == val_tmp) ++ break; ++ ++ usleep_range(100, 200); ++ } ++ ++ if (wait_cnt >= HNS_MAX_WAIT_CNT) { ++ dev_err(dsaf_dev->dev, "hns dsaf clean wait timeout(%u - %u).\n", ++ val, val_tmp); ++ return -EBUSY; ++ } ++ ++ return 0; ++} ++ + /** + * dsaf_probe - probo dsaf dev + * @pdev: dasf platform device +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h +index 4507e8222683..0e1cd99831a6 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h +@@ -44,6 +44,8 @@ struct hns_mac_cb; + #define DSAF_ROCE_CREDIT_CHN 8 + #define DSAF_ROCE_CHAN_MODE 3 + ++#define HNS_MAX_WAIT_CNT 10000 ++ + enum dsaf_roce_port_mode { + DSAF_ROCE_6PORT_MODE, + DSAF_ROCE_4PORT_MODE, +@@ -463,5 +465,6 @@ int hns_dsaf_rm_mac_addr( + + int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev, + u8 mac_id, u8 port_num); ++int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port); + + #endif /* __HNS_DSAF_MAIN_H__ */ +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +index 93e71e27401b..a19932aeb9d7 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +@@ -274,6 +274,29 @@ static void hns_ppe_exc_irq_en(struct hns_ppe_cb *ppe_cb, int en) + dsaf_write_dev(ppe_cb, PPE_INTEN_REG, msk_vlue & vld_msk); + } + ++int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb) ++{ ++ int wait_cnt; ++ u32 val; ++ ++ wait_cnt = 0; ++ while (wait_cnt++ < HNS_MAX_WAIT_CNT) { ++ val = dsaf_read_dev(ppe_cb, PPE_CURR_TX_FIFO0_REG) & 0x3ffU; ++ if (!val) ++ break; ++ ++ usleep_range(100, 200); ++ } ++ ++ if (wait_cnt >= HNS_MAX_WAIT_CNT) { ++ dev_err(ppe_cb->dev, "hns ppe tx fifo clean wait timeout, still has %u pkt.\n", ++ val); ++ return -EBUSY; ++ } ++ ++ return 0; ++} ++ + /** + * ppe_init_hw - init ppe + * @ppe_cb: ppe device +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h +index 9d8e643e8aa6..f670e63a5a01 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h +@@ -100,6 +100,7 @@ struct ppe_common_cb { + + }; + ++int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb); + int hns_ppe_init(struct dsaf_device *dsaf_dev); + + void hns_ppe_uninit(struct dsaf_device *dsaf_dev); +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +index e2e28532e4dc..1e43d7a3ca86 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +@@ -66,6 +66,29 @@ void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag) + "queue(%d) wait fbd(%d) clean fail!!\n", i, fbd_num); + } + ++int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs) ++{ ++ u32 head, tail; ++ int wait_cnt; ++ ++ tail = dsaf_read_dev(&qs->tx_ring, RCB_REG_TAIL); ++ wait_cnt = 0; ++ while (wait_cnt++ < HNS_MAX_WAIT_CNT) { ++ head = dsaf_read_dev(&qs->tx_ring, RCB_REG_HEAD); ++ if (tail == head) ++ break; ++ ++ usleep_range(100, 200); ++ } ++ ++ if (wait_cnt >= HNS_MAX_WAIT_CNT) { ++ dev_err(qs->dev->dev, "rcb wait timeout, head not equal to tail.\n"); ++ return -EBUSY; ++ } ++ ++ return 0; ++} ++ + /** + *hns_rcb_reset_ring_hw - ring reset + *@q: ring struct pointer +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h +index 602816498c8d..2319b772a271 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h +@@ -136,6 +136,7 @@ void hns_rcbv2_int_clr_hw(struct hnae_queue *q, u32 flag); + void hns_rcb_init_hw(struct ring_pair_cb *ring); + void hns_rcb_reset_ring_hw(struct hnae_queue *q); + void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag); ++int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs); + u32 hns_rcb_get_rx_coalesced_frames( + struct rcb_common_cb *rcb_common, u32 port_idx); + u32 hns_rcb_get_tx_coalesced_frames( +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h +index 46a52d9bb196..6d20e4eb7402 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h +@@ -464,6 +464,7 @@ + #define RCB_RING_INTMSK_TX_OVERTIME_REG 0x000C4 + #define RCB_RING_INTSTS_TX_OVERTIME_REG 0x000C8 + ++#define GMAC_FIFO_STATE_REG 0x0000UL + #define GMAC_DUPLEX_TYPE_REG 0x0008UL + #define GMAC_FD_FC_TYPE_REG 0x000CUL + #define GMAC_TX_WATER_LINE_REG 0x0010UL +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 25a9732afc84..07d6a9cf2c55 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -1212,11 +1212,26 @@ static void hns_nic_adjust_link(struct net_device *ndev) + struct hnae_handle *h = priv->ae_handle; + int state = 1; + ++ /* If there is no phy, do not need adjust link */ + if (ndev->phydev) { +- h->dev->ops->adjust_link(h, ndev->phydev->speed, +- ndev->phydev->duplex); +- state = ndev->phydev->link; ++ /* When phy link down, do nothing */ ++ if (ndev->phydev->link == 0) ++ return; ++ ++ if (h->dev->ops->need_adjust_link(h, ndev->phydev->speed, ++ ndev->phydev->duplex)) { ++ /* because Hi161X chip don't support to change gmac ++ * speed and duplex with traffic. Delay 200ms to ++ * make sure there is no more data in chip FIFO. ++ */ ++ netif_carrier_off(ndev); ++ msleep(200); ++ h->dev->ops->adjust_link(h, ndev->phydev->speed, ++ ndev->phydev->duplex); ++ netif_carrier_on(ndev); ++ } + } ++ + state = state && h->dev->ops->get_status(h); + + if (state != priv->link) { +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index 2e14a3ae1d8b..c1e947bb852f 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -243,7 +243,9 @@ static int hns_nic_set_link_ksettings(struct net_device *net_dev, + } + + if (h->dev->ops->adjust_link) { ++ netif_carrier_off(net_dev); + h->dev->ops->adjust_link(h, (int)speed, cmd->base.duplex); ++ netif_carrier_on(net_dev); + return 0; + } + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index b68d94b49a8a..42183a8b649c 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -3108,11 +3108,13 @@ int ixgbe_poll(struct napi_struct *napi, int budget) + return budget; + + /* all work done, exit the polling mode */ +- napi_complete_done(napi, work_done); +- if (adapter->rx_itr_setting & 1) +- ixgbe_set_itr(q_vector); +- if (!test_bit(__IXGBE_DOWN, &adapter->state)) +- ixgbe_irq_enable_queues(adapter, BIT_ULL(q_vector->v_idx)); ++ if (likely(napi_complete_done(napi, work_done))) { ++ if (adapter->rx_itr_setting & 1) ++ ixgbe_set_itr(q_vector); ++ if (!test_bit(__IXGBE_DOWN, &adapter->state)) ++ ixgbe_irq_enable_queues(adapter, ++ BIT_ULL(q_vector->v_idx)); ++ } + + return min(work_done, budget - 1); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +index 