diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1006_linux-5.9.7.patch | 4933 |
2 files changed, 4937 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 95528eee..c95c981f 100644 --- a/0000_README +++ b/0000_README @@ -71,6 +71,10 @@ Patch: 1006_linux-5.9.7.patch From: http://www.kernel.org Desc: Linux 5.9.7 +Patch: 1006_linux-5.9.7.patch +From: http://www.kernel.org +Desc: Linux 5.9.7 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1006_linux-5.9.7.patch b/1006_linux-5.9.7.patch new file mode 100644 index 00000000..28898166 --- /dev/null +++ b/1006_linux-5.9.7.patch @@ -0,0 +1,4933 @@ +diff --git a/Makefile b/Makefile +index 2fed32cac74e2..035d86a0d291d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 9 +-SUBLEVEL = 6 ++SUBLEVEL = 7 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c +index feba91c9d969c..b23986f984509 100644 +--- a/arch/arc/kernel/stacktrace.c ++++ b/arch/arc/kernel/stacktrace.c +@@ -112,7 +112,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs, + int (*consumer_fn) (unsigned int, void *), void *arg) + { + #ifdef CONFIG_ARC_DW2_UNWIND +- int ret = 0; ++ int ret = 0, cnt = 0; + unsigned int address; + struct unwind_frame_info frame_info; + +@@ -132,6 +132,11 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs, + break; + + frame_info.regs.r63 = frame_info.regs.r31; ++ ++ if (cnt++ > 128) { ++ printk("unwinder looping too long, aborting !\n"); ++ return 0; ++ } + } + + return address; /* return the last address it saw */ +diff --git a/arch/arm/boot/dts/mmp3.dtsi b/arch/arm/boot/dts/mmp3.dtsi +index cc4efd0efabd2..4ae630d37d094 100644 +--- a/arch/arm/boot/dts/mmp3.dtsi ++++ b/arch/arm/boot/dts/mmp3.dtsi +@@ -296,6 +296,7 @@ + interrupts = <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&soc_clocks MMP2_CLK_CCIC0>; + clock-names = "axi"; ++ power-domains = <&soc_clocks MMP3_POWER_DOMAIN_CAMERA>; + #clock-cells = <0>; + clock-output-names = "mclk"; + status = "disabled"; +@@ -307,6 +308,7 @@ + interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&soc_clocks MMP2_CLK_CCIC1>; + clock-names = "axi"; ++ power-domains = <&soc_clocks MMP3_POWER_DOMAIN_CAMERA>; + #clock-cells = <0>; + clock-output-names = "mclk"; + status = "disabled"; +diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi +index 0f95a6ef8543a..1c5a666c54b53 100644 +--- a/arch/arm/boot/dts/sun4i-a10.dtsi ++++ b/arch/arm/boot/dts/sun4i-a10.dtsi +@@ -143,7 +143,7 @@ + trips { + cpu_alert0: cpu-alert0 { + /* milliCelsius */ +- temperature = <850000>; ++ temperature = <85000>; + hysteresis = <2000>; + type = "passive"; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index b9efc8469265d..8e134cb470d3b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -187,6 +187,8 @@ + "timing-adjustment"; + rx-fifo-depth = <4096>; + tx-fifo-depth = <2048>; ++ resets = <&reset RESET_ETHERNET>; ++ reset-names = "stmmaceth"; + status = "disabled"; + }; + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index 1e83ec5b8c91a..8514fe6a275a3 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -209,7 +209,7 @@ + }; + + ethmac: ethernet@ff3f0000 { +- compatible = "amlogic,meson-axg-dwmac", ++ compatible = "amlogic,meson-g12a-dwmac", + "snps,dwmac-3.70a", + "snps,dwmac"; + reg = <0x0 0xff3f0000 0x0 0x10000>, +@@ -224,6 +224,8 @@ + "timing-adjustment"; + rx-fifo-depth = <4096>; + tx-fifo-depth = <2048>; ++ resets = <&reset RESET_ETHERNET>; ++ reset-names = "stmmaceth"; + status = "disabled"; + + mdio0: mdio { +@@ -282,6 +284,8 @@ + hwrng: rng@218 { + compatible = "amlogic,meson-rng"; + reg = <0x0 0x218 0x0 0x4>; ++ clocks = <&clkc CLKID_RNG0>; ++ clock-names = "core"; + }; + }; + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 0edd137151f89..726b91d3a905a 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -13,6 +13,7 @@ + #include <dt-bindings/interrupt-controller/irq.h> + #include <dt-bindings/interrupt-controller/arm-gic.h> + #include <dt-bindings/power/meson-gxbb-power.h> ++#include <dt-bindings/reset/amlogic,meson-gxbb-reset.h> + #include <dt-bindings/thermal/thermal.h> + + / { +@@ -575,6 +576,8 @@ + interrupt-names = "macirq"; + rx-fifo-depth = <4096>; + tx-fifo-depth = <2048>; ++ resets = <&reset RESET_ETHERNET>; ++ reset-names = "stmmaceth"; + power-domains = <&pwrc PWRC_GXBB_ETHERNET_MEM_ID>; + status = "disabled"; + }; +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index 355ee9eed4dde..98c059b6bacae 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -213,6 +213,7 @@ asmlinkage notrace void secondary_start_kernel(void) + if (system_uses_irq_prio_masking()) + init_gic_priority_masking(); + ++ rcu_cpu_starting(cpu); + preempt_disable(); + trace_hardirqs_off(); + +diff --git a/arch/powerpc/kernel/head_40x.S b/arch/powerpc/kernel/head_40x.S +index 5b282d9965a56..a3c3519b3f76a 100644 +--- a/arch/powerpc/kernel/head_40x.S ++++ b/arch/powerpc/kernel/head_40x.S +@@ -285,11 +285,7 @@ _ENTRY(saved_ksp_limit) + + rlwimi r11, r10, 22, 20, 29 /* Compute PTE address */ + lwz r11, 0(r11) /* Get Linux PTE */ +-#ifdef CONFIG_SWAP + li r9, _PAGE_PRESENT | _PAGE_ACCESSED +-#else +- li r9, _PAGE_PRESENT +-#endif + andc. r9, r9, r11 /* Check permission */ + bne 5f + +@@ -370,11 +366,7 @@ _ENTRY(saved_ksp_limit) + + rlwimi r11, r10, 22, 20, 29 /* Compute PTE address */ + lwz r11, 0(r11) /* Get Linux PTE */ +-#ifdef CONFIG_SWAP + li r9, _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC +-#else +- li r9, _PAGE_PRESENT | _PAGE_EXEC +-#endif + andc. r9, r9, r11 /* Check permission */ + bne 5f + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 9f359d3fba749..6f3799a04121c 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -202,9 +202,7 @@ SystemCall: + + InstructionTLBMiss: + mtspr SPRN_SPRG_SCRATCH0, r10 +-#if defined(ITLB_MISS_KERNEL) || defined(CONFIG_SWAP) || defined(CONFIG_HUGETLBFS) + mtspr SPRN_SPRG_SCRATCH1, r11 +-#endif + + /* If we are faulting a kernel address, we have to use the + * kernel page tables. +@@ -238,11 +236,9 @@ InstructionTLBMiss: + rlwimi r11, r10, 32 - 9, _PMD_PAGE_512K + mtspr SPRN_MI_TWC, r11 + #endif +-#ifdef CONFIG_SWAP +- rlwinm r11, r10, 32-5, _PAGE_PRESENT ++ rlwinm r11, r10, 32-7, _PAGE_PRESENT + and r11, r11, r10 + rlwimi r10, r11, 0, _PAGE_PRESENT +-#endif + /* The Linux PTE won't go exactly into the MMU TLB. + * Software indicator bits 20 and 23 must be clear. + * Software indicator bits 22, 24, 25, 26, and 27 must be +@@ -256,9 +252,7 @@ InstructionTLBMiss: + + /* Restore registers */ + 0: mfspr r10, SPRN_SPRG_SCRATCH0 +-#if defined(ITLB_MISS_KERNEL) || defined(CONFIG_SWAP) || defined(CONFIG_HUGETLBFS) + mfspr r11, SPRN_SPRG_SCRATCH1 +-#endif + rfi + patch_site 0b, patch__itlbmiss_exit_1 + +@@ -268,9 +262,7 @@ InstructionTLBMiss: + addi r10, r10, 1 + stw r10, (itlb_miss_counter - PAGE_OFFSET)@l(0) + mfspr r10, SPRN_SPRG_SCRATCH0 +-#if defined(ITLB_MISS_KERNEL) || defined(CONFIG_SWAP) + mfspr r11, SPRN_SPRG_SCRATCH1 +-#endif + rfi + #endif + +@@ -316,11 +308,9 @@ DataStoreTLBMiss: + * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5)); + * r10 = (r10 & ~PRESENT) | r11; + */ +-#ifdef CONFIG_SWAP +- rlwinm r11, r10, 32-5, _PAGE_PRESENT ++ rlwinm r11, r10, 32-7, _PAGE_PRESENT + and r11, r11, r10 + rlwimi r10, r11, 0, _PAGE_PRESENT +-#endif + /* The Linux PTE won't go exactly into the MMU TLB. + * Software indicator bits 24, 25, 26, and 27 must be + * set. All other Linux PTE bits control the behavior +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index b55561cc87865..2c4148a3e83b6 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -691,16 +691,6 @@ static inline int pud_large(pud_t pud) + return !!(pud_val(pud) & _REGION3_ENTRY_LARGE); + } + +-static inline unsigned long pud_pfn(pud_t pud) +-{ +- unsigned long origin_mask; +- +- origin_mask = _REGION_ENTRY_ORIGIN; +- if (pud_large(pud)) +- origin_mask = _REGION3_ENTRY_ORIGIN_LARGE; +- return (pud_val(pud) & origin_mask) >> PAGE_SHIFT; +-} +- + #define pmd_leaf pmd_large + static inline int pmd_large(pmd_t pmd) + { +@@ -746,16 +736,6 @@ static inline int pmd_none(pmd_t pmd) + return pmd_val(pmd) == _SEGMENT_ENTRY_EMPTY; + } + +-static inline unsigned long pmd_pfn(pmd_t pmd) +-{ +- unsigned long origin_mask; +- +- origin_mask = _SEGMENT_ENTRY_ORIGIN; +- if (pmd_large(pmd)) +- origin_mask = _SEGMENT_ENTRY_ORIGIN_LARGE; +- return (pmd_val(pmd) & origin_mask) >> PAGE_SHIFT; +-} +- + #define pmd_write pmd_write + static inline int pmd_write(pmd_t pmd) + { +@@ -1230,11 +1210,39 @@ static inline pte_t mk_pte(struct page *page, pgprot_t pgprot) + #define pud_index(address) (((address) >> PUD_SHIFT) & (PTRS_PER_PUD-1)) + #define pmd_index(address) (((address) >> PMD_SHIFT) & (PTRS_PER_PMD-1)) + +-#define pmd_deref(pmd) (pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN) +-#define pud_deref(pud) (pud_val(pud) & _REGION_ENTRY_ORIGIN) + #define p4d_deref(pud) (p4d_val(pud) & _REGION_ENTRY_ORIGIN) + #define pgd_deref(pgd) (pgd_val(pgd) & _REGION_ENTRY_ORIGIN) + ++static inline unsigned long pmd_deref(pmd_t pmd) ++{ ++ unsigned long origin_mask; ++ ++ origin_mask = _SEGMENT_ENTRY_ORIGIN; ++ if (pmd_large(pmd)) ++ origin_mask = _SEGMENT_ENTRY_ORIGIN_LARGE; ++ return pmd_val(pmd) & origin_mask; ++} ++ ++static inline unsigned long pmd_pfn(pmd_t pmd) ++{ ++ return pmd_deref(pmd) >> PAGE_SHIFT; ++} ++ ++static inline unsigned long pud_deref(pud_t pud) ++{ ++ unsigned long origin_mask; ++ ++ origin_mask = _REGION_ENTRY_ORIGIN; ++ if (pud_large(pud)) ++ origin_mask = _REGION3_ENTRY_ORIGIN_LARGE; ++ return pud_val(pud) & origin_mask; ++} ++ ++static inline unsigned long pud_pfn(pud_t pud) ++{ ++ return pud_deref(pud) >> PAGE_SHIFT; ++} ++ + /* + * The pgd_offset function *always* adds the index for the top-level + * region/segment table. This is done to get a sequence like the +diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c +index d9ae7456dd4c8..40a569b548cc1 100644 +--- a/arch/s390/pci/pci_event.c ++++ b/arch/s390/pci/pci_event.c +@@ -101,6 +101,10 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf) + if (ret) + break; + ++ /* the PCI function will be scanned once function 0 appears */ ++ if (!zdev->zbus->bus) ++ break; ++ + pdev = pci_scan_single_device(zdev->zbus->bus, zdev->devfn); + if (!pdev) + break; +diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c +index 57c2ecf431343..ce831f9448e71 100644 +--- a/arch/x86/kernel/kexec-bzimage64.c ++++ b/arch/x86/kernel/kexec-bzimage64.c +@@ -200,8 +200,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params, + params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch; + + /* Copying screen_info will do? */ +- memcpy(¶ms->screen_info, &boot_params.screen_info, +- sizeof(struct screen_info)); ++ memcpy(¶ms->screen_info, &screen_info, sizeof(struct screen_info)); + + /* Fill in memsize later */ + params->screen_info.ext_mem_k = 0; +diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S +index 037faac46b0cc..1e299ac73c869 100644 +--- a/arch/x86/lib/memcpy_64.S ++++ b/arch/x86/lib/memcpy_64.S +@@ -16,8 +16,6 @@ + * to a jmp to memcpy_erms which does the REP; MOVSB mem copy. + */ + +-.weak memcpy +- + /* + * memcpy - Copy a memory block. + * +@@ -30,7 +28,7 @@ + * rax original destination + */ + SYM_FUNC_START_ALIAS(__memcpy) +-SYM_FUNC_START_LOCAL(memcpy) ++SYM_FUNC_START_WEAK(memcpy) + ALTERNATIVE_2 "jmp memcpy_orig", "", X86_FEATURE_REP_GOOD, \ + "jmp memcpy_erms", X86_FEATURE_ERMS + +diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S +index 7ff00ea64e4fe..41902fe8b8598 100644 +--- a/arch/x86/lib/memmove_64.S ++++ b/arch/x86/lib/memmove_64.S +@@ -24,9 +24,7 @@ + * Output: + * rax: dest + */ +-.weak memmove +- +-SYM_FUNC_START_ALIAS(memmove) ++SYM_FUNC_START_WEAK(memmove) + SYM_FUNC_START(__memmove) + + mov %rdi, %rax +diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S +index 9ff15ee404a48..0bfd26e4ca9e9 100644 +--- a/arch/x86/lib/memset_64.S ++++ b/arch/x86/lib/memset_64.S +@@ -6,8 +6,6 @@ + #include <asm/alternative-asm.h> + #include <asm/export.h> + +-.weak memset +- + /* + * ISO C memset - set a memory block to a byte value. This function uses fast + * string to get better performance than the original function. The code is +@@ -19,7 +17,7 @@ + * + * rax original destination + */ +-SYM_FUNC_START_ALIAS(memset) ++SYM_FUNC_START_WEAK(memset) + SYM_FUNC_START(__memset) + /* + * Some CPUs support enhanced REP MOVSB/STOSB feature. It is recommended +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index c195365c98172..c85fbb666e40a 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -648,13 +648,20 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, + goto fail; + } + ++ if (radix_tree_preload(GFP_KERNEL)) { ++ blkg_free(new_blkg); ++ ret = -ENOMEM; ++ goto fail; ++ } ++ + rcu_read_lock(); + spin_lock_irq(&q->queue_lock); + + blkg = blkg_lookup_check(pos, pol, q); + if (IS_ERR(blkg)) { + ret = PTR_ERR(blkg); +- goto fail_unlock; ++ blkg_free(new_blkg); ++ goto fail_preloaded; + } + + if (blkg) { +@@ -663,10 +670,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, + blkg = blkg_create(pos, q, new_blkg); + if (IS_ERR(blkg)) { + ret = PTR_ERR(blkg); +- goto fail_unlock; ++ goto fail_preloaded; + } + } + ++ radix_tree_preload_end(); ++ + if (pos == blkcg) + goto success; + } +@@ -676,6 +685,8 @@ success: + ctx->body = input; + return 0; + ++fail_preloaded: ++ radix_tree_preload_end(); + fail_unlock: + spin_unlock_irq(&q->queue_lock); + rcu_read_unlock(); +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 26dd208a0d636..103ae7401f957 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -1564,7 +1564,7 @@ static ssize_t format1_show(struct device *dev, + le16_to_cpu(nfit_dcr->dcr->code)); + break; + } +- if (rc != ENXIO) ++ if (rc != -ENXIO) + break; + } + mutex_unlock(&acpi_desc->init_mutex); +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 792b92439b77d..91980be5543d3 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -763,8 +763,7 @@ static void __device_link_del(struct kref *kref) + dev_dbg(link->consumer, "Dropping the link to %s\n", + dev_name(link->supplier)); + +- if (link->flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_drop_link(link->consumer); ++ pm_runtime_drop_link(link); + + list_del_rcu(&link->s_node); + list_del_rcu(&link->c_node); +@@ -778,8 +777,7 @@ static void __device_link_del(struct kref *kref) + dev_info(link->consumer, "Dropping the link to %s\n", + dev_name(link->supplier)); + +- if (link->flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_drop_link(link->consumer); ++ pm_runtime_drop_link(link); + + list_del(&link->s_node); + list_del(&link->c_node); +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 857b0a928e8d0..97a93843ad6de 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1117,6 +1117,8 @@ static void __device_release_driver(struct device *dev, struct device *parent) + + drv = dev->driver; + if (drv) { ++ pm_runtime_get_sync(dev); ++ + while (device_links_busy(dev)) { + __device_driver_unlock(dev, parent); + +@@ -1128,13 +1130,12 @@ static void __device_release_driver(struct device *dev, struct device *parent) + * have released the driver successfully while this one + * was waiting, so check for that. + */ +- if (dev->driver != drv) ++ if (dev->driver != drv) { ++ pm_runtime_put(dev); + return; ++ } + } + +- pm_runtime_get_sync(dev); +- pm_runtime_clean_up_links(dev); +- + driver_sysfs_remove(dev); + + if (dev->bus) +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 6f605f7820bb5..bfda153b1a41d 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1642,42 +1642,6 @@ void pm_runtime_remove(struct device *dev) + pm_runtime_reinit(dev); + } + +-/** +- * pm_runtime_clean_up_links - Prepare links to consumers for driver removal. +- * @dev: Device whose driver is going to be removed. +- * +- * Check links from this device to any consumers and if any of them have active +- * runtime PM references to the device, drop the usage counter of the device +- * (as many times as needed). +- * +- * Links with the DL_FLAG_MANAGED flag unset are ignored. +- * +- * Since the device is guaranteed to be runtime-active at the point this is +- * called, nothing else needs to be done here. +- * +- * Moreover, this is called after device_links_busy() has returned 'false', so +- * the status of each link is guaranteed to be DL_STATE_SUPPLIER_UNBIND and +- * therefore rpm_active can't be manipulated concurrently. +- */ +-void pm_runtime_clean_up_links(struct device *dev) +-{ +- struct device_link *link; +- int idx; +- +- idx = device_links_read_lock(); +- +- list_for_each_entry_rcu(link, &dev->links.consumers, s_node, +- device_links_read_lock_held()) { +- if (!(link->flags & DL_FLAG_MANAGED)) +- continue; +- +- while (refcount_dec_not_one(&link->rpm_active)) +- pm_runtime_put_noidle(dev); +- } +- +- device_links_read_unlock(idx); +-} +- + /** + * pm_runtime_get_suppliers - Resume and reference-count supplier devices. + * @dev: Consumer device. +@@ -1729,7 +1693,7 @@ void pm_runtime_new_link(struct device *dev) + spin_unlock_irq(&dev->power.lock); + } + +-void pm_runtime_drop_link(struct device *dev) ++static void pm_runtime_drop_link_count(struct device *dev) + { + spin_lock_irq(&dev->power.lock); + WARN_ON(dev->power.links_count == 0); +@@ -1737,6 +1701,25 @@ void pm_runtime_drop_link(struct device *dev) + spin_unlock_irq(&dev->power.lock); + } + ++/** ++ * pm_runtime_drop_link - Prepare for device link removal. ++ * @link: Device link going away. ++ * ++ * Drop the link count of the consumer end of @link and decrement the supplier ++ * device's runtime PM usage counter as many times as needed to drop all of the ++ * PM runtime reference to it from the consumer. ++ */ ++void pm_runtime_drop_link(struct device_link *link) ++{ ++ if (!(link->flags & DL_FLAG_PM_RUNTIME)) ++ return; ++ ++ pm_runtime_drop_link_count(link->consumer); ++ ++ while (refcount_dec_not_one(&link->rpm_active)) ++ pm_runtime_put(link->supplier); ++} ++ + static bool pm_runtime_need_not_resume(struct device *dev) + { + return atomic_read(&dev->power.usage_count) <= 1 && +diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c +index d581c4e623f8a..96d5616534963 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -212,7 +212,7 @@ static struct sk_buff *alloc_ctrl_skb(struct sk_buff *skb, int len) + { + if (likely(skb && !skb_shared(skb) && !skb_cloned(skb))) { + __skb_trim(skb, 0); +- refcount_add(2, &skb->users); ++ refcount_inc(&skb->users); + } else { + skb = alloc_skb(len, GFP_KERNEL | __GFP_NOFAIL); + } +diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c +index f1820aca0d336..62c829023da56 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_hw.c ++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c +@@ -383,6 +383,9 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, + if (ret) + goto out_notcb; + ++ if (unlikely(csk_flag(sk, CSK_ABORT_SHUTDOWN))) ++ goto out_notcb; ++ + set_wr_txq(skb, CPL_PRIORITY_DATA, csk->tlshws.txqid); + csk->wr_credits -= DIV_ROUND_UP(len, 16); + csk->wr_unacked += DIV_ROUND_UP(len, 16); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 321032d3a51a2..06a5b6ae1c43e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1033,6 +1033,7 @@ static const struct pci_device_id pciidlist[] = { + {0x1002, 0x7319, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI10}, + {0x1002, 0x731A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI10}, + {0x1002, 0x731B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI10}, ++ {0x1002, 0x731E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI10}, + {0x1002, 0x731F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI10}, + /* Navi14 */ + {0x1002, 0x7340, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI14}, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index f1cae42dcc364..7c787ec598f18 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -2322,6 +2322,7 @@ int parse_ta_bin_descriptor(struct psp_context *psp, + psp->asd_feature_version = le32_to_cpu(desc->fw_version); + psp->asd_ucode_size = le32_to_cpu(desc->size_bytes); + psp->asd_start_addr = ucode_start_addr; ++ psp->asd_fw = psp->ta_fw; + break; + case TA_FW_TYPE_PSP_XGMI: + psp->ta_xgmi_ucode_version = le32_to_cpu(desc->fw_version); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index b1cbb958d5cd6..3a2af95f2bf0d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -128,6 +128,9 @@ + #define PA_SC_ENHANCE_3__FORCE_PBB_WORKLOAD_MODE_TO_ZERO__SHIFT 0x3 + #define PA_SC_ENHANCE_3__FORCE_PBB_WORKLOAD_MODE_TO_ZERO_MASK 0x00000008L + ++#define mmCGTT_SPI_CS_CLK_CTRL 0x507c ++#define mmCGTT_SPI_CS_CLK_CTRL_BASE_IDX 1 ++ + MODULE_FIRMWARE("amdgpu/navi10_ce.bin"); + MODULE_FIRMWARE("amdgpu/navi10_pfp.bin"); + MODULE_FIRMWARE("amdgpu/navi10_me.bin"); +@@ -3094,6 +3097,7 @@ static const struct soc15_reg_golden golden_settings_gc_rlc_spm_10_1_2_nv12[] = + + static