commit: 1c7a6b1bfbd50f52704f439af51a76744baa1cae Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Dec 2 12:49:30 2020 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Dec 2 12:49:30 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1c7a6b1b
Linux patch 4.19.161 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1160_linux-4.19.161.patch | 2290 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2294 insertions(+) diff --git a/0000_README b/0000_README index 4c3c996..bb6e712 100644 --- a/0000_README +++ b/0000_README @@ -679,6 +679,10 @@ Patch: 1159_linux-4.19.160.patch From: https://www.kernel.org Desc: Linux 4.19.160 +Patch: 1160_linux-4.19.161.patch +From: https://www.kernel.org +Desc: Linux 4.19.161 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1160_linux-4.19.161.patch b/1160_linux-4.19.161.patch new file mode 100644 index 0000000..168587e --- /dev/null +++ b/1160_linux-4.19.161.patch @@ -0,0 +1,2290 @@ +diff --git a/Makefile b/Makefile +index c587114984229..84807cee57b88 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 160 ++SUBLEVEL = 161 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi +index 216e1d1a69c7d..473d6721b7887 100644 +--- a/arch/arm/boot/dts/dra76x.dtsi ++++ b/arch/arm/boot/dts/dra76x.dtsi +@@ -35,8 +35,8 @@ + interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "int0", "int1"; +- clocks = <&mcan_clk>, <&l3_iclk_div>; +- clock-names = "cclk", "hclk"; ++ clocks = <&l3_iclk_div>, <&mcan_clk>; ++ clock-names = "hclk", "cclk"; + bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>; + }; + }; +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 291fed0a9df82..f43519b710610 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -107,8 +107,6 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID)) + #define pte_valid_not_user(pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID) +-#define pte_valid_young(pte) \ +- ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF)) + #define pte_valid_user(pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER)) + +@@ -116,9 +114,12 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; + * Could the pte be present in the TLB? We must check mm_tlb_flush_pending + * so that we don't erroneously return false for pages that have been + * remapped as PROT_NONE but are yet to be flushed from the TLB. ++ * Note that we can't make any assumptions based on the state of the access ++ * flag, since ptep_clear_flush_young() elides a DSB when invalidating the ++ * TLB. + */ + #define pte_accessible(mm, pte) \ +- (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte)) ++ (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte)) + + /* + * p??_access_permitted() is true for valid user mappings (subject to the +@@ -144,13 +145,6 @@ static inline pte_t set_pte_bit(pte_t pte, pgprot_t prot) + return pte; + } + +-static inline pte_t pte_wrprotect(pte_t pte) +-{ +- pte = clear_pte_bit(pte, __pgprot(PTE_WRITE)); +- pte = set_pte_bit(pte, __pgprot(PTE_RDONLY)); +- return pte; +-} +- + static inline pte_t pte_mkwrite(pte_t pte) + { + pte = set_pte_bit(pte, __pgprot(PTE_WRITE)); +@@ -176,6 +170,20 @@ static inline pte_t pte_mkdirty(pte_t pte) + return pte; + } + ++static inline pte_t pte_wrprotect(pte_t pte) ++{ ++ /* ++ * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY ++ * clear), set the PTE_DIRTY bit. ++ */ ++ if (pte_hw_dirty(pte)) ++ pte = pte_mkdirty(pte); ++ ++ pte = clear_pte_bit(pte, __pgprot(PTE_WRITE)); ++ pte = set_pte_bit(pte, __pgprot(PTE_RDONLY)); ++ return pte; ++} ++ + static inline pte_t pte_mkold(pte_t pte) + { + return clear_pte_bit(pte, __pgprot(PTE_AF)); +@@ -668,12 +676,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres + pte = READ_ONCE(*ptep); + do { + old_pte = pte; +- /* +- * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY +- * clear), set the PTE_DIRTY bit. +- */ +- if (pte_hw_dirty(pte)) +- pte = pte_mkdirty(pte); + pte = pte_wrprotect(pte); + pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep), + pte_val(old_pte), pte_val(pte)); +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 4a650eb3d94a3..3b3cd12c06920 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -100,14 +100,14 @@ + MODULE_LICENSE("GPL"); + + #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __cstate_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __cstate_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __cstate_##_var##_show, NULL) + + static ssize_t cstate_get_attr_cpumask(struct device *dev, +diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c +index 2413169ce3627..bc348663da94d 100644 +--- a/arch/x86/events/intel/rapl.c ++++ b/arch/x86/events/intel/rapl.c +@@ -115,18 +115,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = { + * any other bit is reserved + */ + #define RAPL_EVENT_MASK 0xFFULL +- +-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __rapl_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ +- char *page) \ +-{ \ +- BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ +- return sprintf(page, _format "\n"); \ +-} \ +-static struct kobj_attribute format_attr_##_var = \ +- __ATTR(_name, 0444, __rapl_##_var##_show, NULL) +- + #define RAPL_CNTR_WIDTH 32 + + #define RAPL_EVENT_ATTR_STR(_name, v, str) \ +@@ -548,7 +536,7 @@ static struct attribute_group rapl_pmu_events_group = { + .attrs = NULL, /* patched at runtime */ + }; + +-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7"); ++PMU_FORMAT_ATTR(event, "config:0-7"); + static struct attribute *rapl_formats_attr[] = { + &format_attr_event.attr, + NULL, +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index 7098b9b05d566..2f4ed5aa08bad 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -90,8 +90,8 @@ end: + return map; + } + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct uncore_event_desc *event = + container_of(attr, struct uncore_event_desc, attr); +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index 40e040ec31b50..0fc86ac73b511 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -133,7 +133,7 @@ struct intel_uncore_box { + #define UNCORE_BOX_FLAG_CTL_OFFS8 1 /* event config registers are 8-byte apart */ + + struct uncore_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *config; + }; + +@@ -153,8 +153,8 @@ struct pci2phy_map { + + struct pci2phy_map *__find_pci2phy_map(int segment); + +-ssize_t uncore_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf); ++ssize_t uncore_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf); + + #define INTEL_UNCORE_EVENT_DESC(_name, _config) \ + { \ +@@ -163,14 +163,14 @@ ssize_t uncore_event_show(struct kobject *kobj, + } + + #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \ +-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \ +- struct kobj_attribute *attr, \ ++static ssize_t __uncore_##_var##_show(struct device *dev, \ ++ struct device_attribute *attr, \ + char *page) \ + { \ + BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \ + return sprintf(page, _format "\n"); \ + } \ +-static struct kobj_attribute format_attr_##_var = \ ++static struct device_attribute format_attr_##_var = \ + __ATTR(_name, 0444, __uncore_##_var##_show, NULL) + + static inline bool uncore_pmc_fixed(int idx) +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 4876411a072a7..98b74711e6b74 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1472,6 +1472,7 @@ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); + void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); + int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v); + int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu); ++int kvm_cpu_has_extint(struct kvm_vcpu *v); + int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu); + int kvm_cpu_get_interrupt(struct kvm_vcpu *v); + void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 9e482fbdb28fb..c524fa1f4c0e6 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -733,11 +733,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) + if (boot_cpu_has(X86_FEATURE_IBPB)) { + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); + ++ spectre_v2_user_ibpb = mode; + switch (cmd) { + case SPECTRE_V2_USER_CMD_FORCE: + case SPECTRE_V2_USER_CMD_PRCTL_IBPB: + case SPECTRE_V2_USER_CMD_SECCOMP_IBPB: + static_branch_enable(&switch_mm_always_ibpb); ++ spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT; + break; + case SPECTRE_V2_USER_CMD_PRCTL: + case SPECTRE_V2_USER_CMD_AUTO: +@@ -751,8 +753,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd) + pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n", + static_key_enabled(&switch_mm_always_ibpb) ? + "always-on" : "conditional"); +- +- spectre_v2_user_ibpb = mode; + } + + /* +diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +index e62e416dd1162..12083f200e096 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c ++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +@@ -515,6 +515,24 @@ unlock: + return ret ?: nbytes; + } + ++/** ++ * rdtgroup_remove - the helper to remove resource group safely ++ * @rdtgrp: resource group to remove ++ * ++ * On resource group creation via a mkdir, an extra kernfs_node reference is ++ * taken to ensure that the rdtgroup structure remains accessible for the ++ * rdtgroup_kn_unlock() calls where it is removed. ++ * ++ * Drop the extra reference here, then free the rdtgroup structure. ++ * ++ * Return: void ++ */ ++static void rdtgroup_remove(struct rdtgroup *rdtgrp) ++{ ++ kernfs_put(rdtgrp->kn); ++ kfree(rdtgrp); ++} ++ + struct task_move_callback { + struct callback_head work; + struct rdtgroup *rdtgrp; +@@ -537,7 +555,7 @@ static void move_myself(struct callback_head *head) + (rdtgrp->flags & RDT_DELETED)) { + current->closid = 0; + current->rmid = 0; +- kfree(rdtgrp); ++ rdtgroup_remove(rdtgrp); + } + + preempt_disable(); +@@ -1626,7 +1644,6 @@ static int rdtgroup_mkdir_info_resdir(struct rdt_resource *r, char *name, + if (IS_ERR(kn_subdir)) + return PTR_ERR(kn_subdir); + +- kernfs_get(kn_subdir); + ret = rdtgroup_kn_set_ugid(kn_subdir); + if (ret) + return ret; +@@ -1649,7 +1666,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn) + kn_info = kernfs_create_dir(parent_kn, "info", parent_kn->mode, NULL); + if (IS_ERR(kn_info)) + return PTR_ERR(kn_info); +- kernfs_get(kn_info); + + ret = rdtgroup_add_files(kn_info, RF_TOP_INFO); + if (ret) +@@ -1670,12 +1686,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn) + goto out_destroy; + } + +- /* +- * This extra ref will be put in kernfs_remove() and guarantees +- * that @rdtgrp->kn is always accessible. +- */ +- kernfs_get(kn_info); +- + ret = rdtgroup_kn_set_ugid(kn_info); + if (ret) + goto out_destroy; +@@ -1704,12 +1714,6 @@ mongroup_create_dir(struct kernfs_node *parent_kn, struct rdtgroup *prgrp, + if (dest_kn) + *dest_kn = kn; + +- /* +- * This extra ref will be put in kernfs_remove() and guarantees +- * that @rdtgrp->kn is always accessible. +- */ +- kernfs_get(kn); +- + ret = rdtgroup_kn_set_ugid(kn); + if (ret) + goto out_destroy; +@@ -1973,8 +1977,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn) + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) + rdtgroup_pseudo_lock_remove(rdtgrp); + kernfs_unbreak_active_protection(kn); +- kernfs_put(rdtgrp->kn); +- kfree(rdtgrp); ++ rdtgroup_remove(rdtgrp); + } else { + kernfs_unbreak_active_protection(kn); + } +@@ -2025,7 +2028,6 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type, + dentry = ERR_PTR(ret); + goto out_info; + } +- kernfs_get(kn_mongrp); + + ret = mkdir_mondata_all(rdtgroup_default.kn, + &rdtgroup_default, &kn_mondata); +@@ -2033,7 +2035,6 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type, + dentry = ERR_PTR(ret); + goto out_mongrp; + } +- kernfs_get(kn_mondata); + rdtgroup_default.mon.mon_data_kn = kn_mondata; + } + +@@ -2185,7 +2186,7 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp) + if (atomic_read(&sentry->waitcount) != 0) + sentry->flags = RDT_DELETED; + else +- kfree(sentry); ++ rdtgroup_remove(sentry); + } + } + +@@ -2227,7 +2228,7 @@ static void rmdir_all_sub(void) + if (atomic_read(&rdtgrp->waitcount) != 0) + rdtgrp->flags = RDT_DELETED; + else +- kfree(rdtgrp); ++ rdtgroup_remove(rdtgrp); + } + /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ + update_closid_rmid(cpu_online_mask, &rdtgroup_default); +@@ -2326,11 +2327,6 @@ static int mkdir_mondata_subdir(struct kernfs_node *parent_kn, + if (IS_ERR(kn)) + return PTR_ERR(kn); + +- /* +- * This extra ref will be put in kernfs_remove() and guarantees +- * that kn is always accessible. +- */ +- kernfs_get(kn); + ret = rdtgroup_kn_set_ugid(kn); + if (ret) + goto out_destroy; +@@ -2622,8 +2618,8 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + /* + * kernfs_remove() will drop the reference count on "kn" which + * will free it. But we still need it to stick around for the +- * rdtgroup_kn_unlock(kn} call below. Take one extra reference +- * here, which will be dropped inside rdtgroup_kn_unlock(). ++ * rdtgroup_kn_unlock(kn) call. Take one extra reference here, ++ * which will be dropped by kernfs_put() in rdtgroup_remove(). + */ + kernfs_get(kn); + +@@ -2664,6 +2660,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + out_idfree: + free_rmid(rdtgrp->mon.rmid); + out_destroy: ++ kernfs_put(rdtgrp->kn); + kernfs_remove(rdtgrp->kn); + out_free_rgrp: + kfree(rdtgrp); +@@ -2676,7 +2673,7 @@ static void mkdir_rdt_prepare_clean(struct rdtgroup *rgrp) + { + kernfs_remove(rgrp->kn); + free_rmid(rgrp->mon.rmid); +- kfree(rgrp); ++ rdtgroup_remove(rgrp); + } + + /* +@@ -2838,11 +2835,6 @@ static int rdtgroup_rmdir_mon(struct kernfs_node *kn, struct rdtgroup *rdtgrp, + WARN_ON(list_empty(&prdtgrp->mon.crdtgrp_list)); + list_del(&rdtgrp->mon.crdtgrp_list); + +- /* +- * one extra hold on this, will drop when we kfree(rdtgrp) +- * in rdtgroup_kn_unlock() +- */ +- kernfs_get(kn); + kernfs_remove(rdtgrp->kn); + + return 0; +@@ -2854,11 +2846,6 @@ static int rdtgroup_ctrl_remove(struct kernfs_node *kn, + rdtgrp->flags = RDT_DELETED; + list_del(&rdtgrp->rdtgroup_list); + +- /* +- * one extra hold on this, will drop when we kfree(rdtgrp) +- * in rdtgroup_kn_unlock() +- */ +- kernfs_get(kn); + kernfs_remove(rdtgrp->kn); + return 0; + } +diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c +index 007bc654f928a..295ebadb8f2c1 100644 +--- a/arch/x86/kvm/irq.c ++++ b/arch/x86/kvm/irq.c +@@ -52,29 +52,10 @@ static int pending_userspace_extint(struct kvm_vcpu *v) + * check if there is pending interrupt from + * non-APIC source without intack. + */ +-static int kvm_cpu_has_extint(struct kvm_vcpu *v) +-{ +- u8 accept = kvm_apic_accept_pic_intr(v); +- +- if (accept) { +- if (irqchip_split(v->kvm)) +- return pending_userspace_extint(v); +- else +- return v->kvm->arch.vpic->output; +- } else +- return 0; +-} +- +-/* +- * check if there is injectable interrupt: +- * when virtual interrupt delivery enabled, +- * interrupt from apic will handled by hardware, +- * we don't need to check it here. +- */ +-int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) ++int kvm_cpu_has_extint(struct kvm_vcpu *v) + { + /* +- * FIXME: interrupt.injected represents an interrupt that it's ++ * FIXME: interrupt.injected represents an interrupt whose + * side-effects have already been applied (e.g. bit from IRR + * already moved to ISR). Therefore, it is incorrect to rely + * on interrupt.injected to know if there is a pending +@@ -87,6 +68,23 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) + if (!lapic_in_kernel(v)) + return v->arch.interrupt.injected; + ++ if (!kvm_apic_accept_pic_intr(v)) ++ return 0; ++ ++ if (irqchip_split(v->kvm)) ++ return pending_userspace_extint(v); ++ else ++ return v->kvm->arch.vpic->output; ++} ++ ++/* ++ * check if there is injectable interrupt: ++ * when virtual interrupt delivery enabled, ++ * interrupt from apic will handled by hardware, ++ * we don't need to check it here. ++ */ ++int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) ++{ + if (kvm_cpu_has_extint(v)) + return 1; + +@@ -102,20 +100,6 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v) + */ + int kvm_cpu_has_interrupt(struct kvm_vcpu *v) + { +- /* +- * FIXME: interrupt.injected represents an interrupt that it's +- * side-effects have already been applied (e.g. bit from IRR +- * already moved to ISR). Therefore, it is incorrect to rely +- * on interrupt.injected to know if there is a pending +- * interrupt in the user-mode LAPIC. +- * This leads to nVMX/nSVM not be able to distinguish +- * if it should exit from L2 to L1 on EXTERNAL_INTERRUPT on +- * pending interrupt or should re-inject an injected +- * interrupt. +- */ +- if (!lapic_in_kernel(v)) +- return v->arch.interrupt.injected; +- + if (kvm_cpu_has_extint(v)) + return 1; + +@@ -129,16 +113,21 @@ EXPORT_SYMBOL_GPL(kvm_cpu_has_interrupt); + */ + static int kvm_cpu_get_extint(struct kvm_vcpu *v) + { +- if (kvm_cpu_has_extint(v)) { +- if (irqchip_split(v->kvm)) { +- int vector = v->arch.pending_external_vector; +- +- v->arch.pending_external_vector = -1; +- return vector; +- } else +- return kvm_pic_read_irq(v->kvm); /* PIC */ +- } else ++ if (!kvm_cpu_has_extint(v)) { ++ WARN_ON(!lapic_in_kernel(v)); + return -1; ++ } ++ ++ if (!lapic_in_kernel(v)) ++ return v->arch.interrupt.nr; ++ ++ if (irqchip_split(v->kvm)) { ++ int vector = v->arch.pending_external_vector; ++ ++ v->arch.pending_external_vector = -1; ++ return vector; ++ } else ++ return kvm_pic_read_irq(v->kvm); /* PIC */ + } + + /* +@@ -146,13 +135,7 @@ static int kvm_cpu_get_extint(struct kvm_vcpu *v) + */ + int kvm_cpu_get_interrupt(struct kvm_vcpu *v) + { +- int vector; +- +- if (!lapic_in_kernel(v)) +- return v->arch.interrupt.nr; +- +- vector = kvm_cpu_get_extint(v); +- ++ int vector = kvm_cpu_get_extint(v); + if (vector != -1) + return vector; /* PIC */ + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index bba2f76c356dd..56a4b9762b0c1 