9f9c9ff10735..07fda3984e10 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +@@ -388,16 +388,17 @@ void mlx5_remove_dev_by_protocol(struct mlx5_core_dev *dev, int protocol) + } + } + +-static u16 mlx5_gen_pci_id(struct mlx5_core_dev *dev) ++static u32 mlx5_gen_pci_id(struct mlx5_core_dev *dev) + { +- return (u16)((dev->pdev->bus->number << 8) | ++ return (u32)((pci_domain_nr(dev->pdev->bus) << 16) | ++ (dev->pdev->bus->number << 8) | + PCI_SLOT(dev->pdev->devfn)); + } + + /* Must be called with intf_mutex held */ + struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev) + { +- u16 pci_id = mlx5_gen_pci_id(dev); ++ u32 pci_id = mlx5_gen_pci_id(dev); + struct mlx5_core_dev *res = NULL; + struct mlx5_core_dev *tmp_dev; + struct mlx5_priv *priv; +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 3669005b9294..f7e540eeb877 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -760,7 +760,7 @@ struct rtl8169_tc_offsets { + }; + + enum rtl_flag { +- RTL_FLAG_TASK_ENABLED, ++ RTL_FLAG_TASK_ENABLED = 0, + RTL_FLAG_TASK_SLOW_PENDING, + RTL_FLAG_TASK_RESET_PENDING, + RTL_FLAG_TASK_PHY_PENDING, +@@ -7657,7 +7657,8 @@ static int rtl8169_close(struct net_device *dev) + rtl8169_update_counters(dev); + + rtl_lock_work(tp); +- clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags); ++ /* Clear all task flags */ ++ bitmap_zero(tp->wk.flags, RTL_FLAG_MAX); + + rtl8169_down(dev); + rtl_unlock_work(tp); +@@ -7838,7 +7839,9 @@ static void rtl8169_net_suspend(struct net_device *dev) + + rtl_lock_work(tp); + napi_disable(&tp->napi); +- clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags); ++ /* Clear all task flags */ ++ bitmap_zero(tp->wk.flags, RTL_FLAG_MAX); ++ + rtl_unlock_work(tp); + + rtl_pll_power_down(tp); +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index d686ba10fecc..aafa7aa18fbd 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2632,9 +2632,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, + IEEE80211_VHT_CAP_SHORT_GI_80 | + IEEE80211_VHT_CAP_SHORT_GI_160 | + IEEE80211_VHT_CAP_TXSTBC | +- IEEE80211_VHT_CAP_RXSTBC_1 | +- IEEE80211_VHT_CAP_RXSTBC_2 | +- IEEE80211_VHT_CAP_RXSTBC_3 | + IEEE80211_VHT_CAP_RXSTBC_4 | + IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK; + sband->vht_cap.vht_mcs.rx_mcs_map = +@@ -3124,6 +3121,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + if (info->attrs[HWSIM_ATTR_CHANNELS]) + param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]); + ++ if (param.channels < 1) { ++ GENL_SET_ERR_MSG(info, "must have at least one channel"); ++ return -EINVAL; ++ } ++ + if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) { + GENL_SET_ERR_MSG(info, "too many channels specified"); + return -EINVAL; +diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c +index 3333d417b248..a70b3d24936d 100644 +--- a/drivers/nvme/target/rdma.c ++++ b/drivers/nvme/target/rdma.c +@@ -65,6 +65,7 @@ struct nvmet_rdma_rsp { + + struct nvmet_req req; + ++ bool allocated; + u8 n_rdma; + u32 flags; + u32 invalidate_rkey; +@@ -167,11 +168,19 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue) + unsigned long flags; + + spin_lock_irqsave(&queue->rsps_lock, flags); +- rsp = list_first_entry(&queue->free_rsps, ++ rsp = list_first_entry_or_null(&queue->free_rsps, + struct nvmet_rdma_rsp, free_list); +- list_del(&rsp->free_list); ++ if (likely(rsp)) ++ list_del(&rsp->free_list); + spin_unlock_irqrestore(&queue->rsps_lock, flags); + ++ if (unlikely(!rsp)) { ++ rsp = kmalloc(sizeof(*rsp), GFP_KERNEL); ++ if (unlikely(!rsp)) ++ return NULL; ++ rsp->allocated = true; ++ } ++ + return rsp; + } + +@@ -180,6 +189,11 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp) + { + unsigned long flags; + ++ if (rsp->allocated) { ++ kfree(rsp); ++ return; ++ } ++ + spin_lock_irqsave(&rsp->queue->rsps_lock, flags); + list_add_tail(&rsp->free_list, &rsp->queue->free_rsps); + spin_unlock_irqrestore(&rsp->queue->rsps_lock, flags); +@@ -756,6 +770,15 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) + + cmd->queue = queue; + rsp = nvmet_rdma_get_rsp(queue); ++ if (unlikely(!rsp)) { ++ /* ++ * we get here only under memory pressure, ++ * silently drop and have the host retry ++ * as we can't even fail it. ++ */ ++ nvmet_rdma_post_recv(queue->dev, cmd); ++ return; ++ } + rsp->queue = queue; + rsp->cmd = cmd; + rsp->flags = 0; +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 0a6afd4b283d..4f2747cd15a6 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -23,6 +23,7 @@ + #include <linux/netdevice.h> + #include <linux/netdev_features.h> + #include <linux/skbuff.h> ++#include <linux/vmalloc.h> + + #include <net/iucv/af_iucv.h> + #include <net/dsfield.h> +@@ -4728,7 +4729,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata) + + priv.buffer_len = oat_data.buffer_len; + priv.response_len = 0; +- priv.buffer = kzalloc(oat_data.buffer_len, GFP_KERNEL); ++ priv.buffer = vzalloc(oat_data.buffer_len); + if (!priv.buffer) { + rc = -ENOMEM; + goto out; +@@ -4769,7 +4770,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata) + rc = -EFAULT; + + out_free: +- kfree(priv.buffer); ++ vfree(priv.buffer); + out: + return rc; + } +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 521293b1f4fa..11ae67842edf 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -484,7 +484,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card, + default: + dev_kfree_skb_any(skb); + QETH_CARD_TEXT(card, 3, "inbunkno"); +- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN); ++ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr)); + continue; + } + work_done++; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 1c62cbbaa66f..cd73172bff47 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1793,7 +1793,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card, + default: + dev_kfree_skb_any(skb); + QETH_CARD_TEXT(card, 3, "inbunkno"); +- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN); ++ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr)); + continue; + } + work_done++; +diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c +index 5be0086142ca..ab30db8c36c6 100644 +--- a/drivers/scsi/csiostor/csio_hw.c ++++ b/drivers/scsi/csiostor/csio_hw.c +@@ -2010,8 +2010,8 @@ bye: + } + + /* +- * Returns -EINVAL if attempts to flash the firmware failed +- * else returns 0, ++ * Returns -EINVAL if attempts to flash the firmware failed, ++ * -ENOMEM if memory allocation failed else returns 0, + * if flashing was not attempted because the card had the + * latest firmware ECANCELED is returned + */ +@@ -2039,6 +2039,13 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset) + return -EINVAL; + } + ++ /* allocate memory to read the header of the firmware on the ++ * card ++ */ ++ card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL); ++ if (!card_fw) ++ return -ENOMEM; ++ + if (csio_is_t5(pci_dev->device & CSIO_HW_CHIP_MASK)) + fw_bin_file = FW_FNAME_T5; + else +@@ -2052,11 +2059,6 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset) + fw_size = fw->size; + } + +- /* allocate memory to read the header of the firmware on the +- * card +- */ +- card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL); +- + /* upgrade FW logic */ + ret = csio_hw_prep_fw(hw, fw_info, fw_data, fw_size, card_fw, + hw->fw_state, reset); +diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h +index b8b22ce60ecc..95141066c3fa 100644 +--- a/drivers/scsi/qedi/qedi.h ++++ b/drivers/scsi/qedi/qedi.h +@@ -77,6 +77,11 @@ enum qedi_nvm_tgts { + QEDI_NVM_TGT_SEC, + }; + ++struct qedi_nvm_iscsi_image { ++ struct nvm_iscsi_cfg iscsi_cfg; ++ u32 crc; ++}; ++ + struct qedi_uio_ctrl { + /* meta data */ + u32 uio_hsi_version; +@@ -294,7 +299,7 @@ struct qedi_ctx { + void *bdq_pbl_list; + dma_addr_t bdq_pbl_list_dma; + u8 bdq_pbl_list_num_entries; +- struct nvm_iscsi_cfg *iscsi_cfg; ++ struct qedi_nvm_iscsi_image *iscsi_image; + dma_addr_t nvm_buf_dma; + void __iomem *bdq_primary_prod; + void __iomem *bdq_secondary_prod; +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index e7daadc089fc..24b945b555ba 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1147,23 +1147,26 @@ exit_setup_int: + + static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi) + { +- if (qedi->iscsi_cfg) ++ if (qedi->iscsi_image) + dma_free_coherent(&qedi->pdev->dev, +- sizeof(struct nvm_iscsi_cfg), +- qedi->iscsi_cfg, qedi->nvm_buf_dma); ++ sizeof(struct qedi_nvm_iscsi_image), ++ qedi->iscsi_image, qedi->nvm_buf_dma); + } + + static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi) + { +- qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev, +- sizeof(struct nvm_iscsi_cfg), +- &qedi->nvm_buf_dma, GFP_KERNEL); +- if (!qedi->iscsi_cfg) { ++ struct qedi_nvm_iscsi_image nvm_image; ++ ++ qedi->iscsi_image = dma_zalloc_coherent(&qedi->pdev->dev, ++ sizeof(nvm_image), ++ &qedi->nvm_buf_dma, ++ GFP_KERNEL); ++ if (!qedi->iscsi_image) { + QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n"); + return -ENOMEM; + } + QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO, +- "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg, ++ "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_image, + qedi->nvm_buf_dma); + + return 0; +@@ -1716,7 +1719,7 @@ qedi_get_nvram_block(struct qedi_ctx *qedi) + struct nvm_iscsi_block *block; + + pf = qedi->dev_info.common.abs_pf_id; +- block = &qedi->iscsi_cfg->block[0]; ++ block = &qedi->iscsi_image->iscsi_cfg.block[0]; + for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) { + flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >> + NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET; +@@ -2008,15 +2011,14 @@ static void qedi_boot_release(void *data) + static int qedi_get_boot_info(struct qedi_ctx *qedi) + { + int ret = 1; +- u16 len; +- +- len = sizeof(struct nvm_iscsi_cfg); ++ struct qedi_nvm_iscsi_image nvm_image; + + QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO, + "Get NVM iSCSI CFG image\n"); + ret = qedi_ops->common->nvm_get_image(qedi->cdev, + QED_NVM_IMAGE_ISCSI_CFG, +- (char *)qedi->iscsi_cfg, len); ++ (char *)qedi->iscsi_image, ++ sizeof(nvm_image)); + if (ret) + QEDI_ERR(&qedi->dbg_ctx, + "Could not get NVM image. ret = %d\n", ret); +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 98e27da34f3c..27893d90c4ef 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -310,11 +310,9 @@ static int iscsi_login_zero_tsih_s1( + return -ENOMEM; + } + +- ret = iscsi_login_set_conn_values(sess, conn, pdu->cid); +- if (unlikely(ret)) { +- kfree(sess); +- return ret; +- } ++ if (iscsi_login_set_conn_values(sess, conn, pdu->cid)) ++ goto free_sess; ++ + sess->init_task_tag = pdu->itt; + memcpy(&sess->isid, pdu->isid, 6); + sess->exp_cmd_sn = be32_to_cpu(pdu->cmdsn); +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 45b57c294d13..401c983ec5f3 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -327,8 +327,10 @@ static void mvebu_uart_set_termios(struct uart_port *port, + if ((termios->c_cflag & CREAD) == 0) + port->ignore_status_mask |= STAT_RX_RDY | STAT_BRK_ERR; + +- if (old) ++ if (old) { + tty_termios_copy_hw(termios, old); ++ termios->c_cflag |= CS8; ++ } + + baud = uart_get_baud_rate(port, termios, old, 0, 460800); + uart_update_timeout(port, termios->c_cflag, baud); +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 78d0204e3e20..d17d7052605b 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -1066,12 +1066,15 @@ static const struct usb_gadget_ops fotg210_gadget_ops = { + static int fotg210_udc_remove(struct platform_device *pdev) + { + struct fotg210_udc *fotg210 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fotg210->gadget); + iounmap(fotg210->reg); + free_irq(platform_get_irq(pdev, 0), fotg210); + + fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); ++ for (i = 0; i < FOTG210_MAX_NUM_EP; i++) ++ kfree(fotg210->ep[i]); + kfree(fotg210); + + return 0; +@@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) + /* initialize udc */ + fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL); + if (fotg210 == NULL) +- goto err_alloc; ++ goto err; + + for (i = 0; i < FOTG210_MAX_NUM_EP; i++) { + _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL); +@@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) + fotg210->reg = ioremap(res->start, resource_size(res)); + if (fotg210->reg == NULL) { + pr_err("ioremap error.