const struct soc15_reg_golden golden_settings_gc_10_3[] = + { ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CS_CLK_CTRL, 0x78000000, 0x78000100), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_PS_CLK_CTRL, 0xff7f0fff, 0x78000100), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA0_CLK_CTRL, 0xff7f0fff, 0x30000100), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA1_CLK_CTRL, 0xff7f0fff, 0x7e000100), +diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c +index ca11253e787ca..8254f42146890 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -488,6 +488,14 @@ void nv_set_virt_ops(struct amdgpu_device *adev) + adev->virt.ops = &xgpu_nv_virt_ops; + } + ++static bool nv_is_blockchain_sku(struct pci_dev *pdev) ++{ ++ if (pdev->device == 0x731E && ++ (pdev->revision == 0xC6 || pdev->revision == 0xC7)) ++ return true; ++ return false; ++} ++ + int nv_set_ip_blocks(struct amdgpu_device *adev) + { + int r; +@@ -516,7 +524,8 @@ int nv_set_ip_blocks(struct amdgpu_device *adev) + if (adev->enable_virtual_display || amdgpu_sriov_vf(adev)) + amdgpu_device_ip_block_add(adev, &dce_virtual_ip_block); + #if defined(CONFIG_DRM_AMD_DC) +- else if (amdgpu_device_has_dc_support(adev)) ++ else if (amdgpu_device_has_dc_support(adev) && ++ !nv_is_blockchain_sku(adev->pdev)) + amdgpu_device_ip_block_add(adev, &dm_ip_block); + #endif + amdgpu_device_ip_block_add(adev, &gfx_v10_0_ip_block); +@@ -524,7 +533,8 @@ int nv_set_ip_blocks(struct amdgpu_device *adev) + if (adev->firmware.load_type == AMDGPU_FW_LOAD_DIRECT && + !amdgpu_sriov_vf(adev)) + amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block); +- amdgpu_device_ip_block_add(adev, &vcn_v2_0_ip_block); ++ if (!nv_is_blockchain_sku(adev->pdev)) ++ amdgpu_device_ip_block_add(adev, &vcn_v2_0_ip_block); + amdgpu_device_ip_block_add(adev, &jpeg_v2_0_ip_block); + if (adev->enable_mes) + amdgpu_device_ip_block_add(adev, &mes_v10_1_ip_block); +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +index 9cc65dc1970f8..49ae5ff12da63 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +@@ -1149,7 +1149,8 @@ static uint32_t dcn3_get_pix_clk_dividers( + static const struct clock_source_funcs dcn3_clk_src_funcs = { + .cs_power_down = dce110_clock_source_power_down, + .program_pix_clk = dcn3_program_pix_clk, +- .get_pix_clk_dividers = dcn3_get_pix_clk_dividers ++ .get_pix_clk_dividers = dcn3_get_pix_clk_dividers, ++ .get_pixel_clk_frequency_100hz = get_pixel_clk_frequency_100hz + }; + #endif + /*****************************************/ +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c +index 7e7fb65721073..9d3665f88c523 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c ++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c +@@ -117,6 +117,12 @@ static const struct ddc_registers ddc_data_regs_dcn[] = { + ddc_data_regs_dcn2(4), + ddc_data_regs_dcn2(5), + ddc_data_regs_dcn2(6), ++ { ++ DDC_GPIO_VGA_REG_LIST(DATA), ++ .ddc_setup = 0, ++ .phy_aux_cntl = 0, ++ .dc_gpio_aux_ctrl_5 = 0 ++ } + }; + + static const struct ddc_registers ddc_clk_regs_dcn[] = { +@@ -126,6 +132,12 @@ static const struct ddc_registers ddc_clk_regs_dcn[] = { + ddc_clk_regs_dcn2(4), + ddc_clk_regs_dcn2(5), + ddc_clk_regs_dcn2(6), ++ { ++ DDC_GPIO_VGA_REG_LIST(CLK), ++ .ddc_setup = 0, ++ .phy_aux_cntl = 0, ++ .dc_gpio_aux_ctrl_5 = 0 ++ } + }; + + static const struct ddc_sh_mask ddc_shift[] = { +diff --git a/drivers/gpu/drm/i915/Kconfig.debug b/drivers/gpu/drm/i915/Kconfig.debug +index 1cb28c20807c5..25cd9788a4d54 100644 +--- a/drivers/gpu/drm/i915/Kconfig.debug ++++ b/drivers/gpu/drm/i915/Kconfig.debug +@@ -153,6 +153,7 @@ config DRM_I915_SELFTEST + select DRM_EXPORT_FOR_TESTS if m + select FAULT_INJECTION + select PRIME_NUMBERS ++ select CRC32 + help + Choose this option to allow the driver to perform selftests upon + loading; also requires the i915.selftest=1 module parameter. To +diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c +index a49ff3a1a63ca..25032ce359fcf 100644 +--- a/drivers/gpu/drm/i915/display/intel_ddi.c ++++ b/drivers/gpu/drm/i915/display/intel_ddi.c +@@ -2655,7 +2655,7 @@ tgl_dkl_phy_ddi_vswing_sequence(struct intel_encoder *encoder, int link_clock, + u32 n_entries, val, ln, dpcnt_mask, dpcnt_val; + int rate = 0; + +- if (type == INTEL_OUTPUT_HDMI) { ++ if (type != INTEL_OUTPUT_HDMI) { + struct intel_dp *intel_dp = enc_to_intel_dp(encoder); + + rate = intel_dp->link_rate; +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index b18c5ac2934dc..72a7a428e6210 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -3432,6 +3432,14 @@ initial_plane_vma(struct drm_i915_private *i915, + if (IS_ERR(obj)) + return NULL; + ++ /* ++ * Mark it WT ahead of time to avoid changing the ++ * cache_level during fbdev initialization. The ++ * unbind there would get stuck waiting for rcu. ++ */ ++ i915_gem_object_set_cache_coherency(obj, HAS_WT(i915) ? ++ I915_CACHE_WT : I915_CACHE_NONE); ++ + switch (plane_config->tiling) { + case I915_TILING_NONE: + break; +@@ -10581,6 +10589,10 @@ skl_get_initial_plane_config(struct intel_crtc *crtc, + val & PLANE_CTL_FLIP_HORIZONTAL) + plane_config->rotation |= DRM_MODE_REFLECT_X; + ++ /* 90/270 degree rotation would require extra work */ ++ if (drm_rotation_90_or_270(plane_config->rotation)) ++ goto error; ++ + base = intel_de_read(dev_priv, PLANE_SURF(pipe, plane_id)) & 0xfffff000; + plane_config->base = base; + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index bf9e320c547da..dcd4512198048 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -1672,7 +1672,7 @@ void intel_psr_atomic_check(struct drm_connector *connector, + return; + + intel_connector = to_intel_connector(connector); +- dig_port = enc_to_dig_port(intel_attached_encoder(intel_connector)); ++ dig_port = enc_to_dig_port(to_intel_encoder(new_state->best_encoder)); + if (dev_priv->psr.dp != &dig_port->dp) + return; + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c +index ef755dd5e68fc..26ef17f6d49ba 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -390,24 +390,6 @@ __context_engines_static(const struct i915_gem_context *ctx) + return rcu_dereference_protected(ctx->engines, true); + } + +-static bool __reset_engine(struct intel_engine_cs *engine) +-{ +- struct intel_gt *gt = engine->gt; +- bool success = false; +- +- if (!intel_has_reset_engine(gt)) +- return false; +- +- if (!test_and_set_bit(I915_RESET_ENGINE + engine->id, +- >->reset.flags)) { +- success = intel_engine_reset(engine, NULL) == 0; +- clear_and_wake_up_bit(I915_RESET_ENGINE + engine->id, +- >->reset.flags); +- } +- +- return success; +-} +- + static void __reset_context(struct i915_gem_context *ctx, + struct intel_engine_cs *engine) + { +@@ -431,12 +413,7 @@ static bool __cancel_engine(struct intel_engine_cs *engine) + * kill the banned context, we fallback to doing a local reset + * instead. + */ +- if (IS_ACTIVE(CONFIG_DRM_I915_PREEMPT_TIMEOUT) && +- !intel_engine_pulse(engine)) +- return true; +- +- /* If we are unable to send a pulse, try resetting this engine. */ +- return __reset_engine(engine); ++ return intel_engine_pulse(engine) == 0; + } + + static bool +@@ -493,7 +470,7 @@ static struct intel_engine_cs *active_engine(struct intel_context *ce) + return engine; + } + +-static void kill_engines(struct i915_gem_engines *engines) ++static void kill_engines(struct i915_gem_engines *engines, bool ban) + { + struct i915_gem_engines_iter it; + struct intel_context *ce; +@@ -508,7 +485,7 @@ static void kill_engines(struct i915_gem_engines *engines) + for_each_gem_engine(ce, engines, it) { + struct intel_engine_cs *engine; + +- if (intel_context_set_banned(ce)) ++ if (ban && intel_context_set_banned(ce)) + continue; + + /* +@@ -521,7 +498,7 @@ static void kill_engines(struct i915_gem_engines *engines) + engine = active_engine(ce); + + /* First attempt to gracefully cancel the context */ +- if (engine && !__cancel_engine(engine)) ++ if (engine && !__cancel_engine(engine) && ban) + /* + * If we are unable to send a preemptive pulse to bump + * the context from the GPU, we have to resort to a full +@@ -531,8 +508,10 @@ static void kill_engines(struct i915_gem_engines *engines) + } + } + +-static void kill_stale_engines(struct i915_gem_context *ctx) ++static void kill_context(struct i915_gem_context *ctx) + { ++ bool ban = (!i915_gem_context_is_persistent(ctx) || ++ !ctx->i915->params.enable_hangcheck); + struct i915_gem_engines *pos, *next; + + spin_lock_irq(&ctx->stale.lock); +@@ -545,7 +524,7 @@ static void kill_stale_engines(struct i915_gem_context *ctx) + + spin_unlock_irq(&ctx->stale.lock); + +- kill_engines(pos); ++ kill_engines(pos, ban); + + spin_lock_irq(&ctx->stale.lock); + GEM_BUG_ON(i915_sw_fence_signaled(&pos->fence)); +@@ -557,11 +536,6 @@ static void kill_stale_engines(struct i915_gem_context *ctx) + spin_unlock_irq(&ctx->stale.lock); + } + +-static void kill_context(struct i915_gem_context *ctx) +-{ +- kill_stale_engines(ctx); +-} +- + static void engines_idle_release(struct i915_gem_context *ctx, + struct i915_gem_engines *engines) + { +@@ -596,7 +570,7 @@ static void engines_idle_release(struct i915_gem_context *ctx, + + kill: + if (list_empty(&engines->link)) /* raced, already closed */ +- kill_engines(engines); ++ kill_engines(engines, true); + + i915_sw_fence_commit(&engines->fence); + } +@@ -654,9 +628,7 @@ static void context_close(struct i915_gem_context *ctx) + * case we opt to forcibly kill off all remaining requests on + * context close. + */ +- if (!i915_gem_context_is_persistent(ctx) || +- !ctx->i915->params.enable_hangcheck) +- kill_context(ctx); ++ kill_context(ctx); + + i915_gem_context_put(ctx); + } +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +index 446e76e95c381..7c9be64d6e30d 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +@@ -1962,8 +1962,8 @@ struct eb_parse_work { + struct i915_vma *batch; + struct i915_vma *shadow; + struct i915_vma *trampoline; +- unsigned int batch_offset; +- unsigned int batch_length; ++ unsigned long batch_offset; ++ unsigned long batch_length; + }; + + static int __eb_parse(struct dma_fence_work *work) +@@ -2033,6 +2033,9 @@ static int eb_parse_pipeline(struct i915_execbuffer *eb, + struct eb_parse_work *pw; + int err; + ++ GEM_BUG_ON(overflows_type(eb->batch_start_offset, pw->batch_offset)); ++ GEM_BUG_ON(overflows_type(eb->batch_len, pw->batch_length)); ++ + pw = kzalloc(sizeof(*pw), GFP_KERNEL); + if (!pw) + return -ENOMEM; +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pages.c b/drivers/gpu/drm/i915/gem/i915_gem_pages.c +index e8a083743e092..d6eeefab3d018 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_pages.