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2284,7 +2284,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu) + struct kvm_lapic *apic = vcpu->arch.apic; + u32 ppr; + +- if (!kvm_apic_hw_enabled(apic)) ++ if (!kvm_apic_present(vcpu)) + return -1; + + __apic_update_ppr(apic, &ppr); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index dd182228be714..7096578ef7370 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3351,21 +3351,23 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu, + + static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu) + { ++ /* ++ * We can accept userspace's request for interrupt injection ++ * as long as we have a place to store the interrupt number. ++ * The actual injection will happen when the CPU is able to ++ * deliver the interrupt. ++ */ ++ if (kvm_cpu_has_extint(vcpu)) ++ return false; ++ ++ /* Acknowledging ExtINT does not happen if LINT0 is masked. */ + return (!lapic_in_kernel(vcpu) || + kvm_apic_accept_pic_intr(vcpu)); + } + +-/* +- * if userspace requested an interrupt window, check that the +- * interrupt window is open. +- * +- * No need to exit to userspace if we already have an interrupt queued. +- */ + static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu) + { + return kvm_arch_interrupt_allowed(vcpu) && +- !kvm_cpu_has_interrupt(vcpu) && +- !kvm_event_needs_reinjection(vcpu) && + kvm_cpu_accept_dm_intr(vcpu); + } + +diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c +index 717b4847b473f..6fffb86a32add 100644 +--- a/arch/x86/xen/spinlock.c ++++ b/arch/x86/xen/spinlock.c +@@ -101,10 +101,20 @@ void xen_init_lock_cpu(int cpu) + + void xen_uninit_lock_cpu(int cpu) + { ++ int irq; ++ + if (!xen_pvspin) + return; + +- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL); ++ /* ++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary ++ * CPUs are not activated, and lock_kicker_irq is not initialized. ++ */ ++ irq = per_cpu(lock_kicker_irq, cpu); ++ if (irq == -1) ++ return; ++ ++ unbind_from_irqhandler(irq, NULL); + per_cpu(lock_kicker_irq, cpu) = -1; + kfree(per_cpu(irq_name, cpu)); + per_cpu(irq_name, cpu) = NULL; +diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h +index f1158b4c629cf..da4effe270072 100644 +--- a/arch/xtensa/include/asm/uaccess.h ++++ b/arch/xtensa/include/asm/uaccess.h +@@ -291,7 +291,7 @@ strncpy_from_user(char *dst, const char *src, long count) + return -EFAULT; + } + #else +-long strncpy_from_user(char *dst, const char *src, long count); ++long strncpy_from_user(char *dst, const char __user *src, long count); + #endif + + /* +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index c564df713efc3..15b30d2d8f7ed 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2774,7 +2774,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. + */ +- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) ++ if (burst * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + + desc->bytes_requested = len; +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index d56b6b0e22a84..28592137fb67e 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -453,8 +453,8 @@ struct xilinx_dma_device { + #define to_dma_tx_descriptor(tx) \ + container_of(tx, struct xilinx_dma_tx_descriptor, async_tx) + #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \ +- readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \ +- cond, delay_us, timeout_us) ++ readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \ ++ val, cond, delay_us, timeout_us) + + /* IO accessors */ + static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg) +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index 1a4b44923aeca..281cf9cbb44c4 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1702,27 +1702,6 @@ drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state, + struct drm_connector *connector = conn_state->connector; + struct drm_crtc_state *crtc_state; + +- /* +- * For compatibility with legacy users, we want to make sure that +- * we allow DPMS On<->Off modesets on unregistered connectors, since +- * legacy modesetting users will not be expecting these to fail. We do +- * not however, want to allow legacy users to assign a connector +- * that's been unregistered from sysfs to another CRTC, since doing +- * this with a now non-existent connector could potentially leave us +- * in an invalid state. +- * +- * Since the connector can be unregistered at any point during an +- * atomic check or commit, this is racy. But that's OK: all we care +- * about is ensuring that userspace can't use this connector for new +- * configurations after it's been notified that the connector is no +- * longer present. +- */ +- if (!READ_ONCE(connector->registered) && crtc) { +- DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n", +- connector->base.id, connector->name); +- return -EINVAL; +- } +- + if (conn_state->crtc == crtc) + return 0; + +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index c22062cc99923..d24a15484e31c 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -307,6 +307,26 @@ update_connector_routing(struct drm_atomic_state *state, + return 0; + } + ++ crtc_state = drm_atomic_get_new_crtc_state(state, ++ new_connector_state->crtc); ++ /* ++ * For compatibility with legacy users, we want to make sure that ++ * we allow DPMS On->Off modesets on unregistered connectors. Modesets ++ * which would result in anything else must be considered invalid, to ++ * avoid turning on new displays on dead connectors. ++ * ++ * Since the connector can be unregistered at any point during an ++ * atomic check or commit, this is racy. But that's OK: all we care ++ * about is ensuring that userspace can't do anything but shut off the ++ * display on a connector that was destroyed after its been notified, ++ * not before. ++ */ ++ if (drm_connector_is_unregistered(connector) && crtc_state->active) { ++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n", ++ connector->base.id, connector->name); ++ return -EINVAL; ++ } ++ + funcs = connector->helper_private; + + if (funcs->atomic_best_encoder) +@@ -351,7 +371,6 @@ update_connector_routing(struct drm_atomic_state *state, + + set_best_encoder(state, new_connector_state, new_encoder); + +- crtc_state = drm_atomic_get_new_crtc_state(state, new_connector_state->crtc); + crtc_state->connectors_changed = true; + + DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d:%s]\n", +diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c +index 6011d769d50bb..7bb68ca4aa0ba 100644 +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -375,7 +375,8 @@ void drm_connector_cleanup(struct drm_connector *connector) + /* The connector should have been removed from userspace long before + * it is finally destroyed. + */ +- if (WARN_ON(connector->registered)) ++ if (WARN_ON(connector->registration_state == ++ DRM_CONNECTOR_REGISTERED)) + drm_connector_unregister(connector); + + if (connector->tile_group) { +@@ -432,7 +433,7 @@ int drm_connector_register(struct drm_connector *connector) + return 0; + + mutex_lock(&connector->mutex); +- if (connector->registered) ++ if (connector->registration_state != DRM_CONNECTOR_INITIALIZING) + goto unlock; + + ret = drm_sysfs_connector_add(connector); +@@ -452,7 +453,7 @@ int drm_connector_register(struct drm_connector *connector) + + drm_mode_object_register(connector->dev, &connector->base); + +- connector->registered = true; ++ connector->registration_state = DRM_CONNECTOR_REGISTERED; + goto unlock; + + err_debugfs: +@@ -474,7 +475,7 @@ EXPORT_SYMBOL(drm_connector_register); + void drm_connector_unregister(struct drm_connector *connector) + { + mutex_lock(&connector->mutex); +- if (!connector->registered) { ++ if (connector->registration_state != DRM_CONNECTOR_REGISTERED) { + mutex_unlock(&connector->mutex); + return; + } +@@ -485,7 +486,7 @@ void drm_connector_unregister(struct drm_connector *connector) + drm_sysfs_connector_remove(connector); + drm_debugfs_connector_remove(connector); + +- connector->registered = false; ++ connector->registration_state = DRM_CONNECTOR_UNREGISTERED; + mutex_unlock(&connector->mutex); + } + EXPORT_SYMBOL(drm_connector_unregister); +diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c +index c7d52c66ff298..8a19cfcfc4f18 100644 +--- a/drivers/gpu/drm/i915/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/intel_dp_mst.c +@@ -77,7 +77,7 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + pipe_config->pbn = mst_pbn; + + /* Zombie connectors can't have VCPI slots */ +- if (READ_ONCE(connector->registered)) { ++ if (!drm_connector_is_unregistered(connector)) { + slots = drm_dp_atomic_find_vcpi_slots(state, + &intel_dp->mst_mgr, + port, +@@ -317,7 +317,7 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector) + struct edid *edid; + int ret; + +- if (!READ_ONCE(connector->registered)) ++ if (drm_connector_is_unregistered(connector)) + return