\n"); +- goto err_map; ++ goto err_alloc; + } + + spin_lock_init(&fotg210->lock); +@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) + fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep, + GFP_KERNEL); + if (fotg210->ep0_req == NULL) +- goto err_req; ++ goto err_map; + + fotg210_init(fotg210); + +@@ -1190,12 +1193,14 @@ err_req: + fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); + + err_map: +- if (fotg210->reg) +- iounmap(fotg210->reg); ++ iounmap(fotg210->reg); + + err_alloc: ++ for (i = 0; i < FOTG210_MAX_NUM_EP; i++) ++ kfree(fotg210->ep[i]); + kfree(fotg210); + ++err: + return ret; + } + +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 0673f286afbd..4f48f5730e12 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -417,6 +417,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, + spin_unlock_irqrestore(&dev->lock, flags); + mutex_unlock(&dev->io_mutex); + ++ if (WARN_ON_ONCE(len >= sizeof(in_buffer))) ++ return -EIO; ++ + return simple_read_from_buffer(buffer, count, ppos, in_buffer, len); + } + +diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c +index d4265c8ebb22..b1357aa4bc55 100644 +--- a/drivers/xen/cpu_hotplug.c ++++ b/drivers/xen/cpu_hotplug.c +@@ -19,15 +19,16 @@ static void enable_hotplug_cpu(int cpu) + + static void disable_hotplug_cpu(int cpu) + { +- if (cpu_online(cpu)) { +- lock_device_hotplug(); ++ if (!cpu_is_hotpluggable(cpu)) ++ return; ++ lock_device_hotplug(); ++ if (cpu_online(cpu)) + device_offline(get_cpu_device(cpu)); +- unlock_device_hotplug(); +- } +- if (cpu_present(cpu)) ++ if (!cpu_online(cpu) && cpu_present(cpu)) { + xen_arch_unregister_cpu(cpu); +- +- set_cpu_present(cpu, false); ++ set_cpu_present(cpu, false); ++ } ++ unlock_device_hotplug(); + } + + static int vcpu_online(unsigned int cpu) +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 08e4af04d6f2..e6c1934734b7 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -138,7 +138,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) + clear_evtchn_to_irq_row(row); + } + +- evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq; ++ evtchn_to_irq[row][col] = irq; + return 0; + } + +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index 587d12829925..0444ebdda3f0 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -283,9 +283,11 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path, + /* + * The Xenstore watch fires directly after registering it and + * after a suspend/resume cycle. So ENOENT is no error but +- * might happen in those cases. ++ * might happen in those cases. ERANGE is observed when we get ++ * an empty value (''), this happens when we acknowledge the ++ * request by writing '\0' below. + */ +- if (err != -ENOENT) ++ if (err != -ENOENT && err != -ERANGE) + pr_err("Error %d reading sysrq code in control/sysrq\n", + err); + xenbus_transaction_end(xbt, 1); +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index a39b1f0b0606..a0947f4a3e87 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4517,7 +4517,12 @@ again: + + /* Now btrfs_update_device() will change the on-disk size. */ + ret = btrfs_update_device(trans, device); +- btrfs_end_transaction(trans); ++ if (ret < 0) { ++ btrfs_abort_transaction(trans, ret); ++ btrfs_end_transaction(trans); ++ } else { ++ ret = btrfs_commit_transaction(trans); ++ } + done: + btrfs_free_path(path); + if (ret) { +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index b380e0871372..a2b2355e7f01 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -105,9 +105,6 @@ convert_sfm_char(const __u16 src_char, char *target) + case SFM_LESSTHAN: + *target = '<'; + break; +- case SFM_SLASH: +- *target = '\\'; +- break; + case SFM_SPACE: + *target = ' '; + break; +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index b5a436583469..2e936f94f102 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -589,10 +589,15 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) + } + + count = 0; ++ /* ++ * We know that all the name entries in the protocols array ++ * are short (< 16 bytes anyway) and are NUL terminated. ++ */ + for (i = 0; i < CIFS_NUM_PROT; i++) { +- strncpy(pSMB->DialectsArray+count, protocols[i].name, 16); +- count += strlen(protocols[i].name) + 1; +- /* null at end of source and target buffers anyway */ ++ size_t len = strlen(protocols[i].name) + 1; ++ ++ memcpy(pSMB->DialectsArray+count, protocols[i].name, len); ++ count += len; + } + inc_rfc1001_len(pSMB, count); + pSMB->ByteCount = cpu_to_le16(count); +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 460084a8eac5..bcab30d4a6c7 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -398,9 +398,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) + (struct smb_com_transaction_change_notify_rsp *)buf; + struct file_notify_information *pnotify; + __u32 data_offset = 0; ++ size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length); ++ + if (get_bcc(buf) > sizeof(struct file_notify_information)) { + data_offset = le32_to_cpu(pSMBr->DataOffset); + ++ if (data_offset > ++ len - sizeof(struct file_notify_information)) { ++ cifs_dbg(FYI, "invalid data_offset %u\n", ++ data_offset); ++ return true; ++ } + pnotify = (struct file_notify_information *) + ((char *)&pSMBr->hdr.Protocol + data_offset); + cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n", +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 759cbbf7b1af..4e5b05263e4a 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1239,7 +1239,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + } + + srch_inf->entries_in_buffer = 0; +- srch_inf->index_of_last_entry = 0; ++ srch_inf->index_of_last_entry = 2; + + rc = SMB2_query_directory(xid, tcon, fid->persistent_fid, + fid->volatile_fid, 0, srch_inf); +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index 3e04279446e8..44e7d180ebec 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm, + + res->last_used = 0; + +- spin_lock(&dlm->spinlock); ++ spin_lock(&dlm->track_lock); + list_add_tail(&res->tracking, &dlm->tracking_list); +- spin_unlock(&dlm->spinlock); ++ spin_unlock(&dlm->track_lock); + + memset(res->lvb, 0, DLM_LVB_LEN); + memset(res->refmap, 0, sizeof(res->refmap)); +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index 8a10506db993..d9468de3c951 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -519,7 +519,7 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry, + index = NULL; + goto out; + } +- pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n" ++ pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n" + "overlayfs: mount with '-o index=off' to disable inodes index.