diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1036_linux-4.14.37.patch | 9466 |
2 files changed, 9470 insertions, 0 deletions
diff --git a/0000_README b/0000_README index ff880186..73aafaef 100644 --- a/0000_README +++ b/0000_README @@ -187,6 +187,10 @@ Patch: 1035_linux-4.14.36.patch From: http://www.kernel.org Desc: Linux 4.14.36 +Patch: 1036_linux-4.14.37.patch +From: http://www.kernel.org +Desc: Linux 4.14.37 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1036_linux-4.14.37.patch b/1036_linux-4.14.37.patch new file mode 100644 index 00000000..aba40406 --- /dev/null +++ b/1036_linux-4.14.37.patch @@ -0,0 +1,9466 @@ +diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt +index 1699a55b7b70..ef639960b272 100644 +--- a/Documentation/device-mapper/thin-provisioning.txt ++++ b/Documentation/device-mapper/thin-provisioning.txt +@@ -112,9 +112,11 @@ $low_water_mark is expressed in blocks of size $data_block_size. If + free space on the data device drops below this level then a dm event + will be triggered which a userspace daemon should catch allowing it to + extend the pool device. Only one such event will be sent. +-Resuming a device with a new table itself triggers an event so the +-userspace daemon can use this to detect a situation where a new table +-already exceeds the threshold. ++ ++No special event is triggered if a just resumed device's free space is below ++the low water mark. However, resuming a device always triggers an ++event; a userspace daemon should verify that free space exceeds the low ++water mark when handling this event. + + A low water mark for the metadata device is maintained in the kernel and + will trigger a dm event if free space on the metadata device drops below +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index e63a35fafef0..0f9089416b4c 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -1837,6 +1837,7 @@ registers, find a list below: + PPC | KVM_REG_PPC_DBSR | 32 + PPC | KVM_REG_PPC_TIDR | 64 + PPC | KVM_REG_PPC_PSSCR | 64 ++ PPC | KVM_REG_PPC_DEC_EXPIRY | 64 + PPC | KVM_REG_PPC_TM_GPR0 | 64 + ... + PPC | KVM_REG_PPC_TM_GPR31 | 64 +diff --git a/Makefile b/Makefile +index 0a1f941899f4..ee330f5449e6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 36 ++SUBLEVEL = 37 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h +index 95ad7102b63c..82375b896be5 100644 +--- a/arch/arm64/include/asm/spinlock.h ++++ b/arch/arm64/include/asm/spinlock.h +@@ -89,8 +89,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock) + " cbnz %w1, 1f\n" + " add %w1, %w0, %3\n" + " casa %w0, %w1, %2\n" +- " and %w1, %w1, #0xffff\n" +- " eor %w1, %w1, %w0, lsr #16\n" ++ " sub %w1, %w1, %3\n" ++ " eor %w1, %w1, %w0\n" + "1:") + : "=&r" (lockval), "=&r" (tmp), "+Q" (*lock) + : "I" (1 << TICKET_SHIFT) +diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile +index c675eece389a..adce180f3ee4 100644 +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -133,4 +133,8 @@ vmlinuz.srec: vmlinuz + uzImage.bin: vmlinuz.bin FORCE + $(call if_changed,uimage,none) + +-clean-files := $(objtree)/vmlinuz $(objtree)/vmlinuz.{32,ecoff,bin,srec} ++clean-files += $(objtree)/vmlinuz ++clean-files += $(objtree)/vmlinuz.32 ++clean-files += $(objtree)/vmlinuz.ecoff ++clean-files += $(objtree)/vmlinuz.bin ++clean-files += $(objtree)/vmlinuz.srec +diff --git a/arch/mips/generic/irq.c b/arch/mips/generic/irq.c +index 394f8161e462..cb7fdaeef426 100644 +--- a/arch/mips/generic/irq.c ++++ b/arch/mips/generic/irq.c +@@ -22,10 +22,10 @@ int get_c0_fdc_int(void) + { + int mips_cpu_fdc_irq; + +- if (cpu_has_veic) +- panic("Unimplemented!"); +- else if (mips_gic_present()) ++ if (mips_gic_present()) + mips_cpu_fdc_irq = gic_get_c0_fdc_int(); ++ else if (cpu_has_veic) ++ panic("Unimplemented!"); + else if (cp0_fdc_irq >= 0) + mips_cpu_fdc_irq = MIPS_CPU_IRQ_BASE + cp0_fdc_irq; + else +@@ -38,10 +38,10 @@ int get_c0_perfcount_int(void) + { + int mips_cpu_perf_irq; + +- if (cpu_has_veic) +- panic("Unimplemented!"); +- else if (mips_gic_present()) ++ if (mips_gic_present()) + mips_cpu_perf_irq = gic_get_c0_perfcount_int(); ++ else if (cpu_has_veic) ++ panic("Unimplemented!"); + else if (cp0_perfcount_irq >= 0) + mips_cpu_perf_irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq; + else +@@ -54,10 +54,10 @@ unsigned int get_c0_compare_int(void) + { + int mips_cpu_timer_irq; + +- if (cpu_has_veic) +- panic("Unimplemented!"); +- else if (mips_gic_present()) ++ if (mips_gic_present()) + mips_cpu_timer_irq = gic_get_c0_compare_int(); ++ else if (cpu_has_veic) ++ panic("Unimplemented!"); + else + mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq; + +diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c +index 8b937300fb7f..fd26fadc8617 100644 +--- a/arch/mips/txx9/rbtx4939/setup.c ++++ b/arch/mips/txx9/rbtx4939/setup.c +@@ -186,7 +186,7 @@ static void __init rbtx4939_update_ioc_pen(void) + + #define RBTX4939_MAX_7SEGLEDS 8 + +-#if IS_ENABLED(CONFIG_LEDS_CLASS) ++#if IS_BUILTIN(CONFIG_LEDS_CLASS) + static u8 led_val[RBTX4939_MAX_7SEGLEDS]; + struct rbtx4939_led_data { + struct led_classdev cdev; +@@ -261,7 +261,7 @@ static inline void rbtx4939_led_setup(void) + + static void __rbtx4939_7segled_putc(unsigned int pos, unsigned char val) + { +-#if IS_ENABLED(CONFIG_LEDS_CLASS) ++#if IS_BUILTIN(CONFIG_LEDS_CLASS) + unsigned long flags; + local_irq_save(flags); + /* bit7: reserved for LED class */ +diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h +index 1fcfa425cefa..f326b40b7c7b 100644 +--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h ++++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h +@@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd) + + static inline pgd_t *pgd_alloc(struct mm_struct *mm) + { ++ pgd_t *pgd; ++ + if (radix_enabled()) + return radix__pgd_alloc(mm); +- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), +- pgtable_gfp_flags(mm, GFP_KERNEL)); ++ ++ pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), ++ pgtable_gfp_flags(mm, GFP_KERNEL)); ++ memset(pgd, 0, PGD_TABLE_SIZE); ++ ++ return pgd; + } + + static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) +diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h +index 61d6049f4c1e..8aaec831053a 100644 +--- a/arch/powerpc/include/uapi/asm/kvm.h ++++ b/arch/powerpc/include/uapi/asm/kvm.h +@@ -607,6 +607,8 @@ struct kvm_ppc_rmmu_info { + #define KVM_REG_PPC_TIDR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc) + #define KVM_REG_PPC_PSSCR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd) + ++#define KVM_REG_PPC_DEC_EXPIRY (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe) ++ + /* Transactional Memory checkpointed state: + * This is all GPRs, all VSX regs and a subset of SPRs + */ +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 13c9dcdcba69..d17007451f62 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -336,7 +336,7 @@ void system_reset_exception(struct pt_regs *regs) + * No debugger or crash dump registered, print logs then + * panic. + */ +- __die("System Reset", regs, SIGABRT); ++ die("System Reset", regs, SIGABRT); + + mdelay(2*MSEC_PER_SEC); /* Wait a little while for others to print */ + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); +diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c +index 2645d484e945..df9b53f40b1e 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c +@@ -1348,12 +1348,8 @@ static unsigned long resize_hpt_rehash_hpte(struct kvm_resize_hpt *resize, + } + + new_pteg = hash & new_hash_mask; +- if (vpte & HPTE_V_SECONDARY) { +- BUG_ON(~pteg != (hash & old_hash_mask)); +- new_pteg = ~new_pteg; +- } else { +- BUG_ON(pteg != (hash & old_hash_mask)); +- } ++ if (vpte & HPTE_V_SECONDARY) ++ new_pteg = ~hash & new_hash_mask; + + new_idx = new_pteg * HPTES_PER_GROUP + (idx % HPTES_PER_GROUP); + new_hptep = (__be64 *)(new->virt + (new_idx << 4)); +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index f48e3379a18a..e094dc90ff1b 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -1497,6 +1497,10 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_ARCH_COMPAT: + *val = get_reg_val(id, vcpu->arch.vcore->arch_compat); + break; ++ case KVM_REG_PPC_DEC_EXPIRY: ++ *val = get_reg_val(id, vcpu->arch.dec_expires + ++ vcpu->arch.vcore->tb_offset); ++ break; + default: + r = -EINVAL; + break; +@@ -1724,6 +1728,10 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_ARCH_COMPAT: + r = kvmppc_set_arch_compat(vcpu, set_reg_val(id, *val)); + break; ++ case KVM_REG_PPC_DEC_EXPIRY: ++ vcpu->arch.dec_expires = set_reg_val(id, *val) - ++ vcpu->arch.vcore->tb_offset; ++ break; + default: + r = -EINVAL; + break; +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 2b02d51d14d8..ecb45361095b 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -758,7 +758,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu) + + hrtimer_init(&vcpu->arch.dec_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS); + vcpu->arch.dec_timer.function = kvmppc_decrementer_wakeup; +- vcpu->arch.dec_expires = ~(u64)0; ++ vcpu->arch.dec_expires = get_tb(); + + #ifdef CONFIG_KVM_EXIT_TIMING + mutex_init(&vcpu->arch.exit_timing_lock); +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index a81279249bfb..9fead0796364 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -546,7 +546,7 @@ static int numa_setup_cpu(unsigned long lcpu) + nid = of_node_to_nid_single(cpu); + + out_present: +- if (nid < 0 || !node_online(nid)) ++ if (nid < 0 || !node_possible(nid)) + nid = first_online_node; + + map_cpu_to_node(lcpu, nid); +@@ -887,6 +887,32 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn) + NODE_DATA(nid)->node_spanned_pages = spanned_pages; + } + ++static void __init find_possible_nodes(void) ++{ ++ struct device_node *rtas; ++ u32 numnodes, i; ++ ++ if (min_common_depth <= 0) ++ return; ++ ++ rtas = of_find_node_by_path("/rtas"); ++ if (!rtas) ++ return; ++ ++ if (of_property_read_u32_index(rtas, ++ "ibm,max-associativity-domains", ++ min_common_depth, &numnodes)) ++ goto out; ++ ++ for (i = 0; i < numnodes; i++) { ++ if (!node_possible(i)) ++ node_set(i, node_possible_map); ++ } ++ ++out: ++ of_node_put(rtas); ++} ++ + void __init initmem_init(void) + { + int nid, cpu; +@@ -900,12 +926,15 @@ void __init initmem_init(void) + memblock_dump_all(); + + /* +- * Reduce the possible NUMA nodes to the online NUMA nodes, +- * since we do not support node hotplug. This ensures that we +- * lower the maximum NUMA node ID to what is actually present. ++ * Modify the set of possible NUMA nodes to reflect information ++ * available about the set of online nodes, and the set of nodes ++ * that we expect to make use of for this platform's affinity ++ * calculations. + */ + nodes_and(node_possible_map, node_possible_map, node_online_map); + ++ find_possible_nodes(); ++ + for_each_online_node(nid) { + unsigned long start_pfn, end_pfn; + +@@ -1246,6 +1275,40 @@ static long vphn_get_associativity(unsigned long cpu, + return rc; + } + ++static inline int find_and_online_cpu_nid(int cpu) ++{ ++ __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0}; ++ int new_nid; ++ ++ /* Use associativity from first thread for all siblings */ ++ vphn_get_associativity(cpu, associativity); ++ new_nid = associativity_to_nid(associativity); ++ if (new_nid < 0 || !node_possible(new_nid)) ++ new_nid = first_online_node; ++ ++ if (NODE_DATA(new_nid) == NULL) { ++#ifdef CONFIG_MEMORY_HOTPLUG ++ /* ++ * Need to ensure that NODE_DATA is initialized for a node from ++ * available memory (see memblock_alloc_try_nid). If unable to ++ * init the node, then default to nearest node that has memory ++ * installed. ++ */ ++ if (try_online_node(new_nid)) ++ new_nid = first_online_node; ++#else ++ /* ++ * Default to using the nearest node that has memory installed. ++ * Otherwise, it would be necessary to patch the kernel MM code ++ * to deal with more memoryless-node error conditions. ++ */ ++ new_nid = first_online_node; ++#endif ++ } ++ ++ return new_nid; ++} ++ + /* + * Update the CPU maps and sysfs entries for a single CPU when its NUMA + * characteristics change. This function doesn't perform any locking and is +@@ -1313,7 +1376,6 @@ int numa_update_cpu_topology(bool cpus_locked) + { + unsigned int cpu, sibling, changed = 0; + struct topology_update_data *updates, *ud; +- __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0}; + cpumask_t updated_cpus; + struct device *dev; + int weight, new_nid, i = 0; +@@ -1348,11 +1410,7 @@ int numa_update_cpu_topology(bool cpus_locked) + continue; + } + +- /* Use associativity from first thread for all siblings */ +- vphn_get_associativity(cpu, associativity); +- new_nid = associativity_to_nid(associativity); +- if (new_nid < 0 || !node_online(new_nid)) +- new_nid = first_online_node; ++ new_nid = find_and_online_cpu_nid(cpu); + + if (new_nid == numa_cpu_lookup_table[cpu]) { + cpumask_andnot(&cpu_associativity_changes_mask, +diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c +index b150f4deaccf..6914b289c86b 100644 +--- a/arch/powerpc/platforms/powernv/opal-imc.c ++++ b/arch/powerpc/platforms/powernv/opal-imc.c +@@ -126,9 +126,11 @@ static void disable_nest_pmu_counters(void) + const struct cpumask *l_cpumask; + + get_online_cpus(); +- for_each_online_node(nid) { ++ for_each_node_with_cpus(nid) { + l_cpumask = cpumask_of_node(nid); +- cpu = cpumask_first(l_cpumask); ++ cpu = cpumask_first_and(l_cpumask, cpu_online_mask); ++ if (cpu >= nr_cpu_ids) ++ continue; + opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST, + get_hard_smp_processor_id(cpu)); + } +diff --git a/arch/s390/include/asm/eadm.h b/arch/s390/include/asm/eadm.h +index eb5323161f11..bb63b2afdf6f 100644 +--- a/arch/s390/include/asm/eadm.h ++++ b/arch/s390/include/asm/eadm.h +@@ -4,7 +4,7 @@ + + #include <linux/types.h> + #include <linux/device.h> +-#include <linux/blkdev.h> ++#include <linux/blk_types.h> + + struct arqb { + u64 data; +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 0fa3a788dd20..0bce918db11a 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -601,7 +601,7 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap) + case KVM_CAP_S390_GS: + r = -EINVAL; + mutex_lock(&kvm->lock); +- if (atomic_read(&kvm->online_vcpus)) { ++ if (kvm->created_vcpus) { + r = -EBUSY; + } else if (test_facility(133)) { + set_kvm_facility(kvm->arch.model.fac_mask, 133); +@@ -1121,7 +1121,7 @@ static int kvm_s390_set_processor_feat(struct kvm *kvm, + return -EINVAL; + + mutex_lock(&kvm->lock); +- if (!atomic_read(&kvm->online_vcpus)) { ++ if (!kvm->created_vcpus) { + bitmap_copy(kvm->arch.cpu_feat, (unsigned long *) data.feat, + KVM_S390_VM_CPU_FEAT_NR_BITS); + ret = 0; +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index b18b5652e5c5..a74204db759b 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -31,7 +31,11 @@ struct vsie_page { + * the same offset as that in struct sie_page! + */ + struct mcck_volatile_info mcck_info; /* 0x0200 */ +- /* the pinned originial scb */ ++ /* ++ * The pinned original scb. Be aware that other VCPUs can modify ++ * it while we read from it. Values that are used for conditions or ++ * are reused conditionally, should be accessed via READ_ONCE. ++ */ + struct kvm_s390_sie_block *scb_o; /* 0x0218 */ + /* the shadow gmap in use by the vsie_page */ + struct gmap *gmap; /* 0x0220 */ +@@ -143,12 +147,13 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; +- u32 crycb_addr = scb_o->crycbd & 0x7ffffff8U; ++ const uint32_t crycbd_o = READ_ONCE(scb_o->crycbd); ++ const u32 crycb_addr = crycbd_o & 0x7ffffff8U; + unsigned long *b1, *b2; + u8 ecb3_flags; + + scb_s->crycbd = 0; +- if (!(scb_o->crycbd & vcpu->arch.sie_block->crycbd & CRYCB_FORMAT1)) ++ if (!(crycbd_o & vcpu->arch.sie_block->crycbd & CRYCB_FORMAT1)) + return 0; + /* format-1 is supported with message-security-assist extension 3 */ + if (!test_kvm_facility(vcpu->kvm, 76)) +@@ -186,12 +191,15 @@ static void prepare_ibc(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; ++ /* READ_ONCE does not work on bitfields - use a temporary variable */ ++ const uint32_t __new_ibc = scb_o->ibc; ++ const uint32_t new_ibc = READ_ONCE(__new_ibc) & 0x0fffU; + __u64 min_ibc = (sclp.ibc >> 16) & 0x0fffU; + + scb_s->ibc = 0; + /* ibc installed in g2 and requested for g3 */ +- if (vcpu->kvm->arch.model.ibc && (scb_o->ibc & 0x0fffU)) { +- scb_s->ibc = scb_o->ibc & 0x0fffU; ++ if (vcpu->kvm->arch.model.ibc && new_ibc) { ++ scb_s->ibc = new_ibc; + /* takte care of the minimum ibc level of the machine */ + if (scb_s->ibc < min_ibc) + scb_s->ibc = min_ibc; +@@ -256,6 +264,10 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; ++ /* READ_ONCE does not work on bitfields - use a temporary variable */ ++ const uint32_t __new_prefix = scb_o->prefix; ++ const uint32_t new_prefix = READ_ONCE(__new_prefix); ++ const bool wants_tx = READ_ONCE(scb_o->ecb) & ECB_TE; + bool had_tx = scb_s->ecb & ECB_TE; + unsigned long new_mso = 0; + int rc; +@@ -302,14 +314,14 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->icpua = scb_o->icpua; + + if (!(atomic_read(&scb_s->cpuflags) & CPUSTAT_SM)) +- new_mso = scb_o->mso & 0xfffffffffff00000UL; ++ new_mso = READ_ONCE(scb_o->mso) & 0xfffffffffff00000UL; + /* if the hva of the prefix changes, we have to remap the prefix */ +- if (scb_s->mso != new_mso || scb_s->prefix != scb_o->prefix) ++ if (scb_s->mso != new_mso || scb_s->prefix != new_prefix) + prefix_unmapped(vsie_page); + /* SIE will do mso/msl validity and exception checks for us */ + scb_s->msl = scb_o->msl & 0xfffffffffff00000UL; + scb_s->mso = new_mso; +- scb_s->prefix = scb_o->prefix; ++ scb_s->prefix = new_prefix; + + /* We have to definetly flush the tlb if this scb never ran */ + if (scb_s->ihcpu != 0xffffU) +@@ -321,11 +333,11 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_ESOP)) + scb_s->ecb |= scb_o->ecb & ECB_HOSTPROTINT; + /* transactional execution */ +- if (test_kvm_facility(vcpu->kvm, 73)) { ++ if (test_kvm_facility(vcpu->kvm, 73) && wants_tx) { + /* remap the prefix is tx is toggled on */ +- if ((scb_o->ecb & ECB_TE) && !had_tx) ++ if (!had_tx) + prefix_unmapped(vsie_page); +- scb_s->ecb |= scb_o->ecb & ECB_TE; ++ scb_s->ecb |= ECB_TE; + } + /* SIMD */ + if (test_kvm_facility(vcpu->kvm, 129)) { +@@ -544,9 +556,9 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + gpa_t gpa; + int rc = 0; + +- gpa = scb_o->scaol & ~0xfUL; ++ gpa = READ_ONCE(scb_o->scaol) & ~0xfUL; + if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_64BSCAO)) +- gpa |= (u64) scb_o->scaoh << 32; ++ gpa |= (u64) READ_ONCE(scb_o->scaoh) << 32; + if (gpa) { + if (!(gpa & ~0x1fffUL)) + rc = set_validity_icpt(scb_s, 0x0038U); +@@ -566,7 +578,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->scaol = (u32)(u64)hpa; + } + +- gpa = scb_o->itdba & ~0xffUL; ++ gpa = READ_ONCE(scb_o->itdba) & ~0xffUL; + if (gpa && (scb_s->ecb & ECB_TE)) { + if (!(gpa & ~0x1fffU)) { + rc = set_validity_icpt(scb_s, 0x0080U); +@@ -581,7 +593,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->itdba = hpa; + } + +- gpa = scb_o->gvrd & ~0x1ffUL; ++ gpa = READ_ONCE(scb_o->gvrd) & ~0x1ffUL; + if (gpa && (scb_s->eca & ECA_VX) && !(scb_s->ecd & ECD_HOSTREGMGMT)) { + if (!(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x1310U); +@@ -599,7 +611,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->gvrd = hpa; + } + +- gpa = scb_o->riccbd & ~0x3fUL; ++ gpa = READ_ONCE(scb_o->riccbd) & ~0x3fUL; + if (gpa && (scb_s->ecb3 & ECB3_RI)) { + if (!(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x0043U); +@@ -617,8 +629,8 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + if ((scb_s->ecb & ECB_GS) && !(scb_s->ecd & ECD_HOSTREGMGMT)) { + unsigned long sdnxc; + +- gpa = scb_o->sdnxo & ~0xfUL; +- sdnxc = scb_o->sdnxo & 0xfUL; ++ gpa = READ_ONCE(scb_o->sdnxo) & ~0xfUL; ++ sdnxc = READ_ONCE(scb_o->sdnxo) & 0xfUL; + if (!gpa || !(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x10b0U); + goto unpin; +@@ -785,7 +797,7 @@ static void retry_vsie_icpt(struct vsie_page *vsie_page) + static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; +- __u32 fac = vsie_page->scb_o->fac & 0x7ffffff8U; ++ __u32 fac = READ_ONCE(vsie_page->scb_o->fac) & 0x7ffffff8U; + + if (fac && test_kvm_facility(vcpu->kvm, 7)) { + retry_vsie_icpt(vsie_page); +diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h +index fd9d9bac7cfa..79c3bdaaa0b4 100644 +--- a/arch/sparc/include/asm/pgtable_64.h ++++ b/arch/sparc/include/asm/pgtable_64.h +@@ -980,7 +980,7 @@ void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr, + pmd_t *pmd); + + #define __HAVE_ARCH_PMDP_INVALIDATE +-extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, ++extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + pmd_t *pmdp); + + #define __HAVE_ARCH_PGTABLE_DEPOSIT +diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c +index 4ae86bc0d35c..847ddffbf38a 100644 +--- a/arch/sparc/mm/tlb.c ++++ b/arch/sparc/mm/tlb.c +@@ -219,17 +219,28 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, + } + } + ++static inline pmd_t pmdp_establish(struct vm_area_struct *vma, ++ unsigned long address, pmd_t *pmdp, pmd_t pmd) ++{ ++ pmd_t old; ++ ++ do { ++ old = *pmdp; ++ } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd); ++ ++ return old; ++} ++ + /* + * This routine is only called when splitting a THP + */ +-void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, ++pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + pmd_t *pmdp) + { +- pmd_t entry = *pmdp; +- +- pmd_val(entry) &= ~_PAGE_VALID; ++ pmd_t old, entry; + +- set_pmd_at(vma->vm_mm, address, pmdp, entry); ++ entry = __pmd(pmd_val(*pmdp) & ~_PAGE_VALID); ++ old = pmdp_establish(vma, address, pmdp, entry); + flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE); + + /* +@@ -240,6 +251,8 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + if ((pmd_val(entry) & _PAGE_PMD_HUGE) && + !is_huge_zero_page(pmd_page(entry))) + (vma->vm_mm)->context.thp_pte_count--; ++ ++ return old; + } + + void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, +diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c +index a0b86cf486e0..2e9d58cc371e 100644 +--- a/arch/x86/hyperv/hv_init.c ++++ b/arch/x86/hyperv/hv_init.c +@@ -110,12 +110,19 @@ static int hv_cpu_init(unsigned int cpu) + */ + void hyperv_init(void) + { +- u64 guest_id; ++ u64 guest_id, required_msrs; + union hv_x64_msr_hypercall_contents hypercall_msr; + + if (x86_hyper_type != X86_HYPER_MS_HYPERV) + return; + ++ /* Absolutely required MSRs */ ++ required_msrs = HV_X64_MSR_HYPERCALL_AVAILABLE | ++ HV_X64_MSR_VP_INDEX_AVAILABLE; ++ ++ if ((ms_hyperv.features & required_msrs) != required_msrs) ++ return; ++ + /* Allocate percpu VP index */ + hv_vp_index = kmalloc_array(num_possible_cpus(), sizeof(*hv_vp_index), + GFP_KERNEL); +diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c +index 9cc9e1c1e2db..56c9ebac946f 100644 +--- a/arch/x86/hyperv/mmu.c ++++ b/arch/x86/hyperv/mmu.c +@@ -137,7 +137,12 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus, + } + + if (info->mm) { ++ /* ++ * AddressSpace argument must match the CR3 with PCID bits ++ * stripped out. ++ */ + flush->address_space = virt_to_phys(info->mm->pgd); ++ flush->address_space &= CR3_ADDR_MASK; + flush->flags = 0; + } else { + flush->address_space = 0; +@@ -219,7 +224,12 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus, + } + + if (info->mm) { ++ /* ++ * AddressSpace argument must match the CR3 with PCID bits ++ * stripped out. ++ */ + flush->address_space = virt_to_phys(info->mm->pgd); ++ flush->address_space &= CR3_ADDR_MASK; + flush->flags = 0; + } else { + flush->address_space = 0; +@@ -278,8 +288,6 @@ void hyperv_setup_mmu_ops(void) + if (!(ms_hyperv.hints & HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED)) + return; + +- setup_clear_cpu_cap(X86_FEATURE_PCID); +- + if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED)) { + pr_info("Using hypercall for remote TLB flush\n"); + pv_mmu_ops.flush_tlb_others = hyperv_flush_tlb_others; +diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h +index c8376b40e882..5cdcdbd4d892 100644 +--- a/arch/x86/include/asm/i8259.h ++++ b/arch/x86/include/asm/i8259.h +@@ -69,6 +69,11 @@ struct legacy_pic { + extern struct legacy_pic *legacy_pic; + extern struct legacy_pic null_legacy_pic; + ++static inline bool has_legacy_pic(void) ++{ ++ return legacy_pic != &null_legacy_pic; ++} ++ + static inline int nr_legacy_irqs(void) + { + return legacy_pic->nr_legacy_irqs; +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 9c2a002d9297..6dda3595acf8 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -215,6 +215,10 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end) + apic_id = processor->local_apic_id; + enabled = processor->lapic_flags & ACPI_MADT_ENABLED; + ++ /* Ignore invalid ID */ ++ if (apic_id == 0xffffffff) ++ return 0; ++ + /* + * We need to register disabled CPU as well to permit + * counting disabled CPUs. This allows us to size +diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c +index c0b694810ff4..02cfc615e3fb 100644 +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -1140,16 +1140,25 @@ static void __init decode_gam_rng_tbl(unsigned long ptr) + + uv_gre_table = gre; + for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) { ++ unsigned long size = ((unsigned long)(gre->limit - lgre) ++ << UV_GAM_RANGE_SHFT); ++ int order = 0; ++ char suffix[] = " KMGTPE"; ++ ++ while (size > 9999 && order < sizeof(suffix)) { ++ size /= 1024; ++ order++; ++ } ++ + if (!index) { + pr_info("UV: GAM Range Table...\n"); + pr_info("UV: # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN"); + } +- pr_info("UV: %2d: 0x%014lx-0x%014lx %5luG %3d %04x %02x %02x\n", ++ pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d %04x %02x %02x\n", + index++, + (unsigned long)lgre << UV_GAM_RANGE_SHFT, + (unsigned long)gre->limit << UV_GAM_RANGE_SHFT, +- ((unsigned long)(gre->limit - lgre)) >> +- (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */ ++ size, suffix[order], + gre->type, gre->nasid, gre->sockid, gre->pnode); + + lgre = gre->limit; +diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c +index afbecff161d1..a2d8a3908670 100644 +--- a/arch/x86/kernel/dumpstack.c ++++ b/arch/x86/kernel/dumpstack.c +@@ -109,7 +109,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, + struct stack_info stack_info = {0}; + unsigned long visit_mask = 0; + int graph_idx = 0; +- bool partial; ++ bool partial = false; + + printk("%sCall Trace:\n", log_lvl); + +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index 47506567435e..0bf06fa3027e 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -25,6 +25,7 @@ + #include <asm/geode.h> + #include <asm/apic.h> + #include <asm/intel-family.h> ++#include <asm/i8259.h> + + unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */ + EXPORT_SYMBOL(cpu_khz); +@@ -316,7 +317,7 @@ static unsigned long calc_hpet_ref(u64 deltatsc, u64 hpet1, u64 hpet2) + hpet2 -= hpet1; + tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD)); + do_div(tmp, 1000000); +- do_div(deltatsc, tmp); ++ deltatsc = div64_u64(deltatsc, tmp); + + return (unsigned long) deltatsc; + } +@@ -363,6 +364,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin) + unsigned long tscmin, tscmax; + int pitcnt; + ++ if (!has_legacy_pic()) { ++ /* ++ * Relies on tsc_early_delay_calibrate() to have given us semi ++ * usable udelay(), wait for the same 50ms we would have with ++ * the PIT loop below. ++ */ ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ return ULONG_MAX; ++ } ++ + /* Set the Gate high, disable speaker */ + outb((inb(0x61) & ~0x02) | 0x01, 0x61); + +@@ -487,6 +502,9 @@ static unsigned long quick_pit_calibrate(void) + u64 tsc, delta; + unsigned long d1, d2; + ++ if (!has_legacy_pic()) ++ return 0; ++ + /* Set the Gate high, disable speaker */ + outb((inb(0x61) & ~0x02) | 0x01, 0x61); + +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index f438e0c4aa8c..43bbece92632 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3019,7 +3019,7 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn) + return RET_PF_RETRY; + } + +- return RET_PF_EMULATE; ++ return -EFAULT; + } + + static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index ae4803b213d0..bdd84ce4491e 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6765,7 +6765,21 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu) + if (!is_guest_mode(vcpu) && + !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) { + trace_kvm_fast_mmio(gpa); +- return kvm_skip_emulated_instruction(vcpu); ++ /* ++ * Doing kvm_skip_emulated_instruction() depends on undefined ++ * behavior: Intel's manual doesn't mandate ++ * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG ++ * occurs and while on real hardware it was observed to be set, ++ * other hypervisors (namely Hyper-V) don't set it, we end up ++ * advancing IP with some random value. Disable fast mmio when ++ * running nested and keep it for real hardware in hope that ++ * VM_EXIT_INSTRUCTION_LEN will always be set correctly. ++ */ ++ if (!static_cpu_has(X86_FEATURE_HYPERVISOR)) ++ return kvm_skip_emulated_instruction(vcpu); ++ else ++ return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP, ++ NULL, 0) == EMULATE_DONE; + } + + ret = kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b9afb4784d12..3b2c3aa2cd07 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -4225,13 +4225,14 @@ long kvm_arch_vm_ioctl(struct file *filp, + mutex_unlock(&kvm->lock); + break; + case KVM_XEN_HVM_CONFIG: { ++ struct kvm_xen_hvm_config xhc; + r = -EFAULT; +- if (copy_from_user(&kvm->arch.xen_hvm_config, argp, +- sizeof(struct kvm_xen_hvm_config))) ++ if (copy_from_user(&xhc, argp, sizeof(xhc))) + goto out; + r = -EINVAL; +- if (kvm->arch.xen_hvm_config.flags) ++ if (xhc.flags) + goto out; ++ memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc)); + r = 0; + break; + } +@@ -5698,7 +5699,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, + * handle watchpoints yet, those would be handled in + * the emulate_ops. + */ +- if (kvm_vcpu_check_breakpoint(vcpu, &r)) ++ if (!