intel_connector_update_modes(connector, NULL); + + edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port); +@@ -333,7 +333,7 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force) + struct intel_connector *intel_connector = to_intel_connector(connector); + struct intel_dp *intel_dp = intel_connector->mst_port; + +- if (!READ_ONCE(connector->registered)) ++ if (drm_connector_is_unregistered(connector)) + return connector_status_disconnected; + return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, + intel_connector->port); +@@ -376,7 +376,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector, + int bpp = 24; /* MST uses fixed bpp */ + int max_rate, mode_rate, max_lanes, max_link_clock; + +- if (!READ_ONCE(connector->registered)) ++ if (drm_connector_is_unregistered(connector)) + return MODE_ERROR; + + if (mode->flags & DRM_MODE_FLAG_DBLSCAN) +diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c +index 1689568b597d4..12c5d7c96527a 100644 +--- a/drivers/hid/hid-cypress.c ++++ b/drivers/hid/hid-cypress.c +@@ -26,19 +26,17 @@ + #define CP_2WHEEL_MOUSE_HACK 0x02 + #define CP_2WHEEL_MOUSE_HACK_ON 0x04 + ++#define VA_INVAL_LOGICAL_BOUNDARY 0x08 ++ + /* + * Some USB barcode readers from cypress have usage min and usage max in + * the wrong order + */ +-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); + unsigned int i; + +- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX)) +- return rdesc; +- + if (*rsize < 4) + return rdesc; + +@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, + return rdesc; + } + ++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ /* ++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly ++ * reports Logical Minimum of its Consumer Control device as 572 ++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero. ++ */ ++ if (*rsize == 25 && ++ rdesc[0] == 0x05 && rdesc[1] == 0x0c && ++ rdesc[2] == 0x09 && rdesc[3] == 0x01 && ++ rdesc[6] == 0x19 && rdesc[7] == 0x00 && ++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) { ++ hid_info(hdev, ++ "fixing up varmilo VA104M consumer control report descriptor\n"); ++ rdesc[12] = 0x00; ++ rdesc[13] = 0x00; ++ } ++ return rdesc; ++} ++ ++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev); ++ ++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX) ++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize); ++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY) ++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize); ++ ++ return rdesc; ++} ++ + static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) +@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = { + .driver_data = CP_RDESC_SWAPPED_MIN_MAX }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE), + .driver_data = CP_2WHEEL_MOUSE_HACK }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1), ++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY }, + { } + }; + MODULE_DEVICE_TABLE(hid, cp_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index e18d796d985f8..6d118da1615d4 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -330,6 +330,8 @@ + #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81 + #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001 + ++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1 ++ + #define USB_VENDOR_ID_DATA_MODUL 0x7374 + #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201 + +@@ -442,6 +444,10 @@ + #define USB_VENDOR_ID_FRUCTEL 0x25B6 + #define USB_DEVICE_ID_GAMETEL_MT_MODE 0x0002 + ++#define USB_VENDOR_ID_GAMEVICE 0x27F8 ++#define USB_DEVICE_ID_GAMEVICE_GV186 0x0BBE ++#define USB_DEVICE_ID_GAMEVICE_KISHI 0x0BBF ++ + #define USB_VENDOR_ID_GAMERON 0x0810 + #define USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR 0x0001 + #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002 +@@ -477,6 +483,7 @@ + #define USB_DEVICE_ID_PENPOWER 0x00f4 + + #define USB_VENDOR_ID_GREENASIA 0x0e8f ++#define USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR 0x3010 + #define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD 0x3013 + + #define USB_VENDOR_ID_GRETAGMACBETH 0x0971 +@@ -726,6 +733,7 @@ + #define USB_VENDOR_ID_LOGITECH 0x046d + #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e + #define USB_DEVICE_ID_LOGITECH_T651 0xb00c ++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309 + #define USB_DEVICE_ID_LOGITECH_C007 0xc007 + #define USB_DEVICE_ID_LOGITECH_C077 0xc077 + #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 11bd2ca22a2e6..13deb9a676855 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -331,6 +331,9 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, ++ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 2d8d20a7f4574..10cb42a00fe87 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -85,7 +85,12 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_GV186), ++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI), ++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, +diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c +index 4256fdc5cd6d5..21fbdcde1faa1 100644 +--- a/drivers/hid/hid-sensor-hub.c ++++ b/drivers/hid/hid-sensor-hub.c +@@ -496,7 +496,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev, + return 1; + + ptr = raw_data; +- ptr++; /* Skip report id */ ++ if (report->id) ++ ptr++; /* Skip report id */ + + spin_lock_irqsave(&pdata->lock, flags); + +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index a6531ffe29a6f..a5694dec3f2ee 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -808,8 +808,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL); +- if (IS_ERR(mailbox)) ++ if (IS_ERR(mailbox)) { ++ err = PTR_ERR(mailbox); + goto err_out_arm; ++ } + + cq_context = mailbox->buf; + +@@ -851,9 +853,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + spin_lock_irq(&dev->cq_table.lock); +- if (mthca_array_set(&dev->cq_table.cq, +- cq->cqn & (dev->limits.num_cqs - 1), +- cq)) { ++ err = mthca_array_set(&dev->cq_table.cq, ++ cq->cqn & (dev->limits.num_cqs - 1), cq); ++ if (err) { + spin_unlock_irq(&dev->cq_table.lock); + goto err_out_free_mr; + } +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index 95a78ccbd8470..fef3b4064f187 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600); + MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]"); + #endif + ++static bool i8042_present; + static bool i8042_bypass_aux_irq_test; + static char i8042_kbd_firmware_id[128]; + static char i8042_aux_firmware_id[128]; +@@ -345,6 +346,9 @@ int i8042_command(unsigned char *param, int command) + unsigned long flags; + int retval; + ++ if (!i8042_present) ++ return -1; ++ + spin_lock_irqsave(&i8042_lock, flags); + retval = __i8042_command(param, command); + spin_unlock_irqrestore(&i8042_lock, flags); +@@ -1613,12 +1617,15 @@ static int __init i8042_init(void) + + err = i8042_platform_init(); + if (err) +- return err; ++ return (err == -ENODEV) ? 0 : err; + + err = i8042_controller_check(); + if (err) + goto err_platform_exit; + ++ /* Set this before creating the dev to allow i8042_command to work right away */ ++ i8042_present = true; ++ + pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0); + if (IS_ERR(pdev)) { + err = PTR_ERR(pdev); +@@ -1637,6 +1644,9 @@ static int __init i8042_init(void) + + static void __exit i8042_exit(void) + { ++ if (!i8042_present) ++ return; ++ + platform_device_unregister(i8042_platform_device); + platform_driver_unregister(&i8042_driver); + i8042_platform_exit(); +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index efaa342600c41..fbb970220c2d7 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -976,7 +976,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = { + .name = KBUILD_MODNAME, + .tseg1_min = 2, /* Time segment 1 = prop_seg + phase_seg1 */ + .tseg1_max = 256, +- .tseg2_min = 1, /* Time segment 2 = phase_seg2 */ ++ .tseg2_min = 2, /* Time segment 2 = phase_seg2 */ + .tseg2_max = 128, + .sjw_max = 128, + .brp_min = 1, +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index cc2e224661b30..6a57169c27158 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -71,21 +71,27 @@ enum gs_can_identify_mode { + }; + + /* data types passed between host and device */ ++ ++/* The firmware on the original USB2CAN by Geschwister Schneider ++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data ++ * between the host and the device in host byte order. This is done ++ * with the struct gs_host_config::byte_order member, which is sent ++ * first to indicate the desired byte order. ++ * ++ * The widely used open source firmware candleLight doesn't support ++ * this feature and exchanges the data in little endian byte order. ++ */ + struct gs_host_config { +- u32 byte_order; ++ __le32 byte_order; + } __packed; +-/* All data exchanged between host and device is exchanged in host byte order, +- * thanks to the struct gs_host_config byte_order member, which is sent first +- * to indicate the desired byte order. +- */ + + struct gs_device_config { + u8 reserved1; + u8 reserved2; + u8 