\n", + d_inode(origin)->i_ino, name.len, name.name, + err); +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index d9a0edd4e57e..e1e743005583 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -136,8 +136,8 @@ static inline int ovl_do_setxattr(struct dentry *dentry, const char *name, + const void *value, size_t size, int flags) + { + int err = vfs_setxattr(dentry, name, value, size, flags); +- pr_debug("setxattr(%pd2, \"%s\", \"%*s\", 0x%x) = %i\n", +- dentry, name, (int) size, (char *) value, flags, err); ++ pr_debug("setxattr(%pd2, \"%s\", \"%*pE\", %zu, 0x%x) = %i\n", ++ dentry, name, min((int)size, 48), value, size, flags, err); + return err; + } + +diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c +index f60ce2e04df0..afdc2533ce74 100644 +--- a/fs/overlayfs/util.c ++++ b/fs/overlayfs/util.c +@@ -438,7 +438,7 @@ static void ovl_cleanup_index(struct dentry *dentry) + struct dentry *upperdentry = ovl_dentry_upper(dentry); + struct dentry *index = NULL; + struct inode *inode; +- struct qstr name; ++ struct qstr name = { }; + int err; + + err = ovl_get_index_name(lowerdentry, &name); +@@ -477,6 +477,7 @@ static void ovl_cleanup_index(struct dentry *dentry) + goto fail; + + out: ++ kfree(name.name); + dput(index); + return; + +diff --git a/fs/proc/base.c b/fs/proc/base.c +index c5c42f3e33d1..9063738ff1f0 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -431,6 +431,20 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns, + int err; + int i; + ++ /* ++ * The ability to racily run the kernel stack unwinder on a running task ++ * and then observe the unwinder output is scary; while it is useful for ++ * debugging kernel issues, it can also allow an attacker to leak kernel ++ * stack contents. ++ * Doing this in a manner that is at least safe from races would require ++ * some work to ensure that the remote task can not be scheduled; and ++ * even then, this would still expose the unwinder as local attack ++ * surface. ++ * Therefore, this interface is restricted to root. ++ */ ++ if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) ++ return -EACCES; ++ + entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL); + if (!entries) + return -ENOMEM; +diff --git a/fs/xattr.c b/fs/xattr.c +index be2ce57cd6ad..50029811fbe3 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -951,17 +951,19 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, + int err = 0; + + #ifdef CONFIG_FS_POSIX_ACL +- if (inode->i_acl) { +- err = xattr_list_one(&buffer, &remaining_size, +- XATTR_NAME_POSIX_ACL_ACCESS); +- if (err) +- return err; +- } +- if (inode->i_default_acl) { +- err = xattr_list_one(&buffer, &remaining_size, +- XATTR_NAME_POSIX_ACL_DEFAULT); +- if (err) +- return err; ++ if (IS_POSIXACL(inode)) { ++ if (inode->i_acl) { ++ err = xattr_list_one(&buffer, &remaining_size, ++ XATTR_NAME_POSIX_ACL_ACCESS); ++ if (err) ++ return err; ++ } ++ if (inode->i_default_acl) { ++ err = xattr_list_one(&buffer, &remaining_size, ++ XATTR_NAME_POSIX_ACL_DEFAULT); ++ if (err) ++ return err; ++ } + } + #endif + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 450e2cd31ed6..a0ffc62e7677 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -2076,6 +2076,15 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + u64 umin_val, umax_val; + u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32; + ++ if (insn_bitness == 32) { ++ /* Relevant for 32-bit RSH: Information can propagate towards ++ * LSB, so it isn't sufficient to only truncate the output to ++ * 32 bits. ++ */ ++ coerce_reg_to_size(dst_reg, 4); ++ coerce_reg_to_size(&src_reg, 4); ++ } ++ + smin_val = src_reg.smin_value; + smax_val = src_reg.smax_value; + umin_val = src_reg.umin_value; +@@ -2295,7 +2304,6 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, + if (BPF_CLASS(insn->code) != BPF_ALU64) { + /* 32-bit ALU ops are (32,32)->32 */ + coerce_reg_to_size(dst_reg, 4); +- coerce_reg_to_size(&src_reg, 4); + } + + __reg_deduce_bounds(dst_reg); +diff --git a/mm/madvise.c b/mm/madvise.c +index 751e97aa2210..576b753be428 100644 +--- a/mm/madvise.c ++++ b/mm/madvise.c +@@ -96,7 +96,7 @@ static long madvise_behavior(struct vm_area_struct *vma, + new_flags |= VM_DONTDUMP; + break; + case MADV_DODUMP: +- if (new_flags & VM_SPECIAL) { ++ if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) { + error = -EINVAL; + goto out; + } +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index e9c6aa3ed05b..3d0d12fbd8dd 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata, + if (len < IEEE80211_DEAUTH_FRAME_LEN) + return; + +- ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n", +- mgmt->sa, mgmt->da, mgmt->bssid, reason); ++ ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ++ ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason); + sta_info_destroy_addr(sdata, mgmt->sa); + } + +@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata, + auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg); + auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction); + +- ibss_dbg(sdata, +- "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n", +- mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction); ++ ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ++ ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n", ++ mgmt->bssid, auth_transaction); + + if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) + return; +@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata, + rx_timestamp = drv_get_tsf(local, sdata); + } + +- ibss_dbg(sdata, +- "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n", ++ ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n", + mgmt->sa, mgmt->bssid, +- (unsigned long long)rx_timestamp, ++ (unsigned long long)rx_timestamp); ++ ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n", + (unsigned long long)beacon_timestamp, + (unsigned long long)(rx_timestamp - beacon_timestamp), + jiffies); +@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata, + + tx_last_beacon = drv_tx_last_beacon(local); + +- ibss_dbg(sdata, +- "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n", +- mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon); ++ ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ++ ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n", ++ mgmt->bssid, tx_last_beacon); + + if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da)) + return; +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 8aa1f5b6a051..8a51f94ec1ce 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -255,8 +255,27 @@ static void ieee80211_restart_work(struct work_struct *work) + + flush_work(&local->radar_detected_work); + rtnl_lock(); +- list_for_each_entry(sdata, &local->interfaces, list) ++ list_for_each_entry(sdata, &local->interfaces, list) { ++ /* ++ * XXX: there may be more work for other vif types and even ++ * for station mode: a good thing would be to run most of ++ * the iface type's dependent _stop (ieee80211_mg_stop, ++ * ieee80211_ibss_stop) etc... ++ * For now, fix only the specific bug that was seen: race ++ * between csa_connection_drop_work and us. ++ */ ++ if (sdata->vif.type == NL80211_IFTYPE_STATION) { ++ /* ++ * This worker is scheduled from the iface worker that ++ * runs on mac80211's workqueue, so we can't be ++ * scheduling this worker after the cancel right here. ++ * The exception is ieee80211_chswitch_done. ++ * Then we can have a race... ++ */ ++ cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work); ++ } + flush_delayed_work(&sdata->dec_tailroom_needed_wk); ++ } + ieee80211_scan_cancel(local); + + /* make sure any new ROC will consider local->in_reconfig */ +@@ -467,10 +486,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = { + cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC | + IEEE80211_VHT_CAP_SHORT_GI_80 | + IEEE80211_VHT_CAP_SHORT_GI_160 | +- IEEE80211_VHT_CAP_RXSTBC_1 | +- IEEE80211_VHT_CAP_RXSTBC_2 | +- IEEE80211_VHT_CAP_RXSTBC_3 | +- IEEE80211_VHT_CAP_RXSTBC_4 | ++ IEEE80211_VHT_CAP_RXSTBC_MASK | + IEEE80211_VHT_CAP_TXSTBC | + IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE | + IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE | +@@ -1171,6 +1187,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw) + #if IS_ENABLED(CONFIG_IPV6) + unregister_inet6addr_notifier(&local->ifa6_notifier); + #endif ++ ieee80211_txq_teardown_flows(local); + + rtnl_lock(); + +@@ -1199,7 +1216,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw) + skb_queue_purge(&local->skb_queue); + skb_queue_purge(&local->skb_queue_unreliable); + skb_queue_purge(&local->skb_queue_tdls_chsw); +- ieee80211_txq_teardown_flows(local); + + destroy_workqueue(local->workqueue); + wiphy_unregister(local->hw.wiphy); +diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c +index d6d3f316de4c..055ea36ff27b 100644 +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + forward = false; + reply = true; + target_metric = 0; ++ ++ if (SN_GT(target_sn, ifmsh->sn)) ++ ifmsh->sn = target_sn; ++ + if (time_after(jiffies, ifmsh->last_sn_update + + net_traversal_jiffies(sdata)) || + time_before(jiffies, ifmsh->last_sn_update)) { +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 052dbd4fa366..328ac10084e4 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -988,6 +988,10 @@ static void ieee80211_chswitch_work(struct work_struct *work) + */ + + if (sdata->reserved_chanctx) { ++ struct ieee80211_supported_band *sband = NULL; ++ struct sta_info *mgd_sta = NULL; ++ enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20; ++ + /* + * with multi-vif csa driver may call ieee80211_csa_finish() + * many times while waiting for other interfaces to use their +@@ -996,6 +1000,48 @@ static void ieee80211_chswitch_work(struct work_struct *work) + if (sdata->reserved_ready) + goto out; + ++ if (sdata->vif.bss_conf.chandef.width != ++ sdata->csa_chandef.width) { ++ /* ++ * For managed interface, we need to also update the AP ++ * station bandwidth and align the rate scale algorithm ++ * on the bandwidth change. Here we only consider the ++ * bandwidth of the new channel definition (as channel ++ * switch flow does not have the full HT/VHT/HE ++ * information), assuming that if additional changes are ++ * required they would be done as part of the processing ++ * of the next beacon from the AP. ++ */ ++ switch (sdata->csa_chandef.width) { ++ case NL80211_CHAN_WIDTH_20_NOHT: ++ case NL80211_CHAN_WIDTH_20: ++ default: ++ bw = IEEE80211_STA_RX_BW_20; ++ break; ++ case NL80211_CHAN_WIDTH_40: ++ bw = IEEE80211_STA_RX_BW_40; ++ break; ++ case NL80211_CHAN_WIDTH_80: ++ bw = IEEE80211_STA_RX_BW_80; ++ break; ++ case NL80211_CHAN_WIDTH_80P80: ++ case NL80211_CHAN_WIDTH_160: ++ bw = IEEE80211_STA_RX_BW_160; ++ break; ++ } ++ ++ mgd_sta = sta_info_get(sdata, ifmgd->bssid); ++ sband = ++ local->hw.wiphy->bands[sdata->csa_chandef.chan->band]; ++ } ++ ++ if (sdata->vif.bss_conf.chandef.width > ++ sdata->csa_chandef.width) { ++ mgd_sta->sta.bandwidth = bw; ++ rate_control_rate_update(local, sband, mgd_sta, ++ IEEE80211_RC_BW_CHANGED); ++ } ++ + ret = ieee80211_vif_use_reserved_context(sdata); + if (ret) { + sdata_info(sdata, +@@ -1006,6 +1052,13 @@ static void ieee80211_chswitch_work(struct work_struct *work) + goto out; + } + ++ if (sdata->vif.bss_conf.chandef.width < ++ sdata->csa_chandef.width) { ++ mgd_sta->sta.bandwidth = bw; ++ rate_control_rate_update(local, sband, mgd_sta, ++ IEEE80211_RC_BW_CHANGED); ++ } ++ + goto out; + } + +@@ -1227,6 +1280,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata, + cbss->beacon_interval)); + return; + drop_connection: ++ /* ++ * This is just so that the disconnect flow will know that ++ * we were trying to switch channel and failed. In case the ++ * mode is 1 (we are not allowed to Tx), we will know not to ++ * send a deauthentication frame. Those two fields will be ++ * reset when the disconnection worker runs. ++ */ ++ sdata->vif.csa_active = true; ++ sdata->csa_block_tx = csa_ie.mode; ++ + ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work); + mutex_unlock(&local->chanctx_mtx); + mutex_unlock(&local->mtx); +@@ -2397,6 +2460,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata) + struct