(emulation_type & EMULTYPE_SKIP) && ++ kvm_vcpu_check_breakpoint(vcpu, &r)) + return r; + + ctxt->interruptibility = 0; +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index fe85d1204db8..642357aff216 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -1180,8 +1180,7 @@ void __init mem_init(void) + after_bootmem = 1; + + /* Register memory areas for /proc/kcore */ +- kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, +- PAGE_SIZE, KCORE_OTHER); ++ kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER); + + mem_init_print_info(NULL); + } +diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c +index c35fdb585c68..afc4ed7b1578 100644 +--- a/arch/x86/power/hibernate_32.c ++++ b/arch/x86/power/hibernate_32.c +@@ -145,7 +145,7 @@ static inline void resume_init_first_level_page_table(pgd_t *pg_dir) + #endif + } + +-int swsusp_arch_resume(void) ++asmlinkage int swsusp_arch_resume(void) + { + int error; + +diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c +index f910c514438f..0ef5e5204968 100644 +--- a/arch/x86/power/hibernate_64.c ++++ b/arch/x86/power/hibernate_64.c +@@ -174,7 +174,7 @@ static int relocate_restore_code(void) + return 0; + } + +-int swsusp_arch_resume(void) ++asmlinkage int swsusp_arch_resume(void) + { + int error; + +diff --git a/block/bio.c b/block/bio.c +index dbaa82c967f4..90f19d7df66c 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1893,7 +1893,7 @@ struct bio *bio_split(struct bio *bio, int sectors, + bio_advance(bio, split->bi_iter.bi_size); + + if (bio_flagged(bio, BIO_TRACE_COMPLETION)) +- bio_set_flag(bio, BIO_TRACE_COMPLETION); ++ bio_set_flag(split, BIO_TRACE_COMPLETION); + + return split; + } +diff --git a/block/blk-core.c b/block/blk-core.c +index c01f4907dbbc..1feeb1a8aad9 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -3065,6 +3065,8 @@ void blk_rq_bio_prep(struct request_queue *q, struct request *rq, + { + if (bio_has_data(bio)) + rq->nr_phys_segments = bio_phys_segments(q, bio); ++ else if (bio_op(bio) == REQ_OP_DISCARD) ++ rq->nr_phys_segments = 1; + + rq->__data_len = bio->bi_iter.bi_size; + rq->bio = rq->biotail = bio; +diff --git a/block/blk-merge.c b/block/blk-merge.c +index f5dedd57dff6..8d60a5bbcef9 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -551,6 +551,24 @@ static bool req_no_special_merge(struct request *req) + return !q->mq_ops && req->special; + } + ++static bool req_attempt_discard_merge(struct request_queue *q, struct request *req, ++ struct request *next) ++{ ++ unsigned short segments = blk_rq_nr_discard_segments(req); ++ ++ if (segments >= queue_max_discard_segments(q)) ++ goto no_merge; ++ if (blk_rq_sectors(req) + bio_sectors(next->bio) > ++ blk_rq_get_max_sectors(req, blk_rq_pos(req))) ++ goto no_merge; ++ ++ req->nr_phys_segments = segments + blk_rq_nr_discard_segments(next); ++ return true; ++no_merge: ++ req_set_nomerge(q, req); ++ return false; ++} ++ + static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + struct request *next) + { +@@ -684,9 +702,13 @@ static struct request *attempt_merge(struct request_queue *q, + * If we are allowed to merge, then append bio list + * from next to rq and release next. merge_requests_fn + * will have updated segment counts, update sector +- * counts here. ++ * counts here. Handle DISCARDs separately, as they ++ * have separate settings. + */ +- if (!ll_merge_requests_fn(q, req, next)) ++ if (req_op(req) == REQ_OP_DISCARD) { ++ if (!req_attempt_discard_merge(q, req, next)) ++ return NULL; ++ } else if (!ll_merge_requests_fn(q, req, next)) + return NULL; + + /* +@@ -716,7 +738,8 @@ static struct request *attempt_merge(struct request_queue *q, + + req->__data_len += blk_rq_bytes(next); + +- elv_merge_requests(q, req, next); ++ if (req_op(req) != REQ_OP_DISCARD) ++ elv_merge_requests(q, req, next); + + /* + * 'next' is going away, so update stats accordingly +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index de294d775acf..d95439154556 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -704,7 +704,11 @@ static ssize_t blk_mq_debugfs_write(struct file *file, const char __user *buf, + const struct blk_mq_debugfs_attr *attr = m->private; + void *data = d_inode(file->f_path.dentry->d_parent)->i_private; + +- if (!attr->write) ++ /* ++ * Attributes that only implement .seq_ops are read-only and 'attr' is ++ * the same with 'data' in this case. ++ */ ++ if (attr == data || !attr->write) + return -EPERM; + + return attr->write(data, buf, count, ppos); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 6f899669cbdd..007f96611364 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1143,9 +1143,27 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx) + /* + * We should be running this queue from one of the CPUs that + * are mapped to it. ++ * ++ * There are at least two related races now between setting ++ * hctx->next_cpu from blk_mq_hctx_next_cpu() and running ++ * __blk_mq_run_hw_queue(): ++ * ++ * - hctx->next_cpu is found offline in blk_mq_hctx_next_cpu(), ++ * but later it becomes online, then this warning is harmless ++ * at all ++ * ++ * - hctx->next_cpu is found online in blk_mq_hctx_next_cpu(), ++ * but later it becomes offline, then the warning can't be ++ * triggered, and we depend on blk-mq timeout handler to ++ * handle dispatched requests to this hctx + */ +- WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) && +- cpu_online(hctx->next_cpu)); ++ if (!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) && ++ cpu_online(hctx->next_cpu)) { ++ printk(KERN_WARNING "run queue from wrong CPU %d, hctx %s\n", ++ raw_smp_processor_id(), ++ cpumask_empty(hctx->cpumask) ? "inactive": "active"); ++ dump_stack(); ++ } + + /* + * We can't run the queue inline with ints disabled. Ensure that +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 032ae44710e5..a2be3fd2c72b 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -465,6 +465,8 @@ static int acpi_lpss_create_device(struct acpi_device *adev, + acpi_dev_free_resource_list(&resource_list); + + if (!pdata->mmio_base) { ++ /* Avoid acpi_bus_attach() instantiating a pdev for this dev. */ ++ adev->pnp.type.platform_id = 0; + /* Skip the device, but continue the namespace scan. */ + ret = 0; + goto err_out; +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index b6d58cc58f5f..f0348e388d01 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -146,6 +146,12 @@ int acpi_bus_get_status(struct acpi_device *device) + return 0; + } + ++ /* Battery devices must have their deps met before calling _STA */ ++ if (acpi_device_is_battery(device) && device->dep_unmet) { ++ acpi_set_device_status(device, 0); ++ return 0; ++ } ++ + status = acpi_bus_get_status_handle(device->handle, &sta); + if (ACPI_FAILURE(status)) + return -ENODEV; +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 6adcda057b36..58bc28aff3aa 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1927,6 +1927,9 @@ static int acpi_ec_suspend_noirq(struct device *dev) + ec->reference_count >= 1) + acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE); + ++ if (acpi_sleep_no_ec_events()) ++ acpi_ec_enter_noirq(ec); ++ + return 0; + } + +@@ -1934,6 +1937,9 @@ static int acpi_ec_resume_noirq(struct device *dev) + { + struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev)); + ++ if (acpi_sleep_no_ec_events()) ++ acpi_ec_leave_noirq(ec); ++ + if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) && + ec->reference_count >= 1) + acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE); +diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c +index 18b72eec3507..c7cf48ad5cb9 100644 +--- a/drivers/acpi/processor_perflib.c ++++ b/drivers/acpi/processor_perflib.c +@@ -159,7 +159,7 @@ void acpi_processor_ppc_has_changed(struct acpi_processor *pr, int event_flag) + { + int ret; + +- if (ignore_ppc) { ++ if (ignore_ppc || !pr->performance) { + /* + * Only when it is notification event, the _OST object + * will be evaluated. Otherwise it is skipped. +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 2f2f50322ffb..c0984d33c4c8 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1568,6 +1568,8 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle, + device_initialize(&device->dev); + dev_set_uevent_suppress(&device->dev, true); + acpi_init_coherency(device); ++ /* Assume there are unmet deps until acpi_device_dep_initialize() runs */ ++ device->dep_unmet = 1; + } + + void acpi_device_add_finalize(struct acpi_device *device) +@@ -1591,6 +1593,14 @@ static int acpi_add_single_object(struct acpi_device **child, + } + + acpi_init_device_object(device, handle, type, sta); ++ /* ++ * For ACPI_BUS_TYPE_DEVICE getting the status is delayed till here so ++ * that we can call acpi_bus_get_status() and use its quirk handling. ++ * Note this must be done before the get power-/wakeup_dev-flags calls. ++ */ ++ if (type == ACPI_BUS_TYPE_DEVICE) ++ acpi_bus_get_status(device); ++ + acpi_bus_get_power_flags(device); + acpi_bus_get_wakeup_device_flags(device); + +@@ -1663,9 +1673,11 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type, + return -ENODEV; + + *type = ACPI_BUS_TYPE_DEVICE; +- status = acpi_bus_get_status_handle(handle, sta); +- if (ACPI_FAILURE(status)) +- *sta = 0; ++ /* ++ * acpi_add_single_object updates this once we've an acpi_device ++ * so that acpi_bus_get_status' quirk handling can be used. ++ */ ++ *sta = 0; + break; + case ACPI_TYPE_PROCESSOR: + *type = ACPI_BUS_TYPE_PROCESSOR; +@@ -1763,6 +1775,8 @@ static void acpi_device_dep_initialize(struct acpi_device *adev) + acpi_status status; + int i; + ++ adev->dep_unmet = 0; ++ + if (!acpi_has_method(adev->handle, "_DEP")) + return; + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 70f8904f46a3..b3b78079aa9f 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2206,6 +2206,38 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, + return 0; + } + ++static int genpd_iterate_idle_states(struct device_node *dn, ++ struct genpd_power_state *states) ++{ ++ int ret; ++ struct of_phandle_iterator it; ++ struct device_node *np; ++ int i = 0; ++ ++ ret = of_count_phandle_with_args(dn, "domain-idle-states", NULL); ++ if (ret <= 0) ++ return ret; ++ ++ /* Loop over the phandles until all the requested entry is found */ ++ of_for_each_phandle(&it, ret, dn, "domain-idle-states", NULL, 0) { ++ np = it.node; ++ if (!of_match_node(idle_state_match, np)) ++ continue; ++ if (states) { ++ ret = genpd_parse_state(&states[i], np); ++ if (ret) { ++ pr_err("Parsing idle state node %pOF failed with err %d\n", ++ np, ret); ++ of_node_put(np); ++ return ret; ++ } ++ } ++ i++; ++ } ++ ++ return i; ++} ++ + /** + * of_genpd_parse_idle_states: Return array of idle states for the genpd. + * +@@ -2215,49 +2247,31 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, + * + * Returns the device states parsed from the OF node. The memory for the states + * is allocated by this function and is the responsibility of the caller to +- * free the memory after use. ++ * free the memory after use. If no domain idle states is found it returns ++ * -EINVAL and in case of errors, a negative error code. + */ + int of_genpd_parse_idle_states(struct device_node *dn, + struct genpd_power_state **states, int *n) + { + struct genpd_power_state *st; +- struct device_node *np; +- int i = 0; +- int err, ret; +- int count; +- struct of_phandle_iterator it; +- const struct of_device_id *match_id; ++ int ret; + +- count = of_count_phandle_with_args(dn, "domain-idle-states", NULL); +- if (count <= 0) +- return -EINVAL; ++ ret = genpd_iterate_idle_states(dn, NULL); ++ if (ret <= 0) ++ return ret < 0 ? ret : -EINVAL; + +- st = kcalloc(count, sizeof(*st), GFP_KERNEL); ++ st = kcalloc(ret, sizeof(*st), GFP_KERNEL); + if (!st) + return -ENOMEM; + +- /* Loop over the phandles until all the requested entry is found */ +- of_for_each_phandle(&it, err, dn, "domain-idle-states", NULL, 0) { +- np = it.node; +- match_id = of_match_node(idle_state_match, np); +- if (!match_id) +- continue; +- ret = genpd_parse_state(&st[i++], np); +- if (ret) { +- pr_err +- ("Parsing idle state node %pOF failed with err %d\n", +- np, ret); +- of_node_put(np); +- kfree(st); +- return ret; +- } ++ ret = genpd_iterate_idle_states(dn, st); ++ if (ret <= 0) { ++ kfree(st); ++ return ret < 0 ? ret : -EINVAL; + } + +- *n = i; +- if (!i) +- kfree(st); +- else +- *states = st; ++ *states = st; ++ *n = ret; + + return 0; + } +diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c +index ae0429827f31..67c50738834b 100644 +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -323,7 +323,8 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq) + return; + + if (device_may_wakeup(wirq->dev)) { +- if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && ++ !pm_runtime_status_suspended(wirq->dev)) + enable_irq(wirq->irq); + + enable_irq_wake(wirq->irq); +@@ -345,7 +346,8 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq) + if (device_may_wakeup(wirq->dev)) { + disable_irq_wake(wirq->irq); + +- if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && ++ !pm_runtime_status_suspended(wirq->dev)) + disable_irq_nosync(wirq->irq); + } + } +diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c +index b338a4becbf8..845efa0f724f 100644 +--- a/drivers/char/ipmi/ipmi_powernv.c ++++ b/drivers/char/ipmi/ipmi_powernv.c +@@ -251,8 +251,9 @@ static int ipmi_powernv_probe(struct platform_device *pdev) + ipmi->irq = opal_event_request(prop); + } + +- if (request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH, +- "opal-ipmi", ipmi)) { ++ rc = request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH, ++ "opal-ipmi", ipmi); ++ if (rc) { + dev_warn(dev, "Unable to request irq\n"); + goto err_dispose; + } +diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c +index 21bffdcb2f20..557ed25b42e3 100644 +--- a/drivers/clocksource/timer-imx-tpm.c ++++ b/drivers/clocksource/timer-imx-tpm.c +@@ -105,7 +105,7 @@ static int tpm_set_next_event(unsigned long delta, + * of writing CNT registers which may cause the min_delta event got + * missed, so we need add a ETIME check here in case it happened. + */ +- return (int)((next - now) <= 0) ? -ETIME : 0; ++ return (int)(next - now) <= 0 ? -ETIME : 0; + } + + static int tpm_set_state_oneshot(struct clock_event_device *evt) +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 93a0e88bef76..20226d4243f2 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -779,6 +779,8 @@ static int intel_pstate_hwp_save_state(struct cpufreq_policy *policy) + return 0; + } + ++static void intel_pstate_hwp_enable(struct cpudata *cpudata); ++ + static int intel_pstate_resume(struct cpufreq_policy *policy) + { + if (!hwp_active) +@@ -786,6 +788,9 @@ static int intel_pstate_resume(struct cpufreq_policy *policy) + + mutex_lock(&intel_pstate_limits_lock); + ++ if (policy->cpu == 0) ++ intel_pstate_hwp_enable(all_cpu_data[policy->cpu]); ++ + all_cpu_data[policy->cpu]->epp_policy = 0; + intel_pstate_hwp_set(policy->cpu); + +diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig +index fe33c199fc1a..143f8bc403b9 100644 +--- a/drivers/crypto/Kconfig ++++ b/drivers/crypto/Kconfig +@@ -721,7 +721,6 @@ config CRYPTO_DEV_ARTPEC6 + select CRYPTO_HASH + select CRYPTO_SHA1 + select CRYPTO_SHA256 +- select CRYPTO_SHA384 + select CRYPTO_SHA512 + help + Enables the driver for the on-chip crypto accelerator +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c +index 8bf89267dc25..d731b413cb2c 100644 +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx) + return -ENOMEM; + + offset = (void *)&desc->buffer - (void *)desc; +- desc->buffer_size = PAGE_SIZE - offset; ++ /* ++ * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads ++ * for descriptors, even 0x10-byte ones. This can cause page faults when ++ * an IOMMU is in use and the oversized read crosses a page boundary. ++ * Work around this by always leaving at least 0x10 bytes of padding. ++ */ ++ desc->buffer_size = PAGE_SIZE - offset - 0x10; + desc->buffer_bus = bus_addr + offset; + desc->used = 0; + +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c +index 783041964439..e8db9659a36b 100644 +--- a/drivers/firmware/dmi_scan.c ++++ b/drivers/firmware/dmi_scan.c +@@ -18,7 +18,7 @@ EXPORT_SYMBOL_GPL(dmi_kobj); + * of and an antecedent to, SMBIOS, which stands for System + * Management BIOS. See further: http://www.dmtf.org/standards + */ +-static const char dmi_empty_string[] = " "; ++static const char dmi_empty_string[] = ""; + + static u32 dmi_ver __initdata; + static u32 dmi_len; +@@ -44,25 +44,21 @@ static int dmi_memdev_nr; + static const char * __init dmi_string_nosave(const struct dmi_header *dm, u8 s) + { + const u8 *bp = ((u8 *) dm) + dm->length; ++ const u8 *nsp; + + if (s) { +- s--; +- while (s > 0 && *bp) { ++ while (--s > 0 && *bp) + bp += strlen(bp) + 1; +- s--; +- } +- +- if (*bp != 0) { +- size_t len = strlen(bp)+1; +- size_t cmp_len = len > 8 ? 8 : len; + +- if (!memcmp(bp, dmi_empty_string, cmp_len)) +- return dmi_empty_string; ++ /* Strings containing only spaces are considered empty */ ++ nsp = bp; ++ while (*nsp == ' ') ++ nsp++; ++ if (*nsp != '\0') + return bp; +- } + } + +- return ""; ++ return dmi_empty_string; + } + + static const char * __init dmi_string(const struct dmi_header *dm, u8 s) +diff --git a/drivers/gpu/drm/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/drm_dp_dual_mode_helper.c +index 02a50929af67..e7f4fe2848a5 100644 +--- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c ++++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c +@@ -350,19 +350,44 @@ int drm_dp_dual_mode_set_tmds_output(enum drm_dp_dual_mode_type type, + { + uint8_t tmds_oen = enable ? 0 : DP_DUAL_MODE_TMDS_DISABLE; + ssize_t ret; ++ int retry; + + if (type < DRM_DP_DUAL_MODE_TYPE2_DVI) + return 0; + +- ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN, +- &tmds_oen, sizeof(tmds_oen)); +- if (ret) { +- DRM_DEBUG_KMS("Failed to %s TMDS output buffers\n", +- enable ? "enable" : "disable"); +- return ret; ++ /* ++ * LSPCON adapters in low-power state may ignore the first write, so ++ * read back and verify the written value a few times. ++ */ ++ for (retry = 0; retry < 3; retry++) { ++ uint8_t tmp; ++ ++ ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN, ++ &tmds_oen, sizeof(tmds_oen)); ++ if (ret) { ++ DRM_DEBUG_KMS("Failed to %s TMDS output buffers (%d attempts)\n", ++ enable ? "enable" : "disable", ++ retry + 1); ++ return ret; ++ } ++ ++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_TMDS_OEN, ++ &tmp, sizeof(tmp)); ++ if (ret) { ++ DRM_DEBUG_KMS("I2C read failed during TMDS output buffer %s (%d attempts)\n", ++ enable ? "enabling" : "disabling", ++ retry + 1); ++ return ret; ++ } ++ ++ if (tmp == tmds_oen) ++ return 0; + } + +- return 0; ++ DRM_DEBUG_KMS("I2C write value mismatch during TMDS output buffer %s\n", ++ enable ? "enabling" : "disabling"); ++ ++ return -EIO; + } + EXPORT_SYMBOL(drm_dp_dual_mode_set_tmds_output); + +diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c +index 83e88c70272a..9bf4045cd679 100644 +--- a/drivers/gpu/drm/i915/gvt/kvmgt.c ++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c +@@ -1153,7 +1153,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, + return 0; + } + +- return 0; ++ return -ENOTTY; + } + + static ssize_t +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 3f818412765c..51411894d2cd 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -3995,7 +3995,11 @@ extern void intel_display_print_error_state(struct drm_i915_error_state_buf *e, + struct intel_display_error_state *error); + + int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val); +-int sandybridge_pcode_write(struct drm_i915_private *dev_priv, u32 mbox, u32 val); ++int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, u32 mbox, ++ u32 val, int timeout_us); ++#define sandybridge_pcode_write(dev_priv, mbox, val) \ ++ sandybridge_pcode_write_timeout(dev_priv, mbox, val, 500) ++ + int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request, + u32 reply_mask, u32 reply, int timeout_base_ms); + +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index de8ca5f1dd2e..4cc9ce4b5b16 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -722,7 +722,7 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) + + err = radix_tree_insert(handles_vma, handle, vma); + if (unlikely(err)) { +- kfree(lut); ++ kmem_cache_free(eb->i915->luts, lut); + goto err_obj; + } + +diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c +index 27743be5b768..9240fa79de7c 100644 +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -704,7 +704,7 @@ static void i915_audio_component_codec_wake_override(struct device *kdev, + struct drm_i915_private *dev_priv = kdev_to_i915(kdev); + u32 tmp; + +- if (!IS_GEN9_BC(dev_priv)) ++ if (!IS_GEN9(dev_priv)) + return; + + i915_audio_component_get_power(kdev); +diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c +index 26a8dcd2c549..47ad24229c78 100644 +--- a/drivers/gpu/drm/i915/intel_cdclk.c ++++ b/drivers/gpu/drm/i915/intel_cdclk.c +@@ -1289,10 +1289,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv, + break; + } + +- /* Inform power controller of upcoming frequency change */ + mutex_lock(&dev_priv->rps.hw_lock); +- ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, +- 0x80000000); ++ /* ++ * Inform power controller of upcoming frequency change. BSpec ++ * requires us to wait up to 150usec, but that leads to timeouts; ++ * the 2ms used here is based on experiment. ++ */ ++ ret = sandybridge_pcode_write_timeout(dev_priv, ++ HSW_PCODE_DE_WRITE_FREQ_REQ, ++ 0x80000000, 2000); + mutex_unlock(&dev_priv->rps.hw_lock); + + if (ret) { +@@ -1323,8 +1328,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv, + I915_WRITE(CDCLK_CTL, val); + + mutex_lock(&dev_priv->rps.hw_lock); +- ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, +- DIV_ROUND_UP(cdclk, 25000)); ++ /* ++ * The timeout isn't specified, the 2ms used here is based on ++ * experiment. ++ * FIXME: Waiting for the request completion could be delayed until ++ * the next PCODE request based on BSpec. ++ */ ++ ret = sandybridge_pcode_write_timeout(dev_priv, ++ HSW_PCODE_DE_WRITE_FREQ_REQ, ++ DIV_ROUND_UP(cdclk, 25000), 2000); + mutex_unlock(&dev_priv->rps.hw_lock); + + if (ret) { +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 014e5c08571a..87cccb5f8c5d 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -8941,8 +8941,8 @@ int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val + return 0; + } + +-int sandybridge_pcode_write(struct drm_i915_private *dev_priv, +- u32 mbox, u32 val) ++int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, ++ u32 mbox, u32 val, int timeout_us) + { + int status; + +@@ -8965,7 +8965,7 @@ int sandybridge_pcode_write(struct drm_i915_private *dev_priv, + + if (__intel_wait_for_register_fw(dev_priv, + GEN6_PCODE_MAILBOX, GEN6_PCODE_READY, 0, +- 500, 0, NULL)) { ++ timeout_us, 0, NULL)) { + DRM_ERROR("timeout waiting for pcode write of 0x%08x to mbox %x to finish for %ps\n", + val, mbox, __builtin_return_address(0)); + return -ETIMEDOUT; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h +index 53d01fb00a8b..1dbe593e5960 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h +@@ -47,8 +47,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x584d454d, +- 0x00000756, +- 0x00000748, ++ 0x00000754, ++ 0x00000746, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -69,8 +69,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x46524550, +- 0x0000075a, + 0x00000758, ++ 0x00000756, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -91,8 +91,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x5f433249, +- 0x00000b8a, +- 0x00000a2d, ++ 0x00000b88, ++ 0x00000a2b, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -113,8 +113,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x54534554, +- 0x00000bb3, +- 0x00000b8c, ++ 0x00000bb1, ++ 0x00000b8a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -135,8 +135,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x454c4449, +- 0x00000bbf, + 0x00000bbd, ++ 0x00000bbb, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -237,19 +237,19 @@ static uint32_t gf100_pmu_data[] = { + 0x000005d3, + 0x00000003, + 0x00000002, +- 0x0000069d, ++ 0x0000069b, + 0x00040004, + 0x00000000, +- 0x000006b9, ++ 0x000006b7, + 0x00010005, + 0x00000000, +- 0x000006d6, ++ 0x000006d4, + 0x00010006, + 0x00000000, + 0x0000065b, + 0x00000007, + 0x00000000, +- 0x000006e1, ++ 0x000006df, + /* 0x03c4: memx_func_tail */ + /* 0x03c4: memx_ts_start */ + 0x00000000, +@@ -1373,432 +1373,432 @@ static uint32_t gf100_pmu_code[] = { + /* 0x065b: memx_func_wait_vblank */ + 0x9800f840, + 0x66b00016, +- 0x130bf400, ++ 0x120bf400, + 0xf40166b0, + 0x0ef4060b, + /* 0x066d: memx_func_wait_vblank_head1 */ +- 0x2077f12e, +- 0x070ef400, +-/* 0x0674: memx_func_wait_vblank_head0 */ +- 0x000877f1, +-/* 0x0678: memx_func_wait_vblank_0 */ +- 0x07c467f1, +- 0xcf0664b6, +- 0x67fd0066, +- 0xf31bf404, +-/* 0x0688: memx_func_wait_vblank_1 */ +- 0x07c467f1, +- 0xcf0664b6, +- 0x67fd0066, +- 0xf30bf404, +-/* 0x0698: memx_func_wait_vblank_fini */ +- 0xf80410b6, +-/* 0x069d: memx_func_wr32 */ +- 0x00169800, +- 0xb6011598, +- 0x60f90810, +- 0xd0fc50f9, +- 0x21f4e0fc, +- 0x0242b640, +- 0xf8e91bf4, +-/* 0x06b9: memx_func_wait */ +- 0x2c87f000, +- 0xcf0684b6, +- 0x1e980088, +- 0x011d9800, +- 0x98021c98, +- 0x10b6031b, +- 0xa321f410, +-/* 0x06d6: memx_func_delay */ +- 0x1e9800f8, +- 0x0410b600, +- 0xf87e21f4, +-/* 0x06e1: memx_func_train */ +-/* 0x06e3: memx_exec */ +- 0xf900f800, +- 0xb9d0f9e0, +- 0xb2b902c1, +-/* 0x06ed: memx_exec_next */ +- 0x00139802, +- 0xe70410b6, +- 0xe701f034, +- 0xb601e033, +- 0x30f00132, +- 0xde35980c, +- 0x12b855f9, +- 0xe41ef406, +- 0x98f10b98, +- 0xcbbbf20c, +- 0xc4b7f102, +- 0x06b4b607, +- 0xfc00bbcf, +- 0xf5e0fcd0, +- 0xf8033621, +-/* 0x0729: memx_info */ +- 0x01c67000, +-/* 0x072f: memx_info_data */ +- 0xf10e0bf4, +- 0xf103ccc7, +- 0xf40800b7, +-/* 0x073a: memx_info_train */ +- 0xc7f10b0e, +- 0xb7f10bcc, +-/* 0x0742: memx_info_send */ +- 0x21f50100, +- 0x00f80336, +-/* 0x0748: memx_recv */ +- 0xf401d6b0, +- 0xd6b0980b, +- 0xd80bf400, +-/* 0x0756: memx_init */ +- 0x00f800f8, +-/* 0x0758: perf_recv */ +-/* 0x075a: perf_init */ ++ 0x2077f02c, ++/* 0x0673: memx_func_wait_vblank_head0 */ ++ 0xf0060ef4, ++/* 0x0676: memx_func_wait_vblank_0 */ ++ 0x67f10877, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x0686: memx_func_wait_vblank_1 */ ++ 0x67f1f31b, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x0696: memx_func_wait_vblank_fini */ ++ 0x10b6f30b, ++/* 0x069b: memx_func_wr32 */ ++ 0x9800f804, ++ 0x15980016, ++ 0x0810b601, ++ 0x50f960f9, ++ 0xe0fcd0fc, ++ 0xb64021f4, ++ 0x1bf40242, ++/* 0x06b7: memx_func_wait */ ++ 0xf000f8e9, ++ 0x84b62c87, ++ 0x0088cf06, ++ 0x98001e98, ++ 0x1c98011d, ++ 0x031b9802, ++ 0xf41010b6, ++ 0x00f8a321, ++/* 0x06d4: memx_func_delay */ ++ 0xb6001e98, ++ 0x21f40410, ++/* 0x06df: memx_func_train */ ++ 0xf800f87e, ++/* 0x06e1: memx_exec */ ++ 0xf9e0f900, ++ 0x02c1b9d0, ++/* 0x06eb: memx_exec_next */ ++ 0x9802b2b9, ++ 0x10b60013, ++ 0xf034e704, ++ 0xe033e701, ++ 0x0132b601, ++ 0x980c30f0, ++ 0x55f9de35, ++ 0xf40612b8, ++ 0x0b98e41e, ++ 0xf20c98f1, ++ 0xf102cbbb, ++ 0xb607c4b7, ++ 0xbbcf06b4, ++ 0xfcd0fc00, ++ 0x3621f5e0, ++/* 0x0727: memx_info */ ++ 0x7000f803, ++ 0x0bf401c6, ++/* 0x072d: memx_info_data */ ++ 0xccc7f10e, ++ 0x00b7f103, ++ 0x0b0ef408, ++/* 0x0738: memx_info_train */ ++ 0x0bccc7f1, ++ 0x0100b7f1, ++/* 0x0740: memx_info_send */ ++ 0x033621f5, ++/* 0x0746: memx_recv */ ++ 0xd6b000f8, ++ 0x980bf401, ++ 0xf400d6b0, ++ 0x00f8d80b, ++/* 0x0754: memx_init */ ++/* 0x0756: perf_recv */ + 0x00f800f8, +-/* 0x075c: i2c_drive_scl */ +- 0xf40036b0, +- 0x07f1110b, +- 0x04b607e0, +- 0x0001d006, +- 0x00f804bd, +-/* 0x0770: i2c_drive_scl_lo */ +- 0x07e407f1, +- 0xd00604b6, +- 0x04bd0001, +-/* 0x077e: i2c_drive_sda */ ++/* 0x0758: perf_init */ ++/* 0x075a: i2c_drive_scl */ + 0x36b000f8, + 0x110bf400, + 0x07e007f1, + 0xd00604b6, +- 0x04bd0002, +-/* 0x0792: i2c_drive_sda_lo */ ++ 0x04bd0001, ++/* 0x076e: i2c_drive_scl_lo */ + 0x07f100f8, + 0x04b607e4, ++ 0x0001d006, ++ 0x00f804bd, ++/* 0x077c: i2c_drive_sda */ ++ 0xf40036b0, ++ 0x07f1110b, ++ 0x04b607e0, + 0x0002d006, + 0x00f804bd, +-/* 0x07a0: i2c_sense_scl */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0431fd00, +- 0xf4060bf4, +-/* 0x07b6: i2c_sense_scl_done */ +- 0x00f80131, +-/* 0x07b8: i2c_sense_sda */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0432fd00, +- 0xf4060bf4, +-/* 0x07ce: i2c_sense_sda_done */ +- 0x00f80131, +-/* 0x07d0: i2c_raise_scl */ +- 0x47f140f9, +- 0x37f00898, +- 0x5c21f501, +-/* 0x07dd: i2c_raise_scl_wait */ +- 0xe8e7f107, +- 0x7e21f403, +- 0x07a021f5, +- 0xb60901f4, +- 0x1bf40142, +-/* 0x07f1: i2c_raise_scl_done */ +- 0xf840fcef, +-/* 0x07f5: i2c_start */ +- 0xa021f500, +- 0x0d11f407, +- 0x07b821f5, +- 0xf40611f4, +-/* 0x0806: i2c_start_rep */ +- 0x37f0300e, +- 0x5c21f500, +- 0x0137f007, +- 0x077e21f5, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0xd021f550, +- 0x0464b607, +-/* 0x0833: i2c_start_send */ +- 0xf01f11f4, ++/* 0x0790: i2c_drive_sda_lo */ ++ 0x07e407f1, ++ 0xd00604b6, ++ 0x04bd0002, ++/* 0x079e: i2c_sense_scl */ ++ 0x32f400f8, ++ 0xc437f101, ++ 0x0634b607, ++ 0xfd0033cf, ++ 0x0bf40431, ++ 0x0131f406, ++/* 0x07b4: i2c_sense_scl_done */ ++/* 0x07b6: i2c_sense_sda */ ++ 0x32f400f8, ++ 0xc437f101, ++ 0x0634b607, ++ 0xfd0033cf, ++ 0x0bf40432, ++ 0x0131f406, ++/* 0x07cc: i2c_sense_sda_done */ ++/* 0x07ce: i2c_raise_scl */ ++ 0x40f900f8, ++ 0x089847f1, ++ 0xf50137f0, ++/* 0x07db: i2c_raise_scl_wait */ ++ 0xf1075a21, ++ 0xf403e8e7, ++ 0x21f57e21, ++ 0x01f4079e, ++ 0x0142b609, ++/* 0x07ef: i2c_raise_scl_done */ ++ 0xfcef1bf4, ++/* 0x07f3: i2c_start */ ++ 0xf500f840, ++ 0xf4079e21, ++ 0x21f50d11, ++ 0x11f407b6, ++ 0x300ef406, ++/* 0x0804: i2c_start_rep */ ++ 0xf50037f0, ++ 0xf0075a21, ++ 0x21f50137, ++ 0x76bb077c, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb607ce21, ++ 0x11f40464, ++/* 0x0831: i2c_start_send */ ++ 0x0037f01f, ++ 0x077c21f5, ++ 0x1388e7f1, ++ 0xf07e21f4, + 0x21f50037, +- 0xe7f1077e, ++ 0xe7f1075a, + 0x21f41388, +- 0x0037f07e, +- 0x075c21f5, +- 0x1388e7f1, +-/* 0x084f: i2c_start_out */ +- 0xf87e21f4, +-/* 0x0851: i2c_stop */ +- 0x0037f000, +- 0x075c21f5, +- 0xf50037f0, +- 0xf1077e21, +- 0xf403e8e7, +- 0x37f07e21, +- 0x5c21f501, +- 0x88e7f107, +- 0x7e21f413, ++/* 0x084d: i2c_start_out */ ++/* 0x084f: i2c_stop */ ++ 0xf000f87e, ++ 0x21f50037, ++ 0x37f0075a, ++ 0x7c21f500, ++ 0xe8e7f107, ++ 0x7e21f403, + 0xf50137f0, +- 0xf1077e21, ++ 0xf1075a21, + 0xf41388e7, +- 0x00f87e21, +-/* 0x0884: i2c_bitw */ +- 0x077e21f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x07d021f5, +- 0xf40464b6, +- 0xe7f11811, +- 0x21f41388, +- 0x0037f07e, +- 0x075c21f5, +- 0x1388e7f1, +-/* 0x08c3: i2c_bitw_out */ +- 0xf87e21f4, +-/* 0x08c5: i2c_bitr */ +- 0x0137f000, +- 0x077e21f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x07d021f5, +- 0xf40464b6, +- 0x21f51b11, +- 0x37f007b8, +- 0x5c21f500, ++ 0x37f07e21, ++ 0x7c21f501, + 0x88e7f107, + 0x7e21f413, +- 0xf4013cf0, +-/* 0x090a: i2c_bitr_done */ +- 0x00f80131, +-/* 0x090c: i2c_get_byte */ +- 0xf00057f0, +-/* 0x0912: i2c_get_byte_next */ +- 0x54b60847, +- 0x0076bb01, ++/* 0x0882: i2c_bitw */ ++ 0x21f500f8, ++ 0xe7f1077c, ++ 0x21f403e8, ++ 0x0076bb7e, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b608c5, +- 0x2b11f404, +- 0xb60553fd, +- 0x1bf40142, +- 0x0137f0d8, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0x8421f550, +- 0x0464b608, +-/* 0x095c: i2c_get_byte_done */ +-/* 0x095e: i2c_put_byte */ +- 0x47f000f8, +-/* 0x0961: i2c_put_byte_next */ +- 0x0142b608, +- 0xbb3854ff, ++ 0x64b607ce, ++ 0x1811f404, ++ 0x1388e7f1, ++ 0xf07e21f4, ++ 0x21f50037, ++ 0xe7f1075a, ++ 0x21f41388, ++/* 0x08c1: i2c_bitw_out */ ++/* 0x08c3: i2c_bitr */ ++ 0xf000f87e, ++ 0x21f50137, ++ 0xe7f1077c, ++ 0x21f403e8, ++ 0x0076bb7e, ++ 0xf90465b6, ++ 0x04659450, ++ 0xbd0256bb, ++ 0x0475fd50, ++ 0x21f550fc, ++ 0x64b607ce, ++ 0x1b11f404, ++ 0x07b621f5, ++ 0xf50037f0, ++ 0xf1075a21, ++ 0xf41388e7, ++ 0x3cf07e21, ++ 0x0131f401, ++/* 0x0908: i2c_bitr_done */ ++/* 0x090a: i2c_get_byte */ ++ 0x57f000f8, ++ 0x0847f000, ++/* 0x0910: i2c_get_byte_next */ ++ 0xbb0154b6, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x088421f5, ++ 0x08c321f5, + 0xf40464b6, +- 0x46b03411, +- 0xd81bf400, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0xc521f550, +- 0x0464b608, +- 0xbb0f11f4, +- 0x36b00076, +- 0x061bf401, +-/* 0x09b7: i2c_put_byte_done */ +- 0xf80132f4, +-/* 0x09b9: i2c_addr */ +- 0x0076bb00, ++ 0x53fd2b11, ++ 0x0142b605, ++ 0xf0d81bf4, ++ 0x76bb0137, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb6088221, ++/* 0x095a: i2c_get_byte_done */ ++ 0x00f80464, ++/* 0x095c: i2c_put_byte */ ++/* 0x095f: i2c_put_byte_next */ ++ 0xb60847f0, ++ 0x54ff0142, ++ 0x0076bb38, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b607f5, +- 0x2911f404, +- 0x012ec3e7, +- 0xfd0134b6, +- 0x76bb0553, ++ 0x64b60882, ++ 0x3411f404, ++ 0xf40046b0, ++ 0x76bbd81b, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0xf550fc04, +- 0xb6095e21, +-/* 0x09fe: i2c_addr_done */ +- 0x00f80464, +-/* 0x0a00: i2c_acquire_addr */ +- 0xb6f8cec7, +- 0xe0b702e4, +- 0xee980d1c, +-/* 0x0a0f: i2c_acquire */ +- 0xf500f800, +- 0xf40a0021, +- 0xd9f00421, +- 0x4021f403, +-/* 0x0a1e: i2c_release */ +- 0x21f500f8, +- 0x21f40a00, +- 0x03daf004, +- 0xf84021f4, +-/* 0x0a2d: i2c_recv */ +- 0x0132f400, +- 0xb6f8c1c7, +- 0x16b00214, +- 0x3a1ff528, +- 0xf413a001, +- 0x0032980c, +- 0x0ccc13a0, +- 0xf4003198, +- 0xd0f90231, +- 0xd0f9e0f9, +- 0x000067f1, +- 0x100063f1, +- 0xbb016792, ++ 0xb608c321, ++ 0x11f40464, ++ 0x0076bb0f, ++ 0xf40136b0, ++ 0x32f4061b, ++/* 0x09b5: i2c_put_byte_done */ ++/* 0x09b7: i2c_addr */ ++ 0xbb00f801, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0a0f21f5, +- 0xfc0464b6, +- 0x00d6b0d0, +- 0x00b31bf5, +- 0xbb0057f0, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x09b921f5, +- 0xf50464b6, +- 0xc700d011, +- 0x76bbe0c5, +- 0x0465b600, +- 0x659450f9, +- 0x0256bb04, +- 0x75fd50bd, +- 0xf550fc04, +- 0xb6095e21, +- 0x11f50464, +- 0x57f000ad, ++ 0x07f321f5, ++ 0xf40464b6, ++ 0xc3e72911, ++ 0x34b6012e, ++ 0x0553fd01, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x5c21f550, ++ 0x0464b609, ++/* 0x09fc: i2c_addr_done */ ++/* 0x09fe: i2c_acquire_addr */ ++ 0xcec700f8, ++ 0x02e4b6f8, ++ 0x0d1ce0b7, ++ 0xf800ee98, ++/* 0x0a0d: i2c_acquire */ ++ 0xfe21f500, ++ 0x0421f409, ++ 0xf403d9f0, ++ 0x00f84021, ++/* 0x0a1c: i2c_release */ ++ 0x09fe21f5, ++ 0xf00421f4, ++ 0x21f403da, ++/* 0x0a2b: i2c_recv */ ++ 0xf400f840, ++ 0xc1c70132, ++ 0x0214b6f8, ++ 0xf52816b0, ++ 0xa0013a1f, ++ 0x980cf413, ++ 0x13a00032, ++ 0x31980ccc, ++ 0x0231f400, ++ 0xe0f9d0f9, ++ 