reserved3; + u8 icount; +- u32 sw_version; +- u32 hw_version; ++ __le32 sw_version; ++ __le32 hw_version; + } __packed; + + #define GS_CAN_MODE_NORMAL 0 +@@ -95,26 +101,26 @@ struct gs_device_config { + #define GS_CAN_MODE_ONE_SHOT BIT(3) + + struct gs_device_mode { +- u32 mode; +- u32 flags; ++ __le32 mode; ++ __le32 flags; + } __packed; + + struct gs_device_state { +- u32 state; +- u32 rxerr; +- u32 txerr; ++ __le32 state; ++ __le32 rxerr; ++ __le32 txerr; + } __packed; + + struct gs_device_bittiming { +- u32 prop_seg; +- u32 phase_seg1; +- u32 phase_seg2; +- u32 sjw; +- u32 brp; ++ __le32 prop_seg; ++ __le32 phase_seg1; ++ __le32 phase_seg2; ++ __le32 sjw; ++ __le32 brp; + } __packed; + + struct gs_identify_mode { +- u32 mode; ++ __le32 mode; + } __packed; + + #define GS_CAN_FEATURE_LISTEN_ONLY BIT(0) +@@ -125,23 +131,23 @@ struct gs_identify_mode { + #define GS_CAN_FEATURE_IDENTIFY BIT(5) + + struct gs_device_bt_const { +- u32 feature; +- u32 fclk_can; +- u32 tseg1_min; +- u32 tseg1_max; +- u32 tseg2_min; +- u32 tseg2_max; +- u32 sjw_max; +- u32 brp_min; +- u32 brp_max; +- u32 brp_inc; ++ __le32 feature; ++ __le32 fclk_can; ++ __le32 tseg1_min; ++ __le32 tseg1_max; ++ __le32 tseg2_min; ++ __le32 tseg2_max; ++ __le32 sjw_max; ++ __le32 brp_min; ++ __le32 brp_max; ++ __le32 brp_inc; + } __packed; + + #define GS_CAN_FLAG_OVERFLOW 1 + + struct gs_host_frame { + u32 echo_id; +- u32 can_id; ++ __le32 can_id; + + u8 can_dlc; + u8 channel; +@@ -337,13 +343,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) + if (!skb) + return; + +- cf->can_id = hf->can_id; ++ cf->can_id = le32_to_cpu(hf->can_id); + + cf->can_dlc = get_can_dlc(hf->can_dlc); + memcpy(cf->data, hf->data, 8); + + /* ERROR frames tell us information about the controller */ +- if (hf->can_id & CAN_ERR_FLAG) ++ if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG) + gs_update_state(dev, cf); + + netdev->stats.rx_packets++; +@@ -426,11 +432,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev) + if (!dbt) + return -ENOMEM; + +- dbt->prop_seg = bt->prop_seg; +- dbt->phase_seg1 = bt->phase_seg1; +- dbt->phase_seg2 = bt->phase_seg2; +- dbt->sjw = bt->sjw; +- dbt->brp = bt->brp; ++ dbt->prop_seg = cpu_to_le32(bt->prop_seg); ++ dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1); ++ dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2); ++ dbt->sjw = cpu_to_le32(bt->sjw); ++ dbt->brp = cpu_to_le32(bt->brp); + + /* request bit timings */ + rc = usb_control_msg(interface_to_usbdev(intf), +@@ -511,7 +517,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, + + cf = (struct can_frame *)skb->data; + +- hf->can_id = cf->can_id; ++ hf->can_id = cpu_to_le32(cf->can_id); + hf->can_dlc = cf->can_dlc; + memcpy(hf->data, cf->data, cf->can_dlc); + +@@ -581,6 +587,7 @@ static int gs_can_open(struct net_device *netdev) + int rc, i; + struct gs_device_mode *dm; + u32 ctrlmode; ++ u32 flags = 0; + + rc = open_candev(netdev); + if (rc) +@@ -648,24 +655,24 @@ static int gs_can_open(struct net_device *netdev) + + /* flags */ + ctrlmode = dev->can.ctrlmode; +- dm->flags = 0; + + if (ctrlmode & CAN_CTRLMODE_LOOPBACK) +- dm->flags |= GS_CAN_MODE_LOOP_BACK; ++ flags |= GS_CAN_MODE_LOOP_BACK; + else if (ctrlmode & CAN_CTRLMODE_LISTENONLY) +- dm->flags |= GS_CAN_MODE_LISTEN_ONLY; ++ flags |= GS_CAN_MODE_LISTEN_ONLY; + + /* Controller is not allowed to retry TX + * this mode is unavailable on atmels uc3c hardware + */ + if (ctrlmode & CAN_CTRLMODE_ONE_SHOT) +- dm->flags |= GS_CAN_MODE_ONE_SHOT; ++ flags |= GS_CAN_MODE_ONE_SHOT; + + if (ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE; ++ flags |= GS_CAN_MODE_TRIPLE_SAMPLE; + + /* finally start device */ +- dm->mode = GS_CAN_MODE_START; ++ dm->mode = cpu_to_le32(GS_CAN_MODE_START); ++ dm->flags = cpu_to_le32(flags); + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0), + GS_USB_BREQ_MODE, +@@ -745,9 +752,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) + return -ENOMEM; + + if (do_identify) +- imode->mode = GS_CAN_IDENTIFY_ON; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON); + else +- imode->mode = GS_CAN_IDENTIFY_OFF; ++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF); + + rc = usb_control_msg(interface_to_usbdev(dev->iface), + usb_sndctrlpipe(interface_to_usbdev(dev->iface), +@@ -798,6 +805,7 @@ static struct gs_can *gs_make_candev(unsigned int channel, + struct net_device *netdev; + int rc; + struct gs_device_bt_const *bt_const; ++ u32 feature; + + bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL); + if (!bt_const) +@@ -838,14 +846,14 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* dev settup */ + strcpy(dev->bt_const.name, "gs_usb"); +- dev->bt_const.tseg1_min = bt_const->tseg1_min; +- dev->bt_const.tseg1_max = bt_const->tseg1_max; +- dev->bt_const.tseg2_min = bt_const->tseg2_min; +- dev->bt_const.tseg2_max = bt_const->tseg2_max; +- dev->bt_const.sjw_max = bt_const->sjw_max; +- dev->bt_const.brp_min = bt_const->brp_min; +- dev->bt_const.brp_max = bt_const->brp_max; +- dev->bt_const.brp_inc = bt_const->brp_inc; ++ dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min); ++ dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max); ++ dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min); ++ dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max); ++ dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max); ++ dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min); ++ dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max); ++ dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc); + + dev->udev = interface_to_usbdev(intf); + dev->iface = intf; +@@ -862,28 +870,29 @@ static struct gs_can *gs_make_candev(unsigned int channel, + + /* can settup */ + dev->can.state = CAN_STATE_STOPPED; +- dev->can.clock.freq = bt_const->fclk_can; ++ dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can); + dev->can.bittiming_const = &dev->bt_const; + dev->can.do_set_bittiming = gs_usb_set_bittiming; + + dev->can.ctrlmode_supported = 0; + +- if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY) ++ feature = le32_to_cpu(bt_const->feature); ++ if (feature & GS_CAN_FEATURE_LISTEN_ONLY) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY; + +- if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK) ++ if (feature & GS_CAN_FEATURE_LOOP_BACK) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK; + +- if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) ++ if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; + +- if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT) ++ if (feature & GS_CAN_FEATURE_ONE_SHOT) + dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT; + + SET_NETDEV_DEV(netdev, &intf->dev); + +- if (dconf->sw_version > 1) +- if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY) ++ if (le32_to_cpu(dconf->sw_version) > 1) ++ if (feature & GS_CAN_FEATURE_IDENTIFY) + netdev->ethtool_ops = &gs_usb_ethtool_ops; + + kfree(bt_const); +@@ -918,7 +927,7 @@ static int gs_usb_probe(struct usb_interface *intf, + if (!hconf) + return -ENOMEM; + +- hconf->byte_order = 0x0000beef; ++ hconf->byte_order = cpu_to_le32(0x0000beef); + + /* send host config */ + rc = usb_control_msg(interface_to_usbdev(intf), +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 3c3222e2dcfcf..9aea4cf19d0c9 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -2433,16 +2433,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev, + goto err_mmio_read_less; + } + +- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width)); ++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width)); + if (rc) { +- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc); +- goto err_mmio_read_less; +- } +- +- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width)); +- if (rc) { +- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n", +- rc); ++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc); + goto err_mmio_read_less; + } + +@@ -3183,6 +3176,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + return rc; + } + ++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS)); ++ if (rc) { ++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc); ++ goto err_disable_device; ++ } ++ + pci_set_master(pdev); + + ena_dev = vzalloc(sizeof(*ena_dev)); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 01d28ede1fb20..db1a23b8d531d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8021,7 +8021,8 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev) + if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 && + dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) { + dev_err(&pdev->dev, "System does not support DMA, aborting\n"); +- goto init_err_disable; ++ rc = -EIO; ++ goto init_err_release; + } + + pci_set_master(pdev); +@@ -9120,6 +9121,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + create_singlethread_workqueue("bnxt_pf_wq"); + if (!bnxt_pf_wq) { + dev_err(&pdev->dev, "Unable to create workqueue.