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_pages.c +@@ -254,9 +254,35 @@ static void *i915_gem_object_map(struct drm_i915_gem_object *obj, + if (!i915_gem_object_has_struct_page(obj) && type != I915_MAP_WC) + return NULL; + ++ if (GEM_WARN_ON(type == I915_MAP_WC && ++ !static_cpu_has(X86_FEATURE_PAT))) ++ return NULL; ++ + /* A single page can always be kmapped */ +- if (n_pte == 1 && type == I915_MAP_WB) +- return kmap(sg_page(sgt->sgl)); ++ if (n_pte == 1 && type == I915_MAP_WB) { ++ struct page *page = sg_page(sgt->sgl); ++ ++ /* ++ * On 32b, highmem using a finite set of indirect PTE (i.e. ++ * vmap) to provide virtual mappings of the high pages. ++ * As these are finite, map_new_virtual() must wait for some ++ * other kmap() to finish when it runs out. If we map a large ++ * number of objects, there is no method for it to tell us ++ * to release the mappings, and we deadlock. ++ * ++ * However, if we make an explicit vmap of the page, that ++ * uses a larger vmalloc arena, and also has the ability ++ * to tell us to release unwanted mappings. Most importantly, ++ * it will fail and propagate an error instead of waiting ++ * forever. ++ * ++ * So if the page is beyond the 32b boundary, make an explicit ++ * vmap. On 64b, this check will be optimised away as we can ++ * directly kmap any page on the system. ++ */ ++ if (!PageHighMem(page)) ++ return kmap(page); ++ } + + mem = stack; + if (n_pte > ARRAY_SIZE(stack)) { +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_stolen.c b/drivers/gpu/drm/i915/gem/i915_gem_stolen.c +index 0be5e86833371..84b2707d8b17a 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_stolen.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_stolen.c +@@ -53,8 +53,10 @@ int i915_gem_stolen_insert_node(struct drm_i915_private *i915, + struct drm_mm_node *node, u64 size, + unsigned alignment) + { +- return i915_gem_stolen_insert_node_in_range(i915, node, size, +- alignment, 0, U64_MAX); ++ return i915_gem_stolen_insert_node_in_range(i915, node, ++ size, alignment, ++ I915_GEM_STOLEN_BIAS, ++ U64_MAX); + } + + void i915_gem_stolen_remove_node(struct drm_i915_private *i915, +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_stolen.h b/drivers/gpu/drm/i915/gem/i915_gem_stolen.h +index e15c0adad8af1..61e028063f9fb 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_stolen.h ++++ b/drivers/gpu/drm/i915/gem/i915_gem_stolen.h +@@ -30,4 +30,6 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_i915_private *dev_priv + resource_size_t stolen_offset, + resource_size_t size); + ++#define I915_GEM_STOLEN_BIAS SZ_128K ++ + #endif /* __I915_GEM_STOLEN_H__ */ +diff --git a/drivers/gpu/drm/i915/gt/intel_engine.h b/drivers/gpu/drm/i915/gt/intel_engine.h +index a9249a23903a9..fda90d49844a5 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine.h ++++ b/drivers/gpu/drm/i915/gt/intel_engine.h +@@ -357,4 +357,13 @@ intel_engine_has_preempt_reset(const struct intel_engine_cs *engine) + return intel_engine_has_preemption(engine); + } + ++static inline bool ++intel_engine_has_heartbeat(const struct intel_engine_cs *engine) ++{ ++ if (!IS_ACTIVE(CONFIG_DRM_I915_HEARTBEAT_INTERVAL)) ++ return false; ++ ++ return READ_ONCE(engine->props.heartbeat_interval_ms); ++} ++ + #endif /* _INTEL_RINGBUFFER_H_ */ +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c b/drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c +index 8ffdf676c0a09..5067d0524d4b5 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c +@@ -177,36 +177,82 @@ void intel_engine_init_heartbeat(struct intel_engine_cs *engine) + INIT_DELAYED_WORK(&engine->heartbeat.work, heartbeat); + } + ++static int __intel_engine_pulse(struct intel_engine_cs *engine) ++{ ++ struct i915_sched_attr attr = { .priority = I915_PRIORITY_BARRIER }; ++ struct intel_context *ce = engine->kernel_context; ++ struct i915_request *rq; ++ ++ lockdep_assert_held(&ce->timeline->mutex); ++ GEM_BUG_ON(!intel_engine_has_preemption(engine)); ++ GEM_BUG_ON(!intel_engine_pm_is_awake(engine)); ++ ++ intel_context_enter(ce); ++ rq = __i915_request_create(ce, GFP_NOWAIT | __GFP_NOWARN); ++ intel_context_exit(ce); ++ if (IS_ERR(rq)) ++ return PTR_ERR(rq); ++ ++ __set_bit(I915_FENCE_FLAG_SENTINEL, &rq->fence.flags); ++ idle_pulse(engine, rq); ++ ++ __i915_request_commit(rq); ++ __i915_request_queue(rq, &attr); ++ GEM_BUG_ON(rq->sched.attr.priority < I915_PRIORITY_BARRIER); ++ ++ return 0; ++} ++ ++static unsigned long set_heartbeat(struct intel_engine_cs *engine, ++ unsigned long delay) ++{ ++ unsigned long old; ++ ++ old = xchg(&engine->props.heartbeat_interval_ms, delay); ++ if (delay) ++ intel_engine_unpark_heartbeat(engine); ++ else ++ intel_engine_park_heartbeat(engine); ++ ++ return old; ++} ++ + int intel_engine_set_heartbeat(struct intel_engine_cs *engine, + unsigned long delay) + { +- int err; ++ struct intel_context *ce = engine->kernel_context; ++ int err = 0; + +- /* Send one last pulse before to cleanup persistent hogs */ +- if (!delay && IS_ACTIVE(CONFIG_DRM_I915_PREEMPT_TIMEOUT)) { +- err = intel_engine_pulse(engine); +- if (err) +- return err; +- } ++ if (!delay && !intel_engine_has_preempt_reset(engine)) ++ return -ENODEV; ++ ++ intel_engine_pm_get(engine); ++ ++ err = mutex_lock_interruptible(&ce->timeline->mutex); ++ if (err) ++ goto out_rpm; + +- WRITE_ONCE(engine->props.heartbeat_interval_ms, delay); ++ if (delay != engine->props.heartbeat_interval_ms) { ++ unsigned long saved = set_heartbeat(engine, delay); + +- if (intel_engine_pm_get_if_awake(engine)) { +- if (delay) +- intel_engine_unpark_heartbeat(engine); +- else +- intel_engine_park_heartbeat(engine); +- intel_engine_pm_put(engine); ++ /* recheck current execution */ ++ if (intel_engine_has_preemption(engine)) { ++ err = __intel_engine_pulse(engine); ++ if (err) ++ set_heartbeat(engine, saved); ++ } + } + +- return 0; ++ mutex_unlock(&ce->timeline->mutex); ++ ++out_rpm: ++ intel_engine_pm_put(engine); ++ return err; + } + + int intel_engine_pulse(struct intel_engine_cs *engine) + { +- struct i915_sched_attr attr = { .priority = I915_PRIORITY_BARRIER }; + struct intel_context *ce = engine->kernel_context; +- struct i915_request *rq; + int err; + + if (!intel_engine_has_preemption(engine)) +@@ -215,30 +261,12 @@ int intel_engine_pulse(struct intel_engine_cs *engine) + if (!intel_engine_pm_get_if_awake(engine)) + return 0; + +- if (mutex_lock_interruptible(&ce->timeline->mutex)) { +- err = -EINTR; +- goto out_rpm; +- } +- +- intel_context_enter(ce); +- rq = __i915_request_create(ce, GFP_NOWAIT | __GFP_NOWARN); +- intel_context_exit(ce); +- if (IS_ERR(rq)) { +- err = PTR_ERR(rq); +- goto out_unlock; ++ err = -EINTR; ++ if (!mutex_lock_interruptible(&ce->timeline->mutex)) { ++ err = __intel_engine_pulse(engine); ++ mutex_unlock(&ce->timeline->mutex); + } + +- __set_bit(I915_FENCE_FLAG_SENTINEL, &rq->fence.flags); +- idle_pulse(engine, rq); +- +- __i915_request_commit(rq); +- __i915_request_queue(rq, &attr); +- GEM_BUG_ON(rq->sched.attr.priority < I915_PRIORITY_BARRIER); +- err = 0; +- +-out_unlock: +- mutex_unlock(&ce->timeline->mutex); +-out_rpm: + intel_engine_pm_put(engine); + return err; + } +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index 9eeaca957a7e2..9dfa9a95a4d73 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -1139,9 +1139,8 @@ __unwind_incomplete_requests(struct intel_engine_cs *engine) + + /* Check in case we rollback so far we wrap [size/2] */ + if (intel_ring_direction(rq->ring, +- intel_ring_wrap(rq->ring, +- rq->tail), +- rq->ring->tail) > 0) ++ rq->tail, ++ rq->ring->tail + 8) > 0) + rq->context->lrc.desc |= CTX_DESC_FORCE_RESTORE; + + active = rq; +@@ -2662,6 +2661,9 @@ static void process_csb(struct intel_engine_cs *engine) + smp_wmb(); /* complete the seqlock */ + WRITE_ONCE(execlists->active, execlists->inflight); + ++ /* XXX Magic delay for tgl */ ++ ENGINE_POSTING_READ(engine, RING_CONTEXT_STATUS_PTR); ++ + WRITE_ONCE(execlists->pending[0], NULL); + } else { + if (GEM_WARN_ON(!*execlists->active)) { +@@ -3537,6 +3539,19 @@ static const struct intel_context_ops execlists_context_ops = { + .destroy = execlists_context_destroy, + }; + ++static u32 hwsp_offset(const struct i915_request *rq) ++{ ++ const struct intel_timeline_cacheline *cl; ++ ++ /* Before the request is executed, the timeline/cachline is fixed */ ++ ++ cl = rcu_dereference_protected(rq->hwsp_cacheline, 1); ++ if (cl) ++ return cl->ggtt_offset; ++ ++ return rcu_dereference_protected(rq->timeline, 1)->hwsp_offset; ++} ++ + static int gen8_emit_init_breadcrumb(struct i915_request *rq) + { + u32 *cs; +@@ -3559,7 +3574,7 @@ static int gen8_emit_init_breadcrumb(struct i915_request *rq) + *cs++ = MI_NOOP; + + *cs++ = MI_STORE_DWORD_IMM_GEN4 | MI_USE_GGTT; +- *cs++ = i915_request_timeline(rq)->hwsp_offset; ++ *cs++ = hwsp_offset(rq); + *cs++ = 0; + *cs++ = rq->fence.seqno - 1; + +@@ -4863,11 +4878,9 @@ gen8_emit_fini_breadcrumb_tail(struct i915_request *request, u32 *cs) + return gen8_emit_wa_tail(request, cs); + } + +-static u32 *emit_xcs_breadcrumb(struct i915_request *request, u32 *cs) ++static u32 *emit_xcs_breadcrumb(struct i915_request *rq, u32 *cs) + { +- u32 addr = i915_request_active_timeline(request)->hwsp_offset; +- +- return gen8_emit_ggtt_write(cs, request->fence.seqno, addr, 0); ++ return gen8_emit_ggtt_write(cs, rq->fence.seqno, hwsp_offset(rq), 0); + } + + static u32 *gen8_emit_fini_breadcrumb(struct i915_request *rq, u32 *cs) +@@ -4886,7 +4899,7 @@ static u32 *gen8_emit_fini_breadcrumb_rcs(struct i915_request *request, u32 *cs) + /* XXX flush+write+CS_STALL all in one upsets gem_concurrent_blt:kbl */ + cs = gen8_emit_ggtt_write_rcs(cs, + request->fence.seqno, +- i915_request_active_timeline(request)->hwsp_offset, ++ hwsp_offset(request), + PIPE_CONTROL_FLUSH_ENABLE | + PIPE_CONTROL_CS_STALL); + +@@ -4898,7 +4911,7 @@ gen11_emit_fini_breadcrumb_rcs(struct i915_request *request, u32 *cs) + { + cs = gen8_emit_ggtt_write_rcs(cs, + request->fence.seqno, +- i915_request_active_timeline(request)->hwsp_offset, ++ hwsp_offset(request), + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_TILE_CACHE_FLUSH | + PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH | +@@ -4968,7 +4981,7 @@ gen12_emit_fini_breadcrumb_rcs(struct i915_request *request, u32 *cs) + { + cs = gen12_emit_ggtt_write_rcs(cs, + request->fence.seqno, +- i915_request_active_timeline(request)->hwsp_offset, ++ hwsp_offset(request), + PIPE_CONTROL0_HDC_PIPELINE_FLUSH, + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_TILE_CACHE_FLUSH | +diff --git a/drivers/gpu/drm/i915/gt/intel_mocs.c b/drivers/gpu/drm/i915/gt/intel_mocs.c +index 632e08a4592b2..b8f56e62158e2 100644 +--- a/drivers/gpu/drm/i915/gt/intel_mocs.c ++++ b/drivers/gpu/drm/i915/gt/intel_mocs.c +@@ -234,11 +234,17 @@ static const struct drm_i915_mocs_entry broxton_mocs_table[] = { + L3_1_UC) + + static const struct drm_i915_mocs_entry tgl_mocs_table[] = { +- /* Base - Error (Reserved for Non-Use) */ +- MOCS_ENTRY(0, 0x0, 0x0), +- /* Base - Reserved */ +- MOCS_ENTRY(1, 0x0, 0x0), +- ++ /* ++ * NOTE: ++ * Reserved and unspecified MOCS indices have been set to (L3 + LCC). ++ * These reserved entries should never be used, they may be changed ++ * to low performant variants with better coherency in the future if ++ * more entries are needed. We are programming index I915_MOCS_PTE(1) ++ * only, __init_mocs_table() take care to program unused index with ++ * this entry. ++ */ ++ MOCS_ENTRY(1, LE_3_WB | LE_TC_1_LLC | LE_LRUM(3), ++ L3_3_WB), + GEN11_MOCS_ENTRIES, + + /* Implicitly enable L1 - HDC:L1 + L3 + LLC */ +diff --git a/drivers/gpu/drm/i915/gt/intel_timeline.c b/drivers/gpu/drm/i915/gt/intel_timeline.c +index 46d20f5f3ddcc..ee505cb4710f4 100644 +--- a/drivers/gpu/drm/i915/gt/intel_timeline.c ++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c +@@ -188,10 +188,14 @@ cacheline_alloc(struct intel_timeline_hwsp *hwsp, unsigned int cacheline) + return cl; + } + +-static void cacheline_acquire(struct intel_timeline_cacheline *cl) ++static void cacheline_acquire(struct intel_timeline_cacheline *cl, ++ u32 ggtt_offset) + { +- if (cl) +- i915_active_acquire(&cl->active); ++ if (!cl) ++ return; ++ ++ cl->ggtt_offset = ggtt_offset; ++ i915_active_acquire(&cl->active); + } + + static void cacheline_release(struct intel_timeline_cacheline *cl) +@@ -332,7 +336,7 @@ int intel_timeline_pin(struct intel_timeline *tl) + GT_TRACE(tl->gt, "timeline:%llx using HWSP offset:%x\n", + tl->fence_context, tl->hwsp_offset); + +- cacheline_acquire(tl->hwsp_cacheline); ++ cacheline_acquire(tl->hwsp_cacheline, tl->hwsp_offset); + if (atomic_fetch_inc(&tl->pin_count)) { + cacheline_release(tl->hwsp_cacheline); + __i915_vma_unpin(tl->hwsp_ggtt); +@@ -505,7 +509,7 @@ __intel_timeline_get_seqno(struct intel_timeline *tl, + GT_TRACE(tl->gt, "timeline:%llx using HWSP offset:%x\n", + tl->fence_context, tl->hwsp_offset); + +- cacheline_acquire(cl); ++ cacheline_acquire(cl, tl->hwsp_offset); + tl->hwsp_cacheline = cl; + + *seqno = timeline_advance(tl); +@@ -563,9 +567,7 @@ int intel_timeline_read_hwsp(struct i915_request *from, + if (err) + goto out; + +- *hwsp = i915_ggtt_offset(cl->hwsp->vma) + +- ptr_unmask_bits(cl->vaddr, CACHELINE_BITS) * CACHELINE_BYTES; +- ++ *hwsp = cl->ggtt_offset; + out: + i915_active_release(&cl->active); + return err; +diff --git a/drivers/gpu/drm/i915/gt/intel_timeline_types.h b/drivers/gpu/drm/i915/gt/intel_timeline_types.h +index 02181c5020db0..4474f487f5899 100644 +--- a/drivers/gpu/drm/i915/gt/intel_timeline_types.h ++++ b/drivers/gpu/drm/i915/gt/intel_timeline_types.h +@@ -94,6 +94,8 @@ struct intel_timeline_cacheline { + struct intel_timeline_hwsp *hwsp; + void *vaddr; + ++ u32 ggtt_offset; ++ + struct rcu_head rcu; + }; + +diff --git a/drivers/gpu/drm/i915/gt/selftest_reset.c b/drivers/gpu/drm/i915/gt/selftest_reset.c +index 35406ecdf0b2a..ef5aeebbeeb06 100644 +--- a/drivers/gpu/drm/i915/gt/selftest_reset.c ++++ b/drivers/gpu/drm/i915/gt/selftest_reset.c +@@ -3,9 +3,203 @@ + * Copyright © 2018 Intel Corporation + */ + ++#include <linux/crc32.h> ++ ++#include "gem/i915_gem_stolen.h" ++ ++#include "i915_memcpy.h" + #include "i915_selftest.h" + #include "selftests/igt_reset.h" + #include "selftests/igt_atomic.h" ++#include "selftests/igt_spinner.h" ++ ++static int ++__igt_reset_stolen(struct intel_gt *gt, ++ intel_engine_mask_t mask, ++ const char *msg) ++{ ++ struct i915_ggtt *ggtt = >->i915->ggtt; ++ const struct resource *dsm = >->i915->dsm; ++ resource_size_t num_pages, page; ++ struct intel_engine_cs *engine; ++ intel_wakeref_t wakeref; ++ enum intel_engine_id id; ++ struct igt_spinner spin; ++ long max, count; ++ void *tmp; ++ u32 *crc; ++ int err; ++ ++ if (!drm_mm_node_allocated(&ggtt->error_capture)) ++ return 0; ++ ++ num_pages = resource_size(dsm) >> PAGE_SHIFT; ++ if (!num_pages) ++ return 0; ++ ++ crc = kmalloc_array(num_pages, sizeof(u32), GFP_KERNEL); ++ if (!crc) ++ return -ENOMEM; ++ ++ tmp = kmalloc(PAGE_SIZE, GFP_KERNEL); ++ if (!tmp) { ++ err = -ENOMEM; ++ goto err_crc; ++ } ++ ++ igt_global_reset_lock(gt); ++ wakeref = intel_runtime_pm_get(gt->uncore->rpm); ++ ++ err = igt_spinner_init(&spin, gt); ++ if (err) ++ goto err_lock; ++ ++ for_each_engine(engine, gt, id) { ++ struct intel_context *ce; ++ struct i915_request *rq; ++ ++ if (!(mask & engine->mask)) ++ continue; ++ ++ if (!intel_engine_can_store_dword(engine)) ++ continue; ++ ++ ce = intel_context_create(engine); ++ if (IS_ERR(ce)) { ++ err = PTR_ERR(ce); ++ goto err_spin; ++ } ++ rq = igt_spinner_create_request(&spin, ce, MI_ARB_CHECK); ++ intel_context_put(ce); ++ if (IS_ERR(rq)) { ++ err = PTR_ERR(rq); ++ goto err_spin; ++ } ++ i915_request_add(rq); ++ } ++ ++ for (page = 0; page < num_pages; page++) { ++ dma_addr_t dma = (dma_addr_t)dsm->start + (page << PAGE_SHIFT); ++ void __iomem *s; ++ void *in; ++ ++ ggtt->vm.insert_page(&ggtt->vm, dma, ++ ggtt->error_capture.start, ++ I915_CACHE_NONE, 0); ++ mb(); ++ ++ s = io_mapping_map_wc(&ggtt->iomap, ++ ggtt->error_capture.start, ++ PAGE_SIZE); ++ ++ if (!__drm_mm_interval_first(>->i915->mm.stolen, ++ page << PAGE_SHIFT, ++ ((page + 1) << PAGE_SHIFT) - 1)) ++ memset32(s, STACK_MAGIC, PAGE_SIZE / sizeof(u32)); ++ ++ in = s; ++ if (i915_memcpy_from_wc(tmp, s, PAGE_SIZE)) ++ in = tmp; ++ crc[page] = crc32_le(0, in, PAGE_SIZE); ++ ++ io_mapping_unmap(s); ++ } ++ mb(); ++ ggtt->vm.clear_range(&ggtt->vm, ggtt->error_capture.start, PAGE_SIZE); ++ ++ if (mask == ALL_ENGINES) { ++ intel_gt_reset(gt, mask, NULL); ++ } else { ++ for_each_engine(engine, gt, id) { ++ if (mask & engine->mask) ++ intel_engine_reset(engine, NULL); ++ } ++ } ++ ++ max = -1; ++ count = 0; ++ for (page = 0; page < num_pages; page++) { ++ dma_addr_t dma = (dma_addr_t)dsm->start + (page << PAGE_SHIFT); ++ void __iomem *s; ++ void *in; ++ u32 x; ++ ++ ggtt->vm.insert_page(&ggtt->vm, dma, ++ ggtt->error_capture.start, ++ I915_CACHE_NONE, 0); ++ mb(); ++ ++ s = io_mapping_map_wc(&ggtt->iomap, ++ ggtt->error_capture.start, ++ PAGE_SIZE); ++ ++ in = s; ++ if (i915_memcpy_from_wc(tmp, s, PAGE_SIZE)) ++ in = tmp; ++ x = crc32_le(0, in, PAGE_SIZE); ++ ++ if (x != crc[page] && ++ !__drm_mm_interval_first(>->i915->mm.stolen, ++ page << PAGE_SHIFT, ++ ((page + 1) << PAGE_SHIFT) - 1)) { ++ pr_debug("unused stolen page %pa modified by GPU reset\n", ++ &page); ++ if (count++ == 0) ++ igt_hexdump(in, PAGE_SIZE); ++ max = page; ++ } ++ ++ io_mapping_unmap(s); ++ } ++ mb(); ++ ggtt->vm.clear_range(&ggtt->vm, ggtt->error_capture.start, PAGE_SIZE); ++ ++ if (count > 0) { ++ pr_info("%s reset clobbered %ld pages of stolen, last clobber at page %ld\n", ++ msg, count, max); ++ } ++ if (max >= I915_GEM_STOLEN_BIAS >> PAGE_SHIFT) { ++ pr_err("%s reset clobbered unreserved area [above %x] of stolen; may cause severe faults\n", ++ msg, I915_GEM_STOLEN_BIAS); ++ err = -EINVAL; ++ } ++ ++err_spin: ++ igt_spinner_fini(&spin); ++ ++err_lock: ++ intel_runtime_pm_put(gt->uncore->rpm, wakeref); ++ igt_global_reset_unlock(gt); ++ ++ kfree(tmp); ++err_crc: ++ kfree(crc); ++ return err; ++} ++ ++static int igt_reset_device_stolen(void *arg) ++{ ++ return __igt_reset_stolen(arg, ALL_ENGINES, "device"); ++} ++ ++static int igt_reset_engines_stolen(void *arg) ++{ ++ struct intel_gt *gt = arg; ++ struct intel_engine_cs *engine; ++ enum intel_engine_id id; ++ int err; ++ ++ if (!intel_has_reset_engine(gt)) ++ return 0; ++ ++ for_each_engine(engine, gt, id) { ++ err = __igt_reset_stolen(gt, engine->mask, engine->name); ++ if (err) ++ return err; ++ } ++ ++ return 0; ++} + + static int igt_global_reset(void *arg) + { +@@ -164,6 +358,8 @@ int intel_reset_live_selftests(struct drm_i915_private *i915) + { + static const struct i915_subtest tests[] = { + SUBTEST(igt_global_reset), /* attempt to recover GPU first */ ++ SUBTEST(igt_reset_device_stolen), ++ SUBTEST(igt_reset_engines_stolen), + SUBTEST(igt_wedged_reset), + SUBTEST(igt_atomic_reset), + SUBTEST(igt_atomic_engine_reset), +diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c +index 5ac4a999f05a6..e88970256e8ef 100644 +--- a/drivers/gpu/drm/i915/i915_cmd_parser.c ++++ b/drivers/gpu/drm/i915/i915_cmd_parser.c +@@ -1136,7 +1136,7 @@ find_reg(const struct intel_engine_cs *engine, u32 addr) + /* Returns a vmap'd pointer to dst_obj, which the caller must unmap */ + static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + struct drm_i915_gem_object *src_obj, +- u32 offset, u32 length) ++ unsigned long offset, unsigned long length) + { + bool needs_clflush; + void *dst, *src; +@@ -1166,8 +1166,8 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + } + } + if (IS_ERR(src)) { ++ unsigned long x, n; + void *ptr; +- int x, n; + + /* + * We can avoid clflushing partial cachelines before the write +@@ -1184,7 +1184,7 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + ptr = dst; + x = offset_in_page(offset); + for (n = offset >> PAGE_SHIFT; length; n++) { +- int len = min_t(int, length, PAGE_SIZE - x); ++ int len = min(length, PAGE_SIZE - x); + + src = kmap_atomic(i915_gem_object_get_page(src_obj, n)); + if (needs_clflush) +@@ -1414,8 +1414,8 @@ static bool shadow_needs_clflush(struct drm_i915_gem_object *obj) + */ + int intel_engine_cmd_parser(struct intel_engine_cs *engine, + struct i915_vma *batch, +- u32 batch_offset, +- u32 batch_length, ++ unsigned long batch_offset, ++ unsigned long batch_length, + struct i915_vma *shadow, + bool trampoline) + { +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 37e6f2abab004..68103f0d5fad6 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -1903,8 +1903,8 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine); + void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine); + int intel_engine_cmd_parser(struct intel_engine_cs *engine, + struct i915_vma *batch, +- u32 batch_offset, +- u32 batch_length, ++ unsigned long batch_offset, ++ unsigned long batch_length, + struct i915_vma *shadow, + bool trampoline); + #define I915_CMD_PARSER_TRAMPOLINE_SIZE 8 +diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c +index 3e6cbb0d1150e..cf6e47adfde6f 100644 +--- a/drivers/gpu/drm/i915/i915_gpu_error.c ++++ b/drivers/gpu/drm/i915/i915_gpu_error.c +@@ -311,6 +311,8 @@ static int compress_page(struct i915_vma_compress *c, + + if (zlib_deflate(zstream, Z_NO_FLUSH) != Z_OK) + return -EIO; ++ ++ cond_resched(); + } while (zstream->avail_in); + + /* Fallback to uncompressed if we increase size? */ +@@ -397,6 +399,7 @@ static int compress_page(struct i915_vma_compress *c, + if (!