0x67f1d0f9, ++ 0x63f10000, ++ 0x67921000, + 0x0076bb01, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b609b9, +- 0x8a11f504, ++ 0x64b60a0d, ++ 0xb0d0fc04, ++ 0x1bf500d6, ++ 0x57f000b3, + 0x0076bb00, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b6090c, +- 0x6a11f404, +- 0xbbe05bcb, ++ 0x64b609b7, ++ 0xd011f504, ++ 0xe0c5c700, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x5c21f550, ++ 0x0464b609, ++ 0x00ad11f5, ++ 0xbb0157f0, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x085121f5, +- 0xb90464b6, +- 0x74bd025b, +-/* 0x0b33: i2c_recv_not_rd08 */ +- 0xb0430ef4, +- 0x1bf401d6, +- 0x0057f03d, +- 0x09b921f5, +- 0xc73311f4, +- 0x21f5e0c5, +- 0x11f4095e, +- 0x0057f029, +- 0x09b921f5, +- 0xc71f11f4, +- 0x21f5e0b5, +- 0x11f4095e, +- 0x5121f515, +- 0xc774bd08, +- 0x1bf408c5, +- 0x0232f409, +-/* 0x0b73: i2c_recv_not_wr08 */ +-/* 0x0b73: i2c_recv_done */ +- 0xc7030ef4, +- 0x21f5f8ce, +- 0xe0fc0a1e, +- 0x12f4d0fc, +- 0x027cb90a, +- 0x033621f5, +-/* 0x0b88: i2c_recv_exit */ +-/* 0x0b8a: i2c_init */ +- 0x00f800f8, +-/* 0x0b8c: test_recv */ +- 0x05d817f1, ++ 0x09b721f5, ++ 0xf50464b6, ++ 0xbb008a11, ++ 0x65b60076, ++ 0x9450f904, ++ 0x56bb0465, ++ 0xfd50bd02, ++ 0x50fc0475, ++ 0x090a21f5, ++ 0xf40464b6, ++ 0x5bcb6a11, ++ 0x0076bbe0, ++ 0xf90465b6, ++ 0x04659450, ++ 0xbd0256bb, ++ 0x0475fd50, ++ 0x21f550fc, ++ 0x64b6084f, ++ 0x025bb904, ++ 0x0ef474bd, ++/* 0x0b31: i2c_recv_not_rd08 */ ++ 0x01d6b043, ++ 0xf03d1bf4, ++ 0x21f50057, ++ 0x11f409b7, ++ 0xe0c5c733, ++ 0x095c21f5, ++ 0xf02911f4, ++ 0x21f50057, ++ 0x11f409b7, ++ 0xe0b5c71f, ++ 0x095c21f5, ++ 0xf51511f4, ++ 0xbd084f21, ++ 0x08c5c774, ++ 0xf4091bf4, ++ 0x0ef40232, ++/* 0x0b71: i2c_recv_not_wr08 */ ++/* 0x0b71: i2c_recv_done */ ++ 0xf8cec703, ++ 0x0a1c21f5, ++ 0xd0fce0fc, ++ 0xb90a12f4, ++ 0x21f5027c, ++/* 0x0b86: i2c_recv_exit */ ++ 0x00f80336, ++/* 0x0b88: i2c_init */ ++/* 0x0b8a: test_recv */ ++ 0x17f100f8, ++ 0x14b605d8, ++ 0x0011cf06, ++ 0xf10110b6, ++ 0xb605d807, ++ 0x01d00604, ++ 0xf104bd00, ++ 0xf1d900e7, ++ 0xf5134fe3, ++ 0xf8025621, ++/* 0x0bb1: test_init */ ++ 0x00e7f100, ++ 0x5621f508, ++/* 0x0bbb: idle_recv */ ++ 0xf800f802, ++/* 0x0bbd: idle */ ++ 0x0031f400, ++ 0x05d417f1, + 0xcf0614b6, + 0x10b60011, +- 0xd807f101, ++ 0xd407f101, + 0x0604b605, + 0xbd0001d0, +- 0x00e7f104, +- 0x4fe3f1d9, +- 0x5621f513, +-/* 0x0bb3: test_init */ +- 0xf100f802, +- 0xf50800e7, +- 0xf8025621, +-/* 0x0bbd: idle_recv */ +-/* 0x0bbf: idle */ +- 0xf400f800, +- 0x17f10031, +- 0x14b605d4, +- 0x0011cf06, +- 0xf10110b6, +- 0xb605d407, +- 0x01d00604, +-/* 0x0bdb: idle_loop */ +- 0xf004bd00, +- 0x32f45817, +-/* 0x0be1: idle_proc */ +-/* 0x0be1: idle_proc_exec */ +- 0xb910f902, +- 0x21f5021e, +- 0x10fc033f, +- 0xf40911f4, +- 0x0ef40231, +-/* 0x0bf5: idle_proc_next */ +- 0x5810b6ef, +- 0xf4061fb8, +- 0x02f4e61b, +- 0x0028f4dd, +- 0x00bb0ef4, ++/* 0x0bd9: idle_loop */ ++ 0x5817f004, ++/* 0x0bdf: idle_proc */ ++/* 0x0bdf: idle_proc_exec */ ++ 0xf90232f4, ++ 0x021eb910, ++ 0x033f21f5, ++ 0x11f410fc, ++ 0x0231f409, ++/* 0x0bf3: idle_proc_next */ ++ 0xb6ef0ef4, ++ 0x1fb85810, ++ 0xe61bf406, ++ 0xf4dd02f4, ++ 0x0ef40028, ++ 0x000000bb, + 0x00000000, + 0x00000000, + 0x00000000, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h +index c4edbc79e41a..e0222cb832fb 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h +@@ -47,8 +47,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x584d454d, +- 0x000005f3, +- 0x000005e5, ++ 0x000005ee, ++ 0x000005e0, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -69,8 +69,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x46524550, +- 0x000005f7, +- 0x000005f5, ++ 0x000005f2, ++ 0x000005f0, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -91,8 +91,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x5f433249, +- 0x000009f8, +- 0x000008a2, ++ 0x000009f3, ++ 0x0000089d, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -113,8 +113,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x54534554, +- 0x00000a16, +- 0x000009fa, ++ 0x00000a11, ++ 0x000009f5, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -135,8 +135,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x454c4449, +- 0x00000a21, +- 0x00000a1f, ++ 0x00000a1c, ++ 0x00000a1a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -234,22 +234,22 @@ static uint32_t gk208_pmu_data[] = { + /* 0x037c: memx_func_next */ + 0x00000002, + 0x00000000, +- 0x000004cf, ++ 0x000004cc, + 0x00000003, + 0x00000002, +- 0x00000546, ++ 0x00000541, + 0x00040004, + 0x00000000, +- 0x00000563, ++ 0x0000055e, + 0x00010005, + 0x00000000, +- 0x0000057d, ++ 0x00000578, + 0x00010006, + 0x00000000, +- 0x00000541, ++ 0x0000053c, + 0x00000007, + 0x00000000, +- 0x00000589, ++ 0x00000584, + /* 0x03c4: memx_func_tail */ + /* 0x03c4: memx_ts_start */ + 0x00000000, +@@ -1239,454 +1239,454 @@ static uint32_t gk208_pmu_code[] = { + 0x0001f604, + 0x00f804bd, + /* 0x045c: memx_func_enter */ +- 0x162067f1, +- 0xf55d77f1, +- 0x047e6eb2, +- 0xd8b20000, +- 0xf90487fd, +- 0xfc80f960, +- 0x7ee0fcd0, +- 0x0700002d, +- 0x7e6eb2fe, ++ 0x47162046, ++ 0x6eb2f55d, ++ 0x0000047e, ++ 0x87fdd8b2, ++ 0xf960f904, ++ 0xfcd0fc80, ++ 0x002d7ee0, ++ 0xb2fe0700, ++ 0x00047e6e, ++ 0xfdd8b200, ++ 0x60f90487, ++ 0xd0fc80f9, ++ 0x2d7ee0fc, ++ 0xf0460000, ++ 0x7e6eb226, + 0xb2000004, + 0x0487fdd8, + 0x80f960f9, + 0xe0fcd0fc, + 0x00002d7e, +- 0x26f067f1, +- 0x047e6eb2, +- 0xd8b20000, +- 0xf90487fd, +- 0xfc80f960, +- 0x7ee0fcd0, +- 0x0600002d, +- 0x07e04004, +- 0xbd0006f6, +-/* 0x04b9: memx_func_enter_wait */ +- 0x07c04604, +- 0xf00066cf, +- 0x0bf40464, +- 0xcf2c06f7, +- 0x06b50066, +-/* 0x04cf: memx_func_leave */ +- 0x0600f8f1, +- 0x0066cf2c, +- 0x06f206b5, +- 0x07e44004, +- 0xbd0006f6, +-/* 0x04e1: memx_func_leave_wait */ +- 0x07c04604, +- 0xf00066cf, +- 0x1bf40464, +- 0xf067f1f7, ++ 0xe0400406, ++ 0x0006f607, ++/* 0x04b6: memx_func_enter_wait */ ++ 0xc04604bd, ++ 0x0066cf07, ++ 0xf40464f0, ++ 0x2c06f70b, ++ 0xb50066cf, ++ 0x00f8f106, ++/* 0x04cc: memx_func_leave */ ++ 0x66cf2c06, ++ 0xf206b500, ++ 0xe4400406, ++ 0x0006f607, ++/* 0x04de: memx_func_leave_wait */ ++ 0xc04604bd, ++ 0x0066cf07, ++ 0xf40464f0, ++ 0xf046f71b, + 0xb2010726, + 0x00047e6e, + 0xfdd8b200, + 0x60f90587, + 0xd0fc80f9, + 0x2d7ee0fc, +- 0x67f10000, +- 0x6eb21620, +- 0x0000047e, +- 0x87fdd8b2, +- 0xf960f905, +- 0xfcd0fc80, +- 0x002d7ee0, +- 0x0aa24700, +- 0x047e6eb2, +- 0xd8b20000, +- 0xf90587fd, +- 0xfc80f960, +- 0x7ee0fcd0, +- 0xf800002d, +-/* 0x0541: memx_func_wait_vblank */ ++ 0x20460000, ++ 0x7e6eb216, ++ 0xb2000004, ++ 0x0587fdd8, ++ 0x80f960f9, ++ 0xe0fcd0fc, ++ 0x00002d7e, ++ 0xb20aa247, ++ 0x00047e6e, ++ 0xfdd8b200, ++ 0x60f90587, ++ 0xd0fc80f9, ++ 0x2d7ee0fc, ++ 0x00f80000, ++/* 0x053c: memx_func_wait_vblank */ ++ 0xf80410b6, ++/* 0x0541: memx_func_wr32 */ ++ 0x00169800, ++ 0xb6011598, ++ 0x60f90810, ++ 0xd0fc50f9, ++ 0x2d7ee0fc, ++ 0x42b60000, ++ 0xe81bf402, ++/* 0x055e: memx_func_wait */ ++ 0x2c0800f8, ++ 0x980088cf, ++ 0x1d98001e, ++ 0x021c9801, ++ 0xb6031b98, ++ 0x747e1010, ++ 0x00f80000, ++/* 0x0578: memx_func_delay */ ++ 0xb6001e98, ++ 0x587e0410, ++ 0x00f80000, ++/* 0x0584: memx_func_train */ ++/* 0x0586: memx_exec */ ++ 0xe0f900f8, ++ 0xc1b2d0f9, ++/* 0x058e: memx_exec_next */ ++ 0x1398b2b2, + 0x0410b600, +-/* 0x0546: memx_func_wr32 */ +- 0x169800f8, +- 0x01159800, +- 0xf90810b6, +- 0xfc50f960, ++ 0x01f034e7, ++ 0x01e033e7, ++ 0xf00132b6, ++ 0x35980c30, ++ 0xa655f9de, ++ 0xe51ef412, ++ 0x98f10b98, ++ 0xcbbbf20c, ++ 0x07c44b02, ++ 0xfc00bbcf, + 0x7ee0fcd0, +- 0xb600002d, +- 0x1bf40242, +-/* 0x0563: memx_func_wait */ +- 0x0800f8e8, +- 0x0088cf2c, +- 0x98001e98, +- 0x1c98011d, +- 0x031b9802, +- 0x7e1010b6, +- 0xf8000074, +-/* 0x057d: memx_func_delay */ +- 0x001e9800, +- 0x7e0410b6, +- 0xf8000058, +-/* 0x0589: memx_func_train */ +-/* 0x058b: memx_exec */ +- 0xf900f800, +- 0xb2d0f9e0, +-/* 0x0593: memx_exec_next */ +- 0x98b2b2c1, +- 0x10b60013, +- 0xf034e704, +- 0xe033e701, +- 0x0132b601, +- 0x980c30f0, +- 0x55f9de35, +- 0x1ef412a6, +- 0xf10b98e5, +- 0xbbf20c98, +- 0xc44b02cb, +- 0x00bbcf07, +- 0xe0fcd0fc, +- 0x00029f7e, +-/* 0x05ca: memx_info */ +- 0xc67000f8, +- 0x0c0bf401, +-/* 0x05d0: memx_info_data */ +- 0x4b03cc4c, +- 0x0ef40800, +-/* 0x05d9: memx_info_train */ +- 0x0bcc4c09, +-/* 0x05df: memx_info_send */ +- 0x7e01004b, + 0xf800029f, +-/* 0x05e5: memx_recv */ +- 0x01d6b000, +- 0xb0a30bf4, +- 0x0bf400d6, +-/* 0x05f3: memx_init */ +- 0xf800f8dc, +-/* 0x05f5: perf_recv */ +-/* 0x05f7: perf_init */ +- 0xf800f800, +-/* 0x05f9: i2c_drive_scl */ +- 0x0036b000, +- 0x400d0bf4, +- 0x01f607e0, +- 0xf804bd00, +-/* 0x0609: i2c_drive_scl_lo */ +- 0x07e44000, +- 0xbd0001f6, +-/* 0x0613: i2c_drive_sda */ +- 0xb000f804, +- 0x0bf40036, +- 0x07e0400d, +- 0xbd0002f6, +-/* 0x0623: i2c_drive_sda_lo */ +- 0x4000f804, +- 0x02f607e4, +- 0xf804bd00, +-/* 0x062d: i2c_sense_scl */ +- 0x0132f400, +- 0xcf07c443, +- 0x31fd0033, +- 0x060bf404, +-/* 0x063f: i2c_sense_scl_done */ +- 0xf80131f4, +-/* 0x0641: i2c_sense_sda */ +- 0x0132f400, +- 0xcf07c443, +- 0x32fd0033, +- 0x060bf404, +-/* 0x0653: i2c_sense_sda_done */ +- 0xf80131f4, +-/* 0x0655: i2c_raise_scl */ +- 0x4440f900, +- 0x01030898, +- 0x0005f97e, +-/* 0x0660: i2c_raise_scl_wait */ +- 0x7e03e84e, +- 0x7e000058, +- 0xf400062d, +- 0x42b60901, +- 0xef1bf401, +-/* 0x0674: i2c_raise_scl_done */ +- 0x00f840fc, +-/* 0x0678: i2c_start */ +- 0x00062d7e, +- 0x7e0d11f4, +- 0xf4000641, +- 0x0ef40611, +-/* 0x0689: i2c_start_rep */ +- 0x7e00032e, +- 0x030005f9, +- 0x06137e01, ++/* 0x05c5: memx_info */ ++ 0x01c67000, ++/* 0x05cb: memx_info_data */ ++ 0x4c0c0bf4, ++ 0x004b03cc, ++ 0x090ef408, ++/* 0x05d4: memx_info_train */ ++ 0x4b0bcc4c, ++/* 0x05da: memx_info_send */ ++ 0x9f7e0100, ++ 0x00f80002, ++/* 0x05e0: memx_recv */ ++ 0xf401d6b0, ++ 0xd6b0a30b, ++ 0xdc0bf400, ++/* 0x05ee: memx_init */ ++ 0x00f800f8, ++/* 0x05f0: perf_recv */ ++/* 0x05f2: perf_init */ ++ 0x00f800f8, ++/* 0x05f4: i2c_drive_scl */ ++ 0xf40036b0, ++ 0xe0400d0b, ++ 0x0001f607, ++ 0x00f804bd, ++/* 0x0604: i2c_drive_scl_lo */ ++ 0xf607e440, ++ 0x04bd0001, ++/* 0x060e: i2c_drive_sda */ ++ 0x36b000f8, ++ 0x0d0bf400, ++ 0xf607e040, ++ 0x04bd0002, ++/* 0x061e: i2c_drive_sda_lo */ ++ 0xe44000f8, ++ 0x0002f607, ++ 0x00f804bd, ++/* 0x0628: i2c_sense_scl */ ++ 0x430132f4, ++ 0x33cf07c4, ++ 0x0431fd00, ++ 0xf4060bf4, ++/* 0x063a: i2c_sense_scl_done */ ++ 0x00f80131, ++/* 0x063c: i2c_sense_sda */ ++ 0x430132f4, ++ 0x33cf07c4, ++ 0x0432fd00, ++ 0xf4060bf4, ++/* 0x064e: i2c_sense_sda_done */ ++ 0x00f80131, ++/* 0x0650: i2c_raise_scl */ ++ 0x984440f9, ++ 0x7e010308, ++/* 0x065b: i2c_raise_scl_wait */ ++ 0x4e0005f4, ++ 0x587e03e8, ++ 0x287e0000, ++ 0x01f40006, ++ 0x0142b609, ++/* 0x066f: i2c_raise_scl_done */ ++ 0xfcef1bf4, ++/* 0x0673: i2c_start */ ++ 0x7e00f840, ++ 0xf4000628, ++ 0x3c7e0d11, ++ 0x11f40006, ++ 0x2e0ef406, ++/* 0x0684: i2c_start_rep */ ++ 0xf47e0003, ++ 0x01030005, ++ 0x00060e7e, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x06507e50, ++ 0x0464b600, ++/* 0x06af: i2c_start_send */ ++ 0x031d11f4, ++ 0x060e7e00, ++ 0x13884e00, ++ 0x0000587e, ++ 0xf47e0003, ++ 0x884e0005, ++ 0x00587e13, ++/* 0x06c9: i2c_start_out */ ++/* 0x06cb: i2c_stop */ ++ 0x0300f800, ++ 0x05f47e00, ++ 0x7e000300, ++ 0x4e00060e, ++ 0x587e03e8, ++ 0x01030000, ++ 0x0005f47e, ++ 0x7e13884e, ++ 0x03000058, ++ 0x060e7e01, ++ 0x13884e00, ++ 0x0000587e, ++/* 0x06fa: i2c_bitw */ ++ 0x0e7e00f8, ++ 0xe84e0006, ++ 0x00587e03, + 0x0076bb00, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, +- 0x557e50fc, ++ 0x507e50fc, + 0x64b60006, +- 0x1d11f404, +-/* 0x06b4: i2c_start_send */ +- 0x137e0003, +- 0x884e0006, +- 0x00587e13, +- 0x7e000300, +- 0x4e0005f9, +- 0x587e1388, +-/* 0x06ce: i2c_start_out */ +- 0x00f80000, +-/* 0x06d0: i2c_stop */ +- 0xf97e0003, +- 0x00030005, +- 0x0006137e, +- 0x7e03e84e, ++ 0x1711f404, ++ 0x7e13884e, + 0x03000058, +- 0x05f97e01, ++ 0x05f47e00, + 0x13884e00, + 0x0000587e, +- 0x137e0103, +- 0x884e0006, +- 0x00587e13, +-/* 0x06ff: i2c_bitw */ +- 0x7e00f800, +- 0x4e000613, +- 0x587e03e8, +- 0x76bb0000, ++/* 0x0738: i2c_bitw_out */ ++/* 0x073a: i2c_bitr */ ++ 0x010300f8, ++ 0x00060e7e, ++ 0x7e03e84e, ++ 0xbb000058, ++ 0x65b60076, ++ 0x9450f904, ++ 0x56bb0465, ++ 0xfd50bd02, ++ 0x50fc0475, ++ 0x0006507e, ++ 0xf40464b6, ++ 0x3c7e1a11, ++ 0x00030006, ++ 0x0005f47e, ++ 0x7e13884e, ++ 0xf0000058, ++ 0x31f4013c, ++/* 0x077d: i2c_bitr_done */ ++/* 0x077f: i2c_get_byte */ ++ 0x0500f801, ++/* 0x0783: i2c_get_byte_next */ ++ 0xb6080400, ++ 0x76bb0154, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0x7e50fc04, +- 0xb6000655, ++ 0xb600073a, + 0x11f40464, +- 0x13884e17, +- 0x0000587e, +- 0xf97e0003, +- 0x884e0005, +- 0x00587e13, +-/* 0x073d: i2c_bitw_out */ +-/* 0x073f: i2c_bitr */ +- 0x0300f800, +- 0x06137e01, +- 0x03e84e00, +- 0x0000587e, ++ 0x0553fd2a, ++ 0xf40142b6, ++ 0x0103d81b, + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0x06557e50, ++ 0x06fa7e50, + 0x0464b600, +- 0x7e1a11f4, +- 0x03000641, +- 0x05f97e00, +- 0x13884e00, +- 0x0000587e, +- 0xf4013cf0, +-/* 0x0782: i2c_bitr_done */ +- 0x00f80131, +-/* 0x0784: i2c_get_byte */ +- 0x08040005, +-/* 0x0788: i2c_get_byte_next */ +- 0xbb0154b6, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x00073f7e, +- 0xf40464b6, +- 0x53fd2a11, +- 0x0142b605, +- 0x03d81bf4, +- 0x0076bb01, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0xff7e50fc, +- 0x64b60006, +-/* 0x07d1: i2c_get_byte_done */ +-/* 0x07d3: i2c_put_byte */ +- 0x0400f804, +-/* 0x07d5: i2c_put_byte_next */ +- 0x0142b608, +- 0xbb3854ff, ++/* 0x07cc: i2c_get_byte_done */ ++/* 0x07ce: i2c_put_byte */ ++ 0x080400f8, ++/* 0x07d0: i2c_put_byte_next */ ++ 0xff0142b6, ++ 0x76bb3854, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0x7e50fc04, ++ 0xb60006fa, ++ 0x11f40464, ++ 0x0046b034, ++ 0xbbd81bf4, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0006ff7e, ++ 0x00073a7e, + 0xf40464b6, +- 0x46b03411, +- 0xd81bf400, ++ 0x76bb0f11, ++ 0x0136b000, ++ 0xf4061bf4, ++/* 0x0826: i2c_put_byte_done */ ++ 0x00f80132, ++/* 0x0828: i2c_addr */ + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0x073f7e50, ++ 0x06737e50, + 0x0464b600, +- 0xbb0f11f4, +- 0x36b00076, +- 0x061bf401, +-/* 0x082b: i2c_put_byte_done */ +- 0xf80132f4, +-/* 0x082d: i2c_addr */ +- 0x0076bb00, ++ 0xe72911f4, ++ 0xb6012ec3, ++ 0x53fd0134, ++ 0x0076bb05, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, +- 0x787e50fc, +- 0x64b60006, +- 0x2911f404, +- 0x012ec3e7, +- 0xfd0134b6, +- 0x76bb0553, +- 0x0465b600, +- 0x659450f9, +- 0x0256bb04, +- 0x75fd50bd, +- 0x7e50fc04, +- 0xb60007d3, +-/* 0x0872: i2c_addr_done */ +- 0x00f80464, +-/* 0x0874: i2c_acquire_addr */ +- 0xb6f8cec7, +- 0xe0b705e4, +- 0x00f8d014, +-/* 0x0880: i2c_acquire */ +- 0x0008747e, ++ 0xce7e50fc, ++ 0x64b60007, ++/* 0x086d: i2c_addr_done */ ++/* 0x086f: i2c_acquire_addr */ ++ 0xc700f804, ++ 0xe4b6f8ce, ++ 0x14e0b705, ++/* 0x087b: i2c_acquire */ ++ 0x7e00f8d0, ++ 0x7e00086f, ++ 0xf0000004, ++ 0x2d7e03d9, ++ 0x00f80000, ++/* 0x088c: i2c_release */ ++ 0x00086f7e, + 0x0000047e, +- 0x7e03d9f0, ++ 0x7e03daf0, + 0xf800002d, +-/* 0x0891: i2c_release */ +- 0x08747e00, +- 0x00047e00, +- 0x03daf000, +- 0x00002d7e, +-/* 0x08a2: i2c_recv */ +- 0x32f400f8, +- 0xf8c1c701, +- 0xb00214b6, +- 0x1ff52816, +- 0x13b80134, +- 0x98000cf4, +- 0x13b80032, +- 0x98000ccc, +- 0x31f40031, +- 0xf9d0f902, +- 0xd6d0f9e0, +- 0x10000000, +- 0xbb016792, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x0008807e, +- 0xfc0464b6, +- 0x00d6b0d0, +- 0x00b01bf5, +- 0x76bb0005, ++/* 0x089d: i2c_recv */ ++ 0x0132f400, ++ 0xb6f8c1c7, ++ 0x16b00214, ++ 0x341ff528, ++ 0xf413b801, ++ 0x3298000c, ++ 0xcc13b800, ++ 0x3198000c, ++ 0x0231f400, ++ 0xe0f9d0f9, ++ 0x00d6d0f9, ++ 0x92100000, ++ 0x76bb0167, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0x7e50fc04, +- 0xb600082d, +- 0x11f50464, +- 0xc5c700cc, +- 0x0076bbe0, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0xd37e50fc, +- 0x64b60007, +- 0xa911f504, +- 0xbb010500, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x00082d7e, +- 0xf50464b6, +- 0xbb008711, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x0007847e, +- 0xf40464b6, +- 0x5bcb6711, +- 0x0076bbe0, ++ 0xb600087b, ++ 0xd0fc0464, ++ 0xf500d6b0, ++ 0x0500b01b, ++ 0x0076bb00, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, +- 0xd07e50fc, +- 0x64b60006, +- 0xbd5bb204, +- 0x410ef474, +-/* 0x09a4: i2c_recv_not_rd08 */ +- 0xf401d6b0, +- 0x00053b1b, +- 0x00082d7e, +- 0xc73211f4, +- 0xd37ee0c5, +- 0x11f40007, +- 0x7e000528, +- 0xf400082d, +- 0xb5c71f11, +- 0x07d37ee0, +- 0x1511f400, +- 0x0006d07e, +- 0xc5c774bd, +- 0x091bf408, +- 0xf40232f4, +-/* 0x09e2: i2c_recv_not_wr08 */ +-/* 0x09e2: i2c_recv_done */ +- 0xcec7030e, +- 0x08917ef8, +- 0xfce0fc00, +- 0x0912f4d0, +- 0x9f7e7cb2, +-/* 0x09f6: i2c_recv_exit */ +- 0x00f80002, +-/* 0x09f8: i2c_init */ +-/* 0x09fa: test_recv */ +- 0x584100f8, +- 0x0011cf04, +- 0x400110b6, +- 0x01f60458, +- 0xde04bd00, +- 0x134fd900, +- 0x0001de7e, +-/* 0x0a16: test_init */ +- 0x004e00f8, +- 0x01de7e08, +-/* 0x0a1f: idle_recv */ ++ 0x287e50fc, ++ 0x64b60008, ++ 0xcc11f504, ++ 0xe0c5c700, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x07ce7e50, ++ 0x0464b600, ++ 0x00a911f5, ++ 0x76bb0105, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0x7e50fc04, ++ 0xb6000828, ++ 0x11f50464, ++ 0x76bb0087, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0x7e50fc04, ++ 0xb600077f, ++ 0x11f40464, ++ 0xe05bcb67, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x06cb7e50, ++ 0x0464b600, ++ 0x74bd5bb2, ++/* 0x099f: i2c_recv_not_rd08 */ ++ 0xb0410ef4, ++ 0x1bf401d6, ++ 0x7e00053b, ++ 0xf4000828, ++ 0xc5c73211, ++ 0x07ce7ee0, ++ 0x2811f400, ++ 0x287e0005, ++ 0x11f40008, ++ 0xe0b5c71f, ++ 0x0007ce7e, ++ 0x7e1511f4, ++ 0xbd0006cb, ++ 0x08c5c774, ++ 0xf4091bf4, ++ 0x0ef40232, ++/* 0x09dd: i2c_recv_not_wr08 */ ++/* 0x09dd: i2c_recv_done */ ++ 0xf8cec703, ++ 0x00088c7e, ++ 0xd0fce0fc, ++ 0xb20912f4, ++ 0x029f7e7c, ++/* 0x09f1: i2c_recv_exit */ ++/* 0x09f3: i2c_init */ + 0xf800f800, +-/* 0x0a21: idle */ +- 0x0031f400, +- 0xcf045441, +- 0x10b60011, +- 0x04544001, +- 0xbd0001f6, +-/* 0x0a35: idle_loop */ +- 0xf4580104, +-/* 0x0a3a: idle_proc */ +-/* 0x0a3a: idle_proc_exec */ +- 0x10f90232, +- 0xa87e1eb2, +- 0x10fc0002, +- 0xf40911f4, +- 0x0ef40231, +-/* 0x0a4d: idle_proc_next */ +- 0x5810b6f0, +- 0x1bf41fa6, +- 0xe002f4e8, +- 0xf40028f4, +- 0x0000c60e, ++/* 0x09f5: test_recv */ ++ 0x04584100, ++ 0xb60011cf, ++ 0x58400110, ++ 0x0001f604, ++ 0x00de04bd, ++ 0x7e134fd9, ++ 0xf80001de, ++/* 0x0a11: test_init */ ++ 0x08004e00, ++ 0x0001de7e, ++/* 0x0a1a: idle_recv */ ++ 0x00f800f8, ++/* 0x0a1c: idle */ ++ 0x410031f4, ++ 0x11cf0454, ++ 0x0110b600, ++ 0xf6045440, ++ 0x04bd0001, ++/* 0x0a30: idle_loop */ ++ 0x32f45801, ++/* 0x0a35: idle_proc */ ++/* 0x0a35: idle_proc_exec */ ++ 0xb210f902, ++ 0x02a87e1e, ++ 0xf410fc00, ++ 0x31f40911, ++ 0xf00ef402, ++/* 0x0a48: idle_proc_next */ ++ 0xa65810b6, ++ 0xe81bf41f, ++ 0xf4e002f4, ++ 0x0ef40028, ++ 0x000000c6, ++ 0x00000000, + 0x00000000, + 0x00000000, + 0x00000000, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h +index 6a2572e8945a..defddf5957ee 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h +@@ -47,8 +47,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x584d454d, +- 0x0000083a, +- 0x0000082c, ++ 0x00000833, ++ 0x00000825, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -69,8 +69,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x46524550, +- 0x0000083e, +- 0x0000083c, ++ 0x00000837, ++ 0x00000835, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -91,8 +91,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x5f433249, +- 0x00000c6e, +- 0x00000b11, ++ 0x00000c67, ++ 0x00000b0a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -113,8 +113,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x54534554, +- 0x00000c97, +- 0x00000c70, ++ 0x00000c90, ++ 0x00000c69, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -135,8 +135,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x454c4449, +- 0x00000ca3, +- 0x00000ca1, ++ 0x00000c9c, ++ 0x00000c9a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -234,22 +234,22 @@ static uint32_t gt215_pmu_data[] = { + /* 0x037c: memx_func_next */ + 0x00000002, + 0x00000000, +- 0x000005a0, ++ 0x0000059f, + 0x00000003, + 0x00000002, +- 0x00000632, ++ 0x0000062f, + 0x00040004, + 0x00000000, +- 0x0000064e, ++ 0x0000064b, + 0x00010005, + 0x00000000, +- 0x0000066b, ++ 0x00000668, + 0x00010006, + 0x00000000, +- 0x000005f0, ++ 0x000005ef, + 0x00000007, + 0x00000000, +- 0x00000676, ++ 0x00000673, + /* 0x03c4: memx_func_tail */ + /* 0x03c4: memx_ts_start */ + 0x00000000, +@@ -1305,560 +1305,560 @@ static uint32_t gt215_pmu_code[] = { + 0x67f102d7, + 0x63f1fffc, + 0x76fdffff, +- 0x0267f104, +- 0x0576fd00, +- 0x70f980f9, +- 0xe0fcd0fc, +- 0xf04021f4, ++ 0x0267f004, ++ 0xf90576fd, ++ 0xfc70f980, ++ 0xf4e0fcd0, ++ 0x67f04021, ++ 0xe007f104, ++ 0x0604b607, ++ 0xbd0006d0, ++/* 0x0581: memx_func_enter_wait */ ++ 0xc067f104, ++ 0x0664b607, ++ 0xf00066cf, ++ 0x0bf40464, ++ 0x2c67f0f3, ++ 0xcf0664b6, ++ 0x06800066, ++/* 0x059f: memx_func_leave */ ++ 0xf000f8f1, ++ 0x64b62c67, ++ 0x0066cf06, ++ 0xf0f20680, + 0x07f10467, +- 0x04b607e0, ++ 0x04b607e4, + 0x0006d006, +-/* 0x0582: memx_func_enter_wait */ ++/* 0x05ba: memx_func_leave_wait */ + 0x67f104bd, + 0x64b607c0, + 0x0066cf06, + 0xf40464f0, +- 0x67f0f30b, +- 0x0664b62c, +- 0x800066cf, +- 0x00f8f106, +-/* 0x05a0: memx_func_leave */ +- 0xb62c67f0, +- 0x66cf0664, +- 0xf2068000, +- 0xf10467f0, +- 0xb607e407, +- 0x06d00604, +-/* 0x05bb: memx_func_leave_wait */ +- 0xf104bd00, +- 0xb607c067, +- 0x66cf0664, +- 0x0464f000, +- 0xf1f31bf4, +- 0xb9161087, +- 0x21f4028e, +- 0x02d7b904, +- 0xffcc67f1, +- 0xffff63f1, +- 0xf90476fd, +- 0xfc70f980, +- 0xf4e0fcd0, +- 0x00f84021, +-/* 0x05f0: memx_func_wait_vblank */ +- 0xb0001698, +- 0x0bf40066, +- 0x0166b013, +- 0xf4060bf4, +-/* 0x0602: memx_func_wait_vblank_head1 */ +- 0x77f12e0e, +- 0x0ef40020, +-/* 0x0609: memx_func_wait_vblank_head0 */ +- 0x0877f107, +-/* 0x060d: memx_func_wait_vblank_0 */ +- 0xc467f100, +- 0x0664b607, +- 0xfd0066cf, +- 0x1bf40467, +-/* 0x061d: memx_func_wait_vblank_1 */ +- 0xc467f1f3, +- 0x0664b607, +- 0xfd0066cf, +- 0x0bf40467, +-/* 0x062d: memx_func_wait_vblank_fini */ +- 0x0410b6f3, +-/* 0x0632: memx_func_wr32 */ +- 0x169800f8, +- 0x01159800, +- 0xf90810b6, +- 0xfc50f960, +- 0xf4e0fcd0, +- 0x42b64021, +- 0xe91bf402, +-/* 0x064e: memx_func_wait */ +- 0x87f000f8, +- 0x0684b62c, +- 0x980088cf, +- 0x1d98001e, +- 0x021c9801, +- 0xb6031b98, +- 0x21f41010, +-/* 0x066b: memx_func_delay */ +- 0x9800f8a3, +- 0x10b6001e, +- 0x7e21f404, +-/* 0x0676: memx_func_train */ +- 0x57f100f8, +- 0x77f10003, +- 0x97f10000, +- 0x93f00000, +- 0x029eb970, +- 0xb90421f4, +- 0xe7f102d8, +- 0x21f42710, +-/* 0x0695: memx_func_train_loop_outer */ +- 0x0158e07e, +- 0x0083f101, +- 0xe097f102, +- 0x1193f011, +- 0x80f990f9, ++ 0x87f1f31b, ++ 0x8eb91610, ++ 0x0421f402, ++ 0xf102d7b9, ++ 0xf1ffcc67, ++ 0xfdffff63, ++ 0x80f90476, ++ 0xd0fc70f9, ++ 0x21f4e0fc, ++/* 0x05ef: memx_func_wait_vblank */ ++ 0x9800f840, ++ 0x66b00016, ++ 0x120bf400, ++ 0xf40166b0, ++ 0x0ef4060b, ++/* 0x0601: memx_func_wait_vblank_head1 */ ++ 0x2077f02c, ++/* 0x0607: memx_func_wait_vblank_head0 */ ++ 0xf0060ef4, ++/* 0x060a: memx_func_wait_vblank_0 */ ++ 0x67f10877, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x061a: memx_func_wait_vblank_1 */ ++ 0x67f1f31b, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x062a: memx_func_wait_vblank_fini */ ++ 0x10b6f30b, ++/* 0x062f: memx_func_wr32 */ ++ 0x9800f804, ++ 0x15980016, ++ 0x0810b601, ++ 0x50f960f9, + 0xe0fcd0fc, +- 0xf94021f4, +- 0x0067f150, +-/* 0x06b5: memx_func_train_loop_inner */ +- 0x1187f100, +- 0x9068ff11, +- 0xfd109894, +- 0x97f10589, +- 0x93f00720, +- 0xf990f910, +- 0xfcd0fc80, +- 0x4021f4e0, +- 0x008097f1, +- 0xb91093f0, +- 0x21f4029e, +- 0x02d8b904, +- 0xf92088c5, ++ 0xb64021f4, ++ 0x1bf40242, ++/* 0x064b: memx_func_wait */ ++ 0xf000f8e9, ++ 0x84b62c87, ++ 0x0088cf06, ++ 0x98001e98, ++ 0x1c98011d, ++ 0x031b9802, ++ 0xf41010b6, ++ 0x00f8a321, ++/* 0x0668: memx_func_delay */ ++ 0xb6001e98, ++ 0x21f40410, ++/* 0x0673: memx_func_train */ ++ 0xf000f87e, ++ 0x77f00357, ++ 0x0097f100, ++ 0x7093f000, ++ 0xf4029eb9, ++ 0xd8b90421, ++ 0x10e7f102, ++ 0x7e21f427, ++/* 0x0690: memx_func_train_loop_outer */ ++ 0x010158e0, ++ 0x020083f1, ++ 0x11e097f1, ++ 0xf91193f0, ++ 0xfc80f990, ++ 0xf4e0fcd0, ++ 0x50f94021, ++/* 0x06af: memx_func_train_loop_inner */ ++ 0xf10067f0, ++ 0xff111187, ++ 0x98949068, ++ 0x0589fd10, ++ 0x072097f1, ++ 0xf91093f0, + 0xfc80f990, + 0xf4e0fcd0, + 0x97f14021, +- 0x93f0053c, +- 0x0287f110, +- 0x0083f130, +- 0xf990f980, ++ 0x93f00080, ++ 0x029eb910, ++ 0xb90421f4, ++ 0x88c502d8, ++ 0xf990f920, + 0xfcd0fc80, + 0x4021f4e0, +- 0x0560e7f1, +- 0xf110e3f0, +- 0xf10000d7, +- 0x908000d3, +- 0xb7f100dc, +- 0xb3f08480, +- 0xa321f41e, +- 0x000057f1, +- 0xffff97f1, +- 0x830093f1, +-/* 0x0734: memx_func_train_loop_4x */ +- 0x0080a7f1, +- 0xb910a3f0, +- 0x21f402ae, +- 0x02d8b904, +- 0xffdfb7f1, +- 0xffffb3f1, +- 0xf9048bfd, +- 0xfc80f9a0, ++ 0x053c97f1, ++ 0xf11093f0, ++ 0xf1300287, ++ 0xf9800083, ++ 0xfc80f990, + 0xf4e0fcd0, +- 0xa7f14021, +- 0xa3f0053c, +- 0x0287f110, +- 0x0083f130, +- 0xf9a0f980, +- 0xfcd0fc80, +- 0x4021f4e0, +- 0x0560e7f1, +- 0xf110e3f0, +- 0xf10000d7, +- 0xb98000d3, +- 0xb7f102dc, +- 0xb3f02710, +- 0xa321f400, +- 0xf402eeb9, +- 0xddb90421, +- 0x949dff02, ++ 0xe7f14021, ++ 0xe3f00560, ++ 0x00d7f110, ++ 0x00d3f100, ++ 0x00dc9080, ++ 0x8480b7f1, ++ 0xf41eb3f0, ++ 0x57f0a321, ++ 0xff97f100, ++ 0x0093f1ff, ++/* 0x072d: memx_func_train_loop_4x */ ++ 0x80a7f183, ++ 0x10a3f000, ++ 0xf402aeb9, ++ 0xd8b90421, ++ 0xdfb7f102, ++ 0xffb3f1ff, ++ 0x048bfdff, ++ 0x80f9a0f9, ++ 0xe0fcd0fc, ++ 0xf14021f4, ++ 0xf0053ca7, ++ 0x87f110a3, ++ 0x83f13002, ++ 0xa0f98000, ++ 0xd0fc80f9, ++ 0x21f4e0fc, ++ 0x60e7f140, ++ 0x10e3f005, ++ 0x0000d7f1, ++ 0x8000d3f1, ++ 0xf102dcb9, ++ 0xf02710b7, ++ 0x21f400b3, ++ 0x02eeb9a3, ++ 0xb90421f4, ++ 0x9dff02dd, ++ 0x0150b694, ++ 0xf4045670, ++ 0x7aa0921e, ++ 0xa9800bcc, ++ 0x0160b600, ++ 0x700470b6, ++ 0x1ef51066, ++ 0x50fcff01, + 0x700150b6, +- 0x1ef40456, +- 0xcc7aa092, +- 0x00a9800b, +- 0xb60160b6, +- 0x66700470, +- 0x001ef510, +- 0xb650fcff, +- 0x56700150, +- 0xd41ef507, +-/* 0x07c7: memx_exec */ +- 0xf900f8fe, +- 0xb9d0f9e0, +- 0xb2b902c1, +-/* 0x07d1: memx_exec_next */ +- 0x00139802, +- 0xe70410b6, +- 0xe701f034, +- 0xb601e033, +- 0x30f00132, +- 0xde35980c, +- 0x12b855f9, +- 0xe41ef406, +- 0x98f10b98, +- 0xcbbbf20c, +- 0xc4b7f102, +- 0x06b4b607, +- 0xfc00bbcf, +- 0xf5e0fcd0, ++ 0x1ef50756, ++ 0x00f8fed6, ++/* 0x07c0: memx_exec */ ++ 0xd0f9e0f9, ++ 0xb902c1b9, ++/* 0x07ca: memx_exec_next */ ++ 0x139802b2, ++ 0x0410b600, ++ 0x01f034e7, ++ 0x01e033e7, ++ 0xf00132b6, ++ 0x35980c30, ++ 0xb855f9de, ++ 0x1ef40612, ++ 0xf10b98e4, ++ 0xbbf20c98, ++ 0xb7f102cb, ++ 0xb4b607c4, ++ 0x00bbcf06, ++ 0xe0fcd0fc, ++ 0x033621f5, ++/* 0x0806: memx_info */ ++ 0xc67000f8, ++ 0x0e0bf401, ++/* 0x080c: memx_info_data */ ++ 0x03ccc7f1, ++ 0x0800b7f1, ++/* 0x0817: memx_info_train */ ++ 0xf10b0ef4, ++ 0xf10bccc7, ++/* 0x081f: memx_info_send */ ++ 0xf50100b7, + 0xf8033621, +-/* 0x080d: memx_info */ +- 0x01c67000, +-/* 0x0813: memx_info_data */ +- 0xf10e0bf4, +- 0xf103ccc7, +- 0xf40800b7, +-/* 0x081e: memx_info_train */ +- 0xc7f10b0e, +- 0xb7f10bcc, +-/* 0x0826: memx_info_send */ +- 0x21f50100, +- 0x00f80336, +-/* 0x082c: memx_recv */ +- 0xf401d6b0, +- 0xd6b0980b, +- 0xd80bf400, +-/* 0x083a: memx_init */ +- 0x00f800f8, +-/* 0x083c: perf_recv */ +-/* 0x083e: perf_init */ +- 0x00f800f8, +-/* 0x0840: i2c_drive_scl */ +- 0xf40036b0, +- 0x07f1110b, +- 0x04b607e0, +- 0x0001d006, +- 0x00f804bd, +-/* 0x0854: i2c_drive_scl_lo */ +- 0x07e407f1, +- 0xd00604b6, +- 0x04bd0001, +-/* 0x0862: i2c_drive_sda */ +- 0x36b000f8, +- 0x110bf400, +- 0x07e007f1, +- 0xd00604b6, +- 0x04bd0002, +-/* 0x0876: i2c_drive_sda_lo */ +- 0x07f100f8, +- 0x04b607e4, +- 0x0002d006, +- 0x00f804bd, +-/* 0x0884: i2c_sense_scl */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0431fd00, +- 0xf4060bf4, +-/* 0x089a: i2c_sense_scl_done */ +- 0x00f80131, +-/* 0x089c: i2c_sense_sda */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0432fd00, +- 0xf4060bf4, +-/* 0x08b2: i2c_sense_sda_done */ +- 0x00f80131, +-/* 0x08b4: i2c_raise_scl */ +- 0x47f140f9, +- 0x37f00898, +- 0x4021f501, +-/* 0x08c1: i2c_raise_scl_wait */ ++/* 0x0825: memx_recv */ ++ 0x01d6b000, ++ 0xb0980bf4, ++ 0x0bf400d6, ++/* 0x0833: memx_init */ ++ 0xf800f8d8, ++/* 0x0835: perf_recv */ ++/* 0x0837: perf_init */ ++ 0xf800f800, ++/* 0x0839: i2c_drive_scl */ ++ 0x0036b000, ++ 0xf1110bf4, ++ 0xb607e007, ++ 0x01d00604, ++ 0xf804bd00, ++/* 0x084d: i2c_drive_scl_lo */ ++ 0xe407f100, ++ 0x0604b607, ++ 0xbd0001d0, ++/* 0x085b: i2c_drive_sda */ ++ 0xb000f804, ++ 0x0bf40036, ++ 0xe007f111, ++ 0x0604b607, ++ 0xbd0002d0, ++/* 0x086f: i2c_drive_sda_lo */ ++ 0xf100f804, ++ 0xb607e407, ++ 0x02d00604, ++ 0xf804bd00, ++/* 0x087d: i2c_sense_scl */ ++ 0x0132f400, ++ 0x07c437f1, ++ 0xcf0634b6, ++ 0x31fd0033, ++ 0x060bf404, ++/* 0x0893: i2c_sense_scl_done */ ++ 0xf80131f4, ++/* 0x0895: i2c_sense_sda */ ++ 0x0132f400, ++ 0x07c437f1, ++ 0xcf0634b6, ++ 0x32fd0033, ++ 0x060bf404, ++/* 0x08ab: i2c_sense_sda_done */ ++ 0xf80131f4, ++/* 0x08ad: i2c_raise_scl */ ++ 0xf140f900, ++ 0xf0089847, ++ 0x21f50137, ++/* 0x08ba: i2c_raise_scl_wait */ ++ 0xe7f10839, ++ 0x21f403e8, ++ 0x7d21f57e, ++ 0x0901f408, ++ 0xf40142b6, ++/* 0x08ce: i2c_raise_scl_done */ ++ 0x40fcef1b, ++/* 0x08d2: i2c_start */ ++ 0x21f500f8, ++ 0x11f4087d, ++ 0x9521f50d, ++ 0x0611f408, ++/* 0x08e3: i2c_start_rep */ ++ 0xf0300ef4, ++ 0x21f50037, ++ 0x37f00839, ++ 0x5b21f501, ++ 0x0076bb08, ++ 0xf90465b6, ++ 0x04659450, ++ 0xbd0256bb, ++ 0x0475fd50, ++ 0x21f550fc, ++ 0x64b608ad, ++ 0x1f11f404, ++/* 0x0910: i2c_start_send */ ++ 0xf50037f0, ++ 0xf1085b21, ++ 0xf41388e7, ++ 0x37f07e21, ++ 0x3921f500, ++ 0x88e7f108, ++ 0x7e21f413, ++/* 0x092c: i2c_start_out */ ++/* 0x092e: i2c_stop */ ++ 0x37f000f8, ++ 0x3921f500, ++ 0x0037f008, ++ 0x085b21f5, ++ 0x03e8e7f1, ++ 0xf07e21f4, ++ 0x21f50137, ++ 0xe7f10839, ++ 0x21f41388, ++ 0x0137f07e, ++ 0x085b21f5, ++ 0x1388e7f1, ++ 0xf87e21f4, ++/* 0x0961: i2c_bitw */ ++ 0x5b21f500, + 0xe8e7f108, + 0x7e21f403, +- 0x088421f5, +- 0xb60901f4, +- 0x1bf40142, +-/* 0x08d5: i2c_raise_scl_done */ +- 0xf840fcef, +-/* 0x08d9: i2c_start */ +- 0x8421f500, +- 0x0d11f408, +- 0x089c21f5, +- 0xf40611f4, +-/* 0x08ea: i2c_start_rep */ +- 0x37f0300e, +- 0x4021f500, +- 0x0137f008, +- 0x086221f5, + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0xb421f550, ++ 0xad21f550, + 0x0464b608, +-/* 0x0917: i2c_start_send */ +- 0xf01f11f4, +- 0x21f50037, +- 0xe7f10862, +- 0x21f41388, +- 0x0037f07e, +- 0x084021f5, +- 0x1388e7f1, +-/* 0x0933: i2c_start_out */ +- 0xf87e21f4, +-/* 0x0935: i2c_stop */ +- 0x0037f000, +- 0x084021f5, +- 0xf50037f0, +- 0xf1086221, +- 0xf403e8e7, ++ 0xf11811f4, ++ 0xf41388e7, + 0x37f07e21, +- 0x4021f501, ++ 0x3921f500, + 0x88e7f108, + 0x7e21f413, +- 0xf50137f0, +- 0xf1086221, +- 0xf41388e7, +- 0x00f87e21, +-/* 0x0968: i2c_bitw */ +- 0x086221f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x08b421f5, +- 0xf40464b6, +- 0xe7f11811, ++/* 0x09a0: i2c_bitw_out */ ++/* 0x09a2: i2c_bitr */ ++ 0x37f000f8, ++ 0x5b21f501, ++ 0xe8e7f108, ++ 0x7e21f403, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0xad21f550, ++ 0x0464b608, ++ 0xf51b11f4, ++ 0xf0089521, ++ 0x21f50037, ++ 0xe7f10839, + 0x21f41388, +- 0x0037f07e, +- 0x084021f5, +- 0x1388e7f1, +-/* 0x09a7: i2c_bitw_out */ +- 0xf87e21f4, +-/* 0x09a9: i2c_bitr */ +- 0x0137f000, +- 0x086221f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x08b421f5, +- 0xf40464b6, +- 0x21f51b11, +- 0x37f0089c, +- 0x4021f500, +- 0x88e7f108, +- 0x7e21f413, +- 0xf4013cf0, +-/* 0x09ee: i2c_bitr_done */ +- 0x00f80131, +-/* 0x09f0: i2c_get_byte */ +- 0xf00057f0, +-/* 0x09f6: i2c_get_byte_next */ +- 0x54b60847, ++ 0x013cf07e, ++/* 0x09e7: i2c_bitr_done */ ++ 0xf80131f4, ++/* 0x09e9: i2c_get_byte */ ++ 0x0057f000, ++/* 0x09ef: i2c_get_byte_next */ ++ 0xb60847f0, ++ 0x76bb0154, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb609a221, ++ 0x11f40464, ++ 0x0553fd2b, ++ 0xf40142b6, ++ 0x37f0d81b, + 0x0076bb01, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b609a9, +- 0x2b11f404, +- 0xb60553fd, +- 0x1bf40142, +- 0x0137f0d8, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0x6821f550, +- 0x0464b609, +-/* 0x0a40: i2c_get_byte_done */ +-/* 0x0a42: i2c_put_byte */ +- 0x47f000f8, +-/* 0x0a45: i2c_put_byte_next */ +- 