\n"); ++ rc = -ENOMEM; + goto init_err_pci_clean; + } + } +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +index a62c96001761b..9160b44c68bbf 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -626,7 +626,8 @@ int set_filter_wr(struct adapter *adapter, int fidx) + FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) | + FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) | + FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld)); +- fwr->smac_sel = f->smt->idx; ++ if (f->fs.newsmac) ++ fwr->smac_sel = f->smt->idx; + fwr->rx_chan_rx_rpl_iq = + htons(FW_FILTER_WR_RX_CHAN_V(0) | + FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id)); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index d8115a9333e05..2938ac440fb36 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2560,6 +2560,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter) + { + int i, rc; + ++ if (!adapter->tx_scrq || !adapter->rx_scrq) ++ return -EINVAL; ++ + for (i = 0; i < adapter->req_tx_queues; i++) { + netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i); + rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]); +@@ -4459,6 +4462,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter) + } while (rc == H_BUSY || H_IS_LONG_BUSY(rc)); + + /* Clean out the queue */ ++ if (!crq->msgs) ++ return -EINVAL; ++ + memset(crq->msgs, 0, PAGE_SIZE); + crq->cur = 0; + crq->active = false; +diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c +index 4da409e77a72e..6c78529a8c89b 100644 +--- a/drivers/nfc/s3fwrn5/i2c.c ++++ b/drivers/nfc/s3fwrn5/i2c.c +@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy { + struct i2c_client *i2c_dev; + struct nci_dev *ndev; + +- unsigned int gpio_en; +- unsigned int gpio_fw_wake; ++ int gpio_en; ++ int gpio_fw_wake; + + struct mutex mutex; + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 3c68a5b35ec1b..a52b2f15f372a 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -276,9 +276,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev, + nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)]; + } + ++static void nvme_dbbuf_free(struct nvme_queue *nvmeq) ++{ ++ if (!nvmeq->qid) ++ return; ++ ++ nvmeq->dbbuf_sq_db = NULL; ++ nvmeq->dbbuf_cq_db = NULL; ++ nvmeq->dbbuf_sq_ei = NULL; ++ nvmeq->dbbuf_cq_ei = NULL; ++} ++ + static void nvme_dbbuf_set(struct nvme_dev *dev) + { + struct nvme_command c; ++ unsigned int i; + + if (!dev->dbbuf_dbs) + return; +@@ -292,6 +304,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev) + dev_warn(dev->ctrl.device, "unable to set dbbuf\n"); + /* Free memory and continue on */ + nvme_dbbuf_dma_free(dev); ++ ++ for (i = 1; i <= dev->online_queues; i++) ++ nvme_dbbuf_free(&dev->queues[i]); + } + } + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index de1b4ebe4de28..39c01ef57d83c 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -899,6 +899,7 @@ remove_pads: + reset: + reset_control_assert(padctl->rst); + remove: ++ platform_set_drvdata(pdev, NULL); + soc->ops->remove(padctl); + return err; + } +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 98bd8213b0378..8cc01857bc5c0 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -4251,6 +4251,7 @@ static void hotkey_resume(void) + pr_err("error while attempting to reset the event firmware interface\n"); + + tpacpi_send_radiosw_update(); ++ tpacpi_input_send_tabletsw(); + hotkey_tablet_mode_notify_change(); + hotkey_wakeup_reason_notify_change(); + hotkey_wakeup_hotunplug_complete_notify_change(); +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index e366977bda418..8c3e9bac4754c 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -1497,7 +1497,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file)); + char *buffer; + char *cmd; +- int lcd_out, crt_out, tv_out; ++ int lcd_out = -1, crt_out = -1, tv_out = -1; + int remain = count; + int value; + int ret; +@@ -1529,7 +1529,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf, + + kfree(cmd); + +- lcd_out = crt_out = tv_out = -1; + ret = get_video_status(dev, &video_out); + if (!ret) { + unsigned int new_video_out = video_out; +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 5f59e2dfc7db9..d0aaef937b0fe 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -470,12 +470,6 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx, + + } + } +- if (forced_cleanup && (atomic_read(&(q->bufs[bidx]->state)) == +- QETH_QDIO_BUF_HANDLED_DELAYED)) { +- /* for recovery situations */ +- qeth_init_qdio_out_buf(q, bidx); +- QETH_CARD_TEXT(q->card, 2, "clprecov"); +- } + } + + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 7a05c72717666..1c69515e870cb 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -571,8 +571,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state) + if (conn->task == task) + conn->task = NULL; + +- if (conn->ping_task == task) +- conn->ping_task = NULL; ++ if (READ_ONCE(conn->ping_task) == task) ++ WRITE_ONCE(conn->ping_task, NULL); + + /* release get from queueing */ + __iscsi_put_task(task); +@@ -781,6 +781,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + task->conn->session->age); + } + ++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK)) ++ WRITE_ONCE(conn->ping_task, task); ++ + if (!ihost->workq) { + if (iscsi_prep_mgmt_task(conn, task)) + goto free_task; +@@ -988,8 +991,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + struct iscsi_nopout hdr; + struct iscsi_task *task; + +- if (!rhdr && conn->ping_task) +- return -EINVAL; ++ if (!rhdr) { ++ if (READ_ONCE(conn->ping_task)) ++ return -EINVAL; ++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK); ++ } + + memset(&hdr, 0, sizeof(struct iscsi_nopout)); + hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE; +@@ -1004,11 +1010,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) + + task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0); + if (!task) { ++ if (!rhdr) ++ WRITE_ONCE(conn->ping_task, NULL); + iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n"); + return -EIO; + } else if (!rhdr) { + /* only track our nops */ +- conn->ping_task = task; + conn->last_ping = jiffies; + } + +@@ -1021,7 +1028,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task, + struct iscsi_conn *conn = task->conn; + int rc = 0; + +- if (conn->ping_task != task) { ++ if (READ_ONCE(conn->ping_task) != task) { + /* + * If this is not in response to one of our + * nops then it must be from userspace. +@@ -1961,7 +1968,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn) + */ + static int iscsi_has_ping_timed_out(struct iscsi_conn *conn) + { +- if (conn->ping_task && ++ if (READ_ONCE(conn->ping_task) && + time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) + + (conn->ping_timeout * HZ), jiffies)) + return 1; +@@ -2096,7 +2103,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + * Checking the transport already or nop from a cmd timeout still + * running + */ +- if (conn->ping_task) { ++ if (READ_ONCE(conn->ping_task)) { + task->have_checked_conn = true; + rc = BLK_EH_RESET_TIMER; + goto done; +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index a63119c35fde8..7e4e6e982055e 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -7926,11 +7926,7 @@ int ufshcd_shutdown(struct ufs_hba *hba) + if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) + goto out; + +- if (pm_runtime_suspended(hba->dev)) { +- ret = ufshcd_runtime_resume(hba); +- if (ret) +- goto out; +- } ++ pm_runtime_get_sync(hba->dev); + + ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM); + out: +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 2602b57936d4b..58ccded1be857 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -492,8 +492,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp); + void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) + { + spin_lock_bh(&conn->cmd_lock); +- if (!list_empty(&cmd->i_conn_node) && +- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) ++ if (!list_empty(&cmd->i_conn_node)) + list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + +@@ -4054,12 +4053,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + spin_lock_bh(&conn->cmd_lock); + list_splice_init(&conn->conn_cmd_list, &tmp_list); + +- list_for_each_entry(cmd, &tmp_list, i_conn_node) { ++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + + if (se_cmd->se_tfo != NULL) { + spin_lock_irq(&se_cmd->t_state_lock); +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ /* ++ * LIO's abort path owns the cleanup for this, ++ * so put it back on the list and let ++ * aborted_task handle it. ++ */ ++ list_move_tail(&cmd->i_conn_node, ++ &conn->conn_cmd_list); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ } + spin_unlock_irq(&se_cmd->t_state_lock); + } + } +diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c +index a5afbe6dee686..7cb7efe62b011 100644 +--- a/drivers/tee/optee/call.c ++++ b/drivers/tee/optee/call.c +@@ -538,7 +538,8 @@ void optee_free_pages_list(void *list, size_t num_entries) + static