(wc && i915_memcpy_from_wc(ptr, src, PAGE_SIZE))) + memcpy(ptr, src, PAGE_SIZE); + dst->pages[dst->page_count++] = ptr; ++ cond_resched(); + + return 0; + } +@@ -1309,7 +1312,7 @@ capture_vma(struct intel_engine_capture_vma *next, + } + + strcpy(c->name, name); +- c->vma = i915_vma_get(vma); ++ c->vma = vma; /* reference held while active */ + + c->next = next; + return c; +@@ -1399,7 +1402,6 @@ intel_engine_coredump_add_vma(struct intel_engine_coredump *ee, + compress)); + + i915_active_release(&vma->active); +- i915_vma_put(vma); + + capture = this->next; + kfree(this); +diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c +index 2338f92ce4900..95daba5abf65c 100644 +--- a/drivers/gpu/drm/i915/i915_pci.c ++++ b/drivers/gpu/drm/i915/i915_pci.c +@@ -389,6 +389,7 @@ static const struct intel_device_info ilk_m_info = { + GEN5_FEATURES, + PLATFORM(INTEL_IRONLAKE), + .is_mobile = 1, ++ .has_rps = true, + .display.has_fbc = 1, + }; + +diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c +index 781a6783affe9..4df7b2a16999e 100644 +--- a/drivers/gpu/drm/i915/i915_request.c ++++ b/drivers/gpu/drm/i915/i915_request.c +@@ -549,8 +549,13 @@ bool __i915_request_submit(struct i915_request *request) + if (i915_request_completed(request)) + goto xfer; + ++ if (unlikely(intel_context_is_closed(request->context) && ++ !intel_engine_has_heartbeat(engine))) ++ intel_context_set_banned(request->context); ++ + if (unlikely(intel_context_is_banned(request->context))) + i915_request_set_error_once(request, -EIO); ++ + if (unlikely(fatal_error(request->fence.error))) + __i915_request_skip(request); + +diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c +index 8d5a933e6af60..3b62291b80a35 100644 +--- a/drivers/gpu/drm/i915/intel_uncore.c ++++ b/drivers/gpu/drm/i915/intel_uncore.c +@@ -1209,6 +1209,18 @@ unclaimed_reg_debug(struct intel_uncore *uncore, + spin_unlock(&uncore->debug->lock); + } + ++#define __vgpu_read(x) \ ++static u##x \ ++vgpu_read##x(struct intel_uncore *uncore, i915_reg_t reg, bool trace) { \ ++ u##x val = __raw_uncore_read##x(uncore, reg); \ ++ trace_i915_reg_rw(false, reg, val, sizeof(val), trace); \ ++ return val; \ ++} ++__vgpu_read(8) ++__vgpu_read(16) ++__vgpu_read(32) ++__vgpu_read(64) ++ + #define GEN2_READ_HEADER(x) \ + u##x val = 0; \ + assert_rpm_wakelock_held(uncore->rpm); +@@ -1414,6 +1426,16 @@ __gen_reg_write_funcs(gen8); + #undef GEN6_WRITE_FOOTER + #undef GEN6_WRITE_HEADER + ++#define __vgpu_write(x) \ ++static void \ ++vgpu_write##x(struct intel_uncore *uncore, i915_reg_t reg, u##x val, bool trace) { \ ++ trace_i915_reg_rw(true, reg, val, sizeof(val), trace); \ ++ __raw_uncore_write##x(uncore, reg, val); \ ++} ++__vgpu_write(8) ++__vgpu_write(16) ++__vgpu_write(32) ++ + #define ASSIGN_RAW_WRITE_MMIO_VFUNCS(uncore, x) \ + do { \ + (uncore)->funcs.mmio_writeb = x##_write8; \ +@@ -1735,7 +1757,10 @@ static void uncore_raw_init(struct intel_uncore *uncore) + { + GEM_BUG_ON(intel_uncore_has_forcewake(uncore)); + +- if (IS_GEN(uncore->i915, 5)) { ++ if (intel_vgpu_active(uncore->i915)) { ++ ASSIGN_RAW_WRITE_MMIO_VFUNCS(uncore, vgpu); ++ ASSIGN_RAW_READ_MMIO_VFUNCS(uncore, vgpu); ++ } else if (IS_GEN(uncore->i915, 5)) { + ASSIGN_RAW_WRITE_MMIO_VFUNCS(uncore, gen5); + ASSIGN_RAW_READ_MMIO_VFUNCS(uncore, gen5); + } else { +diff --git a/drivers/gpu/drm/nouveau/dispnv50/core.h b/drivers/gpu/drm/nouveau/dispnv50/core.h +index 498622c0c670d..f75088186fba3 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/core.h ++++ b/drivers/gpu/drm/nouveau/dispnv50/core.h +@@ -44,6 +44,7 @@ int core507d_new_(const struct nv50_core_func *, struct nouveau_drm *, s32, + struct nv50_core **); + int core507d_init(struct nv50_core *); + void core507d_ntfy_init(struct nouveau_bo *, u32); ++int core507d_read_caps(struct nv50_disp *disp); + int core507d_caps_init(struct nouveau_drm *, struct nv50_disp *); + int core507d_ntfy_wait_done(struct nouveau_bo *, u32, struct nvif_device *); + int core507d_update(struct nv50_core *, u32 *, bool); +@@ -55,6 +56,7 @@ extern const struct nv50_outp_func pior507d; + int core827d_new(struct nouveau_drm *, s32, struct nv50_core **); + + int core907d_new(struct nouveau_drm *, s32, struct nv50_core **); ++int core907d_caps_init(struct nouveau_drm *drm, struct nv50_disp *disp); + extern const struct nv50_outp_func dac907d; + extern const struct nv50_outp_func sor907d; + +diff --git a/drivers/gpu/drm/nouveau/dispnv50/core507d.c b/drivers/gpu/drm/nouveau/dispnv50/core507d.c +index 248edf69e1683..e6f16a7750f07 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/core507d.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/core507d.c +@@ -78,18 +78,55 @@ core507d_ntfy_init(struct nouveau_bo *bo, u32 offset) + } + + int +-core507d_caps_init(struct nouveau_drm *drm, struct nv50_disp *disp) ++core507d_read_caps(struct nv50_disp *disp) + { + struct nvif_push *push = disp->core->chan.push; + int ret; + +- if ((ret = PUSH_WAIT(push, 2))) ++ ret = PUSH_WAIT(push, 6); ++ if (ret) + return ret; + ++ PUSH_MTHD(push, NV507D, SET_NOTIFIER_CONTROL, ++ NVDEF(NV507D, SET_NOTIFIER_CONTROL, MODE, WRITE) | ++ NVVAL(NV507D, SET_NOTIFIER_CONTROL, OFFSET, NV50_DISP_CORE_NTFY >> 2) | ++ NVDEF(NV507D, SET_NOTIFIER_CONTROL, NOTIFY, ENABLE)); ++ + PUSH_MTHD(push, NV507D, GET_CAPABILITIES, 0x00000000); ++ ++ PUSH_MTHD(push, NV507D, SET_NOTIFIER_CONTROL, ++ NVDEF(NV507D, SET_NOTIFIER_CONTROL, NOTIFY, DISABLE)); ++ + return PUSH_KICK(push); + } + ++int ++core507d_caps_init(struct nouveau_drm *drm, struct nv50_disp *disp) ++{ ++ struct nv50_core *core = disp->core; ++ struct nouveau_bo *bo = disp->sync; ++ s64 time; ++ int ret; ++ ++ NVBO_WR32(bo, NV50_DISP_CORE_NTFY, NV_DISP_CORE_NOTIFIER_1, CAPABILITIES_1, ++ NVDEF(NV_DISP_CORE_NOTIFIER_1, CAPABILITIES_1, DONE, FALSE)); ++ ++ ret = core507d_read_caps(disp); ++ if (ret < 0) ++ return ret; ++ ++ time = nvif_msec(core->chan.base.device, 2000ULL, ++ if (NVBO_TD32(bo, NV50_DISP_CORE_NTFY, ++ NV_DISP_CORE_NOTIFIER_1, CAPABILITIES_1, DONE, ==, TRUE)) ++ break; ++ usleep_range(1, 2); ++ ); ++ if (time < 0) ++ NV_ERROR(drm, "core caps notifier timeout\n"); ++ ++ return 0; ++} ++ + int + core507d_init(struct nv50_core *core) + { +diff --git a/drivers/gpu/drm/nouveau/dispnv50/core907d.c b/drivers/gpu/drm/nouveau/dispnv50/core907d.c +index b17c03529c784..8564d4dffaff0 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/core907d.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/core907d.c +@@ -22,11 +22,45 @@ + #include "core.h" + #include "head.h" + ++#include <nvif/push507c.h> ++#include <nvif/timer.h> ++ ++#include <nvhw/class/cl907d.h> ++ ++#include "nouveau_bo.h" ++ ++int ++core907d_caps_init(struct nouveau_drm *drm, struct nv50_disp *disp) ++{ ++ struct nv50_core *core = disp->core; ++ struct nouveau_bo *bo = disp->sync; ++ s64 time; ++ int ret; ++ ++ NVBO_WR32(bo, NV50_DISP_CORE_NTFY, NV907D_CORE_NOTIFIER_3, CAPABILITIES_4, ++ NVDEF(NV907D_CORE_NOTIFIER_3, CAPABILITIES_4, DONE, FALSE)); ++ ++ ret = core507d_read_caps(disp); ++ if (ret < 0) ++ return ret; ++ ++ time = nvif_msec(core->chan.base.device, 2000ULL, ++ if (NVBO_TD32(bo, NV50_DISP_CORE_NTFY, ++ NV907D_CORE_NOTIFIER_3, CAPABILITIES_4, DONE, ==, TRUE)) ++ break; ++ usleep_range(1, 2); ++ ); ++ if (time < 0) ++ NV_ERROR(drm, "core caps notifier timeout\n"); ++ ++ return 0; ++} ++ + static const struct nv50_core_func + core907d = { + .init = core507d_init, + .ntfy_init = core507d_ntfy_init, +- .caps_init = core507d_caps_init, ++ .caps_init = core907d_caps_init, + .ntfy_wait_done = core507d_ntfy_wait_done, + .update = core507d_update, + .head = &head907d, +diff --git a/drivers/gpu/drm/nouveau/dispnv50/core917d.c b/drivers/gpu/drm/nouveau/dispnv50/core917d.c +index 66846f3720805..1cd3a2a35dfb7 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/core917d.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/core917d.c +@@ -26,7 +26,7 @@ static const struct nv50_core_func + core917d = { + .init = core507d_init, + .ntfy_init = core507d_ntfy_init, +- .caps_init = core507d_caps_init, ++ .caps_init = core907d_caps_init, + .ntfy_wait_done = core507d_ntfy_wait_done, + .update = core507d_update, + .head = &head917d, +diff --git a/drivers/gpu/drm/nouveau/include/nvhw/class/cl507d.h b/drivers/gpu/drm/nouveau/include/nvhw/class/cl507d.h +index 2e444bac701dd..6a463f308b64f 100644 +--- a/drivers/gpu/drm/nouveau/include/nvhw/class/cl507d.h ++++ b/drivers/gpu/drm/nouveau/include/nvhw/class/cl507d.h +@@ -32,7 +32,10 @@ + #define NV_DISP_CORE_NOTIFIER_1_COMPLETION_0_DONE_TRUE 0x00000001 + #define NV_DISP_CORE_NOTIFIER_1_COMPLETION_0_R0 15:1 + #define NV_DISP_CORE_NOTIFIER_1_COMPLETION_0_TIMESTAMP 29:16 +- ++#define NV_DISP_CORE_NOTIFIER_1_CAPABILITIES_1 0x00000001 ++#define NV_DISP_CORE_NOTIFIER_1_CAPABILITIES_1_DONE 0:0 ++#define NV_DISP_CORE_NOTIFIER_1_CAPABILITIES_1_DONE_FALSE 0x00000000 ++#define NV_DISP_CORE_NOTIFIER_1_CAPABILITIES_1_DONE_TRUE 0x00000001 + + // class methods + #define NV507D_UPDATE (0x00000080) +diff --git a/drivers/gpu/drm/nouveau/include/nvhw/class/cl907d.h b/drivers/gpu/drm/nouveau/include/nvhw/class/cl907d.h +index 34bc3eafac7d1..79aff6ff31385 100644 +--- a/drivers/gpu/drm/nouveau/include/nvhw/class/cl907d.h ++++ b/drivers/gpu/drm/nouveau/include/nvhw/class/cl907d.h +@@ -24,6 +24,10 @@ + #ifndef _cl907d_h_ + #define _cl907d_h_ + ++#define NV907D_CORE_NOTIFIER_3_CAPABILITIES_4 0x00000004 ++#define NV907D_CORE_NOTIFIER_3_CAPABILITIES_4_DONE 0:0 ++#define