0x0142b608, +- 0xbb3854ff, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x096821f5, +- 0xf40464b6, +- 0x46b03411, +- 0xd81bf400, ++ 0x64b60961, ++/* 0x0a39: i2c_get_byte_done */ ++/* 0x0a3b: i2c_put_byte */ ++ 0xf000f804, ++/* 0x0a3e: i2c_put_byte_next */ ++ 0x42b60847, ++ 0x3854ff01, + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0xa921f550, ++ 0x6121f550, + 0x0464b609, +- 0xbb0f11f4, +- 0x36b00076, +- 0x061bf401, +-/* 0x0a9b: i2c_put_byte_done */ +- 0xf80132f4, +-/* 0x0a9d: i2c_addr */ +- 0x0076bb00, ++ 0xb03411f4, ++ 0x1bf40046, ++ 0x0076bbd8, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b608d9, +- 0x2911f404, +- 0x012ec3e7, +- 0xfd0134b6, +- 0x76bb0553, ++ 0x64b609a2, ++ 0x0f11f404, ++ 0xb00076bb, ++ 0x1bf40136, ++ 0x0132f406, ++/* 0x0a94: i2c_put_byte_done */ ++/* 0x0a96: i2c_addr */ ++ 0x76bb00f8, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0xf550fc04, +- 0xb60a4221, +-/* 0x0ae2: i2c_addr_done */ +- 0x00f80464, +-/* 0x0ae4: i2c_acquire_addr */ +- 0xb6f8cec7, +- 0xe0b702e4, +- 0xee980d1c, +-/* 0x0af3: i2c_acquire */ +- 0xf500f800, +- 0xf40ae421, +- 0xd9f00421, +- 0x4021f403, +-/* 0x0b02: i2c_release */ +- 0x21f500f8, +- 0x21f40ae4, +- 0x03daf004, +- 0xf84021f4, +-/* 0x0b11: i2c_recv */ +- 0x0132f400, +- 0xb6f8c1c7, +- 0x16b00214, +- 0x3a1ff528, +- 0xf413a001, +- 0x0032980c, +- 0x0ccc13a0, +- 0xf4003198, +- 0xd0f90231, +- 0xd0f9e0f9, +- 0x000067f1, +- 0x100063f1, +- 0xbb016792, ++ 0xb608d221, ++ 0x11f40464, ++ 0x2ec3e729, ++ 0x0134b601, ++ 0xbb0553fd, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0af321f5, +- 0xfc0464b6, +- 0x00d6b0d0, +- 0x00b31bf5, +- 0xbb0057f0, ++ 0x0a3b21f5, ++/* 0x0adb: i2c_addr_done */ ++ 0xf80464b6, ++/* 0x0add: i2c_acquire_addr */ ++ 0xf8cec700, ++ 0xb702e4b6, ++ 0x980d1ce0, ++ 0x00f800ee, ++/* 0x0aec: i2c_acquire */ ++ 0x0add21f5, ++ 0xf00421f4, ++ 0x21f403d9, ++/* 0x0afb: i2c_release */ ++ 0xf500f840, ++ 0xf40add21, ++ 0xdaf00421, ++ 0x4021f403, ++/* 0x0b0a: i2c_recv */ ++ 0x32f400f8, ++ 0xf8c1c701, ++ 0xb00214b6, ++ 0x1ff52816, ++ 0x13a0013a, ++ 0x32980cf4, ++ 0xcc13a000, ++ 0x0031980c, ++ 0xf90231f4, ++ 0xf9e0f9d0, ++ 0x0067f1d0, ++ 0x0063f100, ++ 0x01679210, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0xec21f550, ++ 0x0464b60a, ++ 0xd6b0d0fc, ++ 0xb31bf500, ++ 0x0057f000, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x9621f550, ++ 0x0464b60a, ++ 0x00d011f5, ++ 0xbbe0c5c7, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0a9d21f5, ++ 0x0a3b21f5, + 0xf50464b6, +- 0xc700d011, +- 0x76bbe0c5, ++ 0xf000ad11, ++ 0x76bb0157, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0xf550fc04, +- 0xb60a4221, ++ 0xb60a9621, + 0x11f50464, +- 0x57f000ad, +- 0x0076bb01, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0x21f550fc, +- 0x64b60a9d, +- 0x8a11f504, +- 0x0076bb00, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0x21f550fc, +- 0x64b609f0, +- 0x6a11f404, +- 0xbbe05bcb, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x093521f5, +- 0xb90464b6, +- 0x74bd025b, +-/* 0x0c17: i2c_recv_not_rd08 */ +- 0xb0430ef4, +- 0x1bf401d6, +- 0x0057f03d, +- 0x0a9d21f5, +- 0xc73311f4, +- 0x21f5e0c5, +- 0x11f40a42, +- 0x0057f029, +- 0x0a9d21f5, +- 0xc71f11f4, +- 0x21f5e0b5, +- 0x11f40a42, +- 0x3521f515, +- 0xc774bd09, +- 0x1bf408c5, +- 0x0232f409, +-/* 0x0c57: i2c_recv_not_wr08 */ +-/* 0x0c57: i2c_recv_done */ +- 0xc7030ef4, +- 0x21f5f8ce, +- 0xe0fc0b02, +- 0x12f4d0fc, +- 0x027cb90a, +- 0x033621f5, +-/* 0x0c6c: i2c_recv_exit */ +-/* 0x0c6e: i2c_init */ ++ 0x76bb008a, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb609e921, ++ 0x11f40464, ++ 0xe05bcb6a, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x2e21f550, ++ 0x0464b609, ++ 0xbd025bb9, ++ 0x430ef474, ++/* 0x0c10: i2c_recv_not_rd08 */ ++ 0xf401d6b0, ++ 0x57f03d1b, ++ 0x9621f500, ++ 0x3311f40a, ++ 0xf5e0c5c7, ++ 0xf40a3b21, ++ 0x57f02911, ++ 0x9621f500, ++ 0x1f11f40a, ++ 0xf5e0b5c7, ++ 0xf40a3b21, ++ 0x21f51511, ++ 0x74bd092e, ++ 0xf408c5c7, ++ 0x32f4091b, ++ 0x030ef402, ++/* 0x0c50: i2c_recv_not_wr08 */ ++/* 0x0c50: i2c_recv_done */ ++ 0xf5f8cec7, ++ 0xfc0afb21, ++ 0xf4d0fce0, ++ 0x7cb90a12, ++ 0x3621f502, ++/* 0x0c65: i2c_recv_exit */ ++/* 0x0c67: i2c_init */ ++ 0xf800f803, ++/* 0x0c69: test_recv */ ++ 0xd817f100, ++ 0x0614b605, ++ 0xb60011cf, ++ 0x07f10110, ++ 0x04b605d8, ++ 0x0001d006, ++ 0xe7f104bd, ++ 0xe3f1d900, ++ 0x21f5134f, ++ 0x00f80256, ++/* 0x0c90: test_init */ ++ 0x0800e7f1, ++ 0x025621f5, ++/* 0x0c9a: idle_recv */ + 0x00f800f8, +-/* 0x0c70: test_recv */ +- 0x05d817f1, +- 0xcf0614b6, +- 0x10b60011, +- 0xd807f101, +- 0x0604b605, +- 0xbd0001d0, +- 0x00e7f104, +- 0x4fe3f1d9, +- 0x5621f513, +-/* 0x0c97: test_init */ +- 0xf100f802, +- 0xf50800e7, +- 0xf8025621, +-/* 0x0ca1: idle_recv */ +-/* 0x0ca3: idle */ +- 0xf400f800, +- 0x17f10031, +- 0x14b605d4, +- 0x0011cf06, +- 0xf10110b6, +- 0xb605d407, +- 0x01d00604, +-/* 0x0cbf: idle_loop */ +- 0xf004bd00, +- 0x32f45817, +-/* 0x0cc5: idle_proc */ +-/* 0x0cc5: idle_proc_exec */ +- 0xb910f902, +- 0x21f5021e, +- 0x10fc033f, +- 0xf40911f4, +- 0x0ef40231, +-/* 0x0cd9: idle_proc_next */ +- 0x5810b6ef, +- 0xf4061fb8, +- 0x02f4e61b, +- 0x0028f4dd, +- 0x00bb0ef4, ++/* 0x0c9c: idle */ ++ 0xf10031f4, ++ 0xb605d417, ++ 0x11cf0614, ++ 0x0110b600, ++ 0x05d407f1, ++ 0xd00604b6, ++ 0x04bd0001, ++/* 0x0cb8: idle_loop */ ++ 0xf45817f0, ++/* 0x0cbe: idle_proc */ ++/* 0x0cbe: idle_proc_exec */ ++ 0x10f90232, ++ 0xf5021eb9, ++ 0xfc033f21, ++ 0x0911f410, ++ 0xf40231f4, ++/* 0x0cd2: idle_proc_next */ ++ 0x10b6ef0e, ++ 0x061fb858, ++ 0xf4e61bf4, ++ 0x28f4dd02, ++ 0xbb0ef400, ++ 0x00000000, ++ 0x00000000, + 0x00000000, + 0x00000000, + 0x00000000, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc +index ec03f9a4290b..1663bf943d77 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc +@@ -82,15 +82,15 @@ memx_train_tail: + // $r0 - zero + memx_func_enter: + #if NVKM_PPWR_CHIPSET == GT215 +- movw $r8 0x1610 ++ mov $r8 0x1610 + nv_rd32($r7, $r8) + imm32($r6, 0xfffffffc) + and $r7 $r6 +- movw $r6 0x2 ++ mov $r6 0x2 + or $r7 $r6 + nv_wr32($r8, $r7) + #else +- movw $r6 0x001620 ++ mov $r6 0x001620 + imm32($r7, ~0x00000aa2); + nv_rd32($r8, $r6) + and $r8 $r7 +@@ -101,7 +101,7 @@ memx_func_enter: + and $r8 $r7 + nv_wr32($r6, $r8) + +- movw $r6 0x0026f0 ++ mov $r6 0x0026f0 + nv_rd32($r8, $r6) + and $r8 $r7 + nv_wr32($r6, $r8) +@@ -136,19 +136,19 @@ memx_func_leave: + bra nz #memx_func_leave_wait + + #if NVKM_PPWR_CHIPSET == GT215 +- movw $r8 0x1610 ++ mov $r8 0x1610 + nv_rd32($r7, $r8) + imm32($r6, 0xffffffcc) + and $r7 $r6 + nv_wr32($r8, $r7) + #else +- movw $r6 0x0026f0 ++ mov $r6 0x0026f0 + imm32($r7, 0x00000001) + nv_rd32($r8, $r6) + or $r8 $r7 + nv_wr32($r6, $r8) + +- movw $r6 0x001620 ++ mov $r6 0x001620 + nv_rd32($r8, $r6) + or $r8 $r7 + nv_wr32($r6, $r8) +@@ -177,11 +177,11 @@ memx_func_wait_vblank: + bra #memx_func_wait_vblank_fini + + memx_func_wait_vblank_head1: +- movw $r7 0x20 ++ mov $r7 0x20 + bra #memx_func_wait_vblank_0 + + memx_func_wait_vblank_head0: +- movw $r7 0x8 ++ mov $r7 0x8 + + memx_func_wait_vblank_0: + nv_iord($r6, NV_PPWR_INPUT) +@@ -273,13 +273,13 @@ memx_func_train: + // $r5 - outer loop counter + // $r6 - inner loop counter + // $r7 - entry counter (#memx_train_head + $r7) +- movw $r5 0x3 +- movw $r7 0x0 ++ mov $r5 0x3 ++ mov $r7 0x0 + + // Read random memory to wake up... things + imm32($r9, 0x700000) + nv_rd32($r8,$r9) +- movw $r14 0x2710 ++ mov $r14 0x2710 + call(nsec) + + memx_func_train_loop_outer: +@@ -289,9 +289,9 @@ memx_func_train: + nv_wr32($r9, $r8) + push $r5 + +- movw $r6 0x0 ++ mov $r6 0x0 + memx_func_train_loop_inner: +- movw $r8 0x1111 ++ mov $r8 0x1111 + mulu $r9 $r6 $r8 + shl b32 $r8 $r9 0x10 + or $r8 $r9 +@@ -315,7 +315,7 @@ memx_func_train: + + // $r5 - inner inner loop counter + // $r9 - result +- movw $r5 0 ++ mov $r5 0 + imm32($r9, 0x8300ffff) + memx_func_train_loop_4x: + imm32($r10, 0x100080) +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index 3afdbf4bc10b..eff0a8ece8bc 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -173,6 +173,7 @@ static void vc4_bo_destroy(struct vc4_bo *bo) + vc4_bo_set_label(obj, -1); + + if (bo->validated_shader) { ++ kfree(bo->validated_shader->uniform_addr_offsets); + kfree(bo->validated_shader->texture_samples); + kfree(bo->validated_shader); + bo->validated_shader = NULL; +@@ -432,6 +433,7 @@ void vc4_free_object(struct drm_gem_object *gem_bo) + } + + if (bo->validated_shader) { ++ kfree(bo->validated_shader->uniform_addr_offsets); + kfree(bo->validated_shader->texture_samples); + kfree(bo->validated_shader); + bo->validated_shader = NULL; +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index d3f15bf60900..7cf82b071de2 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -942,6 +942,7 @@ vc4_validate_shader(struct drm_gem_cma_object *shader_obj) + fail: + kfree(validation_state.branch_targets); + if (validated_shader) { ++ kfree(validated_shader->uniform_addr_offsets); + kfree(validated_shader->texture_samples); + kfree(validated_shader); + } +diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c +index 43617fb28b87..317c9c2c0a7c 100644 +--- a/drivers/hid/hid-roccat-kovaplus.c ++++ b/drivers/hid/hid-roccat-kovaplus.c +@@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(uint value) + static void kovaplus_profile_activated(struct kovaplus_device *kovaplus, + uint new_profile_index) + { ++ if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings)) ++ return; + kovaplus->actual_profile = new_profile_index; + kovaplus->actual_cpi = kovaplus->profile_settings[new_profile_index].cpi_startup_level; + kovaplus->actual_x_sensitivity = kovaplus->profile_settings[new_profile_index].sensitivity_x; +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 25de7cc9f49f..6c725c435f5d 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -624,11 +624,13 @@ static inline int cma_validate_port(struct ib_device *device, u8 port, + if ((dev_type != ARPHRD_INFINIBAND) && rdma_protocol_ib(device, port)) + return ret; + +- if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port)) ++ if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port)) { + ndev = dev_get_by_index(&init_net, bound_if_index); +- else ++ if (!ndev) ++ return ret; ++ } else { + gid_type = IB_GID_TYPE_IB; +- ++ } + + ret = ib_find_cached_gid_by_port(device, gid, gid_type, port, + ndev, NULL); +diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c +index f2ae75fa3128..757d308bebe8 100644 +--- a/drivers/infiniband/core/cq.c ++++ b/drivers/infiniband/core/cq.c +@@ -17,6 +17,7 @@ + + /* # of WCs to poll for with a single call to ib_poll_cq */ + #define IB_POLL_BATCH 16 ++#define IB_POLL_BATCH_DIRECT 8 + + /* # of WCs to iterate over before yielding */ + #define IB_POLL_BUDGET_IRQ 256 +@@ -25,7 +26,8 @@ + #define IB_POLL_FLAGS \ + (IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS) + +-static int __ib_process_cq(struct ib_cq *cq, int budget) ++static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *wcs, ++ int batch) + { + int i, n, completed = 0; + +@@ -34,10 +36,10 @@ static int __ib_process_cq(struct ib_cq *cq, int budget) + * want to bound this call, thus we need unsigned + * minimum here. + */ +- while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH, +- budget - completed), cq->wc)) > 0) { ++ while ((n = ib_poll_cq(cq, min_t(u32, batch, ++ budget - completed), wcs)) > 0) { + for (i = 0; i < n; i++) { +- struct ib_wc *wc = &cq->wc[i]; ++ struct ib_wc *wc = &wcs[i]; + + if (wc->wr_cqe) + wc->wr_cqe->done(cq, wc); +@@ -47,8 +49,7 @@ static int __ib_process_cq(struct ib_cq *cq, int budget) + + completed += n; + +- if (n != IB_POLL_BATCH || +- (budget != -1 && completed >= budget)) ++ if (n != batch || (budget != -1 && completed >= budget)) + break; + } + +@@ -60,18 +61,20 @@ static int __ib_process_cq(struct ib_cq *cq, int budget) + * @cq: CQ to process + * @budget: number of CQEs to poll for + * +- * This function is used to process all outstanding CQ entries on a +- * %IB_POLL_DIRECT CQ. It does not offload CQ processing to a different +- * context and does not ask for completion interrupts from the HCA. ++ * This function is used to process all outstanding CQ entries. ++ * It does not offload CQ processing to a different context and does ++ * not ask for completion interrupts from the HCA. ++ * Using direct processing on CQ with non IB_POLL_DIRECT type may trigger ++ * concurrent processing. + * + * Note: do not pass -1 as %budget unless it is guaranteed that the number + * of completions that will be processed is small. + */ + int ib_process_cq_direct(struct ib_cq *cq, int budget) + { +- WARN_ON_ONCE(cq->poll_ctx != IB_POLL_DIRECT); ++ struct ib_wc wcs[IB_POLL_BATCH_DIRECT]; + +- return __ib_process_cq(cq, budget); ++ return __ib_process_cq(cq, budget, wcs, IB_POLL_BATCH_DIRECT); + } + EXPORT_SYMBOL(ib_process_cq_direct); + +@@ -85,7 +88,7 @@ static int ib_poll_handler(struct irq_poll *iop, int budget) + struct ib_cq *cq = container_of(iop, struct ib_cq, iop); + int completed; + +- completed = __ib_process_cq(cq, budget); ++ completed = __ib_process_cq(cq, budget, cq->wc, IB_POLL_BATCH); + if (completed < budget) { + irq_poll_complete(&cq->iop); + if (ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0) +@@ -105,7 +108,8 @@ static void ib_cq_poll_work(struct work_struct *work) + struct ib_cq *cq = container_of(work, struct ib_cq, work); + int completed; + +- completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE); ++ completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, cq->wc, ++ IB_POLL_BATCH); + if (completed >= IB_POLL_BUDGET_WORKQUEUE || + ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0) + queue_work(ib_comp_wq, &cq->work); +diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c +index 5286ad57d903..8f2dc79ad4ec 100644 +--- a/drivers/infiniband/core/uverbs_ioctl.c ++++ b/drivers/infiniband/core/uverbs_ioctl.c +@@ -245,16 +245,13 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev, + uintptr_t data[UVERBS_OPTIMIZE_USING_STACK_SZ / sizeof(uintptr_t)]; + #endif + +- if (hdr->reserved) +- return -EINVAL; +- + object_spec = uverbs_get_object(ib_dev, hdr->object_id); + if (!object_spec) +- return -EOPNOTSUPP; ++ return -EPROTONOSUPPORT; + + method_spec = uverbs_get_method(object_spec, hdr->method_id); + if (!method_spec) +- return -EOPNOTSUPP; ++ return -EPROTONOSUPPORT; + + if ((method_spec->flags & UVERBS_ACTION_FLAG_CREATE_ROOT) ^ !file->ucontext) + return -EINVAL; +@@ -310,6 +307,16 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev, + + err = uverbs_handle_method(buf, ctx->uattrs, hdr->num_attrs, ib_dev, + file, method_spec, ctx->uverbs_attr_bundle); ++ ++ /* ++ * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can ++ * not invoke the method because the request is not supported. No ++ * other cases should return this code. ++ */ ++ if (unlikely(err == -EPROTONOSUPPORT)) { ++ WARN_ON_ONCE(err == -EPROTONOSUPPORT); ++ err = -EINVAL; ++ } + out: + #ifdef UVERBS_OPTIMIZE_USING_STACK_SZ + if (ctx_size > UVERBS_OPTIMIZE_USING_STACK_SZ) +@@ -348,7 +355,7 @@ long ib_uverbs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + } + + if (hdr.reserved) { +- err = -EOPNOTSUPP; ++ err = -EPROTONOSUPPORT; + goto out; + } + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 0e17d03ef1cb..82114ba86041 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -8294,8 +8294,8 @@ static irqreturn_t sdma_interrupt(int irq, void *data) + /* handle the interrupt(s) */ + sdma_engine_interrupt(sde, status); + } else { +- dd_dev_err_ratelimited(dd, "SDMA engine %u interrupt, but no status bits set\n", +- sde->this_idx); ++ dd_dev_info_ratelimited(dd, "SDMA engine %u interrupt, but no status bits set\n", ++ sde->this_idx); + } + return IRQ_HANDLED; + } +@@ -12967,7 +12967,14 @@ static void disable_intx(struct pci_dev *pdev) + pci_intx(pdev, 0); + } + +-static void clean_up_interrupts(struct hfi1_devdata *dd) ++/** ++ * hfi1_clean_up_interrupts() - Free all IRQ resources ++ * @dd: valid device data data structure ++ * ++ * Free the MSI or INTx IRQs and assoicated PCI resources, ++ * if they have been allocated. ++ */ ++void hfi1_clean_up_interrupts(struct hfi1_devdata *dd) + { + int i; + +@@ -13344,7 +13351,7 @@ static int set_up_interrupts(struct hfi1_devdata *dd) + return 0; + + fail: +- clean_up_interrupts(dd); ++ hfi1_clean_up_interrupts(dd); + return ret; + } + +@@ -14770,7 +14777,6 @@ void hfi1_start_cleanup(struct hfi1_devdata *dd) + aspm_exit(dd); + free_cntrs(dd); + free_rcverr(dd); +- clean_up_interrupts(dd); + finish_chip_resources(dd); + } + +@@ -15229,7 +15235,7 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev, + bail_free_cntrs: + free_cntrs(dd); + bail_clear_intr: +- clean_up_interrupts(dd); ++ hfi1_clean_up_interrupts(dd); + bail_cleanup: + hfi1_pcie_ddcleanup(dd); + bail_free: +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index fd28f09b4445..ee2253d06984 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -191,9 +191,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) + if (!atomic_inc_not_zero(&dd->user_refcount)) + return -ENXIO; + +- /* Just take a ref now. Not all opens result in a context assign */ +- kobject_get(&dd->kobj); +- + /* The real work is performed later in assign_ctxt() */ + + fd = kzalloc(sizeof(*fd), GFP_KERNEL); +@@ -203,6 +200,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) + fd->mm = current->mm; + mmgrab(fd->mm); + fd->dd = dd; ++ kobject_get(&fd->dd->kobj); + fp->private_data = fd; + } else { + fp->private_data = NULL; +diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h +index 3409eee16092..dc9c951ef946 100644 +--- a/drivers/infiniband/hw/hfi1/hfi.h ++++ b/drivers/infiniband/hw/hfi1/hfi.h +@@ -1954,6 +1954,7 @@ void hfi1_verbs_unregister_sysfs(struct hfi1_devdata *dd); + int qsfp_dump(struct hfi1_pportdata *ppd, char *buf, int len); + + int hfi1_pcie_init(struct pci_dev *pdev, const struct pci_device_id *ent); ++void hfi1_clean_up_interrupts(struct hfi1_devdata *dd); + void hfi1_pcie_cleanup(struct pci_dev *pdev); + int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev); + void hfi1_pcie_ddcleanup(struct hfi1_devdata *); +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index fba77001c3a7..d4fc8795cdf6 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -1039,8 +1039,9 @@ static void shutdown_device(struct hfi1_devdata *dd) + } + dd->flags &= ~HFI1_INITTED; + +- /* mask interrupts, but not errors */ ++ /* mask and clean up interrupts, but not errors */ + set_intr_state(dd, 0); ++ hfi1_clean_up_interrupts(dd); + + for (pidx = 0; pidx < dd->num_pports; ++pidx) { + ppd = dd->pport + pidx; +@@ -1696,6 +1697,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dd_dev_err(dd, "Failed to create /dev devices: %d\n", -j); + + if (initfail || ret) { ++ hfi1_clean_up_interrupts(dd); + stop_timers(dd); + flush_workqueue(ib_wq); + for (pidx = 0; pidx < dd->num_pports; ++pidx) { +diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c +index 14d38d733cb4..27a2d782f6d9 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c +@@ -48,7 +48,6 @@ static void i40iw_ieq_tx_compl(struct i40iw_sc_vsi *vsi, void *sqwrid); + static void i40iw_ilq_putback_rcvbuf(struct i40iw_sc_qp *qp, u32 wqe_idx); + static enum i40iw_status_code i40iw_puda_replenish_rq(struct i40iw_puda_rsrc + *rsrc, bool initial); +-static void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp); + /** + * i40iw_puda_get_listbuf - get buffer from puda list + * @list: list to use for buffers (ILQ or IEQ) +@@ -1480,7 +1479,7 @@ static void i40iw_ieq_tx_compl(struct i40iw_sc_vsi *vsi, void *sqwrid) + * @ieq: ieq resource + * @qp: all pending fpdu buffers + */ +-static void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp) ++void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp) + { + struct i40iw_puda_buf *buf; + struct i40iw_pfpdu *pfpdu = &qp->pfpdu; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.h b/drivers/infiniband/hw/i40iw/i40iw_puda.h +index dba05ce7d392..ebe37f157d90 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_puda.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.h +@@ -186,4 +186,5 @@ enum i40iw_status_code i40iw_cqp_qp_create_cmd(struct i40iw_sc_dev *dev, struct + enum i40iw_status_code i40iw_cqp_cq_create_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_cq *cq); + void i40iw_cqp_qp_destroy_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp); + void i40iw_cqp_cq_destroy_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_cq *cq); ++void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp); + #endif +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index 62be0a41ad0b..b7961f21b555 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -428,6 +428,7 @@ void i40iw_free_qp_resources(struct i40iw_device *iwdev, + { + struct i40iw_pbl *iwpbl = &iwqp->iwpbl; + ++ i40iw_ieq_cleanup_qp(iwdev->vsi.ieq, &iwqp->sc_qp); + i40iw_dealloc_push_page(iwdev, &iwqp->sc_qp); + if (qp_num) + i40iw_free_resource(iwdev, iwdev->allocated_qps, qp_num); +@@ -1655,6 +1656,7 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd, + err_code = -EOVERFLOW; + goto err; + } ++ stag &= ~I40IW_CQPSQ_STAG_KEY_MASK; + iwmr->stag = stag; + iwmr->ibmr.rkey = stag; + iwmr->ibmr.lkey = stag; +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index c4d8cc1c2b1d..464c78f8cec9 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2923,7 +2923,8 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp, + * If we moved a kernel QP to RESET, clean up all old CQ + * entries and reinitialize the QP. + */ +- if (new_state == IB_QPS_RESET && !ibqp->uobject) { ++ if (new_state == IB_QPS_RESET && ++ !ibqp->uobject && ibqp->qp_type != IB_QPT_XRC_TGT) { + mlx5_ib_cq_clean(recv_cq, base->mqp.qpn, + ibqp->srq ? to_msrq(ibqp->srq) : NULL); + if (send_cq != recv_cq) +@@ -4636,13 +4637,10 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd *xrcd) + int err; + + err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn); +- if (err) { ++ if (err) + mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn); +- return err; +- } + + kfree(xrcd); +- + return 0; + } + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index a009e943362a..6bc9a768f721 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -2273,6 +2273,9 @@ static struct net_device *ipoib_add_port(const char *format, + priv->ca, ipoib_event); + ib_register_event_handler(&priv->event_handler); + ++ /* call event handler to ensure pkey in sync */ ++ queue_work(ipoib_workqueue, &priv->flush_heavy); ++ + result = register_netdev(priv->dev); + if (result) { + printk(KERN_WARNING "%s: couldn't register ipoib port %d; error %d\n", +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index 6a5649e52eed..8ac9e03c05b4 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -975,6 +975,21 @@ static void psmouse_apply_defaults(struct psmouse *psmouse) + psmouse->pt_deactivate = NULL; + } + ++static bool psmouse_do_detect(int (*detect)(struct psmouse *, bool), ++ struct psmouse *psmouse, bool allow_passthrough, ++ bool set_properties) ++{ ++ if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU && ++ !allow_passthrough) { ++ return false; ++ } ++ ++ if (set_properties) ++ psmouse_apply_defaults(psmouse); ++ ++ return detect(psmouse, set_properties) == 0; ++} ++ + static bool psmouse_try_protocol(struct psmouse *psmouse, + enum psmouse_type type, + unsigned int *max_proto, +@@ -986,15 +1001,8 @@ static bool psmouse_try_protocol(struct psmouse *psmouse, + if (!proto) + return false; + +- if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU && +- !proto->try_passthru) { +- return false; +- } +- +- if (set_properties) +- psmouse_apply_defaults(psmouse); +- +- if (proto->detect(psmouse, set_properties) != 0) ++ if (!psmouse_do_detect(proto->detect, psmouse, proto->try_passthru, ++ set_properties)) + return false; + + if (set_properties && proto->init && init_allowed) { +@@ -1027,8 +1035,8 @@ static int psmouse_extensions(struct psmouse *psmouse, + * Always check for focaltech, this is safe as it uses pnp-id + * matching. + */ +- if (psmouse_try_protocol(psmouse, PSMOUSE_FOCALTECH, +- &max_proto, set_properties, false)) { ++ if (psmouse_do_detect(focaltech_detect, ++ psmouse, false, set_properties)) { + if (max_proto > PSMOUSE_IMEX && + IS_ENABLED(CONFIG_MOUSE_PS2_FOCALTECH) && + (!set_properties || focaltech_init(psmouse) == 0)) { +@@ -1074,8 +1082,8 @@ static int psmouse_extensions(struct psmouse *psmouse, + * probing for IntelliMouse. + */ + if (max_proto > PSMOUSE_PS2 && +- psmouse_try_protocol(psmouse, PSMOUSE_SYNAPTICS, &max_proto, +- set_properties, false)) { ++ psmouse_do_detect(synaptics_detect, ++ psmouse, false, set_properties)) { + synaptics_hardware = true; + + if (max_proto > PSMOUSE_IMEX) { +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index ee5466a374bf..a246fc686bb7 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1280,6 +1280,16 @@ static void set_input_params(struct psmouse *psmouse, + INPUT_MT_POINTER | + (cr48_profile_sensor ? + INPUT_MT_TRACK : INPUT_MT_SEMI_MT)); ++ ++ /* ++ * For semi-mt devices we send ABS_X/Y ourselves instead of ++ * input_mt_report_pointer_emulation. But ++ * input_mt_init_slots() resets the fuzz to 0, leading to a ++ * filtered ABS_MT_POSITION_X but an unfiltered ABS_X ++ * position. Let's re-initialize ABS_X/Y here. ++ */ ++ if (!cr48_profile_sensor) ++ set_abs_position_params(dev, &priv->info, ABS_X, ABS_Y); + } + + if (SYN_CAP_PALMDETECT(info->capabilities)) +diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c +index 8c6c6178ec12..025bae3853cc 100644 +--- a/drivers/input/touchscreen/stmfts.c ++++ b/drivers/input/touchscreen/stmfts.c +@@ -687,6 +687,14 @@ static int stmfts_probe(struct i2c_client *client, + + input_set_drvdata(sdata->input, sdata); + ++ /* ++ * stmfts_power_on expects interrupt to be disabled, but ++ * at this point the device is still off and I do not trust ++ * the status of the irq line that can generate some spurious ++ * interrupts. To be on the safe side it's better to not enable ++ * the interrupts during their request. ++ */ ++ irq_set_status_flags(client->irq, IRQ_NOAUTOEN); + err = devm_request_threaded_irq(&client->dev, client->irq, + NULL, stmfts_irq_handler, + IRQF_ONESHOT, +@@ -694,9 +702,6 @@ static int stmfts_probe(struct i2c_client *client, + if (err) + return err; + +- /* stmfts_power_on expects interrupt to be disabled */ +- disable_irq(client->irq); +- + dev_dbg(&client->dev, "initializing ST-Microelectronics FTS...\n"); + + err = stmfts_power_on(sdata); +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index 25c2c75f5332..13485a40dd46 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -1344,8 +1344,15 @@ static const struct iommu_ops exynos_iommu_ops = { + + static int __init exynos_iommu_init(void) + { ++ struct device_node *np; + int ret; + ++ np = of_find_matching_node(NULL, sysmmu_of_match); ++ if (!np) ++ return 0; ++ ++ of_node_put(np); ++ + lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table", + LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL); + if (!lv2table_kmem_cache) { +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 83f3d4831f94..e8414bcf8390 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1603,8 +1603,7 @@ static void iommu_flush_iotlb_psi(struct intel_iommu *iommu, + * flush. However, device IOTLB doesn't need to be flushed in this case. + */ + if (!cap_caching_mode(iommu->cap) || !map) +- iommu_flush_dev_iotlb(get_iommu_domain(iommu, did), +- addr, mask); ++ iommu_flush_dev_iotlb(domain, addr, mask); + } + + static void iommu_flush_iova(struct iova_domain *iovad) +diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c +index 14a8c0a7e095..25a98de5cfb2 100644 +--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c ++++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c +@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void) + + for (np = of_find_matching_node(NULL, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) + continue; + +diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c +index 833a90fe33ae..8881a053c173 100644 +--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c ++++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c +@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void) + + for (np = of_find_matching_node(NULL, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) + continue; + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index af57f8473a88..13f195c9743e 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -3083,6 +3083,8 @@ static int __init its_of_probe(struct device_node *node) + + for (np = of_find_matching_node(node, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) { + pr_warn("%pOF: no msi-controller property, ITS ignored\n", + np); +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 848fcdf6a112..3d7374655587 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -645,7 +645,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq) + MPIDR_TO_SGI_AFFINITY(cluster_id, 1) | + tlist << ICC_SGI1R_TARGET_LIST_SHIFT); + +- pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val); ++ pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val); + gic_write_sgi1r(val); + } + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index f0dc8e2aee65..8c13a9036d07 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -287,8 +287,10 @@ do { \ + break; \ + \ + mutex_unlock(&(ca)->set->bucket_lock); \ +- if (kthread_should_stop()) \ ++ if (kthread_should_stop()) { \ ++ set_current_state(TASK_RUNNING); \ + return 0; \ ++ } \ + \ + schedule(); \ + mutex_lock(&(ca)->set->bucket_lock); \ +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index abd31e847f96..e4a3f692057b 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -906,7 +906,7 @@ void bcache_write_super(struct cache_set *); + + int bch_flash_dev_create(struct cache_set *c, uint64_t size); + +-int bch_cached_dev_attach(struct cached_dev *, struct cache_set *); ++int bch_cached_dev_attach(struct cached_dev *, struct cache_set *, uint8_t *); + void bch_cached_dev_detach(struct cached_dev *); + void bch_cached_dev_run(struct cached_dev *); + void bcache_device_stop(struct bcache_device *); +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 1598d1e04989..89d088cf95d9 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1868,14 +1868,17 @@ void bch_initial_gc_finish(struct cache_set *c) + */ + for_each_cache(ca, c, i) { + for_each_bucket(b, ca) { +- if (fifo_full(&ca->free[RESERVE_PRIO])) ++ if (fifo_full(&ca->free[RESERVE_PRIO]) && ++ fifo_full(&ca->free[RESERVE_BTREE])) + break; + + if (bch_can_invalidate_bucket(ca, b) && + !GC_MARK(b)) { + __bch_invalidate_one_bucket(ca, b); +- fifo_push(&ca->free[RESERVE_PRIO], +- b - ca->buckets); ++ if (!fifo_push(&ca->free[RESERVE_PRIO], ++ b - ca->buckets)) ++ fifo_push(&ca->free[RESERVE_BTREE], ++ b - ca->buckets); + } + } + } +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 5d0430777dda..fe6e4c319b7c 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -939,7 +939,8 @@ void bch_cached_dev_detach(struct cached_dev *dc) + cached_dev_put(dc); + } + +-int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) ++int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c, ++ uint8_t *set_uuid) + { + uint32_t rtime = cpu_to_le32(get_seconds()); + struct uuid_entry *u; +@@ -948,7 +949,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + + bdevname(dc->bdev, buf); + +- if (memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)) ++ if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) || ++ (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16))) + return -ENOENT; + + if (dc->disk.c) { +@@ -1190,7 +1192,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page, + + list_add(&dc->list, &uncached_devices); + list_for_each_entry(c, &bch_cache_sets, list) +- bch_cached_dev_attach(dc, c); ++ bch_cached_dev_attach(dc, c, NULL); + + if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE || + BDEV_STATE(&dc->sb) == BDEV_STATE_STALE) +@@ -1712,7 +1714,7 @@ static void run_cache_set(struct cache_set *c) + bcache_write_super(c); + + list_for_each_entry_safe(dc, t, &uncached_devices, list) +- bch_cached_dev_attach(dc, c); ++ bch_cached_dev_attach(dc, c, NULL); + + flash_devs_run(c); + +@@ -1829,6 +1831,7 @@ void bch_cache_release(struct kobject *kobj) + static int cache_alloc(struct cache *ca) + { + size_t free; ++ size_t btree_buckets; + struct bucket *b; + + __module_get(THIS_MODULE); +@@ -1836,9 +1839,19 @@ static int cache_alloc(struct cache *ca) + + bio_init(&ca->journal.bio, ca->journal.bio.bi_inline_vecs, 8); + ++ /* ++ * when ca->sb.njournal_buckets is not zero, journal exists, ++ * and in bch_journal_replay(), tree node may split, ++ * so bucket of RESERVE_BTREE type is needed, ++ * the worst situation is all journal buckets are valid journal, ++ * and all the keys need to replay, ++ * so the number of RESERVE_BTREE type buckets should be as much ++ * as journal buckets ++ */ ++ btree_buckets = ca->sb.njournal_buckets ?: 8; + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; + +- if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || ++ if (!init_fifo(&ca->free[RESERVE_BTREE], btree_buckets, GFP_KERNEL) || + !