ieee80211_local *local = sdata->local; + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; + u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; ++ bool tx; + + sdata_lock(sdata); + if (!ifmgd->associated) { +@@ -2404,6 +2468,8 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata) + return; + } + ++ tx = !sdata->csa_block_tx; ++ + /* AP is probably out of range (or not reachable for another reason) so + * remove the bss struct for that AP. + */ +@@ -2411,7 +2477,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata) + + ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, + WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, +- true, frame_buf); ++ tx, frame_buf); + mutex_lock(&local->mtx); + sdata->vif.csa_active = false; + ifmgd->csa_waiting_bcn = false; +@@ -2422,7 +2488,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata) + } + mutex_unlock(&local->mtx); + +- ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true, ++ ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx, + WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY); + + sdata_unlock(sdata); +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index ccb65f18df5d..d8fddd88bf46 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3022,27 +3022,18 @@ void ieee80211_clear_fast_xmit(struct sta_info *sta) + } + + static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local, +- struct sk_buff *skb, int headroom, +- int *subframe_len) ++ struct sk_buff *skb, int headroom) + { +- int amsdu_len = *subframe_len + sizeof(struct ethhdr); +- int padding = (4 - amsdu_len) & 3; +- +- if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) { ++ if (skb_headroom(skb) < headroom) { + I802_DEBUG_INC(local->tx_expand_skb_head); + +- if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) { ++ if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) { + wiphy_debug(local->hw.wiphy, + "failed to reallocate TX buffer\n"); + return false; + } + } + +- if (padding) { +- *subframe_len += padding; +- skb_put_zero(skb, padding); +- } +- + return true; + } + +@@ -3066,8 +3057,7 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata, + if (info->control.flags & IEEE80211_TX_CTRL_AMSDU) + return true; + +- if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr), +- &subframe_len)) ++ if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr))) + return false; + + data = skb_push(skb, sizeof(*amsdu_hdr)); +@@ -3133,7 +3123,8 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata, + void *data; + bool ret = false; + unsigned int orig_len; +- int n = 1, nfrags; ++ int n = 2, nfrags, pad = 0; ++ u16 hdrlen; + + if (!ieee80211_hw_check(&local->hw, TX_AMSDU)) + return false; +@@ -3166,9 +3157,6 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata, + if (skb->len + head->len > max_amsdu_len) + goto out; + +- if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head)) +- goto out; +- + nfrags = 1 + skb_shinfo(skb)->nr_frags; + nfrags += 1 + skb_shinfo(head)->nr_frags; + frag_tail = &skb_shinfo(head)->frag_list; +@@ -3184,10 +3172,24 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata, + if (max_frags && nfrags > max_frags) + goto out; + +- if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2, +- &subframe_len)) ++ if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head)) + goto out; + ++ /* ++ * Pad out the previous subframe to a multiple of 4 by adding the ++ * padding to the next one, that's being added. Note that head->len ++ * is the length of the full A-MSDU, but that works since each time ++ * we add a new subframe we pad out the previous one to a multiple ++ * of 4 and thus it no longer matters in the next round. ++ */ ++ hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header); ++ if ((head->len - hdrlen) & 3) ++ pad = 4 - ((head->len - hdrlen) & 3); ++ ++ if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + ++ 2 + pad)) ++ goto out_recalc; ++ + ret = true; + data = skb_push(skb, ETH_ALEN + 2); + memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN); +@@ -3197,15 +3199,19 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata, + memcpy(data, &len, 2); + memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header)); + ++ memset(skb_push(skb, pad), 0, pad); ++ + head->len += skb->len; + head->data_len += skb->len; + *frag_tail = skb; + +- flow->backlog += head->len - orig_len; +- tin->backlog_bytes += head->len - orig_len; +- +- fq_recalc_backlog(fq, tin, flow); ++out_recalc: ++ if (head->len != orig_len) { ++ flow->backlog += head->len - orig_len; ++ tin->backlog_bytes += head->len - orig_len; + ++ fq_recalc_backlog(fq, tin, flow); ++ } + out: + spin_unlock_bh(&fq->lock); + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 742aacb317e5..3ae365f92bff 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4250,6 +4250,7 @@ static int nft_flush_set(const struct nft_ctx *ctx, + } + set->ndeact++; + ++ nft_set_elem_deactivate(ctx->net, set, elem); + nft_trans_elem_set(trans) = set; + nft_trans_elem(trans) = *elem; + list_add_tail(&trans->list, &ctx->net->nft.commit_list); +diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c +index 57ef175dfbfa..504d5f730f4e 100644 +--- a/net/netfilter/xt_cluster.c ++++ b/net/netfilter/xt_cluster.c +@@ -133,6 +133,7 @@ xt_cluster_mt(const struct sk_buff *skb, struct xt_action_param *par) + static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par) + { + struct xt_cluster_match_info *info = par->matchinfo; ++ int ret; + + if (info->total_nodes > XT_CLUSTER_NODES_MAX) { + pr_info("you have exceeded the maximum " +@@ -145,7 +146,17 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par) + "higher than the total number of nodes\n"); + return -EDOM; + } +- return 0; ++ ++ ret = nf_ct_netns_get(par->net, par->family); ++ if (ret < 0) ++ pr_info_ratelimited("cannot load conntrack support for proto=%u\n", ++ par->family); ++ return ret; ++} ++ ++static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par) ++{ ++ nf_ct_netns_put(par->net, par->family); + } + + static struct xt_match xt_cluster_match __read_mostly = { +@@ -154,6 +165,7 @@ static struct xt_match xt_cluster_match __read_mostly = { + .match = xt_cluster_mt, + .checkentry = xt_cluster_mt_checkentry, + .matchsize = sizeof(struct xt_cluster_match_info), ++ .destroy = xt_cluster_mt_destroy, + .me = THIS_MODULE, + }; + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 753f3e73c498..3de415bca391 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -11679,6 +11679,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) + return -EOPNOTSUPP; + + if (!info->attrs[NL80211_ATTR_MDID] || ++ !info->attrs[NL80211_ATTR_IE] || + !