NV907D_CORE_NOTIFIER_3_CAPABILITIES_4_DONE_FALSE 0x00000000 ++#define NV907D_CORE_NOTIFIER_3_CAPABILITIES_4_DONE_TRUE 0x00000001 + #define NV907D_CORE_NOTIFIER_3_CAPABILITIES_CAP_SOR0_20 0x00000014 + #define NV907D_CORE_NOTIFIER_3_CAPABILITIES_CAP_SOR0_20_SINGLE_LVDS18 0:0 + #define NV907D_CORE_NOTIFIER_3_CAPABILITIES_CAP_SOR0_20_SINGLE_LVDS18_FALSE 0x00000000 +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 7674025a4bfe8..1d91d52ee5083 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -1035,29 +1035,6 @@ get_tmds_link_bandwidth(struct drm_connector *connector) + return 112000 * duallink_scale; + } + +-enum drm_mode_status +-nouveau_conn_mode_clock_valid(const struct drm_display_mode *mode, +- const unsigned min_clock, +- const unsigned max_clock, +- unsigned int *clock_out) +-{ +- unsigned int clock = mode->clock; +- +- if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == +- DRM_MODE_FLAG_3D_FRAME_PACKING) +- clock *= 2; +- +- if (clock < min_clock) +- return MODE_CLOCK_LOW; +- if (clock > max_clock) +- return MODE_CLOCK_HIGH; +- +- if (clock_out) +- *clock_out = clock; +- +- return MODE_OK; +-} +- + static enum drm_mode_status + nouveau_connector_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) +@@ -1065,7 +1042,7 @@ nouveau_connector_mode_valid(struct drm_connector *connector, + struct nouveau_connector *nv_connector = nouveau_connector(connector); + struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder; + struct drm_encoder *encoder = to_drm_encoder(nv_encoder); +- unsigned min_clock = 25000, max_clock = min_clock; ++ unsigned int min_clock = 25000, max_clock = min_clock, clock = mode->clock; + + switch (nv_encoder->dcb->type) { + case DCB_OUTPUT_LVDS: +@@ -1094,8 +1071,15 @@ nouveau_connector_mode_valid(struct drm_connector *connector, + return MODE_BAD; + } + +- return nouveau_conn_mode_clock_valid(mode, min_clock, max_clock, +- NULL); ++ if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING) ++ clock *= 2; ++ ++ if (clock < min_clock) ++ return MODE_CLOCK_LOW; ++ if (clock > max_clock) ++ return MODE_CLOCK_HIGH; ++ ++ return MODE_OK; + } + + static struct drm_encoder * +diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c +index 8a0f7994e1aeb..9c06d1cc43905 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_dp.c ++++ b/drivers/gpu/drm/nouveau/nouveau_dp.c +@@ -114,18 +114,25 @@ nv50_dp_mode_valid(struct drm_connector *connector, + unsigned *out_clock) + { + const unsigned min_clock = 25000; +- unsigned max_clock, clock; +- enum drm_mode_status ret; ++ unsigned int max_rate, mode_rate, clock = mode->clock; ++ const u8 bpp = connector->display_info.bpc * 3; + + if (mode->flags & DRM_MODE_FLAG_INTERLACE && !outp->caps.dp_interlace) + return MODE_NO_INTERLACE; + +- max_clock = outp->dp.link_nr * outp->dp.link_bw; +- clock = mode->clock * (connector->display_info.bpc * 3) / 10; ++ if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING) ++ clock *= 2; ++ ++ max_rate = outp->dp.link_nr * outp->dp.link_bw; ++ mode_rate = DIV_ROUND_UP(clock * bpp, 8); ++ if (mode_rate > max_rate) ++ return MODE_CLOCK_HIGH; ++ ++ if (clock < min_clock) ++ return MODE_CLOCK_LOW; + +- ret = nouveau_conn_mode_clock_valid(mode, min_clock, max_clock, +- &clock); + if (out_clock) + *out_clock = clock; +- return ret; ++ ++ return MODE_OK; + } +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 81f111ad3f4fd..124d3dcc5c590 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -198,7 +198,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain, + * to the caller, instead of a normal nouveau_bo ttm reference. */ + ret = drm_gem_object_init(drm->dev, &nvbo->bo.base, size); + if (ret) { +- nouveau_bo_ref(NULL, &nvbo); ++ drm_gem_object_release(&nvbo->bo.base); ++ kfree(nvbo); + return ret; + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c +index 2df1c04605594..4f69e4c3dafde 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_svm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c +@@ -105,11 +105,11 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, + struct nouveau_cli *cli = nouveau_cli(file_priv); + struct drm_nouveau_svm_bind *args = data; + unsigned target, cmd, priority; +- unsigned long addr, end, size; ++ unsigned long addr, end; + struct mm_struct *mm; + + args->va_start &= PAGE_MASK; +- args->va_end &= PAGE_MASK; ++ args->va_end = ALIGN(args->va_end, PAGE_SIZE); + + /* Sanity check arguments */ + if (args->reserved0 || args->reserved1) +@@ -118,8 +118,6 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, + return -EINVAL; + if (args->va_start >= args->va_end) + return -EINVAL; +- if (!args->npages) +- return -EINVAL; + + cmd = args->header >> NOUVEAU_SVM_BIND_COMMAND_SHIFT; + cmd &= NOUVEAU_SVM_BIND_COMMAND_MASK; +@@ -151,12 +149,6 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, + if (args->stride) + return -EINVAL; + +- size = ((unsigned long)args->npages) << PAGE_SHIFT; +- if ((args->va_start + size) <= args->va_start) +- return -EINVAL; +- if ((args->va_start + size) > args->va_end) +- return -EINVAL; +- + /* + * Ok we are ask to do something sane, for now we only support migrate + * commands but we will add things like memory policy (what to do on +@@ -171,7 +163,7 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, + return -EINVAL; + } + +- for (addr = args->va_start, end = args->va_start + size; addr < end;) { ++ for (addr = args->va_start, end = args->va_end; addr < end;) { + struct vm_area_struct *vma; + unsigned long next; + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +index dcb70677d0acc..7851bec5f0e5f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c +@@ -2924,17 +2924,34 @@ nvkm_device_del(struct nvkm_device **pdevice) + } + } + ++/* returns true if the GPU is in the CPU native byte order */ + static inline bool + nvkm_device_endianness(struct nvkm_device *device) + { +- u32 boot1 = nvkm_rd32(device, 0x000004) & 0x01000001; + #ifdef __BIG_ENDIAN +- if (!boot1) +- return false; ++ const bool big_endian = true; + #else +- if (boot1) +- return false; ++ const bool big_endian = false; + #endif ++ ++ /* Read NV_PMC_BOOT_1, and assume non-functional endian switch if it ++ * doesn't contain the expected values. ++ */ ++ u32 pmc_boot_1 = nvkm_rd32(device, 0x000004); ++ if (pmc_boot_1 && pmc_boot_1 != 0x01000001) ++ return !big_endian; /* Assume GPU is LE in this case. */ ++ ++ /* 0 means LE and 0x01000001 means BE GPU. Condition is true when ++ * GPU/CPU endianness don't match. ++ */ ++ if (big_endian == !pmc_boot_1) { ++ nvkm_wr32(device, 0x000004, 0x01000001); ++ nvkm_rd32(device, 0x000000); ++ if (nvkm_rd32(device, 0x000004) != (big_endian ? 0x01000001 : 0x00000000)) ++ return !big_endian; /* Assume GPU is LE on any unexpected read-back. */ ++ } ++ ++ /* CPU/GPU endianness should (hopefully) match. */ + return true; + } + +@@ -2987,14 +3004,10 @@ nvkm_device_ctor(const struct nvkm_device_func *func, + if (detect) { + /* switch mmio to cpu's native endianness */ + if (!nvkm_device_endianness(device)) { +- nvkm_wr32(device, 0x000004, 0x01000001); +- nvkm_rd32(device, 0x000000); +- if (!nvkm_device_endianness(device)) { +- nvdev_error(device, +- "GPU not supported on big-endian\n"); +- ret = -ENOSYS; +- goto done; +- } ++ nvdev_error(device, ++ "Couldn't switch GPU to CPUs endianess\n"); ++ ret = -ENOSYS; ++ goto done; + } + + boot0 = nvkm_rd32(device, 0x000000); +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c +index 1a6cea0e0bd74..62d4d710a5711 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -105,14 +105,12 @@ void panfrost_gem_mapping_put(struct panfrost_gem_mapping *mapping) + kref_put(&mapping->refcount, panfrost_gem_mapping_release); + } + +-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo) ++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo) + { + struct panfrost_gem_mapping *mapping; + +- mutex_lock(&bo->mappings.lock); + list_for_each_entry(mapping, &bo->mappings.list, node) + panfrost_gem_teardown_mapping(mapping); +- mutex_unlock(&bo->mappings.lock); + } + + int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv) +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.h b/drivers/gpu/drm/panfrost/panfrost_gem.h +index b3517ff9630cb..8088d5fd8480e 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem.h ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h +@@ -82,7 +82,7 @@ struct panfrost_gem_mapping * + panfrost_gem_mapping_get(struct panfrost_gem_object *bo, + struct panfrost_file_priv *priv); + void panfrost_gem_mapping_put(struct panfrost_gem_mapping *mapping); +-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo); ++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo); + + void panfrost_gem_shrinker_init(struct drm_device *dev); + void panfrost_gem_shrinker_cleanup(struct drm_device *dev); +diff --git a/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c b/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c +index 288e46c40673a..1b9f68d8e9aa6 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c +@@ -40,18 +40,26 @@ static bool panfrost_gem_purge(struct drm_gem_object *obj) + { + struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); + struct panfrost_gem_object *bo = to_panfrost_bo(obj); ++ bool ret = false; + + if (atomic_read(&bo->gpu_usecount)) + return false; + +- if (!mutex_trylock(&shmem->pages_lock)) ++ if (!mutex_trylock(&bo->mappings.lock)) + return false; + +- panfrost_gem_teardown_mappings(bo); ++ if (!mutex_trylock(&shmem->pages_lock)) ++ goto unlock_mappings; ++ ++ panfrost_gem_teardown_mappings_locked(bo); + drm_gem_shmem_purge_locked(obj); ++ ret = true; + + mutex_unlock(&shmem->pages_lock); +- return true; ++ ++unlock_mappings: ++ mutex_unlock(&bo->mappings.lock); ++ return ret; + } + + static unsigned long +diff --git a/drivers/gpu/drm/sun4i/sun4i_frontend.c b/drivers/gpu/drm/sun4i/sun4i_frontend.c +index ec2a032e07b97..7186ba73d8e14 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_frontend.c ++++ b/drivers/gpu/drm/sun4i/sun4i_frontend.c +@@ -407,6 +407,7 @@ int sun4i_frontend_update_formats(struct sun4i_frontend *frontend, + struct drm_framebuffer *fb = state->fb; + const struct drm_format_info *format = fb->format; + uint64_t modifier = fb->modifier; ++ unsigned int ch1_phase_idx; + u32 out_fmt_val; + u32 in_fmt_val, in_mod_val, in_ps_val; + unsigned int i; +@@ -442,18 +443,19 @@ int sun4i_frontend_update_formats(struct sun4i_frontend *frontend, + * I have no idea what this does exactly, but it seems to be + * related to the scaler FIR filter phase parameters. + */ ++ ch1_phase_idx = (format->num_planes > 1) ? 