bool is_normal_memory(pgprot_t p) + { + #if defined(CONFIG_ARM) +- return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC; ++ return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) || ++ ((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK)); + #elif defined(CONFIG_ARM64) + return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL); + #else +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 00204824bffd8..732e7f1687dd2 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -463,11 +463,11 @@ static void snoop_urb(struct usb_device *udev, + + if (userurb) { /* Async */ + if (when == SUBMIT) +- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " ++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " + "length %u\n", + userurb, ep, t, d, length); + else +- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " ++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, " + "actual_length %u status %d\n", + userurb, ep, t, d, length, + timeout_or_status); +@@ -1927,7 +1927,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg) + if (as) { + int retval; + +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl(as, (void __user * __user *)arg); + free_async(as); + return retval; +@@ -1944,7 +1944,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg) + + as = async_getcompleted(ps); + if (as) { +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl(as, (void __user * __user *)arg); + free_async(as); + } else { +@@ -2070,7 +2070,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg) + if (as) { + int retval; + +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl_compat(as, (void __user * __user *)arg); + free_async(as); + return retval; +@@ -2087,7 +2087,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar + + as = async_getcompleted(ps); + if (as) { +- snoop(&ps->dev->dev, "reap %pK\n", as->userurb); ++ snoop(&ps->dev->dev, "reap %px\n", as->userurb); + retval = processcompl_compat(as, (void __user * __user *)arg); + free_async(as); + } else { +@@ -2512,7 +2512,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, + #endif + + case USBDEVFS_DISCARDURB: +- snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p); ++ snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p); + ret = proc_unlinkurb(ps, p); + break; + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 5ad14cdd97623..b55c3a699fc65 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -348,6 +348,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Guillemot Webcam Hercules Dualpix Exchange*/ + { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Guillemot Hercules DJ Console audio card (BZ 208357) */ ++ { USB_DEVICE(0x06f8, 0xb000), .driver_info = ++ USB_QUIRK_ENDPOINT_BLACKLIST }, ++ + /* Midiman M-Audio Keystation 88es */ + { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, + +@@ -421,6 +425,10 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkCenter A630Z TI024Gen3 usb-audio */ ++ { USB_DEVICE(0x17ef, 0xa012), .driver_info = ++ USB_QUIRK_DISCONNECT_SUSPEND }, ++ + /* BUILDWIN Photo Frame */ + { USB_DEVICE(0x1908, 0x1315), .driver_info = + USB_QUIRK_HONOR_BNUMINTERFACES }, +@@ -521,6 +529,8 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = { + * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST. + */ + static const struct usb_device_id usb_endpoint_blacklist[] = { ++ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 }, ++ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 }, + { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 }, + { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 }, + { } +diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c +index 46af0aa07e2e3..b2b5b0689667b 100644 +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -1315,7 +1315,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi) + midi->id = kstrdup(opts->id, GFP_KERNEL); + if (opts->id && !midi->id) { + status = -ENOMEM; +- goto setup_fail; ++ goto midi_free; + } + midi->in_ports = opts->in_ports; + midi->out_ports = opts->out_ports; +@@ -1327,7 +1327,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi) + + status = kfifo_alloc(&midi->in_req_fifo, midi->qlen, GFP_KERNEL); + if (status) +- goto setup_fail; ++ goto midi_free; + + spin_lock_init(&midi->transmit_lock); + +@@ -1343,9 +1343,13 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi) + + return &midi->func; + ++midi_free: ++ if (midi) ++ kfree(midi->id); ++ kfree(midi); + setup_fail: + mutex_unlock(&opts->lock); +- kfree(midi); ++ + return ERR_PTR(status); + } + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 25d417ad9000c..09ed5f02c24f4 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -2039,6 +2039,9 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent) + return 0; + + Enomem: ++ kfree(CHIP); ++ CHIP = NULL; ++ + return -ENOMEM; + } + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 403d8cd3e5827..56e70f12c9960 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + goto err1; + } + +- fb_virt = ioremap(par->mem->start, screen_fb_size); ++ /* ++ * Map the VRAM cacheable for performance. This is also required for ++ * VM Connect to display properly for ARM64 Linux VM, as the host also ++ * maps the VRAM cacheable. ++ */ ++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size); + if (!fb_virt) + goto err2; + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index c8ed4db73b840..9936e4b991aa3 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -488,13 +488,13 @@ next2: + break; + } + out: ++ btrfs_free_path(path); + fs_info->qgroup_flags |= flags; + if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON)) + clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); + else if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN && + ret >= 0) + ret = qgroup_rescan_init(fs_info, rescan_progress, 0); +- btrfs_free_path(path); + + if (ret < 0) { + ulist_free(fs_info->qgroup_ulist); +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 7e000d061813c..95b6a4ea18f7a 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -857,7 +857,13 @@ static noinline struct btrfs_device *device_list_add(const char *path, + if (device->bdev != path_bdev) { + bdput(path_bdev); + mutex_unlock(&fs_devices->device_list_mutex); +- btrfs_warn_in_rcu(device->fs_info, ++ /* ++ * device->fs_info may not be reliable here, so ++ * pass in a NULL instead. This avoids a ++ * possible use-after-free when the fs_info and ++ * fs_info->sb are already torn down. ++ */ ++ btrfs_warn_in_rcu(NULL, + "duplicate device %s devid %llu generation %llu scanned by %s (%d)", + path, devid, found_transid, + current->comm, +diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c +index 8c6ab6c95727e..7f40343b39b05 100644 +--- a/fs/efivarfs/inode.c ++++ b/fs/efivarfs/inode.c +@@ -10,6 +10,7 @@ + #include <linux/efi.h> + #include <linux/fs.h> + #include <linux/ctype.h> ++#include <linux/kmemleak.h> + #include <linux/slab.h> + #include <linux/uuid.h> + +@@ -106,6 +107,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry, + var->var.VariableName[i] = '\0'; + + inode->i_private = var; ++ kmemleak_ignore(var); + + err = efivar_entry_add(var, &efivarfs_list); + if (err) +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index 7808a26bd33fa..834615f13f3e3 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list); + static void efivarfs_evict_inode(struct inode *inode) + { + clear_inode(inode); +- kfree(inode->i_private); + } + + static const struct super_operations efivarfs_ops = { +diff --git a/fs/proc/self.c b/fs/proc/self.c +index cc6d4253399d1..7922edf70ce1a 100644 +--- a/fs/proc/self.c ++++ b/fs/proc/self.c +@@ -16,6 +16,13 @@ static const char *proc_self_get_link(struct dentry *dentry, + pid_t tgid = task_tgid_nr_ns(current, ns); + char *name; + ++ /* ++ * Not currently supported. Once we can inherit all of struct pid, ++ * we can allow this. ++ */ ++ if (current->flags & PF_KTHREAD) ++ return ERR_PTR(-EOPNOTSUPP); ++ + if (!tgid) + return ERR_PTR(-ENOENT); + /* max length of unsigned int in decimal + NULL term */ +diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h +index 97ea41dc678fe..e5f641cdab5a4 100644 +--- a/include/drm/drm_connector.h ++++ b/include/drm/drm_connector.h +@@ -81,6 +81,53 @@ enum drm_connector_status { + connector_status_unknown = 3, + }; + ++/** ++ * enum drm_connector_registration_status - userspace registration status for ++ * a &drm_connector ++ * ++ * This enum is used to track the status of initializing a connector and ++ * registering it with userspace, so that DRM can prevent bogus modesets on ++ * connectors that no longer exist. ++ */ ++enum drm_connector_registration_state { ++ /** ++ * @DRM_CONNECTOR_INITIALIZING: The connector has just been created, ++ * but has yet to be exposed to userspace. There should be no ++ * additional restrictions to how the state of this connector may be ++ * modified. ++ */ ++ DRM_CONNECTOR_INITIALIZING = 0, ++ ++ /** ++ * @DRM_CONNECTOR_REGISTERED: The connector has been fully initialized ++ * and registered with sysfs, as such it has been exposed to ++ * userspace. There should be no additional restrictions to how the ++ * state of this connector may be modified. ++ */ ++ DRM_CONNECTOR_REGISTERED = 1, ++ ++ /** ++ * @DRM_CONNECTOR_UNREGISTERED: The connector has either been exposed ++ * to userspace and has since been unregistered and removed from ++ * userspace, or the connector was unregistered before it had a chance ++ * to be exposed to userspace (e.g. still in the ++ * @DRM_CONNECTOR_INITIALIZING state). When a connector is ++ * unregistered, there are additional restrictions to how its state ++ * may be modified: ++ * ++ * - An unregistered connector may only have its DPMS changed from ++ * On->Off. Once DPMS is changed to Off, it may not be switched back ++ * to On. ++ * - Modesets are not allowed on unregistered connectors, unless they ++ * would result in disabling its assigned CRTCs. This means ++ * disabling a CRTC on an unregistered connector is OK, but enabling ++ * one is not. ++ * - Removing a CRTC from an unregistered connector is OK, but new ++ * CRTCs may never be assigned to an unregistered connector. ++ */ ++ DRM_CONNECTOR_UNREGISTERED = 2, ++}; ++ + enum subpixel_order { + SubPixelUnknown = 0, + SubPixelHorizontalRGB, +@@ -852,10 +899,12 @@ struct drm_connector { + bool ycbcr_420_allowed; + + /** +- * @registered: Is this connector exposed (registered) with userspace? ++ * @registration_state: Is this connector initializing, exposed ++ * (registered) with userspace, or unregistered? ++ * + * Protected by @mutex. + */ +- bool registered; ++ enum drm_connector_registration_state registration_state; + + /** + * @modes: +@@ -1165,6 +1214,24 @@ static inline void drm_connector_unreference(struct drm_connector *connector) + drm_connector_put(connector); + } + ++/** ++ * drm_connector_is_unregistered - has the connector been unregistered from ++ * userspace? ++ * @connector: DRM connector ++ * ++ * Checks whether or not @connector has been unregistered from userspace. ++ * ++ * Returns: ++ * True if the connector was unregistered, false if the connector is ++ * registered or has not yet been registered with userspace. ++ */ ++static inline bool ++drm_connector_is_unregistered(struct drm_connector *connector) ++{ ++ return READ_ONCE(connector->registration_state) == ++ DRM_CONNECTOR_UNREGISTERED; ++} ++ + const char *drm_get_connector_status_name(enum drm_connector_status status); + const char *drm_get_subpixel_order_name(enum subpixel_order order); + const char *drm_get_dpms_name(int val); +diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h +index 72cb19c3db6aa..9460a5635c90b 100644 +--- a/include/linux/netfilter.h ++++ b/include/linux/netfilter.h +@@ -300,7 +300,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, + + INIT_LIST_HEAD(&sublist); + list_for_each_entry_safe(skb, next, head, list) { +- list_del(&skb->list); ++ skb_list_del_init(skb); + if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) + list_add_tail(&skb->list, &sublist); + } +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index c9bd935f4fd1c..1ee0f30ae190b 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -145,6 +145,9 @@ struct iscsi_task { + void *dd_data; /* driver/transport data */ + }; + ++/* invalid scsi_task pointer */ ++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l ++ + static inline int iscsi_task_has_unsol_data(struct iscsi_task *task) + { + return task->unsol_r2t.data_length > task->unsol_r2t.sent; +diff --git a/include/uapi/linux/wireless.h b/include/uapi/linux/wireless.h +index a2c006a364e0b..24f3371ad8262 100644 +--- a/include/uapi/linux/wireless.h ++++ b/include/uapi/linux/wireless.h +@@ -74,7 +74,11 @@ + #include <linux/socket.h> /* for "struct sockaddr" et al */ + #include <linux/if.h> /* for IFNAMSIZ and co... */ + +-#include <stddef.h> /* for offsetof */ ++#ifdef __KERNEL__ ++# include <linux/stddef.h> /* for offsetof */ ++#else ++# include <stddef.h> /* for offsetof */ ++#endif + + /***************************** VERSION *****************************/ + /* +diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c +index 853773e45f792..837f67c9fad35 100644 +--- a/net/batman-adv/log.c ++++ b/net/batman-adv/log.c +@@ -205,6 +205,7 @@ static const struct file_operations batadv_log_fops = { + .read = batadv_log_read, + .poll = batadv_log_poll, + .llseek = no_llseek, ++ .owner = THIS_MODULE, + }; + + /** +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 708efb9b43877..f86b9b0a0607e 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1955,20 +1955,23 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo, + int pinctl; + int err = 0; + ++ mutex_lock(&spec->pcm_lock); + if (hinfo->nid) { + pcm_idx = hinfo_to_pcm_index(codec, hinfo); +- if (snd_BUG_ON(pcm_idx < 0)) +- return -EINVAL; ++ if (snd_BUG_ON(pcm_idx < 0)) { ++ err = -EINVAL; ++ goto unlock; ++ } + cvt_idx = cvt_nid_to_cvt_index(codec, hinfo->nid); +- if (snd_BUG_ON(cvt_idx < 0)) +- return -EINVAL; ++ if (snd_BUG_ON(cvt_idx < 0)) { ++ err = -EINVAL; ++ goto unlock; ++ } + per_cvt = get_cvt(spec, cvt_idx); +- + snd_BUG_ON(!per_cvt->assigned); + per_cvt->assigned = 0; + hinfo->nid = 0; + +- mutex_lock(&spec->pcm_lock); + snd_hda_spdif_ctls_unassign(codec, pcm_idx); + clear_bit(pcm_idx, &spec->pcm_in_use); + pin_idx = hinfo_to_pin_index(codec, hinfo); +@@ -1996,10 +1999,11 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo, + per_pin->setup = false; + per_pin->channels = 0; + mutex_unlock(&per_pin->lock); +- unlock: +- mutex_unlock(&spec->pcm_lock); + } + ++unlock: ++ mutex_unlock(&spec->pcm_lock); ++ + return err; + } + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 29e75c051d045..230e94bf7775a 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -332,6 +332,7 @@ bool die_is_func_def(Dwarf_Die *dw_die) + int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + { + Dwarf_Addr base, end; ++ Dwarf_Attribute attr; + + if (!addr) + return -EINVAL; +@@ -339,6 +340,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) + if (dwarf_entrypc(dw_die, addr) == 0) + return 0; + ++ /* ++ * Since the dwarf_ranges() will return 0 if there is no ++ * DW_AT_ranges attribute, we should check it first. ++ */ ++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr)) ++ return -ENOENT; ++ + return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; + } + +diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c +index aa9c7df120cae..9c22729e2ad60 100644 +--- a/tools/perf/util/event.c ++++ b/tools/perf/util/event.c +@@ -912,11 +912,13 @@ static int __perf_event__synthesize_kernel_mmap(struct perf_tool *tool, + int err; + union perf_event *event; + +- if (symbol_conf.kptr_restrict) +- return -1; + if (map == NULL) + return -1; + ++ kmap = map__kmap(map); ++ if (!kmap->ref_reloc_sym) ++ return -1; ++ + /* + * We should get this from /sys/kernel/sections/.text, but till that is + * available use this, and after it is use this as a fallback for older +@@ -939,7 +941,6 @@ static int __perf_event__synthesize_kernel_mmap(struct perf_tool *tool, + event->header.misc = PERF_RECORD_MISC_GUEST_KERNEL; + } + +- kmap = map__kmap(map); + size = snprintf(event->mmap.filename, sizeof(event->mmap.filename), + "%s%s", machine->mmap_name, kmap->ref_reloc_sym->name) + 1; + size = PERF_ALIGN(size, sizeof(u64)); +diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c +index a2a175b08b172..cbb38a0d1b251 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c ++++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c +@@ -226,6 +226,23 @@ static unsigned long vgic_mmio_read_v3r_typer(struct kvm_vcpu *vcpu, + return extract_bytes(value, addr & 7, len); + } + ++static unsigned long vgic_uaccess_read_v3r_typer(struct kvm_vcpu *vcpu, ++ gpa_t addr, unsigned int len) ++{ ++ unsigned long mpidr = kvm_vcpu_get_mpidr_aff(vcpu); ++ int target_vcpu_id = vcpu->vcpu_id; ++ u64 value; ++ ++ value = (u64)(mpidr & GENMASK(23, 0)) << 32; ++ value |= ((target_vcpu_id & 0xffff) << 8); ++ ++ if (vgic_has_its(vcpu->kvm)) ++ value |= GICR_TYPER_PLPIS; ++ ++ /* reporting of the Last bit is not supported for userspace */ ++ return extract_bytes(value, addr & 7, len); ++} ++ + static unsigned long vgic_mmio_read_v3r_iidr(struct kvm_vcpu *vcpu, + gpa_t addr, unsigned int len) + { +@@ -532,8 +549,9 @@ static const struct vgic_register_region vgic_v3_rdbase_registers[] = { + REGISTER_DESC_WITH_LENGTH(GICR_IIDR, + vgic_mmio_read_v3r_iidr, vgic_mmio_write_wi, 4, + VGIC_ACCESS_32bit), +- REGISTER_DESC_WITH_LENGTH(GICR_TYPER, +- vgic_mmio_read_v3r_typer, vgic_mmio_write_wi, 8, ++ REGISTER_DESC_WITH_LENGTH_UACCESS(GICR_TYPER, ++ vgic_mmio_read_v3r_typer, vgic_mmio_write_wi, ++ vgic_uaccess_read_v3r_typer, vgic_mmio_uaccess_write_wi, 8, + VGIC_ACCESS_64bit | VGIC_ACCESS_32bit), + REGISTER_DESC_WITH_LENGTH(GICR_WAKER, + vgic_mmio_read_raz, vgic_mmio_write_wi, 4,