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c +index 234b2f5b286d..5d81cd06af00 100644 +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -193,7 +193,7 @@ STORE(__cached_dev) + { + struct cached_dev *dc = container_of(kobj, struct cached_dev, + disk.kobj); +- ssize_t v = size; ++ ssize_t v; + struct cache_set *c; + struct kobj_uevent_env *env; + +@@ -265,17 +265,20 @@ STORE(__cached_dev) + } + + if (attr == &sysfs_attach) { +- if (bch_parse_uuid(buf, dc->sb.set_uuid) < 16) ++ uint8_t set_uuid[16]; ++ ++ if (bch_parse_uuid(buf, set_uuid) < 16) + return -EINVAL; + ++ v = -ENOENT; + list_for_each_entry(c, &bch_cache_sets, list) { +- v = bch_cached_dev_attach(dc, c); ++ v = bch_cached_dev_attach(dc, c, set_uuid); + if (!v) + return size; + } + + pr_err("Can't attach %s: cache set not found", buf); +- size = v; ++ return v; + } + + if (attr == &sysfs_detach && dc->disk.c) +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index 70454f2ad2fa..f046dedc59ab 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -420,18 +420,21 @@ static int bch_writeback_thread(void *arg) + + while (!kthread_should_stop()) { + down_write(&dc->writeback_lock); ++ set_current_state(TASK_INTERRUPTIBLE); + if (!atomic_read(&dc->has_dirty) || + (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) && + !dc->writeback_running)) { + up_write(&dc->writeback_lock); +- set_current_state(TASK_INTERRUPTIBLE); + +- if (kthread_should_stop()) ++ if (kthread_should_stop()) { ++ set_current_state(TASK_RUNNING); + return 0; ++ } + + schedule(); + continue; + } ++ set_current_state(TASK_RUNNING); + + searched_full_index = refill_dirty(dc); + +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index 2704a55f8b6e..8b7328666eaa 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -502,8 +502,20 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq, + if (queue_dying) { + atomic_inc(&m->pg_init_in_progress); + activate_or_offline_path(pgpath); ++ return DM_MAPIO_DELAY_REQUEUE; + } +- return DM_MAPIO_DELAY_REQUEUE; ++ ++ /* ++ * blk-mq's SCHED_RESTART can cover this requeue, so we ++ * needn't deal with it by DELAY_REQUEUE. More importantly, ++ * we have to return DM_MAPIO_REQUEUE so that blk-mq can ++ * get the queue busy feedback (via BLK_STS_RESOURCE), ++ * otherwise I/O merging can suffer. ++ */ ++ if (q->mq_ops) ++ return DM_MAPIO_REQUEUE; ++ else ++ return DM_MAPIO_DELAY_REQUEUE; + } + clone->bio = clone->biotail = NULL; + clone->rq_disk = bdev->bd_disk; +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 7f837006bb6a..3bdeb295514b 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2932,7 +2932,7 @@ static irqreturn_t gfar_transmit(int irq, void *grp_id) + static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + struct sk_buff *skb, bool first) + { +- unsigned int size = lstatus & BD_LENGTH_MASK; ++ int size = lstatus & BD_LENGTH_MASK; + struct page *page = rxb->page; + bool last = !!(lstatus & BD_LFLAG(RXBD_LAST)); + +@@ -2947,11 +2947,16 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + if (last) + size -= skb->len; + +- /* in case the last fragment consisted only of the FCS */ ++ /* Add the last fragment if it contains something other than ++ * the FCS, otherwise drop it and trim off any part of the FCS ++ * that was already received. ++ */ + if (size > 0) + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, + rxb->page_offset + RXBUF_ALIGNMENT, + size, GFAR_RXB_TRUESIZE); ++ else if (size < 0) ++ pskb_trim(skb, skb->len + size); + } + + /* try reuse page */ +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c +index e69d49d91d67..914258310ddd 100644 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c +@@ -815,8 +815,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set) + if (vid >= VLAN_N_VID) + return -EINVAL; + +- /* Verify we have permission to add VLANs */ +- if (hw->mac.vlan_override) ++ /* Verify that we have permission to add VLANs. If this is a request ++ * to remove a VLAN, we still want to allow the user to remove the ++ * VLAN device. In that case, we need to clear the bit in the ++ * active_vlans bitmask. ++ */ ++ if (set && hw->mac.vlan_override) + return -EACCES; + + /* update active_vlans bitmask */ +@@ -835,6 +839,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set) + rx_ring->vid &= ~FM10K_VLAN_CLEAR; + } + ++ /* If our VLAN has been overridden, there is no reason to send VLAN ++ * removal requests as they will be silently ignored. ++ */ ++ if (hw->mac.vlan_override) ++ return 0; ++ + /* Do not remove default VLAN ID related entries from VLAN and MAC + * tables + */ +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 05e89864f781..ef22793d6a03 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -2588,16 +2588,16 @@ static int i40e_get_ethtool_fdir_entry(struct i40e_pf *pf, + + no_input_set: + if (input_set & I40E_L3_SRC_MASK) +- fsp->m_u.tcp_ip4_spec.ip4src = htonl(0xFFFF); ++ fsp->m_u.tcp_ip4_spec.ip4src = htonl(0xFFFFFFFF); + + if (input_set & I40E_L3_DST_MASK) +- fsp->m_u.tcp_ip4_spec.ip4dst = htonl(0xFFFF); ++ fsp->m_u.tcp_ip4_spec.ip4dst = htonl(0xFFFFFFFF); + + if (input_set & I40E_L4_SRC_MASK) +- fsp->m_u.tcp_ip4_spec.psrc = htons(0xFFFFFFFF); ++ fsp->m_u.tcp_ip4_spec.psrc = htons(0xFFFF); + + if (input_set & I40E_L4_DST_MASK) +- fsp->m_u.tcp_ip4_spec.pdst = htons(0xFFFFFFFF); ++ fsp->m_u.tcp_ip4_spec.pdst = htons(0xFFFF); + + if (rule->dest_ctl == I40E_FILTER_PROGRAM_DESC_DEST_DROP_PACKET) + fsp->ring_cookie = RX_CLS_FLOW_DISC; +@@ -3648,6 +3648,16 @@ static int i40e_check_fdir_input_set(struct i40e_vsi *vsi, + + i40e_write_fd_input_set(pf, index, new_mask); + ++ /* IP_USER_FLOW filters match both IPv4/Other and IPv4/Fragmented ++ * frames. If we're programming the input set for IPv4/Other, we also ++ * need to program the IPv4/Fragmented input set. Since we don't have ++ * separate support, we'll always assume and enforce that the two flow ++ * types must have matching input sets. ++ */ ++ if (index == I40E_FILTER_PCTYPE_NONF_IPV4_OTHER) ++ i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_FRAG_IPV4, ++ new_mask); ++ + /* Add the new offset and update table, if necessary */ + if (new_flex_offset) { + err = i40e_add_flex_offset(&pf->l4_flex_pit_list, src_offset, +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index b1cde1b051a4..d36b799116e4 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5828,6 +5828,9 @@ static void i40e_fdir_filter_exit(struct i40e_pf *pf) + /* Reprogram the default input set for Other/IPv4 */ + i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_NONF_IPV4_OTHER, + I40E_L3_SRC_MASK | I40E_L3_DST_MASK); ++ ++ i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_FRAG_IPV4, ++ I40E_L3_SRC_MASK | I40E_L3_DST_MASK); + } + + /** +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf.h b/drivers/net/ethernet/intel/i40evf/i40evf.h +index 82f69031e5cd..2ef32ab1dfae 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf.h ++++ b/drivers/net/ethernet/intel/i40evf/i40evf.h +@@ -186,6 +186,7 @@ enum i40evf_state_t { + enum i40evf_critical_section_t { + __I40EVF_IN_CRITICAL_TASK, /* cannot be interrupted */ + __I40EVF_IN_CLIENT_TASK, ++ __I40EVF_IN_REMOVE_TASK, /* device being removed */ + }; + + /* board specific private data structure */ +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index 4eb6ff60e8fc..1b5d204c57c1 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -1839,6 +1839,12 @@ static void i40evf_reset_task(struct work_struct *work) + int i = 0, err; + bool running; + ++ /* When device is being removed it doesn't make sense to run the reset ++ * task, just return in such a case. ++ */ ++ if (test_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section)) ++ return; ++ + while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK, + &adapter->crit_section)) + usleep_range(500, 1000); +@@ -3022,7 +3028,8 @@ static void i40evf_remove(struct pci_dev *pdev) + struct i40evf_mac_filter *f, *ftmp; + struct i40e_hw *hw = &adapter->hw; + int err; +- ++ /* Indicate we are in remove and not to run reset_task */ ++ set_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section); + cancel_delayed_work_sync(&adapter->init_task); + cancel_work_sync(&adapter->reset_task); + cancel_delayed_work_sync(&adapter->client_task); +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c +index 85876f4fb1fb..46bf11afba08 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c +@@ -937,23 +937,34 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter, + if (v_opcode == VIRTCHNL_OP_EVENT) { + struct virtchnl_pf_event *vpe = + (struct virtchnl_pf_event *)msg; ++ bool link_up = vpe->event_data.link_event.link_status; + switch (vpe->event) { + case VIRTCHNL_EVENT_LINK_CHANGE: + adapter->link_speed = + vpe->event_data.link_event.link_speed; +- if (adapter->link_up != +- vpe->event_data.link_event.link_status) { +- adapter->link_up = +- vpe->event_data.link_event.link_status; +- if (adapter->link_up) { +- netif_tx_start_all_queues(netdev); +- netif_carrier_on(netdev); +- } else { +- netif_tx_stop_all_queues(netdev); +- netif_carrier_off(netdev); +- } +- i40evf_print_link_message(adapter); ++ ++ /* we've already got the right link status, bail */ ++ if (adapter->link_up == link_up) ++ break; ++ ++ /* If we get link up message and start queues before ++ * our queues are configured it will trigger a TX hang. ++ * In that case, just ignore the link status message, ++ * we'll get another one after we enable queues and ++ * actually prepared to send traffic. ++ */ ++ if (link_up && adapter->state != __I40EVF_RUNNING) ++ break; ++ ++ adapter->link_up = link_up; ++ if (link_up) { ++ netif_tx_start_all_queues(netdev); ++ netif_carrier_on(netdev); ++ } else { ++ netif_tx_stop_all_queues(netdev); ++ netif_carrier_off(netdev); + } ++ i40evf_print_link_message(adapter); + break; + case VIRTCHNL_EVENT_RESET_IMPENDING: + dev_info(&adapter->pdev->dev, "PF reset warning received\n"); +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index d1a44a84c97e..6ca580cdfd84 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8373,7 +8373,8 @@ static void igb_rar_set_index(struct igb_adapter *adapter, u32 index) + + /* Indicate to hardware the Address is Valid. */ + if (adapter->mac_table[index].state & IGB_MAC_STATE_IN_USE) { +- rar_high |= E1000_RAH_AV; ++ if (is_valid_ether_addr(addr)) ++ rar_high |= E1000_RAH_AV; + + if (hw->mac.type == e1000_82575) + rar_high |= E1000_RAH_POOL_1 * +@@ -8411,17 +8412,36 @@ static int igb_set_vf_mac(struct igb_adapter *adapter, + static int igb_ndo_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) + { + struct igb_adapter *adapter = netdev_priv(netdev); +- if (!is_valid_ether_addr(mac) || (vf >= adapter->vfs_allocated_count)) ++ ++ if (vf >= adapter->vfs_allocated_count) ++ return -EINVAL; ++ ++ /* Setting the VF MAC to 0 reverts the IGB_VF_FLAG_PF_SET_MAC ++ * flag and allows to overwrite the MAC via VF netdev. This ++ * is necessary to allow libvirt a way to restore the original ++ * MAC after unbinding vfio-pci and reloading igbvf after shutting ++ * down a VM. ++ */ ++ if (is_zero_ether_addr(mac)) { ++ adapter->vf_data[vf].flags &= ~IGB_VF_FLAG_PF_SET_MAC; ++ dev_info(&adapter->pdev->dev, ++ "remove administratively set MAC on VF %d\n", ++ vf); ++ } else if (is_valid_ether_addr(mac)) { ++ adapter->vf_data[vf].flags |= IGB_VF_FLAG_PF_SET_MAC; ++ dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n", ++ mac, vf); ++ dev_info(&adapter->pdev->dev, ++ "Reload the VF driver to make this change effective."); ++ /* Generate additional warning if PF is down */ ++ if (test_bit(__IGB_DOWN, &adapter->state)) { ++ dev_warn(&adapter->pdev->dev, ++ "The VF MAC address has been set, but the PF device is not up.\n"); ++ dev_warn(&adapter->pdev->dev, ++ "Bring the PF device up before attempting to use the VF device.\n"); ++ } ++ } else { + return -EINVAL; +- adapter->vf_data[vf].flags |= IGB_VF_FLAG_PF_SET_MAC; +- dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n", mac, vf); +- dev_info(&adapter->pdev->dev, +- "Reload the VF driver to make this change effective."); +- if (test_bit(__IGB_DOWN, &adapter->state)) { +- dev_warn(&adapter->pdev->dev, +- "The VF MAC address has been set, but the PF device is not up.\n"); +- dev_warn(&adapter->pdev->dev, +- "Bring the PF device up before attempting to use the VF device.\n"); + } + return igb_set_vf_mac(adapter, vf, mac); + } +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c +index 841c2a083349..0746b19ec6d3 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c +@@ -643,6 +643,10 @@ static void igb_ptp_tx_work(struct work_struct *work) + adapter->ptp_tx_skb = NULL; + clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state); + adapter->tx_hwtstamp_timeouts++; ++ /* Clear the tx valid bit in TSYNCTXCTL register to enable ++ * interrupt ++ */ ++ rd32(E1000_TXSTMPH); + dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n"); + return; + } +@@ -717,6 +721,7 @@ void igb_ptp_rx_hang(struct igb_adapter *adapter) + */ + void igb_ptp_tx_hang(struct igb_adapter *adapter) + { ++ struct e1000_hw *hw = &adapter->hw; + bool timeout = time_is_before_jiffies(adapter->ptp_tx_start + + IGB_PTP_TX_TIMEOUT); + +@@ -736,6 +741,10 @@ void igb_ptp_tx_hang(struct igb_adapter *adapter) + adapter->ptp_tx_skb = NULL; + clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state); + adapter->tx_hwtstamp_timeouts++; ++ /* Clear the tx valid bit in TSYNCTXCTL register to enable ++ * interrupt ++ */ ++ rd32(E1000_TXSTMPH); + dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n"); + } + } +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 29f600fd6977..9e30cfeac04b 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -3987,11 +3987,15 @@ void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter, + rxdctl &= ~0x3FFFFF; + rxdctl |= 0x080420; + #if (PAGE_SIZE < 8192) +- } else { ++ /* RXDCTL.RLPML does not work on 82599 */ ++ } else if (hw->mac.type != ixgbe_mac_82599EB) { + rxdctl &= ~(IXGBE_RXDCTL_RLPMLMASK | + IXGBE_RXDCTL_RLPML_EN); + +- /* Limit the maximum frame size so we don't overrun the skb */ ++ /* Limit the maximum frame size so we don't overrun the skb. ++ * This can happen in SRIOV mode when the MTU of the VF is ++ * higher than the MTU of the PF. ++ */ + if (ring_uses_build_skb(ring) && + !test_bit(__IXGBE_RX_3K_BUFFER, &ring->state)) + rxdctl |= IXGBE_MAX_2K_FRAME_BUILD_SKB | +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c +index f8fa63b66739..a1a15e0c2245 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c +@@ -492,6 +492,7 @@ static int nfp_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, + "Error: %d VFs already enabled, but loaded FW can only support %d\n", + pf->num_vfs, pf->limit_vfs); ++ err = -EINVAL; + goto err_fw_unload; + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +index 4404650b32c5..8be4b32544ef 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +@@ -116,7 +116,7 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac) + snprintf(clk_name, sizeof(clk_name), "%s#m250_sel", dev_name(dev)); + init.name = clk_name; + init.ops = &clk_mux_ops; +- init.flags = 0; ++ init.flags = CLK_SET_RATE_PARENT; + init.parent_names = mux_parent_names; + init.num_parents = MUX_CLK_NUM_PARENTS; + +@@ -144,7 +144,9 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac) + dwmac->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT; + dwmac->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH; + dwmac->m250_div.hw.init = &init; +- dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO; ++ dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED | ++ CLK_DIVIDER_ALLOW_ZERO | ++ CLK_DIVIDER_ROUND_CLOSEST; + + dwmac->m250_div_clk = devm_clk_register(dev, &dwmac->m250_div.hw); + if (WARN_ON(IS_ERR(dwmac->m250_div_clk))) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index 2f7d7ec59962..e1d03489ae63 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -562,10 +562,12 @@ static int dwmac4_irq_status(struct mac_device_info *hw, + struct stmmac_extra_stats *x) + { + void __iomem *ioaddr = hw->pcsr; +- u32 intr_status; ++ u32 intr_status = readl(ioaddr + GMAC_INT_STATUS); ++ u32 intr_enable = readl(ioaddr + GMAC_INT_EN); + int ret = 0; + +- intr_status = readl(ioaddr + GMAC_INT_STATUS); ++ /* Discard disabled bits */ ++ intr_status &= intr_enable; + + /* Not used events (e.g. MMC interrupts) are not handled. */ + if ((intr_status & mmc_tx_irq)) +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index d148dbf3beeb..d686ba10fecc 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3153,8 +3153,10 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) { + u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]); + +- if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) ++ if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) { ++ kfree(hwname); + return -EINVAL; ++ } + param.regd = hwsim_world_regdom_custom[idx]; + } + +@@ -3425,8 +3427,11 @@ static void __net_exit hwsim_exit_net(struct net *net) + continue; + + list_del(&data->list); +- INIT_WORK(&data->destroy_work, destroy_radio); +- schedule_work(&data->destroy_work); ++ spin_unlock_bh(&hwsim_radio_lock); ++ mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), ++ NULL); ++ spin_lock_bh(&hwsim_radio_lock); ++ + } + spin_unlock_bh(&hwsim_radio_lock); + } +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index a9ba9fe263ca..f07b9c9bb5ba 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -351,6 +351,9 @@ static int xennet_open(struct net_device *dev) + unsigned int i = 0; + struct netfront_queue *queue = NULL; + ++ if (!np->queues) ++ return -ENODEV; ++ + for (i = 0; i < num_queues; ++i) { + queue = &np->queues[i]; + napi_enable(&queue->napi); +@@ -1358,18 +1361,8 @@ static int netfront_probe(struct xenbus_device *dev, + #ifdef CONFIG_SYSFS + info->netdev->sysfs_groups[0] = &xennet_dev_group; + #endif +- err = register_netdev(info->netdev); +- if (err) { +- pr_warn("%s: register_netdev err=%d\n", __func__, err); +- goto fail; +- } + + return 0; +- +- fail: +- xennet_free_netdev(netdev); +- dev_set_drvdata(&dev->dev, NULL); +- return err; + } + + static void xennet_end_access(int ref, void *page) +@@ -1738,8 +1731,6 @@ static void xennet_destroy_queues(struct netfront_info *info) + { + unsigned int i; + +- rtnl_lock(); +- + for (i = 0; i < info->netdev->real_num_tx_queues; i++) { + struct netfront_queue *queue = &info->queues[i]; + +@@ -1748,8 +1739,6 @@ static void xennet_destroy_queues(struct netfront_info *info) + netif_napi_del(&queue->napi); + } + +- rtnl_unlock(); +- + kfree(info->queues); + info->queues = NULL; + } +@@ -1765,8 +1754,6 @@ static int xennet_create_queues(struct netfront_info *info, + if (!info->queues) + return -ENOMEM; + +- rtnl_lock(); +- + for (i = 0; i < *num_queues; i++) { + struct netfront_queue *queue = &info->queues[i]; + +@@ -1775,7 +1762,7 @@ static int xennet_create_queues(struct netfront_info *info, + + ret = xennet_init_queue(queue); + if (ret < 0) { +- dev_warn(&info->netdev->dev, ++ dev_warn(&info->xbdev->dev, + "only created %d queues\n", i); + *num_queues = i; + break; +@@ -1789,10 +1776,8 @@ static int xennet_create_queues(struct netfront_info *info, + + netif_set_real_num_tx_queues(info->netdev, *num_queues); + +- rtnl_unlock(); +- + if (*num_queues == 0) { +- dev_err(&info->netdev->dev, "no queues\n"); ++ dev_err(&info->xbdev->dev, "no queues\n"); + return -EINVAL; + } + return 0; +@@ -1829,6 +1814,7 @@ static int talk_to_netback(struct xenbus_device *dev, + goto out; + } + ++ rtnl_lock(); + if (info->queues) + xennet_destroy_queues(info); + +@@ -1839,6 +1825,7 @@ static int talk_to_netback(struct xenbus_device *dev, + info->queues = NULL; + goto out; + } ++ rtnl_unlock(); + + /* Create shared ring, alloc event channel -- for each queue */ + for (i = 0; i < num_queues; ++i) { +@@ -1935,8 +1922,10 @@ static int talk_to_netback(struct xenbus_device *dev, + xenbus_transaction_end(xbt, 1); + destroy_ring: + xennet_disconnect_backend(info); ++ rtnl_lock(); + xennet_destroy_queues(info); + out: ++ rtnl_unlock(); + device_unregister(&dev->dev); + return err; + } +@@ -1966,6 +1955,15 @@ static int xennet_connect(struct net_device *dev) + netdev_update_features(dev); + rtnl_unlock(); + ++ if (dev->reg_state == NETREG_UNINITIALIZED) { ++ err = register_netdev(dev); ++ if (err) { ++ pr_warn("%s: register_netdev err=%d\n", __func__, err); ++ device_unregister(&np->xbdev->dev); ++ return err; ++ } ++ } ++ + /* + * All public and private state should now be sane. Get + * ready to start sending and receiving packets and give the driver +@@ -2156,10 +2154,14 @@ static int xennet_remove(struct xenbus_device *dev) + + xennet_disconnect_backend(info); + +- unregister_netdev(info->netdev); ++ if (info->netdev->reg_state == NETREG_REGISTERED) ++ unregister_netdev(info->netdev); + +- if (info->queues) ++ if (info->queues) { ++ rtnl_lock(); + xennet_destroy_queues(info); ++ rtnl_unlock(); ++ } + xennet_free_netdev(info->netdev); + + return 0; +diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c +index f58d8e305323..18339b7e88a4 100644 +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -998,6 +998,9 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, + mw_base = nt->mw_vec[mw_num].phys_addr; + mw_size = nt->mw_vec[mw_num].phys_size; + ++ if (max_mw_size && mw_size > max_mw_size) ++ mw_size = max_mw_size; ++ + tx_size = (unsigned int)mw_size / num_qps_mw; + qp_offset = tx_size * (qp_num / mw_count); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 5c5a8af66829..116127a0accb 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3879,6 +3879,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9120, + quirk_dma_func1_alias); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123, + quirk_dma_func1_alias); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, ++ quirk_dma_func1_alias); + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130, + quirk_dma_func1_alias); +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index 7424e53157b0..dd5043a6a114 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -1177,6 +1177,7 @@ static u8 kbd_previous_mode_bit; + + static bool kbd_led_present; + static DEFINE_MUTEX(kbd_led_mutex); ++static enum led_brightness kbd_led_level; + + /* + * NOTE: there are three ways to set the keyboard backlight level. +@@ -2020,6 +2021,7 @@ static enum led_brightness kbd_led_level_get(struct led_classdev *led_cdev) + static int kbd_led_level_set(struct led_classdev *led_cdev, + enum led_brightness value) + { ++ enum led_brightness new_value = value; + struct kbd_state state; + struct kbd_state new_state; + u16 num; +@@ -2049,6 +2051,9 @@ static int kbd_led_level_set(struct led_classdev *led_cdev, + } + + out: ++ if (ret == 0) ++ kbd_led_level = new_value; ++ + mutex_unlock(&kbd_led_mutex); + return ret; + } +@@ -2076,6 +2081,9 @@ static int __init kbd_led_init(struct device *dev) + if (kbd_led.max_brightness) + kbd_led.max_brightness--; + } ++ ++ kbd_led_level = kbd_led_level_get(NULL); ++ + ret = led_classdev_register(dev, &kbd_led); + if (ret) + kbd_led_present = false; +@@ -2100,13 +2108,25 @@ static void kbd_led_exit(void) + static int dell_laptop_notifier_call(struct notifier_block *nb, + unsigned long action, void *data) + { ++ bool changed = false; ++ enum led_brightness new_kbd_led_level; ++ + switch (action) { + case DELL_LAPTOP_KBD_BACKLIGHT_BRIGHTNESS_CHANGED: + if (!kbd_led_present) + break; + +- led_classdev_notify_brightness_hw_changed(&kbd_led, +- kbd_led_level_get(&kbd_led)); ++ mutex_lock(&kbd_led_mutex); ++ new_kbd_led_level = kbd_led_level_get(&kbd_led); ++ if (kbd_led_level != new_kbd_led_level) { ++ kbd_led_level = new_kbd_led_level; ++ changed = true; ++ } ++ mutex_unlock(&kbd_led_mutex); ++ ++ if (changed) ++ led_classdev_notify_brightness_hw_changed(&kbd_led, ++ kbd_led_level); + break; + } + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 2242d6035d9e..c407d52ef7cf 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -214,6 +214,10 @@ enum tpacpi_hkey_event_t { + /* AC-related events */ + TP_HKEY_EV_AC_CHANGED = 0x6040, /* AC status changed */ + ++ /* Further user-interface events */ ++ TP_HKEY_EV_PALM_DETECTED = 0x60b0, /* palm hoveres keyboard */ ++ TP_HKEY_EV_PALM_UNDETECTED = 0x60b1, /* palm removed */ ++ + /* Misc */ + TP_HKEY_EV_RFKILL_CHANGED = 0x7000, /* rfkill switch changed */ + }; +@@ -3973,6 +3977,12 @@ static bool hotkey_notify_6xxx(const u32 hkey, + *send_acpi_ev = false; + break; + ++ case TP_HKEY_EV_PALM_DETECTED: ++ case TP_HKEY_EV_PALM_UNDETECTED: ++ /* palm detected hovering the keyboard, forward to user-space ++ * via netlink for consumption */ ++ return true; ++ + default: + pr_warn("unknown possible thermal alarm or keyboard event received\n"); + known = false; +diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c +index 24388795ee9a..936e8c735656 100644 +--- a/drivers/scsi/arm/fas216.c ++++ b/drivers/scsi/arm/fas216.c +@@ -2011,7 +2011,7 @@ static void fas216_rq_sns_done(FAS216_Info *info, struct scsi_cmnd *SCpnt, + * have valid data in the sense buffer that could + * confuse the higher levels. + */ +- memset(SCpnt->sense_buffer, 0, sizeof(SCpnt->sense_buffer)); ++ memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE); + //printk("scsi%d.%c: sense buffer: ", info->host->host_no, '0' + SCpnt->device->id); + //{ int i; for (i = 0; i < 32; i++) printk("%02x ", SCpnt->sense_buffer[i]); printk("\n"); } + /* +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 2300c02ab5e6..e24f57946a17 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -115,6 +115,8 @@ qla2x00_async_iocb_timeout(void *data) + + switch (sp->type) { + case SRB_LOGIN_CMD: ++ if (!fcport) ++ break; + /* Retry as needed. */ + lio->u.logio.data[0] = MBS_COMMAND_ERROR; + lio->u.logio.data[1] = lio->u.logio.flags & SRB_LOGIN_RETRIED ? +@@ -128,6 +130,8 @@ qla2x00_async_iocb_timeout(void *data) + qla24xx_handle_plogi_done_event(fcport->vha, &ea); + break; + case SRB_LOGOUT_CMD: ++ if (!fcport) ++ break; + qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT); + break; + case SRB_CT_PTHRU_CMD: +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index cfc095f45e26..ea947a7c2596 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -109,8 +109,8 @@ static struct { + * seagate controller, which causes SCSI code to reset bus. + */ + {"HP", "C1750A", "3226", BLIST_NOLUN}, /* scanjet iic */ +- {"HP", "C1790A", "", BLIST_NOLUN}, /* scanjet iip */ +- {"HP", "C2500A", "", BLIST_NOLUN}, /* scanjet iicx */ ++ {"HP", "C1790A", NULL, BLIST_NOLUN}, /* scanjet iip */ ++ {"HP", "C2500A", NULL, BLIST_NOLUN}, /* scanjet iicx */ + {"MEDIAVIS", "CDR-H93MV", "1.31", BLIST_NOLUN}, /* locks up */ + {"MICROTEK", "ScanMaker II", "5.61", BLIST_NOLUN}, /* responds to all lun */ + {"MITSUMI", "CD-R CR-2201CS", "6119", BLIST_NOLUN}, /* locks up */ +@@ -120,7 +120,7 @@ static struct { + {"QUANTUM", "FIREBALL ST4.3S", "0F0C", BLIST_NOLUN}, /* locks up */ + {"RELISYS", "Scorpio", NULL, BLIST_NOLUN}, /* responds to all lun */ + {"SANKYO", "CP525", "6.64", BLIST_NOLUN}, /* causes failed REQ SENSE, extra reset */ +- {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN}, ++ {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN | BLIST_BORKEN}, + {"transtec", "T5008", "0001", BLIST_NOREPORTLUN }, + {"YAMAHA", "CDR100", "1.00", BLIST_NOLUN}, /* locks up */ + {"YAMAHA", "CDR102", "1.00", BLIST_NOLUN}, /* locks up */ +@@ -255,7 +255,6 @@ static struct { + {"ST650211", "CF", NULL, BLIST_RETRY_HWERROR}, + {"SUN", "T300", "*", BLIST_SPARSELUN}, + {"SUN", "T4", "*", BLIST_SPARSELUN}, +- {"TEXEL", "CD-ROM", "1.06", BLIST_BORKEN}, + {"Tornado-", "F4", "*", BLIST_NOREPORTLUN}, + {"TOSHIBA", "CDROM", NULL, BLIST_ISROM}, + {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM}, +diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c +index fe3fa1e8517a..4903f15177cf 100644 +--- a/drivers/spi/spi-armada-3700.c ++++ b/drivers/spi/spi-armada-3700.c +@@ -624,6 +624,11 @@ static int a3700_spi_transfer_one(struct spi_master *master, + a3700_spi_header_set(a3700_spi); + + if (xfer->rx_buf) { ++ /* Clear WFIFO, since it's last 2 bytes are shifted out during ++ * a read operation ++ */ ++ spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, 0); ++ + /* Set read data length */ + spireg_write(a3700_spi, A3700_SPI_IF_DIN_CNT_REG, + a3700_spi->buf_len); +diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c +index 123e4af58408..50260cb5056d 100644 +--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c ++++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c +@@ -75,6 +75,8 @@ int __init its_fsl_mc_msi_init(void) + + for (np = of_find_matching_node(NULL, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) + continue; + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index c55624703fdf..e0aa5f03004c 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -37,6 +37,7 @@ + #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 + #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 + ++#define UART_EXAR_INT0 0x80 + #define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */ + + #define UART_EXAR_FCTR 0x08 /* Feature Control Register */ +@@ -124,6 +125,7 @@ struct exar8250_board { + struct exar8250 { + unsigned int nr; + struct exar8250_board *board; ++ void __iomem *virt; + int line[0]; + }; + +@@ -134,12 +136,9 @@ static int default_setup(struct exar8250 *priv, struct pci_dev *pcidev, + const struct exar8250_board *board = priv->board; + unsigned int bar = 0; + +- if (!pcim_iomap_table(pcidev)[bar] && !pcim_iomap(pcidev, bar, 0)) +- return -ENOMEM; +- + port->port.iotype = UPIO_MEM; + port->port.mapbase = pci_resource_start(pcidev, bar) + offset; +- port->port.membase = pcim_iomap_table(pcidev)[bar] + offset; ++ port->port.membase = priv->virt + offset; + port->port.regshift = board->reg_shift; + + return 0; +@@ -423,6 +422,25 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev) + port->port.private_data = NULL; + } + ++/* ++ * These Exar UARTs have an extra interrupt indicator that could fire for a ++ * few interrupts that are not presented/cleared through IIR. One of which is ++ * a wakeup interrupt when coming out of sleep. These interrupts are only ++ * cleared by reading global INT0 or INT1 registers as interrupts are ++ * associated with channel 0. The INT[3:0] registers _are_ accessible from each ++ * channel's address space, but for the sake of bus efficiency we register a ++ * dedicated handler at the PCI device level to handle them. ++ */ ++static irqreturn_t exar_misc_handler(int irq, void *data) ++{ ++ struct exar8250 *priv = data; ++ ++ /* Clear all PCI interrupts by reading INT0. No effect on IIR */ ++ ioread8(priv->virt + UART_EXAR_INT0); ++ ++ return IRQ_HANDLED; ++} ++ + static int + exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + { +@@ -451,6 +469,9 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + return -ENOMEM; + + priv->board = board; ++ priv->virt = pcim_iomap(pcidev, bar, 0); ++ if (!priv->virt) ++ return -ENOMEM; + + pci_set_master(pcidev); + +@@ -464,6 +485,11 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + uart.port.irq = pci_irq_vector(pcidev, 0); + uart.port.dev = &pcidev->dev; + ++ rc = devm_request_irq(&pcidev->dev, uart.port.irq, exar_misc_handler, ++ IRQF_SHARED, "exar_uart", priv); ++ if (rc) ++ return rc; ++ + for (i = 0; i < nr_ports && i < maxnr; i++) { + rc = board->setup(priv, pcidev, &uart, i); + if (rc) { +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index fde34c84e707..e32c51d549c3 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -458,7 +458,6 @@ static void io_serial_out(struct uart_port *p, int offset, int value) + } + + static int serial8250_default_handle_irq(struct uart_port *port); +-static int exar_handle_irq(struct uart_port *port); + + static void set_io_from_upio(struct uart_port *p) + { +@@ -1903,26 +1902,6 @@ static int serial8250_default_handle_irq(struct uart_port *port) + return ret; + } + +-/* +- * These Exar UARTs have an extra interrupt indicator that could +- * fire for a few unimplemented interrupts. One of which is a +- * wakeup event when coming out of sleep. Put this here just +- * to be on the safe side that these interrupts don't go unhandled. +- */ +-static int exar_handle_irq(struct uart_port *port) +-{ +- unsigned int iir = serial_port_in(port, UART_IIR); +- int ret = 0; +- +- if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) && +- serial_port_in(port, UART_EXAR_INT0) != 0) +- ret = 1; +- +- ret |= serial8250_handle_irq(port, iir); +- +- return ret; +-} +- + /* + * Newer 16550 compatible parts such as the SC16C650 & Altera 16550 Soft IP + * have a programmable TX threshold that triggers the THRE interrupt in +@@ -3107,11 +3086,6 @@ static void serial8250_config_port(struct uart_port *port, int flags) + if (port->type == PORT_UNKNOWN) + serial8250_release_std_resource(up); + +- /* Fixme: probably not the best place for this */ +- if ((port->type == PORT_XR17V35X) || +- (port->type == PORT_XR17D15X)) +- port->handle_irq = exar_handle_irq; +- + register_dev_spec_attr_grp(up); + up->fcr = uart_config[up->port.type].fcr; + } +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index ff5a1a8989d5..ff17e94ef465 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1780,6 +1780,7 @@ musb_vbus_show(struct device *dev, struct device_attribute *attr, char *buf) + int vbus; + u8 devctl; + ++ pm_runtime_get_sync(dev); + spin_lock_irqsave(&musb->lock, flags); + val = musb->a_wait_bcon; + vbus = musb_platform_get_vbus_status(musb); +@@ -1793,6 +1794,7 @@ musb_vbus_show(struct device *dev, struct device_attribute *attr, char *buf) + vbus = 0; + } + spin_unlock_irqrestore(&musb->lock, flags); ++ pm_runtime_put_sync(dev); + + return sprintf(buf, "Vbus %s, timeout %lu msec\n", + vbus ? "on" : "off", val); +@@ -2496,11 +2498,11 @@ static int musb_remove(struct platform_device *pdev) + musb_disable_interrupts(musb); + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); + spin_unlock_irqrestore(&musb->lock, flags); ++ musb_platform_exit(musb); + + pm_runtime_dont_use_autosuspend(musb->controller); + pm_runtime_put_sync(musb->controller); + pm_runtime_disable(musb->controller); +- musb_platform_exit(musb); + musb_phy_callback = NULL; + if (musb->dma_controller) + musb_dma_controller_destroy(musb->dma_controller); +@@ -2733,7 +2735,8 @@ static int musb_resume(struct device *dev) + if ((devctl & mask) != (musb->context.devctl & mask)) + musb->port1_status = 0; + +- musb_start(musb); ++ musb_enable_interrupts(musb); ++ musb_platform_enable(musb); + + spin_lock_irqsave(&musb->lock, flags); + error = musb_run_resume_work(musb); +diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h +index 1af4dee71337..0e242d1110ce 100644 +--- a/drivers/watchdog/sp5100_tco.h ++++ b/drivers/watchdog/sp5100_tco.h +@@ -55,7 +55,7 @@ + #define SB800_PM_WATCHDOG_CONFIG 0x4C + + #define SB800_PCI_WATCHDOG_DECODE_EN (1 << 0) +-#define SB800_PM_WATCHDOG_DISABLE (1 << 2) ++#define SB800_PM_WATCHDOG_DISABLE (1 << 1) + #define SB800_PM_WATCHDOG_SECOND_RES (3 << 0) + #define SB800_ACPI_MMIO_DECODE_EN (1 << 0) + #define SB800_ACPI_MMIO_SEL (1 << 1) +diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c +index 2c6a9114d332..1fb374466e84 100644 +--- a/drivers/xen/grant-table.c ++++ b/drivers/xen/grant-table.c +@@ -328,7 +328,7 @@ static void gnttab_handle_deferred(unsigned long unused) + if (entry->page) { + pr_debug("freeing g.e. %#x (pfn %#lx)\n", + entry->ref, page_to_pfn(entry->page)); +- __free_page(entry->page); ++ put_page(entry->page); + } else + pr_info("freeing g.e. %#x\n", entry->ref); + kfree(entry); +@@ -384,7 +384,7 @@ void gnttab_end_foreign_access(grant_ref_t ref, int readonly, + if (gnttab_end_foreign_access_ref(ref, readonly)) { + put_free_entry(ref); + if (page != 0) +- free_page(page); ++ put_page(virt_to_page(page)); + } else + gnttab_add_deferred(ref, readonly, + page ? virt_to_page(page) : NULL); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index e2bb2a065741..21cc27509993 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -2774,6 +2774,8 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root, + * contention with the cow code + */ + if (cow) { ++ bool last_level = (level == (BTRFS_MAX_LEVEL - 1)); ++ + /* + * if we don't really need to cow this block + * then we don't want to set the path blocking, +@@ -2798,9 +2800,13 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root, + } + + btrfs_set_path_blocking(p); +- err = btrfs_cow_block(trans, root, b, +- p->nodes[level + 1], +- p->slots[level + 1], &b); ++ if (last_level) ++ err = btrfs_cow_block(trans, root, b, NULL, 0, ++ &b); ++ else ++ err = btrfs_cow_block(trans, root, b, ++ p->nodes[level + 1], ++ p->slots[level + 1], &b); + if (err) { + ret = err; + goto done; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 167ce43cabe8..79f0f282a0ef 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4063,9 +4063,11 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info) + btrfs_err(fs_info, "no valid FS found"); + ret = -EINVAL; + } +- if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP) +- btrfs_warn(fs_info, "unrecognized super flag: %llu", ++ if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP) { ++ btrfs_err(fs_info, "unrecognized or unsupported super flag: %llu", + btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP); ++ ret = -EINVAL; ++ } + if (btrfs_super_root_level(sb) >= BTRFS_MAX_LEVEL) { + btrfs_err(fs_info, "tree_root level too big: %d >= %d", + btrfs_super_root_level(sb), BTRFS_MAX_LEVEL); +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index d564a7049d7f..5690feded0de 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2018,10 +2018,19 @@ int btrfs_release_file(struct inode *inode, struct file *filp) + static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end) + { + int ret; ++ struct blk_plug plug; + ++ /* ++ * This is only called in fsync, which would do synchronous writes, so ++ * a plug can merge adjacent IOs as much as possible. Esp. in case of ++ * multiple disks using raid profile, a large IO can be split to ++ * several segments of stripe length (currently 64K). ++ */ ++ blk_start_plug(&plug); + atomic_inc(&BTRFS_I(inode)->sync_writers); + ret = btrfs_fdatawrite_range(inode, start, end); + atomic_dec(&BTRFS_I(inode)->sync_writers); ++ blk_finish_plug(&plug); + + return ret; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index dfa360d18ae2..9f21c29d0259 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -42,6 +42,7 @@ + #include <linux/blkdev.h> + #include <linux/posix_acl_xattr.h> + #include <linux/uio.h> ++#include <asm/unaligned.h> + #include "ctree.h" + #include "disk-io.h" + #include "transaction.h" +@@ -5980,11 +5981,13 @@ static int btrfs_filldir(void *addr, int entries, struct dir_context *ctx) + struct dir_entry *entry = addr; + char *name = (char *)(entry + 1); + +- ctx->pos = entry->offset; +- if (!dir_emit(ctx, name, entry->name_len, entry->ino, +- entry->type)) ++ ctx->pos = get_unaligned(&entry->offset); ++ if (!dir_emit(ctx, name, get_unaligned(&entry->name_len), ++ get_unaligned(&entry->ino), ++ get_unaligned(&entry->type))) + return 1; +- addr += sizeof(struct dir_entry) + entry->name_len; ++ addr += sizeof(struct dir_entry) + ++ get_unaligned(&entry->name_len); + ctx->pos++; + } + return 0; +@@ -6078,14 +6081,15 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx) + } + + entry = addr; +- entry->name_len = name_len; ++ put_unaligned(name_len, &entry->name_len); + name_ptr = (char *)(entry + 1); + read_extent_buffer(leaf, name_ptr, (unsigned long)(di + 1), + name_len); +- entry->type = btrfs_filetype_table[btrfs_dir_type(leaf, di)]; ++ put_unaligned(btrfs_filetype_table[btrfs_dir_type(leaf, di)], ++ &entry->type); + btrfs_dir_item_key_to_cpu(leaf, di, &location); +- entry->ino = location.objectid; +- entry->offset = found_key.offset; ++ put_unaligned(location.objectid, &entry->ino); ++ put_unaligned(found_key.offset, &entry->offset); + entries++; + addr += sizeof(struct dir_entry) + name_len; + total_len += sizeof(struct dir_entry) + name_len; +@@ -7261,19 +7265,12 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, + * existing will always be non-NULL, since there must be + * extent causing the -EEXIST. + */ +- if (existing->start == em->start && +- extent_map_end(existing) >= extent_map_end(em) && +- em->block_start == existing->block_start) { +- /* +- * The existing extent map already encompasses the +- * entire extent map we tried to add. +- */ ++ if (start >= existing->start && ++ start < extent_map_end(existing)) { + free_extent_map(em); + em = existing; + err = 0; +- +- } else if (start >= extent_map_end(existing) || +- start <= existing->start) { ++ } else { + /* + * The existing extent map is the one nearest to + * the [start, start + len) range which overlaps +@@ -7285,10 +7282,6 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, + free_extent_map(em); + em = NULL; + } +- } else { +- free_extent_map(em); +- em = existing; +- err = 0; + } + } + write_unlock(&em_tree->lock); +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 32b186c5694c..2e995e565633 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -858,10 +858,17 @@ static void __free_raid_bio(struct btrfs_raid_bio *rbio) + kfree(rbio); + } + +-static void free_raid_bio(struct btrfs_raid_bio *rbio) ++static void rbio_endio_bio_list(struct bio *cur, blk_status_t err) + { +- unlock_stripe(rbio); +- __free_raid_bio(rbio); ++ struct bio *next; ++ ++ while (cur) { ++ next = cur->bi_next; ++ cur->bi_next = NULL; ++ cur->bi_status = err; ++ bio_endio(cur); ++ cur = next; ++ } + } + + /* +@@ -871,20 +878,26 @@ static void free_raid_bio(struct btrfs_raid_bio *rbio) + static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, blk_status_t err) + { + struct bio *cur = bio_list_get(&rbio->bio_list); +- struct bio *next; ++ struct bio *extra; + + if (rbio->generic_bio_cnt) + btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt); + +- free_raid_bio(rbio); ++ /* ++ * At this moment, rbio->bio_list is empty, however since rbio does not ++ * always have RBIO_RMW_LOCKED_BIT set and rbio is still linked on the ++ * hash list, rbio may be merged with others so that rbio->bio_list ++ * becomes non-empty. ++ * Once unlock_stripe() is done, rbio->bio_list will not be updated any ++ * more and we can call bio_endio() on all queued bios. ++ */ ++ unlock_stripe(rbio); ++ extra = bio_list_get(&rbio->bio_list); ++ __free_raid_bio(rbio); + +- while (cur) { +- next = cur->bi_next; +- cur->bi_next = NULL; +- cur->bi_status = err; +- bio_endio(cur); +- cur = next; +- } ++ rbio_endio_bio_list(cur, err); ++ if (extra) ++ rbio_endio_bio_list(extra, err); + } + + /* +@@ -2159,11 +2172,21 @@ int raid56_parity_recover(struct btrfs_fs_info *fs_info, struct bio *bio, + } + + /* +- * reconstruct from the q stripe if they are +- * asking for mirror 3 ++ * Loop retry: ++ * for 'mirror == 2', reconstruct from all other stripes. ++ * for 'mirror_num > 2', select a stripe to fail on every retry. + */ +- if (mirror_num == 3) +- rbio->failb = rbio->real_stripes - 2; ++ if (mirror_num > 2) { ++ /* ++ * 'mirror == 3' is to fail the p stripe and ++ * reconstruct from the q stripe. 'mirror > 3' is to ++ * fail a data stripe and reconstruct from p+q stripe. ++ */ ++ rbio->failb = rbio->real_stripes - (mirror_num - 1); ++ ASSERT(rbio->failb > 0); ++ if (rbio->failb <= rbio->faila) ++ rbio->failb--; ++ } + + ret = lock_stripe_add(rbio); + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 71b3cd634436..b983e7fb200b 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -5101,7 +5101,14 @@ int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len) + else if (map->type & BTRFS_BLOCK_GROUP_RAID5) + ret = 2; + else if (map->type & BTRFS_BLOCK_GROUP_RAID6) +- ret = 3; ++ /* ++ * There could be two corrupted data stripes, we need ++ * to loop retry in order to rebuild the correct data. ++ * ++ * Fail a stripe at a time on every retry except the ++ * stripe under reconstruction. ++ */ ++ ret = map->num_stripes; + else + ret = 1; + free_extent_map(em); +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 35dc5bf01ee2..7fd39ea6e22e 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -6331,9 +6331,7 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, + pSMB->InformationLevel = + cpu_to_le16(SMB_SET_FILE_EA); + +- parm_data = +- (struct fealist *) (((char *) &pSMB->hdr.Protocol) + +- offset); ++ parm_data = (void *)pSMB + offsetof(struct smb_hdr, Protocol) + offset; + pSMB->ParameterOffset = cpu_to_le16(param_offset); + pSMB->DataOffset = cpu_to_le16(offset); + pSMB->SetupCount = 1; +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 81ba6e0d88d8..925844343038 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -684,6 +684,9 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode, + goto mknod_out; + } + ++ if (!S_ISCHR(mode) && !S_ISBLK(mode)) ++ goto mknod_out; ++ + if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) + goto mknod_out; + +@@ -692,10 +695,8 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode, + + buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL); + if (buf == NULL) { +- kfree(full_path); + rc = -ENOMEM; +- free_xid(xid); +- return rc; ++ goto mknod_out; + } + + if (backup_cred(cifs_sb)) +@@ -742,7 +743,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode, + pdev->minor = cpu_to_le64(MINOR(device_number)); + rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms, + &bytes_written, iov, 1); +- } /* else if (S_ISFIFO) */ ++ } + tcon->ses->server->ops->close(xid, tcon, &fid); + d_drop(direntry); + +diff --git a/fs/dax.c b/fs/dax.c +index 191306cd8b6b..ddb4981ae32e 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -630,8 +630,8 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping, + set_pmd_at(vma->vm_mm, address, pmdp, pmd); + mmu_notifier_invalidate_range(vma->vm_mm, start, end); + unlock_pmd: +- spin_unlock(ptl); + #endif ++ spin_unlock(ptl); + } else { + if (pfn != pte_pfn(*ptep)) + goto unlock_pte; +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index d5021ba69e7a..e5673a9b2619 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -696,7 +696,12 @@ static void move_data_block(struct inode *inode, block_t bidx, + fio.op = REQ_OP_WRITE; + fio.op_flags = REQ_SYNC; + fio.new_blkaddr = newaddr; +- f2fs_submit_page_write(&fio); ++ err = f2fs_submit_page_write(&fio); ++ if (err) { ++ if (PageWriteback(fio.encrypted_page)) ++ end_page_writeback(fio.encrypted_page); ++ goto put_page_out; ++ } + + f2fs_update_iostat(fio.sbi, FS_GC_DATA_IO, F2FS_BLKSIZE); + +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c +index e96c6b05e43e..3c96f4bdc549 100644 +--- a/fs/jffs2/fs.c ++++ b/fs/jffs2/fs.c +@@ -362,7 +362,6 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino) + ret = -EIO; + error: + mutex_unlock(&f->sem); +- jffs2_do_clear_inode(c, f); + iget_failed(inode); + return ERR_PTR(ret); + } +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 2241d52710f7..ae8f43d270d6 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1885,7 +1885,7 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta + return ret; + } + +-static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, int err) ++static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, struct file_lock *fl, int err) + { + switch (err) { + default: +@@ -1932,7 +1932,11 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct + return -EAGAIN; + case -ENOMEM: + case -NFS4ERR_DENIED: +- /* kill_proc(fl->fl_pid, SIGLOST, 1); */ ++ if (fl) { ++ struct nfs4_lock_state *lsp = fl->fl_u.nfs4_fl.owner; ++ if (lsp) ++ set_bit(NFS_LOCK_LOST, &lsp->ls_flags); ++ } + return 0; + } + return err; +@@ -1968,7 +1972,7 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, + err = nfs4_open_recover_helper(opendata, FMODE_READ); + } + nfs4_opendata_put(opendata); +- return nfs4_handle_delegation_recall_error(server, state, stateid, err); ++ return nfs4_handle_delegation_recall_error(server, state, stateid, NULL, err); + } + + static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata) +@@ -6595,7 +6599,7 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, + if (err != 0) + return err; + err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); +- return nfs4_handle_delegation_recall_error(server, state, stateid, err); ++ return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err); + } + + struct nfs_release_lockowner_data { +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 0378e2257ca7..45873ed92057 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1447,6 +1447,7 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_ + struct inode *inode = state->inode; + struct nfs_inode *nfsi = NFS_I(inode); + struct file_lock *fl; ++ struct nfs4_lock_state *lsp; + int status = 0; + struct file_lock_context *flctx = inode->i_flctx; + struct list_head *list; +@@ -1487,7 +1488,9 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_ + case -NFS4ERR_DENIED: + case -NFS4ERR_RECLAIM_BAD: + case -NFS4ERR_RECLAIM_CONFLICT: +- /* kill_proc(fl->fl_pid, SIGLOST, 1); */ ++ lsp = fl->fl_u.nfs4_fl.owner; ++ if (lsp) ++ set_bit(NFS_LOCK_LOST, &lsp->ls_flags); + status = 0; + } + spin_lock(&flctx->flc_lock); +diff --git a/fs/nfs/nfs4sysctl.c b/fs/nfs/nfs4sysctl.c +index 0d91d84e5822..c394e4447100 100644 +--- a/fs/nfs/nfs4sysctl.c ++++ b/fs/nfs/nfs4sysctl.c +@@ -32,7 +32,7 @@ static struct ctl_table nfs4_cb_sysctls[] = { + .data = &nfs_idmap_cache_timeout, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec_jiffies, ++ .proc_handler = proc_dointvec, + }, + { } + }; +diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c +index 40b5cc97f7b0..917fadca8a7b 100644 +--- a/fs/ocfs2/acl.c ++++ b/fs/ocfs2/acl.c +@@ -311,7 +311,9 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) + if (had_lock < 0) + return ERR_PTR(had_lock); + ++ down_read(&OCFS2_I(inode)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(inode, type, di_bh); ++ up_read(&OCFS2_I(inode)->ip_xattr_sem); + + ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); + brelse(di_bh); +@@ -330,7 +332,9 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) + if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) + return 0; + ++ down_read(&OCFS2_I(inode)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); ++ up_read(&OCFS2_I(inode)->ip_xattr_sem); + if (IS_ERR(acl) || !acl) + return PTR_ERR(acl); + ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); +@@ -361,8 +365,10 @@ int ocfs2_init_acl(handle_t *handle, + + if (!S_ISLNK(inode->i_mode)) { + if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { ++ down_read(&OCFS2_I(dir)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, + dir_bh); ++ up_read(&OCFS2_I(dir)->ip_xattr_sem); + if (IS_ERR(acl)) + return PTR_ERR(acl); + } +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c +index 36304434eacf..e5dcea6cee5f 100644 +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -666,23 +666,24 @@ static int __ocfs2_journal_access(handle_t *handle, + /* we can safely remove this assertion after testing. */ + if (!buffer_uptodate(bh)) { + mlog(ML_ERROR, "giving me a buffer that's not uptodate!\n"); +- mlog(ML_ERROR, "b_blocknr=%llu\n", +- (unsigned long long)bh->b_blocknr); ++ mlog(ML_ERROR, "b_blocknr=%llu, b_state=0x%lx\n", ++ (unsigned long long)bh->b_blocknr, bh->b_state); + + lock_buffer(bh); + /* +- * A previous attempt to write this buffer head failed. +- * Nothing we can do but to retry the write and hope for +- * the best. ++ * A previous transaction with a couple of buffer heads fail ++ * to checkpoint, so all the bhs are marked as BH_Write_EIO. ++ * For current transaction, the bh is just among those error ++ * bhs which previous transaction handle. We can't just clear ++ * its BH_Write_EIO and reuse directly, since other bhs are ++ * not written to disk yet and that will cause metadata ++ * inconsistency. So we should set fs read-only to avoid ++ * further damage. + */ + if (buffer_write_io_error(bh) && !buffer_uptodate(bh)) { +- clear_buffer_write_io_error(bh); +- set_buffer_uptodate(bh); +- } +- +- if (!buffer_uptodate(bh)) { + unlock_buffer(bh); +- return -EIO; ++ return ocfs2_error(osb->sb, "A previous attempt to " ++ "write this buffer head failed\n"); + } + unlock_buffer(bh); + } +diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c +index 80733496b22a..24ab735d91dd 100644 +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -474,9 +474,8 @@ static int ocfs2_init_global_system_inodes(struct ocfs2_super *osb) + new = ocfs2_get_system_file_inode(osb, i, osb->slot_num); + if (!new) { + ocfs2_release_system_inodes(osb); +- status = -EINVAL; ++ status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL; + mlog_errno(status); +- /* FIXME: Should ERROR_RO_FS */ + mlog(ML_ERROR, "Unable to load system inode %d, " + "possibly corrupt fs?", i); + goto bail; +@@ -505,7 +504,7 @@ static int ocfs2_init_local_system_inodes(struct ocfs2_super *osb) + new = ocfs2_get_system_file_inode(osb, i, osb->slot_num); + if (!new) { + ocfs2_release_system_inodes(osb); +- status = -EINVAL; ++ status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL; + mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n", + status, i, osb->slot_num); + goto bail; +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 5fdf269ba82e..fb0a4eec310c 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -638,9 +638,11 @@ int ocfs2_calc_xattr_init(struct inode *dir, + si->value_len); + + if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { ++ down_read(&OCFS2_I(dir)->ip_xattr_sem); + acl_len = ocfs2_xattr_get_nolock(dir, dir_bh, + OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT, + "", NULL, 0); ++ up_read(&OCFS2_I(dir)->ip_xattr_sem); + if (acl_len > 0) { + a_size = ocfs2_xattr_entry_real_size(0, acl_len); + if (S_ISDIR(mode)) +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 9d357b2ea6cb..2ff11a693360 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -100,6 +100,8 @@ + #include "internal.h" + #include "fd.h" + ++#include "../../lib/kstrtox.h" ++ + /* NOTE: + * Implementing inode permission operations in /proc is almost + * certainly an error. Permission checks need to happen during +@@ -1908,8 +1910,33 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx, + static int dname_to_vma_addr(struct dentry *dentry, + unsigned long *start, unsigned long *end) + { +- if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2) ++ const char *str = dentry->d_name.name; ++ unsigned long long sval, eval; ++ unsigned int len; ++ ++ len = _parse_integer(str, 16, &sval); ++ if (len & KSTRTOX_OVERFLOW) ++ return -EINVAL; ++ if (sval != (unsigned long)sval) ++ return -EINVAL; ++ str += len; ++ ++ if (*str != '-') + return -EINVAL; ++ str++; ++ ++ len = _parse_integer(str, 16, &eval); ++ if (len & KSTRTOX_OVERFLOW) ++ return -EINVAL; ++ if (eval != (unsigned long)eval) ++ return -EINVAL; ++ str += len; ++ ++ if (*str != '\0') ++ return -EINVAL; ++ ++ *start = sval; ++ *end = eval; + + return 0; + } +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index e8a93bc8285d..d1e82761de81 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -510,6 +510,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) + /* we have to zero-fill user buffer even if no read */ + if (copy_to_user(buffer, buf, tsz)) + return -EFAULT; ++ } else if (m->type == KCORE_USER) { ++ /* User page is handled prior to normal kernel page: */ ++ if (copy_to_user(buffer, (char *)start, tsz)) ++ return -EFAULT; + } else { + if (kern_addr_valid(start)) { + /* +diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c +index 0a213dcba2a1..ba3d0e0f8615 100644 +--- a/fs/ubifs/tnc.c ++++ b/fs/ubifs/tnc.c +@@ -1890,35 +1890,28 @@ static int search_dh_cookie(struct ubifs_info *c, const union ubifs_key *key, + union ubifs_key *dkey; + + for (;;) { +- if (!err) { +- err = tnc_next(c, &znode, n); +- if (err) +- goto out; +- } +- + zbr = &znode->zbranch[*n]; + dkey = &zbr->key; + + if (key_inum(c, dkey) != key_inum(c, key) || + key_type(c, dkey) != key_type(c, key)) { +- err = -ENOENT; +- goto out; ++ return -ENOENT; + } + + err = tnc_read_hashed_node(c, zbr, dent); + if (err) +- goto out; ++ return err; + + if (key_hash(c, key) == key_hash(c, dkey) && + le32_to_cpu(dent->cookie) == cookie) { + *zn = znode; +- goto out; ++ return 0; + } +- } +- +-out: + +- return err; ++ err = tnc_next(c, &znode, n); ++ if (err) ++ return err; ++ } + } + + static int do_lookup_dh(struct ubifs_info *c, const union ubifs_key *key, +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 77b891a8f191..2142bceaeb75 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -309,6 +309,21 @@ extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, + extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp); + #endif + ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++/* ++ * This is an implementation of pmdp_establish() that is only suitable for an ++ * architecture that doesn't have hardware dirty/accessed bits. In this case we ++ * can't race with CPU which sets these bits and non-atomic aproach is fine. ++ */ ++static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma, ++ unsigned long address, pmd_t *pmdp, pmd_t pmd) ++{ ++ pmd_t old_pmd = *pmdp; ++ set_pmd_at(vma->vm_mm, address, pmdp, pmd); ++ return old_pmd; ++} ++#endif ++ + #ifndef __HAVE_ARCH_PMDP_INVALIDATE + extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + pmd_t *pmdp); +diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h +index 8d3125c493b2..db461a07bf38 100644 +--- a/include/linux/cpumask.h ++++ b/include/linux/cpumask.h +@@ -165,6 +165,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node) + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask) + #define for_each_cpu_not(cpu, mask) \ + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask) ++#define for_each_cpu_wrap(cpu, mask, start) \ ++ for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start)) + #define for_each_cpu_and(cpu, mask, and) \ + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and) + #else +diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h +index 2d9f80848d4b..c643cc7fefb5 100644 +--- a/include/linux/etherdevice.h ++++ b/include/linux/etherdevice.h +@@ -31,7 +31,7 @@ + #ifdef __KERNEL__ + struct device; + int eth_platform_get_mac_address(struct device *dev, u8 *mac_addr); +-unsigned char *arch_get_platform_get_mac_address(void); ++unsigned char *arch_get_platform_mac_address(void); + u32 eth_get_headlen(void *data, unsigned int max_len); + __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev); + extern const struct header_ops eth_header_ops; +diff --git a/include/linux/kcore.h b/include/linux/kcore.h +index 7ff25a808fef..80db19d3a505 100644 +--- a/include/linux/kcore.h ++++ b/include/linux/kcore.h +@@ -10,6 +10,7 @@ enum kcore_type { + KCORE_VMALLOC, + KCORE_RAM, + KCORE_VMEMMAP, ++ KCORE_USER, + KCORE_OTHER, + }; + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 8e46c35d654b..54f346a45cd0 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -301,6 +301,7 @@ int xt_data_to_user(void __user *dst, const void *src, + + void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + struct xt_counters_info *info, bool compat); ++struct xt_counters *xt_counters_alloc(unsigned int counters); + + struct xt_table *xt_register_table(struct net *net, + const struct xt_table *table, +@@ -507,7 +508,7 @@ void xt_compat_unlock(u_int8_t af); + + int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta); + void xt_compat_flush_offsets(u_int8_t af); +-void xt_compat_init_offsets(u_int8_t af, unsigned int number); ++int xt_compat_init_offsets(u8 af, unsigned int number); + int xt_compat_calc_jump(u_int8_t af, unsigned int offset); + + int xt_compat_match_offset(const struct xt_match *match); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index d16a7c037ec0..727e309baa5e 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1688,6 +1688,13 @@ static inline int pci_get_new_domain_nr(void) { return -ENOSYS; } + #define dev_is_pf(d) (false) + static inline bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags) + { return false; } ++static inline int pci_irqd_intx_xlate(struct irq_domain *d, ++ struct device_node *node, ++ const u32 *intspec, ++ unsigned int intsize, ++ unsigned long *out_hwirq, ++ unsigned int *out_type) ++{ return -EINVAL; } + #endif /* CONFIG_PCI */ + + /* Include architecture-dependent settings and functions */ +diff --git a/include/linux/property.h b/include/linux/property.h +index 6bebee13c5e0..89d94b349912 100644 +--- a/include/linux/property.h ++++ b/include/linux/property.h +@@ -206,7 +206,7 @@ struct property_entry { + */ + + #define PROPERTY_ENTRY_INTEGER_ARRAY(_name_, _type_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = ARRAY_SIZE(_val_) * sizeof(_type_), \ + .is_array = true, \ +@@ -224,7 +224,7 @@ struct property_entry { + PROPERTY_ENTRY_INTEGER_ARRAY(_name_, u64, _val_) + + #define PROPERTY_ENTRY_STRING_ARRAY(_name_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = ARRAY_SIZE(_val_) * sizeof(const char *), \ + .is_array = true, \ +@@ -233,7 +233,7 @@ struct property_entry { + } + + #define PROPERTY_ENTRY_INTEGER(_name_, _type_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = sizeof(_type_), \ + .is_string = false, \ +@@ -250,7 +250,7 @@ struct property_entry { + PROPERTY_ENTRY_INTEGER(_name_, u64, _val_) + + #define PROPERTY_ENTRY_STRING(_name_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = sizeof(_val_), \ + .is_string = true, \ +@@ -258,7 +258,7 @@ struct property_entry { + } + + #define PROPERTY_ENTRY_BOOL(_name_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + } + +diff --git a/include/linux/suspend.h b/include/linux/suspend.h +index d60b0f5c38d5..8544357d92d0 100644 +--- a/include/linux/suspend.h ++++ b/include/linux/suspend.h +@@ -384,6 +384,8 @@ extern int swsusp_page_is_forbidden(struct page *); + extern void swsusp_set_page_free(struct page *); + extern void swsusp_unset_page_free(struct page *); + extern unsigned long get_safe_page(gfp_t gfp_mask); ++extern asmlinkage int swsusp_arch_suspend(void); ++extern asmlinkage int swsusp_arch_resume(void); + + extern void hibernation_set_ops(const struct platform_hibernation_ops *ops); + extern int hibernate(void); +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 6533aa64f009..08f3d8699a27 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -866,6 +866,7 @@ struct ib_mr_status { + __attribute_const__ enum ib_rate mult_to_ib_rate(int mult); + + enum rdma_ah_attr_type { ++ RDMA_AH_ATTR_TYPE_UNDEFINED, + RDMA_AH_ATTR_TYPE_IB, + RDMA_AH_ATTR_TYPE_ROCE, + RDMA_AH_ATTR_TYPE_OPA, +@@ -3762,18 +3763,24 @@ static inline void rdma_ah_set_grh(struct rdma_ah_attr *attr, + grh->traffic_class = traffic_class; + } + +-/*Get AH type */ ++/** ++ * rdma_ah_find_type - Return address handle type. ++ * ++ * @dev: Device to be checked ++ * @port_num: Port number ++ */ + static inline enum rdma_ah_attr_type rdma_ah_find_type(struct ib_device *dev, +- u32 port_num) ++ u8 port_num) + { +- if ((rdma_protocol_roce(dev, port_num)) || +- (rdma_protocol_iwarp(dev, port_num))) ++ if (rdma_protocol_roce(dev, port_num)) + return RDMA_AH_ATTR_TYPE_ROCE; +- else if ((rdma_protocol_ib(dev, port_num)) && +- (rdma_cap_opa_ah(dev, port_num))) +- return RDMA_AH_ATTR_TYPE_OPA; +- else ++ if (rdma_protocol_ib(dev, port_num)) { ++ if (rdma_cap_opa_ah(dev, port_num)) ++ return RDMA_AH_ATTR_TYPE_OPA; + return RDMA_AH_ATTR_TYPE_IB; ++ } ++ ++ return RDMA_AH_ATTR_TYPE_UNDEFINED; + } + + /** +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h +index 16e305e69f34..c6f728037c53 100644 +--- a/include/trace/events/timer.h ++++ b/include/trace/events/timer.h +@@ -136,6 +136,20 @@ DEFINE_EVENT(timer_class, timer_cancel, + TP_ARGS(timer) + ); + ++#define decode_clockid(type) \ ++ __print_symbolic(type, \ ++ { CLOCK_REALTIME, "CLOCK_REALTIME" }, \ ++ { CLOCK_MONOTONIC, "CLOCK_MONOTONIC" }, \ ++ { CLOCK_BOOTTIME, "CLOCK_BOOTTIME" }, \ ++ { CLOCK_TAI, "CLOCK_TAI" }) ++ ++#define decode_hrtimer_mode(mode) \ ++ __print_symbolic(mode, \ ++ { HRTIMER_MODE_ABS, "ABS" }, \ ++ { HRTIMER_MODE_REL, "REL" }, \ ++ { HRTIMER_MODE_ABS_PINNED, "ABS|PINNED" }, \ ++ { HRTIMER_MODE_REL_PINNED, "REL|PINNED" }) ++ + /** + * hrtimer_init - called when the hrtimer is initialized + * @hrtimer: pointer to struct hrtimer +@@ -162,10 +176,8 @@ TRACE_EVENT(hrtimer_init, + ), + + TP_printk("hrtimer=%p clockid=%s mode=%s", __entry->hrtimer, +- __entry->clockid == CLOCK_REALTIME ? +- "CLOCK_REALTIME" : "CLOCK_MONOTONIC", +- __entry->mode == HRTIMER_MODE_ABS ? +- "HRTIMER_MODE_ABS" : "HRTIMER_MODE_REL") ++ decode_clockid(__entry->clockid), ++ decode_hrtimer_mode(__entry->mode)) + ); + + /** +diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c +index 1890be7ea9cd..53a4787c08d8 100644 +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -601,11 +601,6 @@ static void sock_map_free(struct bpf_map *map) + } + rcu_read_unlock(); + +- if (stab->bpf_verdict) +- bpf_prog_put(stab->bpf_verdict); +- if (stab->bpf_parse) +- bpf_prog_put(stab->bpf_parse); +- + sock_map_remove_complete(stab); + } + +@@ -877,6 +872,19 @@ static int sock_map_update_elem(struct bpf_map *map, + return err; + } + ++static void sock_map_release(struct bpf_map *map, struct file *map_file) ++{ ++ struct bpf_stab *stab = container_of(map, struct bpf_stab, map); ++ struct bpf_prog *orig; ++ ++ orig = xchg(&stab->bpf_parse, NULL); ++ if (orig) ++ bpf_prog_put(orig); ++ orig = xchg(&stab->bpf_verdict, NULL); ++ if (orig) ++ bpf_prog_put(orig); ++} ++ + const struct bpf_map_ops sock_map_ops = { + .map_alloc = sock_map_alloc, + .map_free = sock_map_free, +@@ -884,6 +892,7 @@ const struct bpf_map_ops sock_map_ops = { + .map_get_next_key = sock_map_get_next_key, + .map_update_elem = sock_map_update_elem, + .map_delete_elem = sock_map_delete_elem, ++ .map_release = sock_map_release, + }; + + BPF_CALL_4(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock, +diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c +index 1b2be63c8528..fa4f47a0a631 100644 +--- a/kernel/events/callchain.c ++++ b/kernel/events/callchain.c +@@ -119,19 +119,22 @@ int get_callchain_buffers(int event_max_stack) + goto exit; + } + ++ /* ++ * If requesting per event more than the global cap, ++ * return a different error to help userspace figure ++ * this out. ++ * ++ * And also do it here so that we have &callchain_mutex held. ++ */ ++ if (event_max_stack > sysctl_perf_event_max_stack) { ++ err = -EOVERFLOW; ++ goto exit; ++ } ++ + if (count > 1) { + /* If the allocation failed, give up */ + if (!callchain_cpus_entries) + err = -ENOMEM; +- /* +- * If requesting per event more than the global cap, +- * return a different error to help userspace figure +- * this out. +- * +- * And also do it here so that we have &callchain_mutex held. +- */ +- if (event_max_stack > sysctl_perf_event_max_stack) +- err = -EOVERFLOW; + goto exit; + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index e9b0beca830f..cb8274d7824f 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9750,9 +9750,9 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr, + * __u16 sample size limit. + */ + if (attr->sample_stack_user >= USHRT_MAX) +- ret = -EINVAL; ++ return -EINVAL; + else if (!IS_ALIGNED(attr->sample_stack_user, sizeof(u64))) +- ret = -EINVAL; ++ return -EINVAL; + } + + if (attr->sample_type & PERF_SAMPLE_REGS_INTR) +diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c +index 294294c71ba4..50dc42aeaa56 100644 +--- a/kernel/locking/qspinlock.c ++++ b/kernel/locking/qspinlock.c +@@ -379,6 +379,14 @@ void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val) + tail = encode_tail(smp_processor_id(), idx); + + node += idx; ++ ++ /* ++ * Ensure that we increment the head node->count before initialising ++ * the actual node. If the compiler is kind enough to reorder these ++ * stores, then an IRQ could overwrite our assignments. ++ */ ++ barrier(); ++ + node->locked = 0; + node->next = NULL; + pv_init_node(node); +diff --git a/kernel/power/power.h b/kernel/power/power.h +index f29cd178df90..9e58bdc8a562 100644 +--- a/kernel/power/power.h ++++ b/kernel/power/power.h +@@ -104,9 +104,6 @@ extern int in_suspend; + extern dev_t swsusp_resume_device; + extern sector_t swsusp_resume_block; + +-extern asmlinkage int swsusp_arch_suspend(void); +-extern asmlinkage int swsusp_arch_resume(void); +- + extern int create_basic_memory_bitmaps(void); + extern void free_basic_memory_bitmaps(void); + extern int hibernate_preallocate_memory(void); +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index ec09ce9a6012..639321bf2e39 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -326,6 +326,17 @@ static int alarmtimer_resume(struct device *dev) + } + #endif + ++static void ++__alarm_init(struct alarm *alarm, enum alarmtimer_type type, ++ enum alarmtimer_restart (*function)(struct alarm *, ktime_t)) ++{ ++ timerqueue_init(&alarm->node); ++ alarm->timer.function = alarmtimer_fired; ++ alarm->function = function; ++ alarm->type = type; ++ alarm->state = ALARMTIMER_STATE_INACTIVE; ++} ++ + /** + * alarm_init - Initialize an alarm structure + * @alarm: ptr to alarm to be initialized +@@ -335,13 +346,9 @@ static int alarmtimer_resume(struct device *dev) + void alarm_init(struct alarm *alarm, enum alarmtimer_type type, + enum alarmtimer_restart (*function)(struct alarm *, ktime_t)) + { +- timerqueue_init(&alarm->node); + hrtimer_init(&alarm->timer, alarm_bases[type].base_clockid, +- HRTIMER_MODE_ABS); +- alarm->timer.function = alarmtimer_fired; +- alarm->function = function; +- alarm->type = type; +- alarm->state = ALARMTIMER_STATE_INACTIVE; ++ HRTIMER_MODE_ABS); ++ __alarm_init(alarm, type, function); + } + EXPORT_SYMBOL_GPL(alarm_init); + +@@ -719,6 +726,8 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp, + + __set_current_state(TASK_RUNNING); + ++ destroy_hrtimer_on_stack(&alarm->timer); ++ + if (!alarm->data) + return 0; + +@@ -740,6 +749,15 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp, + return -ERESTART_RESTARTBLOCK; + } + ++static void ++alarm_init_on_stack(struct alarm *alarm, enum alarmtimer_type type, ++ enum alarmtimer_restart (*function)(struct alarm *, ktime_t)) ++{ ++ hrtimer_init_on_stack(&alarm->timer, alarm_bases[type].base_clockid, ++ HRTIMER_MODE_ABS); ++ __alarm_init(alarm, type, function); ++} ++ + /** + * alarm_timer_nsleep_restart - restartblock alarmtimer nsleep + * @restart: ptr to restart block +@@ -752,7 +770,7 @@ static long __sched alarm_timer_nsleep_restart(struct restart_block *restart) + ktime_t exp = restart->nanosleep.expires; + struct alarm alarm; + +- alarm_init(&alarm, type, alarmtimer_nsleep_wakeup); ++ alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup); + + return alarmtimer_do_nsleep(&alarm, exp, type); + } +@@ -784,7 +802,7 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, + if (!capable(CAP_WAKE_ALARM)) + return -EPERM; + +- alarm_init(&alarm, type, alarmtimer_nsleep_wakeup); ++ alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup); + + exp = timespec64_to_ktime(*tsreq); + /* Convert (if necessary) to absolute time */ +diff --git a/lib/test_bpf.c b/lib/test_bpf.c +index 6fbb73f3f531..64701b4c9900 100644 +--- a/lib/test_bpf.c ++++ b/lib/test_bpf.c +@@ -83,6 +83,7 @@ struct bpf_test { + __u32 result; + } test[MAX_SUBTESTS]; + int (*fill_helper)(struct bpf_test *self); ++ int expected_errcode; /* used when FLAG_EXPECTED_FAIL is set in the aux */ + __u8 frag_data[MAX_DATA]; + int stack_depth; /* for eBPF only, since tests don't call verifier */ + }; +@@ -1987,7 +1988,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: div_k_0", +@@ -1997,7 +2000,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: unknown insn", +@@ -2008,7 +2013,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: out of range spill/fill", +@@ -2018,7 +2025,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "JUMPS + HOLES", +@@ -2110,6 +2119,8 @@ static struct bpf_test tests[] = { + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, + { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: LDX + RET X", +@@ -2120,6 +2131,8 @@ static struct bpf_test tests[] = { + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, + { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { /* Mainly checking JIT here. */ + "M[]: alt STX + LDX", +@@ -2294,6 +2307,8 @@ static struct bpf_test tests[] = { + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, + { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { /* Passes checker but fails during runtime. */ + "LD [SKF_AD_OFF-1]", +@@ -5356,6 +5371,7 @@ static struct bpf_test tests[] = { + { }, + { }, + .fill_helper = bpf_fill_maxinsns4, ++ .expected_errcode = -EINVAL, + }, + { /* Mainly checking JIT here. */ + "BPF_MAXINSNS: Very long jump", +@@ -5411,10 +5427,15 @@ static struct bpf_test tests[] = { + { + "BPF_MAXINSNS: Jump, gap, jump, ...", + { }, ++#ifdef CONFIG_BPF_JIT_ALWAYS_ON ++ CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, ++#else + CLASSIC | FLAG_NO_DATA, ++#endif + { }, + { { 0, 0xababcbac } }, + .fill_helper = bpf_fill_maxinsns11, ++ .expected_errcode = -ENOTSUPP, + }, + { + "BPF_MAXINSNS: ld_abs+get_processor_id", +@@ -6193,7 +6214,7 @@ static struct bpf_prog *generate_filter(int which, int *err) + + *err = bpf_prog_create(&fp, &fprog); + if (tests[which].aux & FLAG_EXPECTED_FAIL) { +- if (*err == -EINVAL) { ++ if (*err == tests[which].expected_errcode) { + pr_cont("PASS\n"); + /* Verifier rejected filter as expected. */ + *err = 0; +diff --git a/mm/fadvise.c b/mm/fadvise.c +index ec70d6e4b86d..767887f5f3bf 100644 +--- a/mm/fadvise.c ++++ b/mm/fadvise.c +@@ -127,7 +127,15 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice) + */ + start_index = (offset+(PAGE_SIZE-1)) >> PAGE_SHIFT; + end_index = (endbyte >> PAGE_SHIFT); +- if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK) { ++ /* ++ * The page at end_index will be inclusively discarded according ++ * by invalidate_mapping_pages(), so subtracting 1 from ++ * end_index means we will skip the last page. But if endbyte ++ * is page aligned or is at the end of file, we should not skip ++ * that page - discarding the last page is safe enough. ++ */ ++ if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK && ++ endbyte != inode->i_size - 1) { + /* First page is tricky as 0 - 1 = -1, but pgoff_t + * is unsigned, so the end_index >= start_index + * check below would be true and we'll discard the whole +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 2fe26634e1a2..29221602d802 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1679,10 +1679,14 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages, + spin_unlock(&khugepaged_mm_lock); + + mm = mm_slot->mm; +- down_read(&mm->mmap_sem); +- if (unlikely(khugepaged_test_exit(mm))) +- vma = NULL; +- else ++ /* ++ * Don't wait for semaphore (to avoid long wait times). Just move to ++ * the next mm on the list. ++ */ ++ vma = NULL; ++ if (unlikely(!down_read_trylock(&mm->mmap_sem))) ++ goto breakouterloop_mmap_sem; ++ if (likely(!khugepaged_test_exit(mm))) + vma = find_vma(mm, khugepaged_scan.address); + + progress++; +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index a2af6d58a68f..2d3077ce50cd 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1262,6 +1262,7 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask, + unsigned long maxnode) + { + unsigned long k; ++ unsigned long t; + unsigned long nlongs; + unsigned long endmask; + +@@ -1278,13 +1279,19 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask, + else + endmask = (1UL << (maxnode % BITS_PER_LONG)) - 1; + +- /* When the user specified more nodes than supported just check +- if the non supported part is all zero. */ ++ /* ++ * When the user specified more nodes than supported just check ++ * if the non supported part is all zero. ++ * ++ * If maxnode have more longs than MAX_NUMNODES, check ++ * the bits in that area first. And then go through to ++ * check the rest bits which equal or bigger than MAX_NUMNODES. ++ * Otherwise, just check bits [MAX_NUMNODES, maxnode). ++ */ + if (nlongs > BITS_TO_LONGS(MAX_NUMNODES)) { + if (nlongs > PAGE_SIZE/sizeof(long)) + return -EINVAL; + for (k = BITS_TO_LONGS(MAX_NUMNODES); k < nlongs; k++) { +- unsigned long t; + if (get_user(t, nmask + k)) + return -EFAULT; + if (k == nlongs - 1) { +@@ -1297,6 +1304,16 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask, + endmask = ~0UL; + } + ++ if (maxnode > MAX_NUMNODES && MAX_NUMNODES % BITS_PER_LONG != 0) { ++ unsigned long valid_mask = endmask; ++ ++ valid_mask &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1); ++ if (get_user(t, nmask + nlongs - 1)) ++ return -EFAULT; ++ if (t & valid_mask) ++ return -EINVAL; ++ } ++ + if (copy_from_user(nodes_addr(*nodes), nmask, nlongs*sizeof(unsigned long))) + return -EFAULT; + nodes_addr(*nodes)[nlongs-1] &= endmask; +@@ -1423,10 +1440,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, + goto out_put; + } + +- if (!nodes_subset(*new, node_states[N_MEMORY])) { +- err = -EINVAL; ++ task_nodes = cpuset_mems_allowed(current); ++ nodes_and(*new, *new, task_nodes); ++ if (nodes_empty(*new)) ++ goto out_put; ++ ++ nodes_and(*new, *new, node_states[N_MEMORY]); ++ if (nodes_empty(*new)) + goto out_put; +- } + + err = security_task_movememory(task); + if (err) +diff --git a/mm/vmscan.c b/mm/vmscan.c +index a8a3729bfaa9..b3f5e337b64a 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1436,14 +1436,24 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode) + + if (PageDirty(page)) { + struct address_space *mapping; ++ bool migrate_dirty; + + /* + * Only pages without mappings or that have a + * ->migratepage callback are possible to migrate +- * without blocking ++ * without blocking. However, we can be racing with ++ * truncation so it's necessary to lock the page ++ * to stabilise the mapping as truncation holds ++ * the page lock until after the page is removed ++ * from the page cache. + */ ++ if (!trylock_page(page)) ++ return ret; ++ + mapping = page_mapping(page); +- if (mapping && !mapping->a_ops->migratepage) ++ migrate_dirty = mapping && mapping->a_ops->migratepage; ++ unlock_page(page); ++ if (!migrate_dirty) + return ret; + } + } +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 16eb99458df4..014a73b46064 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1819,10 +1819,14 @@ static int compat_table_info(const struct ebt_table_info *info, + { + unsigned int size = info->entries_size; + const void *entries = info->entries; ++ int ret; + + newinfo->entries_size = size; + +- xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries); ++ ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries); ++ if (ret) ++ return ret; ++ + return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, + entries, newinfo); + } +@@ -2257,7 +2261,9 @@ static int compat_do_replace(struct net *net, void __user *user, + + xt_compat_lock(NFPROTO_BRIDGE); + +- xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); ++ ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); ++ if (ret < 0) ++ goto out_unlock; + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); + if (ret < 0) + goto out_unlock; +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index aa4c3b7f7da4..356ae7da4f16 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -768,7 +768,9 @@ static int compat_table_info(const struct xt_table_info *info, + memcpy(newinfo, info, offsetof(struct xt_table_info, entries)); + newinfo->initial_entries = 0; + loc_cpu_entry = info->entries; +- xt_compat_init_offsets(NFPROTO_ARP, info->number); ++ ret = xt_compat_init_offsets(NFPROTO_ARP, info->number); ++ if (ret) ++ return ret; + xt_entry_foreach(iter, loc_cpu_entry, info->size) { + ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); + if (ret != 0) +@@ -883,7 +885,7 @@ static int __do_replace(struct net *net, const char *name, + struct arpt_entry *iter; + + ret = 0; +- counters = vzalloc(num_counters * sizeof(struct xt_counters)); ++ counters = xt_counters_alloc(num_counters); + if (!counters) { + ret = -ENOMEM; + goto out; +@@ -1157,7 +1159,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + struct compat_arpt_entry *iter0; + struct arpt_replace repl; + unsigned int size; +- int ret = 0; ++ int ret; + + info = *pinfo; + entry0 = *pentry0; +@@ -1166,7 +1168,9 @@ static int translate_compat_table(struct xt_table_info **pinfo, + + j = 0; + xt_compat_lock(NFPROTO_ARP); +- xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries); ++ ret = xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries); ++ if (ret) ++ goto out_unlock; + /* Walk through entries, checking offsets. */ + xt_entry_foreach(iter0, entry0, compatr->size) { + ret = check_compat_entry_size_and_hooks(iter0, info, &size, +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index cadb82a906b8..1a925f2394ad 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -931,7 +931,9 @@ static int compat_table_info(const struct xt_table_info *info, + memcpy(newinfo, info, offsetof(struct xt_table_info, entries)); + newinfo->initial_entries = 0; + loc_cpu_entry = info->entries; +- xt_compat_init_offsets(AF_INET, info->number); ++ ret = xt_compat_init_offsets(AF_INET, info->number); ++ if (ret) ++ return ret; + xt_entry_foreach(iter, loc_cpu_entry, info->size) { + ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); + if (ret != 0) +@@ -1044,7 +1046,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, + struct ipt_entry *iter; + + ret = 0; +- counters = vzalloc(num_counters * sizeof(struct xt_counters)); ++ counters = xt_counters_alloc(num_counters); + if (!counters) { + ret = -ENOMEM; + goto out; +@@ -1407,7 +1409,9 @@ translate_compat_table(struct net *net, + + j = 0; + xt_compat_lock(AF_INET); +- xt_compat_init_offsets(AF_INET, compatr->num_entries); ++ ret = xt_compat_init_offsets(AF_INET, compatr->num_entries); ++ if (ret) ++ goto out_unlock; + /* Walk through entries, checking offsets. */ + xt_entry_foreach(iter0, entry0, compatr->size) { + ret = check_compat_entry_size_and_hooks(iter0, info, &size, +diff --git a/net/ipv4/tcp_nv.c b/net/ipv4/tcp_nv.c +index 125fc1450b01..09f8773fd769 100644 +--- a/net/ipv4/tcp_nv.c ++++ b/net/ipv4/tcp_nv.c +@@ -327,7 +327,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample) + */ + cwnd_by_slope = (u32) + div64_u64(((u64)ca->nv_rtt_max_rate) * ca->nv_min_rtt, +- (u64)(80000 * tp->mss_cache)); ++ 80000ULL * tp->mss_cache); + max_win = cwnd_by_slope + nv_pad; + + /* If cwnd > max_win, decrease cwnd +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index a0a31972fc75..c5fe42e6b7f7 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -949,7 +949,9 @@ static int compat_table_info(const struct xt_table_info *info, + memcpy(newinfo, info, offsetof(struct xt_table_info, entries)); + newinfo->initial_entries = 0; + loc_cpu_entry = info->entries; +- xt_compat_init_offsets(AF_INET6, info->number); ++ ret = xt_compat_init_offsets(AF_INET6, info->number); ++ if (ret) ++ return ret; + xt_entry_foreach(iter, loc_cpu_entry, info->size) { + ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); + if (ret != 0) +@@ -1063,7 +1065,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, + struct ip6t_entry *iter; + + ret = 0; +- counters = vzalloc(num_counters * sizeof(struct xt_counters)); ++ counters = xt_counters_alloc(num_counters); + if (!counters) { + ret = -ENOMEM; + goto out; +@@ -1415,7 +1417,7 @@ translate_compat_table(struct net *net, + struct compat_ip6t_entry *iter0; + struct ip6t_replace repl; + unsigned int size; +- int ret = 0; ++ int ret; + + info = *pinfo; + entry0 = *pentry0; +@@ -1424,7 +1426,9 @@ translate_compat_table(struct net *net, + + j = 0; + xt_compat_lock(AF_INET6); +- xt_compat_init_offsets(AF_INET6, compatr->num_entries); ++ ret = xt_compat_init_offsets(AF_INET6, compatr->num_entries); ++ if (ret) ++ goto out_unlock; + /* Walk through entries, checking offsets. */ + xt_entry_foreach(iter0, entry0, compatr->size) { + ret = check_compat_entry_size_and_hooks(iter0, info, &size, +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index b263bf3a19f7..64ec23388450 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -230,7 +230,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + + if ((unsigned int)end > IPV6_MAXPLEN) { + pr_debug("offset is too large.\n"); +- return -1; ++ return -EINVAL; + } + + ecn = ip6_frag_ecn(ipv6_hdr(skb)); +@@ -263,7 +263,8 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + * this case. -DaveM + */ + pr_debug("end of fragment not rounded to 8 bytes.\n"); +- return -1; ++ inet_frag_kill(&fq->q, &nf_frags); ++ return -EPROTO; + } + if (end > fq->q.len) { + /* Some bits beyond end -> corruption. */ +@@ -357,7 +358,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + discard_fq: + inet_frag_kill(&fq->q, &nf_frags); + err: +- return -1; ++ return -EINVAL; + } + + /* +@@ -566,6 +567,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff) + + int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + { ++ u16 savethdr = skb->transport_header; + struct net_device *dev = skb->dev; + int fhoff, nhoff, ret; + struct frag_hdr *fhdr; +@@ -599,8 +601,12 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + + spin_lock_bh(&fq->q.lock); + +- if (nf_ct_frag6_queue(fq, skb, fhdr, nhoff) < 0) { +- ret = -EINVAL; ++ ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff); ++ if (ret < 0) { ++ if (ret == -EPROTO) { ++ skb->transport_header = savethdr; ++ ret = 0; ++ } + goto out_unlock; + } + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index a450a1c8804b..8e054c63b54e 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -40,6 +40,7 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); + MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); + + #define XT_PCPU_BLOCK_SIZE 4096 ++#define XT_MAX_TABLE_SIZE (512 * 1024 * 1024) + + struct compat_delta { + unsigned int offset; /* offset in kernel */ +@@ -554,14 +555,8 @@ int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta) + { + struct xt_af *xp = &xt[af]; + +- if (!xp->compat_tab) { +- if (!xp->number) +- return -EINVAL; +- xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number); +- if (!xp->compat_tab) +- return -ENOMEM; +- xp->cur = 0; +- } ++ if (WARN_ON(!xp->compat_tab)) ++ return -ENOMEM; + + if (xp->cur >= xp->number) + return -EINVAL; +@@ -604,10 +599,28 @@ int xt_compat_calc_jump(u_int8_t af, unsigned int offset) + } + EXPORT_SYMBOL_GPL(xt_compat_calc_jump); + +-void xt_compat_init_offsets(u_int8_t af, unsigned int number) ++int xt_compat_init_offsets(u8 af, unsigned int number) + { ++ size_t mem; ++ ++ if (!number || number > (INT_MAX / sizeof(struct compat_delta))) ++ return -EINVAL; ++ ++ if (WARN_ON(xt[af].compat_tab)) ++ return -EINVAL; ++ ++ mem = sizeof(struct compat_delta) * number; ++ if (mem > XT_MAX_TABLE_SIZE) ++ return -ENOMEM; ++ ++ xt[af].compat_tab = vmalloc(mem); ++ if (!xt[af].compat_tab) ++ return -ENOMEM; ++ + xt[af].number = number; + xt[af].cur = 0; ++ ++ return 0; + } + EXPORT_SYMBOL(xt_compat_init_offsets); + +@@ -806,6 +819,9 @@ EXPORT_SYMBOL(xt_check_entry_offsets); + */ + unsigned int *xt_alloc_entry_offsets(unsigned int size) + { ++ if (size > XT_MAX_TABLE_SIZE / sizeof(unsigned int)) ++ return NULL; ++ + return kvmalloc_array(size, sizeof(unsigned int), GFP_KERNEL | __GFP_ZERO); + + } +@@ -1031,7 +1047,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + struct xt_table_info *info = NULL; + size_t sz = sizeof(*info) + size; + +- if (sz < sizeof(*info)) ++ if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE) + return NULL; + + /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ +@@ -1186,6 +1202,21 @@ static int xt_jumpstack_alloc(struct xt_table_info *i) + return 0; + } + ++struct xt_counters *xt_counters_alloc(unsigned int counters) ++{ ++ struct xt_counters *mem; ++ ++ if (counters == 0 || counters > INT_MAX / sizeof(*mem)) ++ return NULL; ++ ++ counters *= sizeof(*mem); ++ if (counters > XT_MAX_TABLE_SIZE) ++ return NULL; ++ ++ return vzalloc(counters); ++} ++EXPORT_SYMBOL(xt_counters_alloc); ++ + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index bb5d6a058fb7..1141f08810b6 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -256,6 +256,7 @@ static struct xt_target idletimer_tg __read_mostly = { + .family = NFPROTO_UNSPEC, + .target = idletimer_tg_target, + .targetsize = sizeof(struct idletimer_tg_info), ++ .usersize = offsetof(struct idletimer_tg_info, timer), + .checkentry = idletimer_tg_checkentry, + .destroy = idletimer_tg_destroy, + .me = THIS_MODULE, +diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c +index 0858fe17e14a..2d1c5c169a26 100644 +--- a/net/netfilter/xt_LED.c ++++ b/net/netfilter/xt_LED.c +@@ -198,6 +198,7 @@ static struct xt_target led_tg_reg __read_mostly = { + .family = NFPROTO_UNSPEC, + .target = led_tg, + .targetsize = sizeof(struct xt_led_info), ++ .usersize = offsetof(struct xt_led_info, internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me = THIS_MODULE, +diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c +index d27b5f1ea619..61403b77361c 100644 +--- a/net/netfilter/xt_limit.c ++++ b/net/netfilter/xt_limit.c +@@ -193,9 +193,8 @@ static struct xt_match limit_mt_reg __read_mostly = { + .compatsize = sizeof(struct compat_xt_rateinfo), + .compat_from_user = limit_mt_compat_from_user, + .compat_to_user = limit_mt_compat_to_user, +-#else +- .usersize = offsetof(struct xt_rateinfo, prev), + #endif ++ .usersize = offsetof(struct xt_rateinfo, prev), + .me = THIS_MODULE, + }; + +diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c +index cc0518fe598e..6f92d25590a8 100644 +--- a/net/netfilter/xt_nfacct.c ++++ b/net/netfilter/xt_nfacct.c +@@ -62,6 +62,7 @@ static struct xt_match nfacct_mt_reg __read_mostly = { + .match = nfacct_mt, + .destroy = nfacct_mt_destroy, + .matchsize = sizeof(struct xt_nfacct_match_info), ++ .usersize = offsetof(struct xt_nfacct_match_info, nfacct), + .me = THIS_MODULE, + }; + +diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c +index 11de55e7a868..8710fdba2ae2 100644 +--- a/net/netfilter/xt_statistic.c ++++ b/net/netfilter/xt_statistic.c +@@ -84,6 +84,7 @@ static struct xt_match xt_statistic_mt_reg __read_mostly = { + .checkentry = statistic_mt_check, + .destroy = statistic_mt_destroy, + .matchsize = sizeof(struct xt_statistic_info), ++ .usersize = offsetof(struct xt_statistic_info, master), + .me = THIS_MODULE, + }; + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index d558e882ca0c..285f8797c26a 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -1097,6 +1097,36 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, + return 0; + } + ++/* Trim the skb to the length specified by the IP/IPv6 header, ++ * removing any trailing lower-layer padding. This prepares the skb ++ * for higher-layer processing that assumes skb->len excludes padding ++ * (such as nf_ip_checksum). The caller needs to pull the skb to the ++ * network header, and ensure ip_hdr/ipv6_hdr points to valid data. ++ */ ++static int ovs_skb_network_trim(struct sk_buff *skb) ++{ ++ unsigned int len; ++ int err; ++ ++ switch (skb->protocol) { ++ case htons(ETH_P_IP): ++ len = ntohs(ip_hdr(skb)->tot_len); ++ break; ++ case htons(ETH_P_IPV6): ++ len = sizeof(struct ipv6hdr) ++ + ntohs(ipv6_hdr(skb)->payload_len); ++ break; ++ default: ++ len = skb->len; ++ } ++ ++ err = pskb_trim_rcsum(skb, len); ++ if (err) ++ kfree_skb(skb); ++ ++ return err; ++} ++ + /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero + * value if 'skb' is freed. + */ +@@ -1111,6 +1141,10 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb, + nh_ofs = skb_network_offset(skb); + skb_pull_rcsum(skb, nh_ofs); + ++ err = ovs_skb_network_trim(skb); ++ if (err) ++ return err; ++ + if (key->ip.frag != OVS_FRAG_TYPE_NONE) { + err = handle_fragments(net, key, info->zone.id, skb); + if (err) +diff --git a/net/rds/ib.c b/net/rds/ib.c +index a0954ace3774..c21eb4850b9d 100644 +--- a/net/rds/ib.c ++++ b/net/rds/ib.c +@@ -346,7 +346,8 @@ static int rds_ib_laddr_check(struct net *net, __be32 addr) + /* Create a CMA ID and try to bind it. This catches both + * IB and iWARP capable NICs. + */ +- cm_id = rdma_create_id(&init_net, NULL, NULL, RDMA_PS_TCP, IB_QPT_RC); ++ cm_id = rdma_create_id(&init_net, rds_rdma_cm_event_handler, ++ NULL, RDMA_PS_TCP, IB_QPT_RC); + if (IS_ERR(cm_id)) + return PTR_ERR(cm_id); + +diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c +index 59a51a56e7c8..0435c4167a1a 100644 +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -404,6 +404,7 @@ void rxrpc_process_connection(struct work_struct *work) + case -EKEYEXPIRED: + case -EKEYREJECTED: + goto protocol_error; ++ case -ENOMEM: + case -EAGAIN: + goto requeue_and_leave; + case -ECONNABORTED: +diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c +index c38b3a1de56c..77cb23c7bd0a 100644 +--- a/net/rxrpc/rxkad.c ++++ b/net/rxrpc/rxkad.c +@@ -773,8 +773,7 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, + { + const struct rxrpc_key_token *token; + struct rxkad_challenge challenge; +- struct rxkad_response resp +- __attribute__((aligned(8))); /* must be aligned for crypto */ ++ struct rxkad_response *resp; + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + const char *eproto; + u32 version, nonce, min_level, abort_code; +@@ -818,26 +817,29 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, + token = conn->params.key->payload.data[0]; + + /* build the response packet */ +- memset(&resp, 0, sizeof(resp)); +- +- resp.version = htonl(RXKAD_VERSION); +- resp.encrypted.epoch = htonl(conn->proto.epoch); +- resp.encrypted.cid = htonl(conn->proto.cid); +- resp.encrypted.securityIndex = htonl(conn->security_ix); +- resp.encrypted.inc_nonce = htonl(nonce + 1); +- resp.encrypted.level = htonl(conn->params.security_level); +- resp.kvno = htonl(token->kad->kvno); +- resp.ticket_len = htonl(token->kad->ticket_len); +- +- resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter); +- resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter); +- resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter); +- resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter); ++ resp = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); ++ if (!resp) ++ return -ENOMEM; ++ ++ resp->version = htonl(RXKAD_VERSION); ++ resp->encrypted.epoch = htonl(conn->proto.epoch); ++ resp->encrypted.cid = htonl(conn->proto.cid); ++ resp->encrypted.securityIndex = htonl(conn->security_ix); ++ resp->encrypted.inc_nonce = htonl(nonce + 1); ++ resp->encrypted.level = htonl(conn->params.security_level); ++ resp->kvno = htonl(token->kad->kvno); ++ resp->ticket_len = htonl(token->kad->ticket_len); ++ resp->encrypted.call_id[0] = htonl(conn->channels[0].call_counter); ++ resp->encrypted.call_id[1] = htonl(conn->channels[1].call_counter); ++ resp->encrypted.call_id[2] = htonl(conn->channels[2].call_counter); ++ resp->encrypted.call_id[3] = htonl(conn->channels[3].call_counter); + + /* calculate the response checksum and then do the encryption */ +- rxkad_calc_response_checksum(&resp); +- rxkad_encrypt_response(conn, &resp, token->kad); +- return rxkad_send_response(conn, &sp->hdr, &resp, token->kad); ++ rxkad_calc_response_checksum(resp); ++ rxkad_encrypt_response(conn, resp, token->kad); ++ ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad); ++ kfree(resp); ++ return ret; + + protocol_error: + trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); +@@ -1048,8 +1050,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + struct sk_buff *skb, + u32 *_abort_code) + { +- struct rxkad_response response +- __attribute__((aligned(8))); /* must be aligned for crypto */ ++ struct rxkad_response *response; + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + struct rxrpc_crypt session_key; + const char *eproto; +@@ -1061,17 +1062,22 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + + _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key)); + ++ ret = -ENOMEM; ++ response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); ++ if (!response) ++ goto temporary_error; ++ + eproto = tracepoint_string("rxkad_rsp_short"); + abort_code = RXKADPACKETSHORT; + if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), +- &response, sizeof(response)) < 0) ++ response, sizeof(*response)) < 0) + goto protocol_error; +- if (!pskb_pull(skb, sizeof(response))) ++ if (!pskb_pull(skb, sizeof(*response))) + BUG(); + +- version = ntohl(response.version); +- ticket_len = ntohl(response.ticket_len); +- kvno = ntohl(response.kvno); ++ version = ntohl(response->version); ++ ticket_len = ntohl(response->ticket_len); ++ kvno = ntohl(response->kvno); + _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }", + sp->hdr.serial, version, kvno, ticket_len); + +@@ -1105,31 +1111,31 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key, + &expiry, _abort_code); + if (ret < 0) +- goto temporary_error_free; ++ goto temporary_error_free_resp; + + /* use the session key from inside the ticket to decrypt the + * response */ +- rxkad_decrypt_response(conn, &response, &session_key); ++ rxkad_decrypt_response(conn, response, &session_key); + + eproto = tracepoint_string("rxkad_rsp_param"); + abort_code = RXKADSEALEDINCON; +- if (ntohl(response.encrypted.epoch) != conn->proto.epoch) ++ if (ntohl(response->encrypted.epoch) != conn->proto.epoch) + goto protocol_error_free; +- if (ntohl(response.encrypted.cid) != conn->proto.cid) ++ if (ntohl(response->encrypted.cid) != conn->proto.cid) + goto protocol_error_free; +- if (ntohl(response.encrypted.securityIndex) != conn->security_ix) ++ if (ntohl(response->encrypted.securityIndex) != conn->security_ix) + goto protocol_error_free; +- csum = response.encrypted.checksum; +- response.encrypted.checksum = 0; +- rxkad_calc_response_checksum(&response); ++ csum = response->encrypted.checksum; ++ response->encrypted.checksum = 0; ++ rxkad_calc_response_checksum(response); + eproto = tracepoint_string("rxkad_rsp_csum"); +- if (response.encrypted.checksum != csum) ++ if (response->encrypted.checksum != csum) + goto protocol_error_free; + + spin_lock(&conn->channel_lock); + for (i = 0; i < RXRPC_MAXCALLS; i++) { + struct rxrpc_call *call; +- u32 call_id = ntohl(response.encrypted.call_id[i]); ++ u32 call_id = ntohl(response->encrypted.call_id[i]); + + eproto = tracepoint_string("rxkad_rsp_callid"); + if (call_id > INT_MAX) +@@ -1153,12 +1159,12 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + + eproto = tracepoint_string("rxkad_rsp_seq"); + abort_code = RXKADOUTOFSEQUENCE; +- if (ntohl(response.encrypted.inc_nonce) != conn->security_nonce + 1) ++ if (ntohl(response->encrypted.inc_nonce) != conn->security_nonce + 1) + goto protocol_error_free; + + eproto = tracepoint_string("rxkad_rsp_level"); + abort_code = RXKADLEVELFAIL; +- level = ntohl(response.encrypted.level); ++ level = ntohl(response->encrypted.level); + if (level > RXRPC_SECURITY_ENCRYPT) + goto protocol_error_free; + conn->params.security_level = level; +@@ -1168,9 +1174,10 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + * as for a client connection */ + ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno); + if (ret < 0) +- goto temporary_error_free; ++ goto temporary_error_free_ticket; + + kfree(ticket); ++ kfree(response); + _leave(" = 0"); + return 0; + +@@ -1179,12 +1186,15 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + protocol_error_free: + kfree(ticket); + protocol_error: ++ kfree(response); + trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); + *_abort_code = abort_code; + return -EPROTO; + +-temporary_error_free: ++temporary_error_free_ticket: + kfree(ticket); ++temporary_error_free_resp: ++ kfree(response); + temporary_error: + /* Ignore the response packet if we got a temporary error such as + * ENOMEM. We just want to send the challenge again. Note that we +diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c +index 823a781ec89c..25e3602aa41f 100644 +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -74,21 +74,13 @@ static int rpcrdma_bc_setup_rqst(struct rpcrdma_xprt *r_xprt, + static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt, + unsigned int count) + { +- struct rpcrdma_rep *rep; + int rc = 0; + + while (count--) { +- rep = rpcrdma_create_rep(r_xprt); +- if (IS_ERR(rep)) { +- pr_err("RPC: %s: reply buffer alloc failed\n", +- __func__); +- rc = PTR_ERR(rep); ++ rc = rpcrdma_create_rep(r_xprt); ++ if (rc) + break; +- } +- +- rpcrdma_recv_buffer_put(rep); + } +- + return rc; + } + +diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c +index 9bd04549a1ad..12b9a7e0b6d2 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c +@@ -727,12 +727,16 @@ static int svc_rdma_build_normal_read_chunk(struct svc_rqst *rqstp, + head->arg.head[0].iov_len - info->ri_position; + head->arg.head[0].iov_len = info->ri_position; + +- /* Read chunk may need XDR roundup (see RFC 5666, s. 3.7). ++ /* Read chunk may need XDR roundup (see RFC 8166, s. 3.4.5.2). + * +- * NFSv2/3 write decoders need the length of the tail to +- * contain the size of the roundup padding. ++ * If the client already rounded up the chunk length, the ++ * length does not change. Otherwise, the length of the page ++ * list is increased to include XDR round-up. ++ * ++ * Currently these chunks always start at page offset 0, ++ * thus the rounded-up length never crosses a page boundary. + */ +- head->arg.tail[0].iov_len += 4 - (info->ri_chunklen & 3); ++ info->ri_chunklen = XDR_QUADLEN(info->ri_chunklen) << 2; + + head->arg.page_len = info->ri_chunklen; + head->arg.len += info->ri_chunklen; +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 9e8e1de19b2e..97b9d4f671ac 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -951,10 +951,17 @@ rpcrdma_create_req(struct rpcrdma_xprt *r_xprt) + return req; + } + +-struct rpcrdma_rep * ++/** ++ * rpcrdma_create_rep - Allocate an rpcrdma_rep object ++ * @r_xprt: controlling transport ++ * ++ * Returns 0 on success or a negative errno on failure. ++ */ ++int + rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt) + { + struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data; ++ struct rpcrdma_buffer *buf = &r_xprt->rx_buf; + struct rpcrdma_rep *rep; + int rc; + +@@ -979,12 +986,18 @@ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt) + rep->rr_recv_wr.wr_cqe = &rep->rr_cqe; + rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov; + rep->rr_recv_wr.num_sge = 1; +- return rep; ++ ++ spin_lock(&buf->rb_lock); ++ list_add(&rep->rr_list, &buf->rb_recv_bufs); ++ spin_unlock(&buf->rb_lock); ++ return 0; + + out_free: + kfree(rep); + out: +- return ERR_PTR(rc); ++ dprintk("RPC: %s: reply buffer %d alloc failed\n", ++ __func__, rc); ++ return rc; + } + + int +@@ -1027,17 +1040,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt) + } + + INIT_LIST_HEAD(&buf->rb_recv_bufs); +- for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) { +- struct rpcrdma_rep *rep; +- +- rep = rpcrdma_create_rep(r_xprt); +- if (IS_ERR(rep)) { +- dprintk("RPC: %s: reply buffer %d alloc failed\n", +- __func__, i); +- rc = PTR_ERR(rep); ++ for (i = 0; i <= buf->rb_max_requests; i++) { ++ rc = rpcrdma_create_rep(r_xprt); ++ if (rc) + goto out; +- } +- list_add(&rep->rr_list, &buf->rb_recv_bufs); + } + + return 0; +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index e26a97d2f922..fcb0b3227ee1 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -550,8 +550,8 @@ int rpcrdma_ep_post_recv(struct rpcrdma_ia *, struct rpcrdma_rep *); + * Buffer calls - xprtrdma/verbs.c + */ + struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *); +-struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *); + void rpcrdma_destroy_req(struct rpcrdma_req *); ++int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt); + int rpcrdma_buffer_create(struct rpcrdma_xprt *); + void rpcrdma_buffer_destroy(struct rpcrdma_buffer *); + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 8cb40f8ffa5b..30192abfdc3b 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1069,18 +1069,18 @@ static void xs_udp_data_read_skb(struct rpc_xprt *xprt, + + /* Suck it into the iovec, verify checksum if not done by hw. */ + if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb)) { +- __UDPX_INC_STATS(sk, UDP_MIB_INERRORS); + spin_lock(&xprt->recv_lock); ++ __UDPX_INC_STATS(sk, UDP_MIB_INERRORS); + goto out_unpin; + } + +- __UDPX_INC_STATS(sk, UDP_MIB_INDATAGRAMS); + + spin_lock_bh(&xprt->transport_lock); + xprt_adjust_cwnd(xprt, task, copied); + spin_unlock_bh(&xprt->transport_lock); + spin_lock(&xprt->recv_lock); + xprt_complete_rqst(task, copied); ++ __UDPX_INC_STATS(sk, UDP_MIB_INDATAGRAMS); + out_unpin: + xprt_unpin_rqst(rovr); + out_unlock: +diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile +index 9b4a66e3363e..c1dc632d4ea4 100644 +--- a/samples/bpf/Makefile ++++ b/samples/bpf/Makefile +@@ -179,13 +179,16 @@ LLC ?= llc + CLANG ?= clang + + # Trick to allow make to be run from this directory +-all: ++all: $(LIBBPF) + $(MAKE) -C ../../ $(CURDIR)/ + + clean: + $(MAKE) -C ../../ M=$(CURDIR) clean + @rm -f *~ + ++$(LIBBPF): FORCE ++ $(MAKE) -C $(dir $@) $(notdir $@) ++ + $(obj)/syscall_nrs.s: $(src)/syscall_nrs.c + $(call if_changed_dep,cc_s_c) + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index cbf4996dd9c1..ed29bad1f03a 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -113,7 +113,7 @@ void expr_free(struct expr *e) + break; + case E_NOT: + expr_free(e->left.expr); +- return; ++ break; + case E_EQUAL: + case E_GEQ: + case E_GTH: +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c +index e9357931b47d..749c2bd5fc51 100644 +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -372,6 +372,7 @@ void menu_finalize(struct menu *parent) + menu->parent = parent; + last_menu = menu; + } ++ expr_free(basedep); + if (last_menu) { + parent->list = parent->next; + parent->next = last_menu->next; +diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y +index c8f396c3b190..20d9caa4be99 100644 +--- a/scripts/kconfig/zconf.y ++++ b/scripts/kconfig/zconf.y +@@ -108,7 +108,27 @@ static struct menu *current_menu, *current_entry; + %% + input: nl start | start; + +-start: mainmenu_stmt stmt_list | stmt_list; ++start: mainmenu_stmt stmt_list | no_mainmenu_stmt stmt_list; ++ ++/* mainmenu entry */ ++ ++mainmenu_stmt: T_MAINMENU prompt nl ++{ ++ menu_add_prompt(P_MENU, $2, NULL); ++}; ++ ++/* Default main menu, if there's no mainmenu entry */ ++ ++no_mainmenu_stmt: /* empty */ ++{ ++ /* ++ * Hack: Keep the main menu title on the heap so we can safely free it ++ * later regardless of whether it comes from the 'prompt' in ++ * mainmenu_stmt or here ++ */ ++ menu_add_prompt(P_MENU, strdup("Linux Kernel Configuration"), NULL); ++}; ++ + + stmt_list: + /* empty */ +@@ -351,13 +371,6 @@ if_block: + | if_block choice_stmt + ; + +-/* mainmenu entry */ +- +-mainmenu_stmt: T_MAINMENU prompt nl +-{ +- menu_add_prompt(P_MENU, $2, NULL); +-}; +- + /* menu entry */ + + menu: T_MENU prompt T_EOL +@@ -502,6 +515,7 @@ word_opt: /* empty */ { $$ = NULL; } + + void conf_parse(const char *name) + { ++ const char *tmp; + struct symbol *sym; + int i; + +@@ -509,7 +523,6 @@ void conf_parse(const char *name) + + sym_init(); + _menu_init(); +- rootmenu.prompt = menu_add_prompt(P_MENU, "Linux Kernel Configuration", NULL); + + if (getenv("ZCONF_DEBUG")) + zconfdebug = 1; +@@ -519,8 +532,10 @@ void conf_parse(const char *name) + if (!modules_sym) + modules_sym = sym_find( "n" ); + ++ tmp = rootmenu.prompt->text; + rootmenu.prompt->text = _(rootmenu.prompt->text); + rootmenu.prompt->text = sym_expand_string_value(rootmenu.prompt->text); ++ free((char*)tmp); + + menu_finalize(&rootmenu); + for_all_symbols(i, sym) { +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig +index 7f3b5ed81995..f7a492c382d9 100644 +--- a/sound/pci/hda/Kconfig ++++ b/sound/pci/hda/Kconfig +@@ -88,7 +88,6 @@ config SND_HDA_PATCH_LOADER + config SND_HDA_CODEC_REALTEK + tristate "Build Realtek HD-audio codec support" + select SND_HDA_GENERIC +- select INPUT + help + Say Y or M here to include Realtek HD-audio codec support in + snd-hda-intel driver, such as ALC880. +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b1b28c6928a7..590887d9b7a1 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3721,6 +3721,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec, + } + } + ++#if IS_REACHABLE(INPUT) + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { +@@ -3853,6 +3854,10 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec, + spec->kb_dev = NULL; + } + } ++#else /* INPUT */ ++#define alc280_fixup_hp_gpio2_mic_hotkey NULL ++#define alc233_fixup_lenovo_line2_mic_hotkey NULL ++#endif /* INPUT */ + + static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +diff --git a/sound/soc/au1x/ac97c.c b/sound/soc/au1x/ac97c.c +index 29a97d52e8ad..66d6c52e7761 100644 +--- a/sound/soc/au1x/ac97c.c ++++ b/sound/soc/au1x/ac97c.c +@@ -91,8 +91,8 @@ static unsigned short au1xac97c_ac97_read(struct snd_ac97 *ac97, + do { + mutex_lock(&ctx->lock); + +- tmo = 5; +- while ((RD(ctx, AC97_STATUS) & STAT_CP) && tmo--) ++ tmo = 6; ++ while ((RD(ctx, AC97_STATUS) & STAT_CP) && --tmo) + udelay(21); /* wait an ac97 frame time */ + if (!tmo) { + pr_debug("ac97rd timeout #1\n"); +@@ -105,7 +105,7 @@ static unsigned short au1xac97c_ac97_read(struct snd_ac97 *ac97, + * poll, Forrest, poll... + */ + tmo = 0x10000; +- while ((RD(ctx, AC97_STATUS) & STAT_CP) && tmo--) ++ while ((RD(ctx, AC97_STATUS) & STAT_CP) && --tmo) + asm volatile ("nop"); + data = RD(ctx, AC97_CMDRESP); + +diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c +index 0513fe480353..21ac8d6cce3a 100644 +--- a/sound/soc/rockchip/rk3399_gru_sound.c ++++ b/sound/soc/rockchip/rk3399_gru_sound.c +@@ -387,7 +387,8 @@ static const struct snd_soc_dai_link rockchip_dais[] = { + [DAILINK_RT5514_DSP] = { + .name = "RT5514 DSP", + .stream_name = "Wake on Voice", +- .codec_dai_name = "rt5514-dsp-cpu-dai", ++ .codec_name = "snd-soc-dummy", ++ .codec_dai_name = "snd-soc-dummy-dai", + }, + }; + +@@ -432,7 +433,18 @@ static int rockchip_sound_of_parse_dais(struct device *dev, + if (index < 0) + continue; + +- np_cpu = (index == DAILINK_CDNDP) ? np_cpu1 : np_cpu0; ++ switch (index) { ++ case DAILINK_CDNDP: ++ np_cpu = np_cpu1; ++ break; ++ case DAILINK_RT5514_DSP: ++ np_cpu = np_codec; ++ break; ++ default: ++ np_cpu = np_cpu0; ++ break; ++ } ++ + if (!np_cpu) { + dev_err(dev, "Missing 'rockchip,cpu' for %s\n", + rockchip_dais[index].name); +@@ -442,7 +454,8 @@ static int rockchip_sound_of_parse_dais(struct device *dev, + dai = &card->dai_link[card->num_links++]; + *dai = rockchip_dais[index]; + +- dai->codec_of_node = np_codec; ++ if (!dai->codec_name) ++ dai->codec_of_node = np_codec; + dai->platform_of_node = np_cpu; + dai->cpu_of_node = np_cpu; + } +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 4555304dc18e..f02448e86d38 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -183,7 +183,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 '$(DESTDIR_SQ)$2' ++ $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 35f6dfcdc565..701d29c8364f 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -661,6 +661,24 @@ bpf_object__init_maps(struct bpf_object *obj) + return bpf_object__validate_maps(obj); + } + ++static bool section_have_execinstr(struct bpf_object *obj, int idx) ++{ ++ Elf_Scn *scn; ++ GElf_Shdr sh; ++ ++ scn = elf_getscn(obj->efile.elf, idx); ++ if (!scn) ++ return false; ++ ++ if (gelf_getshdr(scn, &sh) != &sh) ++ return false; ++ ++ if (sh.sh_flags & SHF_EXECINSTR) ++ return true; ++ ++ return false; ++} ++ + static int bpf_object__elf_collect(struct bpf_object *obj) + { + Elf *elf = obj->efile.elf; +@@ -742,6 +760,14 @@ static int bpf_object__elf_collect(struct bpf_object *obj) + } else if (sh.sh_type == SHT_REL) { + void *reloc = obj->efile.reloc; + int nr_reloc = obj->efile.nr_reloc + 1; ++ int sec = sh.sh_info; /* points to other section */ ++ ++ /* Only do relo for section with exec instructions */ ++ if (!section_have_execinstr(obj, sec)) { ++ pr_debug("skip relo %s(%d) for section(%d)\n", ++ name, idx, sec); ++ continue; ++ } + + reloc = realloc(reloc, + sizeof(*obj->efile.reloc) * nr_reloc); +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c +index 7ce724fc0544..9a17bc27296e 100644 +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -4949,21 +4949,22 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event + else + ls = 2; + +- if (*(ptr+1) == 'F' || *(ptr+1) == 'f' || +- *(ptr+1) == 'S' || *(ptr+1) == 's') { ++ if (isalnum(ptr[1])) + ptr++; ++ ++ if (*ptr == 'F' || *ptr == 'f' || ++ *ptr == 'S' || *ptr == 's') { + show_func = *ptr; +- } else if (*(ptr+1) == 'M' || *(ptr+1) == 'm') { +- print_mac_arg(s, *(ptr+1), data, size, event, arg); +- ptr++; ++ } else if (*ptr == 'M' || *ptr == 'm') { ++ print_mac_arg(s, *ptr, data, size, event, arg); + arg = arg->next; + break; +- } else if (*(ptr+1) == 'I' || *(ptr+1) == 'i') { ++ } else if (*ptr == 'I' || *ptr == 'i') { + int n; + +- n = print_ip_arg(s, ptr+1, data, size, event, arg); ++ n = print_ip_arg(s, ptr, data, size, event, arg); + if (n > 0) { +- ptr += n; ++ ptr += n - 1; + arg = arg->next; + break; + } +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index 7c214ceb9386..5e10ba796a6f 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1879,17 +1879,25 @@ static const char *get_field_str(struct filter_arg *arg, struct pevent_record *r + struct pevent *pevent; + unsigned long long addr; + const char *val = NULL; ++ unsigned int size; + char hex[64]; + + /* If the field is not a string convert it */ + if (arg->str.field->flags & FIELD_IS_STRING) { + val = record->data + arg->str.field->offset; ++ size = arg->str.field->size; ++ ++ if (arg->str.field->flags & FIELD_IS_DYNAMIC) { ++ addr = *(unsigned int *)val; ++ val = record->data + (addr & 0xffff); ++ size = addr >> 16; ++ } + + /* + * We need to copy the data since we can't be sure the field + * is null terminated. + */ +- if (*(val + arg->str.field->size - 1)) { ++ if (*(val + size - 1)) { + /* copy it */ + memcpy(arg->str.buffer, val, arg->str.field->size); + /* the buffer is already NULL terminated */ +diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c +index 33027c5e6f92..c6b5204e0280 100644 +--- a/tools/perf/arch/x86/util/header.c ++++ b/tools/perf/arch/x86/util/header.c +@@ -70,7 +70,7 @@ get_cpuid_str(void) + { + char *buf = malloc(128); + +- if (__get_cpuid(buf, 128, "%s-%u-%X$") < 0) { ++ if (buf && __get_cpuid(buf, 128, "%s-%u-%X$") < 0) { + free(buf); + return NULL; + } +diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c +index d00aac51130d..3479a1bc7caa 100644 +--- a/tools/perf/builtin-c2c.c ++++ b/tools/perf/builtin-c2c.c +@@ -2393,9 +2393,10 @@ static int setup_callchain(struct perf_evlist *evlist) + enum perf_call_graph_mode mode = CALLCHAIN_NONE; + + if ((sample_type & PERF_SAMPLE_REGS_USER) && +- (sample_type & PERF_SAMPLE_STACK_USER)) ++ (sample_type & PERF_SAMPLE_STACK_USER)) { + mode = CALLCHAIN_DWARF; +- else if (sample_type & PERF_SAMPLE_BRANCH_STACK) ++ dwarf_callchain_users = true; ++ } else if (sample_type & PERF_SAMPLE_BRANCH_STACK) + mode = CALLCHAIN_LBR; + else if (sample_type & PERF_SAMPLE_CALLCHAIN) + mode = CALLCHAIN_FP; +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 1957abc1c8cf..b205c1340456 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -1611,7 +1611,8 @@ static struct option __record_options[] = { + OPT_BOOLEAN_SET('T', "timestamp", &record.opts.sample_time, + &record.opts.sample_time_set, + "Record the sample timestamps"), +- OPT_BOOLEAN('P', "period", &record.opts.period, "Record the sample period"), ++ OPT_BOOLEAN_SET('P', "period", &record.opts.period, &record.opts.period_set, ++ "Record the sample period"), + OPT_BOOLEAN('n', "no-samples", &record.opts.no_samples, + "don't sample"), + OPT_BOOLEAN_SET('N', "no-buildid-cache", &record.no_buildid_cache, +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 183c3ed56e08..4ddb0726eebc 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -328,9 +328,10 @@ static int report__setup_sample_type(struct report *rep) + + if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain) { + if ((sample_type & PERF_SAMPLE_REGS_USER) && +- (sample_type & PERF_SAMPLE_STACK_USER)) ++ (sample_type & PERF_SAMPLE_STACK_USER)) { + callchain_param.record_mode = CALLCHAIN_DWARF; +- else if (sample_type & PERF_SAMPLE_BRANCH_STACK) ++ dwarf_callchain_users = true; ++ } else if (sample_type & PERF_SAMPLE_BRANCH_STACK) + callchain_param.record_mode = CALLCHAIN_LBR; + else + callchain_param.record_mode = CALLCHAIN_FP; +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 0fe02758de7d..615fdc63452e 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -2574,9 +2574,10 @@ static void script__setup_sample_type(struct perf_script *script) + + if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain) { + if ((sample_type & PERF_SAMPLE_REGS_USER) && +- (sample_type & PERF_SAMPLE_STACK_USER)) ++ (sample_type & PERF_SAMPLE_STACK_USER)) { + callchain_param.record_mode = CALLCHAIN_DWARF; +- else if (sample_type & PERF_SAMPLE_BRANCH_STACK) ++ dwarf_callchain_users = true; ++ } else if (sample_type & PERF_SAMPLE_BRANCH_STACK) + callchain_param.record_mode = CALLCHAIN_LBR; + else + callchain_param.record_mode = CALLCHAIN_FP; +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index f75f3dec7485..55086389fc06 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -50,6 +50,7 @@ struct record_opts { + bool sample_time_set; + bool sample_cpu; + bool period; ++ bool period_set; + bool running_time; + bool full_auxtrace; + bool auxtrace_snapshot_mode; +diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c +index ac40e05bcab4..260418969120 100644 +--- a/tools/perf/tests/dwarf-unwind.c ++++ b/tools/perf/tests/dwarf-unwind.c +@@ -173,6 +173,7 @@ int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unu + } + + callchain_param.record_mode = CALLCHAIN_DWARF; ++ dwarf_callchain_users = true; + + if (init_live_machine(machine)) { + pr_err("Could not init machine\n"); +diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh +index 7a84d73324e3..a2f757da49d9 100755 +--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh ++++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh +@@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() { + expected[4]="rtt min.*" + expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)" + expected[6]=".*inet_pton[[:space:]]\($libc\)$" +- expected[7]="getaddrinfo[[:space:]]\($libc\)$" +- expected[8]=".*\(.*/bin/ping.*\)$" ++ case "$(uname -m)" in ++ s390x) ++ eventattr='call-graph=dwarf' ++ expected[7]="gaih_inet[[:space:]]\(inlined\)$" ++ expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$" ++ expected[9]="main[[:space:]]\(.*/bin/ping.*\)$" ++ expected[10]="__libc_start_main[[:space:]]\($libc\)$" ++ expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$" ++ ;; ++ *) ++ eventattr='max-stack=3' ++ expected[7]="getaddrinfo[[:space:]]\($libc\)$" ++ expected[8]=".*\(.*/bin/ping.*\)$" ++ ;; ++ esac + +- perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do ++ perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do + echo $line + echo "$line" | egrep -q "${expected[$idx]}" + if [ $? -ne 0 ] ; then +@@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() { + exit 1 + fi + let idx+=1 +- [ $idx -eq 9 ] && break ++ [ -z "${expected[$idx]}" ] && break + done + } + +diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c +index 6031933d811c..146683b1c28d 100644 +--- a/tools/perf/util/callchain.c ++++ b/tools/perf/util/callchain.c +@@ -37,6 +37,15 @@ struct callchain_param callchain_param = { + CALLCHAIN_PARAM_DEFAULT + }; + ++/* ++ * Are there any events usind DWARF callchains? ++ * ++ * I.e. ++ * ++ * -e cycles/call-graph=dwarf/ ++ */ ++bool dwarf_callchain_users; ++ + struct callchain_param callchain_param_default = { + CALLCHAIN_PARAM_DEFAULT + }; +@@ -265,6 +274,7 @@ int parse_callchain_record(const char *arg, struct callchain_param *param) + ret = 0; + param->record_mode = CALLCHAIN_DWARF; + param->dump_size = default_stack_dump_size; ++ dwarf_callchain_users = true; + + tok = strtok_r(NULL, ",", &saveptr); + if (tok) { +diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h +index f967aa47d0a1..9ba5903c8d3e 100644 +--- a/tools/perf/util/callchain.h ++++ b/tools/perf/util/callchain.h +@@ -89,6 +89,8 @@ enum chain_value { + CCVAL_COUNT, + }; + ++extern bool dwarf_callchain_users; ++ + struct callchain_param { + bool enabled; + enum perf_call_graph_mode record_mode; +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index ac19130c14d8..226a9245d1db 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -722,26 +722,28 @@ static void apply_config_terms(struct perf_evsel *evsel, + struct perf_evsel_config_term *term; + struct list_head *config_terms = &evsel->config_terms; + struct perf_event_attr *attr = &evsel->attr; +- struct callchain_param param; ++ /* callgraph default */ ++ struct callchain_param param = { ++ .record_mode = callchain_param.record_mode, ++ }; + u32 dump_size = 0; + int max_stack = 0; + const char *callgraph_buf = NULL; + +- /* callgraph default */ +- param.record_mode = callchain_param.record_mode; +- + list_for_each_entry(term, config_terms, list) { + switch (term->type) { + case PERF_EVSEL__CONFIG_TERM_PERIOD: + if (!(term->weak && opts->user_interval != ULLONG_MAX)) { + attr->sample_period = term->val.period; + attr->freq = 0; ++ perf_evsel__reset_sample_bit(evsel, PERIOD); + } + break; + case PERF_EVSEL__CONFIG_TERM_FREQ: + if (!(term->weak && opts->user_freq != UINT_MAX)) { + attr->sample_freq = term->val.freq; + attr->freq = 1; ++ perf_evsel__set_sample_bit(evsel, PERIOD); + } + break; + case PERF_EVSEL__CONFIG_TERM_TIME: +@@ -943,9 +945,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + if (target__has_cpu(&opts->target) || opts->sample_cpu) + perf_evsel__set_sample_bit(evsel, CPU); + +- if (opts->period) +- perf_evsel__set_sample_bit(evsel, PERIOD); +- + /* + * When the user explicitly disabled time don't force it here. + */ +@@ -1047,6 +1046,14 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + apply_config_terms(evsel, opts); + + evsel->ignore_missing_thread = opts->ignore_missing_thread; ++ ++ /* The --period option takes the precedence. */ ++ if (opts->period_set) { ++ if (opts->period) ++ perf_evsel__set_sample_bit(evsel, PERIOD); ++ else ++ perf_evsel__reset_sample_bit(evsel, PERIOD); ++ } + } + + static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int nthreads) +diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c +index 7a42f703e858..af873044d33a 100644 +--- a/tools/perf/util/unwind-libunwind-local.c ++++ b/tools/perf/util/unwind-libunwind-local.c +@@ -631,9 +631,8 @@ static unw_accessors_t accessors = { + + static int _unwind__prepare_access(struct thread *thread) + { +- if (callchain_param.record_mode != CALLCHAIN_DWARF) ++ if (!dwarf_callchain_users) + return 0; +- + thread->addr_space = unw_create_addr_space(&accessors, 0); + if (!thread->addr_space) { + pr_err("unwind: Can't create unwind address space.\n"); +@@ -646,17 +645,15 @@ static int _unwind__prepare_access(struct thread *thread) + + static void _unwind__flush_access(struct thread *thread) + { +- if (callchain_param.record_mode != CALLCHAIN_DWARF) ++ if (!dwarf_callchain_users) + return; +- + unw_flush_cache(thread->addr_space, 0, 0); + } + + static void _unwind__finish_access(struct thread *thread) + { +- if (callchain_param.record_mode != CALLCHAIN_DWARF) ++ if (!dwarf_callchain_users) + return; +- + unw_destroy_addr_space(thread->addr_space); + } + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 50ce52d2013d..8b9470b5af6d 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -463,7 +463,7 @@ static void test_devmap(int task, void *data) + #define SOCKMAP_VERDICT_PROG "./sockmap_verdict_prog.o" + static void test_sockmap(int tasks, void *data) + { +- int one = 1, map_fd_rx, map_fd_tx, map_fd_break, s, sc, rc; ++ int one = 1, map_fd_rx = 0, map_fd_tx = 0, map_fd_break, s, sc, rc; + struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_break; + int ports[] = {50200, 50201, 50202, 50204}; + int err, i, fd, udp, sfd[6] = {0xdeadbeef}; +@@ -868,9 +868,12 @@ static void test_sockmap(int tasks, void *data) + goto out_sockmap; + } + +- /* Test map close sockets */ +- for (i = 0; i < 6; i++) ++ /* Test map close sockets and empty maps */ ++ for (i = 0; i < 6; i++) { ++ bpf_map_delete_elem(map_fd_tx, &i); ++ bpf_map_delete_elem(map_fd_rx, &i); + close(sfd[i]); ++ } + close(fd); + close(map_fd_rx); + bpf_object__close(obj); +@@ -881,8 +884,13 @@ static void test_sockmap(int tasks, void *data) + printf("Failed to create sockmap '%i:%s'!\n", i, strerror(errno)); + exit(1); + out_sockmap: +- for (i = 0; i < 6; i++) ++ for (i = 0; i < 6; i++) { ++ if (map_fd_tx) ++ bpf_map_delete_elem(map_fd_tx, &i); ++ if (map_fd_rx) ++ bpf_map_delete_elem(map_fd_rx, &i); + close(sfd[i]); ++ } + close(fd); + exit(1); + } +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +index 589d52b211b7..27a54a17da65 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +@@ -29,6 +29,12 @@ ftrace_filter_check '*schedule*' '^.*schedule.*$' + # filter by *, end match + ftrace_filter_check 'schedule*' '^schedule.*$' + ++# filter by *mid*end ++ftrace_filter_check '*aw*lock' '.*aw.*lock$' ++ ++# filter by start*mid* ++ftrace_filter_check 'mutex*try*' '^mutex.*try.*' ++ + # Advanced full-glob matching feature is recently supported. + # Skip the tests if we are sure the kernel does not support it. + if grep -q 'accepts: .* glob-matching-pattern' README ; then +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +index bb16cf91f1b5..e297bd7a2e79 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +@@ -12,8 +12,8 @@ case `uname -m` in + *) OFFS=0;; + esac + +-echo "Setup up to 256 kprobes" +-grep t /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \ ++echo "Setup up kprobes on first 256 text symbols" ++grep -i " t " /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \ + head -n 256 | while read i; do echo p ${i}+${OFFS} ; done > kprobe_events ||: + + echo 1 > events/kprobes/enable +diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c +index 4a8217448f20..cad14cd0ea92 100644 +--- a/tools/testing/selftests/net/reuseport_bpf.c ++++ b/tools/testing/selftests/net/reuseport_bpf.c +@@ -21,6 +21,7 @@ + #include <sys/epoll.h> + #include <sys/types.h> + #include <sys/socket.h> ++#include <sys/resource.h> + #include <unistd.h> + + #ifndef ARRAY_SIZE +@@ -190,11 +191,14 @@ static void send_from(struct test_params p, uint16_t sport, char *buf, + struct sockaddr * const saddr = new_any_sockaddr(p.send_family, sport); + struct sockaddr * const daddr = + new_loopback_sockaddr(p.send_family, p.recv_port); +- const int fd = socket(p.send_family, p.protocol, 0); ++ const int fd = socket(p.send_family, p.protocol, 0), one = 1; + + if (fd < 0) + error(1, errno, "failed to create send socket"); + ++ if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one))) ++ error(1, errno, "failed to set reuseaddr"); ++ + if (bind(fd, saddr, sockaddr_size())) + error(1, errno, "failed to bind send socket"); + +@@ -433,6 +437,21 @@ void enable_fastopen(void) + } + } + ++static struct rlimit rlim_old, rlim_new; ++ ++static __attribute__((constructor)) void main_ctor(void) ++{ ++ getrlimit(RLIMIT_MEMLOCK, &rlim_old); ++ rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20); ++ rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20); ++ setrlimit(RLIMIT_MEMLOCK, &rlim_new); ++} ++ ++static __attribute__((destructor)) void main_dtor(void) ++{ ++ setrlimit(RLIMIT_MEMLOCK, &rlim_old); ++} ++ + int main(void) + { + fprintf(stderr, "---- IPv4 UDP ----\n"); +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index d81af263f50b..4f35f0dfe681 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -1434,7 +1434,8 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault) + + static int hva_to_pfn_remapped(struct vm_area_struct *vma, + unsigned long addr, bool *async, +- bool write_fault, kvm_pfn_t *p_pfn) ++ bool write_fault, bool *writable, ++ kvm_pfn_t *p_pfn) + { + unsigned long pfn; + int r; +@@ -1460,6 +1461,8 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma, + + } + ++ if (writable) ++ *writable = true; + + /* + * Get a reference here because callers of *hva_to_pfn* and +@@ -1525,7 +1528,7 @@ static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async, + if (vma == NULL) + pfn = KVM_PFN_ERR_FAULT; + else if (vma->vm_flags & (VM_IO | VM_PFNMAP)) { +- r = hva_to_pfn_remapped(vma, addr, async, write_fault, &pfn); ++ r = hva_to_pfn_remapped(vma, addr, async, write_fault, writable, &pfn); + if (r == -EAGAIN) + goto retry; + if (r < 0) |