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) + return -EINVAL; + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index c1238d582fd1..ca3361a3e750 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1449,7 +1449,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef, + u8 *op_class) + { + u8 vht_opclass; +- u16 freq = chandef->center_freq1; ++ u32 freq = chandef->center_freq1; + + if (freq >= 2412 && freq <= 2472) { + if (chandef->width > NL80211_CHAN_WIDTH_40) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index dcc9e6551b51..fe5c741fcc6a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6288,6 +6288,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), +diff --git a/tools/hv/hv_fcopy_daemon.c b/tools/hv/hv_fcopy_daemon.c +index 785f4e95148c..7a1039c15e7d 100644 +--- a/tools/hv/hv_fcopy_daemon.c ++++ b/tools/hv/hv_fcopy_daemon.c +@@ -233,6 +233,7 @@ int main(int argc, char *argv[]) + break; + + default: ++ error = HV_E_FAIL; + syslog(LOG_ERR, "Unknown operation: %d", + buffer.hdr.operation); + +diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat +index 32283d88701a..c0d653d36c0f 100755 +--- a/tools/kvm/kvm_stat/kvm_stat ++++ b/tools/kvm/kvm_stat/kvm_stat +@@ -724,13 +724,20 @@ class DebugfsProvider(Provider): + if len(vms) == 0: + self.do_read = False + +- self.paths = filter(lambda x: "{}-".format(pid) in x, vms) ++ self.paths = list(filter(lambda x: "{}-".format(pid) in x, vms)) + + else: + self.paths = [] + self.do_read = True + self.reset() + ++ def _verify_paths(self): ++ """Remove invalid paths""" ++ for path in self.paths: ++ if not os.path.exists(os.path.join(PATH_DEBUGFS_KVM, path)): ++ self.paths.remove(path) ++ continue ++ + def read(self, reset=0, by_guest=0): + """Returns a dict with format:'file name / field -> current value'. + +@@ -745,6 +752,7 @@ class DebugfsProvider(Provider): + # If no debugfs filtering support is available, then don't read. + if not self.do_read: + return results ++ self._verify_paths() + + paths = self.paths + if self._pid == 0: +@@ -1119,10 +1127,10 @@ class Tui(object): + (x, term_width) = self.screen.getmaxyx() + row = 2 + for line in text: +- start = (term_width - len(line)) / 2 ++ start = (term_width - len(line)) // 2 + self.screen.addstr(row, start, line) + row += 1 +- self.screen.addstr(row + 1, (term_width - len(hint)) / 2, hint, ++ self.screen.addstr(row + 1, (term_width - len(hint)) // 2, hint, + curses.A_STANDOUT) + self.screen.getkey() + +diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c +index 20e7d74d86cd..10a44e946f77 100644 +--- a/tools/perf/arch/powerpc/util/sym-handling.c ++++ b/tools/perf/arch/powerpc/util/sym-handling.c +@@ -22,15 +22,16 @@ bool elf__needs_adjust_symbols(GElf_Ehdr ehdr) + + #endif + +-#if !defined(_CALL_ELF) || _CALL_ELF != 2 + int arch__choose_best_symbol(struct symbol *syma, + struct symbol *symb __maybe_unused) + { + char *sym = syma->name; + ++#if !defined(_CALL_ELF) || _CALL_ELF != 2 + /* Skip over any initial dot */ + if (*sym == '.') + sym++; ++#endif + + /* Avoid "SyS" kernel syscall aliases */ + if (strlen(sym) >= 3 && !strncmp(sym, "SyS", 3)) +@@ -41,6 +42,7 @@ int arch__choose_best_symbol(struct symbol *syma, + return SYMBOL_A; + } + ++#if !defined(_CALL_ELF) || _CALL_ELF != 2 + /* Allow matching against dot variants */ + int arch__compare_symbol_names(const char *namea, const char *nameb) + { +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 2227ee92d8e2..44c2f62b47a3 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -259,8 +259,9 @@ struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx) + { + struct perf_evsel *evsel = zalloc(perf_evsel__object.size); + +- if (evsel != NULL) +- perf_evsel__init(evsel, attr, idx); ++ if (!evsel) ++ return NULL; ++ perf_evsel__init(evsel, attr, idx); + + if (perf_evsel__is_bpf_output(evsel)) { + evsel->attr.sample_type |= (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | +diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c +index e7d60d05596d..8f3b7ef221f2 100644 +--- a/tools/perf/util/trace-event-info.c ++++ b/tools/perf/util/trace-event-info.c +@@ -379,7 +379,7 @@ out: + + static int record_saved_cmdline(void) + { +- unsigned int size; ++ unsigned long long size; + char *path; + struct stat st; + int ret, err = 0; +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 1512086c8cb8..7a1b20ec5216 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -1485,7 +1485,7 @@ int get_mp(int cpu, struct msr_counter *mp, unsigned long long *counterp) + if (get_msr(cpu, mp->msr_num, counterp)) + return -1; + } else { +- char path[128]; ++ char path[128 + PATH_BYTES]; + + if (mp->flags & SYSFS_PERCPU) { + sprintf(path, "/sys/devices/system/cpu/cpu%d/%s", +diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c +index e92903fc7113..6d5bcbaf6193 100644 +--- a/tools/vm/page-types.c ++++ b/tools/vm/page-types.c +@@ -155,12 +155,6 @@ static const char * const page_flag_names[] = { + }; + + +-static const char * const debugfs_known_mountpoints[] = { +- "/sys/kernel/debug", +- "/debug", +- 0, +-}; +- + /* + * data structures + */ +diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c +index b0b7ef6d0de1..3fe093254385 100644 +--- a/tools/vm/slabinfo.c ++++ b/tools/vm/slabinfo.c +@@ -30,8 +30,8 @@ struct slabinfo { + int alias; + int refs; + int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu; +- int hwcache_align, object_size, objs_per_slab; +- int sanity_checks, slab_size, store_user, trace; ++ unsigned int hwcache_align, object_size, objs_per_slab; ++ unsigned int sanity_checks, slab_size, store_user, trace; + int order, poison, reclaim_account, red_zone; + unsigned long partial, objects, slabs, objects_partial, objects_total; + unsigned long alloc_fastpath, alloc_slowpath;