1 : 0; + regmap_write(frontend->regs, SUN4I_FRONTEND_CH0_HORZPHASE_REG, +- frontend->data->ch_phase[0].horzphase); ++ frontend->data->ch_phase[0]); + regmap_write(frontend->regs, SUN4I_FRONTEND_CH1_HORZPHASE_REG, +- frontend->data->ch_phase[1].horzphase); ++ frontend->data->ch_phase[ch1_phase_idx]); + regmap_write(frontend->regs, SUN4I_FRONTEND_CH0_VERTPHASE0_REG, +- frontend->data->ch_phase[0].vertphase[0]); ++ frontend->data->ch_phase[0]); + regmap_write(frontend->regs, SUN4I_FRONTEND_CH1_VERTPHASE0_REG, +- frontend->data->ch_phase[1].vertphase[0]); ++ frontend->data->ch_phase[ch1_phase_idx]); + regmap_write(frontend->regs, SUN4I_FRONTEND_CH0_VERTPHASE1_REG, +- frontend->data->ch_phase[0].vertphase[1]); ++ frontend->data->ch_phase[0]); + regmap_write(frontend->regs, SUN4I_FRONTEND_CH1_VERTPHASE1_REG, +- frontend->data->ch_phase[1].vertphase[1]); ++ frontend->data->ch_phase[ch1_phase_idx]); + + /* + * Checking the input format is sufficient since we currently only +@@ -687,30 +689,12 @@ static const struct dev_pm_ops sun4i_frontend_pm_ops = { + }; + + static const struct sun4i_frontend_data sun4i_a10_frontend = { +- .ch_phase = { +- { +- .horzphase = 0, +- .vertphase = { 0, 0 }, +- }, +- { +- .horzphase = 0xfc000, +- .vertphase = { 0xfc000, 0xfc000 }, +- }, +- }, ++ .ch_phase = { 0x000, 0xfc000 }, + .has_coef_rdy = true, + }; + + static const struct sun4i_frontend_data sun8i_a33_frontend = { +- .ch_phase = { +- { +- .horzphase = 0x400, +- .vertphase = { 0x400, 0x400 }, +- }, +- { +- .horzphase = 0x400, +- .vertphase = { 0x400, 0x400 }, +- }, +- }, ++ .ch_phase = { 0x400, 0xfc400 }, + .has_coef_access_ctrl = true, + }; + +diff --git a/drivers/gpu/drm/sun4i/sun4i_frontend.h b/drivers/gpu/drm/sun4i/sun4i_frontend.h +index 0c382c1ddb0fe..2e7b76e50c2ba 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_frontend.h ++++ b/drivers/gpu/drm/sun4i/sun4i_frontend.h +@@ -115,11 +115,7 @@ struct reset_control; + struct sun4i_frontend_data { + bool has_coef_access_ctrl; + bool has_coef_rdy; +- +- struct { +- u32 horzphase; +- u32 vertphase[2]; +- } ch_phase[2]; ++ u32 ch_phase[2]; + }; + + struct sun4i_frontend { +diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c +index 915f8bfdb58ca..182c586525eb8 100644 +--- a/drivers/gpu/drm/v3d/v3d_gem.c ++++ b/drivers/gpu/drm/v3d/v3d_gem.c +@@ -568,7 +568,6 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, + ret = v3d_job_init(v3d, file_priv, &bin->base, + v3d_job_free, args->in_sync_bcl); + if (ret) { +- kfree(bin); + v3d_job_put(&render->base); + kfree(bin); + return ret; +diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c +index 38343d2fb4fb4..f6995e7f6eb6e 100644 +--- a/drivers/gpu/drm/vc4/vc4_drv.c ++++ b/drivers/gpu/drm/vc4/vc4_drv.c +@@ -310,6 +310,7 @@ unbind_all: + component_unbind_all(dev, drm); + gem_destroy: + vc4_gem_destroy(drm); ++ drm_mode_config_cleanup(drm); + vc4_bo_cache_destroy(drm); + dev_put: + drm_dev_put(drm); +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 2239c211178b6..e58be1fe7585e 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -2490,6 +2490,9 @@ struct dmar_domain *find_domain(struct device *dev) + { + struct device_domain_info *info; + ++ if (unlikely(!dev || !dev->iommu)) ++ return NULL; ++ + if (unlikely(attach_deferred(dev))) + return NULL; + +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index 0369d98b2d12e..b37d6c1936de1 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -2701,11 +2701,10 @@ static void spi_nor_sfdp_init_params(struct spi_nor *nor) + + memcpy(&sfdp_params, nor->params, sizeof(sfdp_params)); + +- if (spi_nor_parse_sfdp(nor, &sfdp_params)) { ++ if (spi_nor_parse_sfdp(nor, nor->params)) { ++ memcpy(nor->params, &sfdp_params, sizeof(*nor->params)); + nor->addr_width = 0; + nor->flags &= ~SNOR_F_4B_OPCODES; +- } else { +- memcpy(nor->params, &sfdp_params, sizeof(*nor->params)); + } + } + +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index f1e484477e35d..7adf71ebd9fed 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -1219,8 +1219,8 @@ qca8k_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + priv->port_mtu[port] = new_mtu; + + for (i = 0; i < QCA8K_NUM_PORTS; i++) +- if (priv->port_mtu[port] > mtu) +- mtu = priv->port_mtu[port]; ++ if (priv->port_mtu[i] > mtu) ++ mtu = priv->port_mtu[i]; + + /* Include L2 header / FCS length */ + qca8k_write(priv, QCA8K_MAX_FRAME_SIZE, mtu + ETH_HLEN + ETH_FCS_LEN); +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 9179f7b0b900e..c62465d83bc03 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1930,7 +1930,8 @@ static inline int macb_clear_csum(struct sk_buff *skb) + + static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + { +- bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb); ++ bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb) || ++ skb_is_nonlinear(*skb); + int padlen = ETH_ZLEN - (*skb)->len; + int headroom = skb_headroom(*skb); + int tailroom = skb_tailroom(*skb); +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index fdff3b4723bad..39ad01bf5ee70 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -174,12 +174,17 @@ MODULE_PARM_DESC(tx_timeout, "The Tx timeout in ms"); + #define DPAA_PARSE_RESULTS_SIZE sizeof(struct fman_prs_result) + #define DPAA_TIME_STAMP_SIZE 8 + #define DPAA_HASH_RESULTS_SIZE 8 ++#define DPAA_HWA_SIZE (DPAA_PARSE_RESULTS_SIZE + DPAA_TIME_STAMP_SIZE \ ++ + DPAA_HASH_RESULTS_SIZE) ++#define DPAA_RX_PRIV_DATA_DEFAULT_SIZE (DPAA_TX_PRIV_DATA_SIZE + \ ++ dpaa_rx_extra_headroom) + #ifdef CONFIG_DPAA_ERRATUM_A050385 +-#define DPAA_RX_PRIV_DATA_SIZE (DPAA_A050385_ALIGN - (DPAA_PARSE_RESULTS_SIZE\ +- + DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE)) ++#define DPAA_RX_PRIV_DATA_A050385_SIZE (DPAA_A050385_ALIGN - DPAA_HWA_SIZE) ++#define DPAA_RX_PRIV_DATA_SIZE (fman_has_errata_a050385() ? \ ++ DPAA_RX_PRIV_DATA_A050385_SIZE : \ ++ DPAA_RX_PRIV_DATA_DEFAULT_SIZE) + #else +-#define DPAA_RX_PRIV_DATA_SIZE (u16)(DPAA_TX_PRIV_DATA_SIZE + \ +- dpaa_rx_extra_headroom) ++#define DPAA_RX_PRIV_DATA_SIZE DPAA_RX_PRIV_DATA_DEFAULT_SIZE + #endif + + #define DPAA_ETH_PCD_RXQ_NUM 128 +@@ -2840,7 +2845,8 @@ out_error: + return err; + } + +-static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl) ++static u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl, ++ enum port_type port) + { + u16 headroom; + +@@ -2854,10 +2860,12 @@ static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl) + * + * Also make sure the headroom is a multiple of data_align bytes + */ +- headroom = (u16)(bl->priv_data_size + DPAA_PARSE_RESULTS_SIZE + +- DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE); ++ headroom = (u16)(bl[port].priv_data_size + DPAA_HWA_SIZE); + +- return ALIGN(headroom, DPAA_FD_DATA_ALIGNMENT); ++ if (port == RX) ++ return ALIGN(headroom, DPAA_FD_RX_DATA_ALIGNMENT); ++ else ++ return ALIGN(headroom, DPAA_FD_DATA_ALIGNMENT); + } + + static int dpaa_eth_probe(struct platform_device *pdev) +@@ -3025,8 +3033,8 @@ static int dpaa_eth_probe(struct platform_device *pdev) + goto free_dpaa_fqs; + } + +- priv->tx_headroom = dpaa_get_headroom(&priv->buf_layout[TX]); +- priv->rx_headroom = dpaa_get_headroom(&priv->buf_layout[RX]); ++ priv->tx_headroom = dpaa_get_headroom(priv->buf_layout, TX); ++ priv->rx_headroom = dpaa_get_headroom(priv->buf_layout, RX); + + /* All real interfaces need their ports initialized */ + err = dpaa_eth_init_ports(mac_dev, dpaa_bp, &port_fqs, +diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h +index 832a2175636d6..c527f4ee1d3ae 100644 +--- a/drivers/net/ethernet/freescale/fec.h ++++ b/drivers/net/ethernet/freescale/fec.h +@@ -456,6 +456,12 @@ struct bufdesc_ex { + */ + #define FEC_QUIRK_HAS_FRREG (1 << 16) + ++/* Some FEC hardware blocks need the MMFR cleared at setup time to avoid ++ * the generation of an MII event. This must be avoided in the older ++ * FEC blocks where it will stop MII events being generated. ++ */ ++#define FEC_QUIRK_CLEAR_SETUP_MII (1 << 17) ++ + struct bufdesc_prop { + int qid; + /* Address of Rx and Tx buffers */ +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 31f60b542feb4..c7d2c01023f81 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -100,14 +100,14 @@ static const struct fec_devinfo fec_imx27_info = { + static const struct fec_devinfo fec_imx28_info = { + .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME | + FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC | +- FEC_QUIRK_HAS_FRREG, ++ FEC_QUIRK_HAS_FRREG | FEC_QUIRK_CLEAR_SETUP_MII, + }; + + static const struct fec_devinfo fec_imx6q_info = { + .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT | + FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM | + FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358 | +- FEC_QUIRK_HAS_RACC, ++ FEC_QUIRK_HAS_RACC | FEC_QUIRK_CLEAR_SETUP_MII, + }; + + static const struct fec_devinfo fec_mvf600_info = { +@@ -119,7 +119,8 @@ static const struct fec_devinfo fec_imx6x_info = { + FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM | + FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB | + FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE | +- FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE, ++ FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE | ++ FEC_QUIRK_CLEAR_SETUP_MII, + }; + + static const struct fec_devinfo fec_imx6ul_info = { +@@ -127,7 +128,7 @@ static const struct fec_devinfo fec_imx6ul_info = { + FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM | + FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR007885 | + FEC_QUIRK_BUG_CAPTURE | FEC_QUIRK_HAS_RACC | +- FEC_QUIRK_HAS_COALESCE, ++ FEC_QUIRK_HAS_COALESCE | FEC_QUIRK_CLEAR_SETUP_MII, + }; + + static struct platform_device_id fec_devtype[] = { +@@ -2135,15 +2136,17 @@ static int fec_enet_mii_init(struct platform_device *pdev) + if (suppress_preamble) + fep->phy_speed |= BIT(7); + +- /* Clear MMFR to avoid to generate MII event by writing MSCR. +- * MII event generation condition: +- * - writing MSCR: +- * - mmfr[31:0]_not_zero & mscr[7:0]_is_zero & +- * mscr_reg_data_in[7:0] != 0 +- * - writing MMFR: +- * - mscr[7:0]_not_zero +- */ +- writel(0, fep->hwp + FEC_MII_DATA); ++ if (fep->quirks & FEC_QUIRK_CLEAR_SETUP_MII) { ++ /* Clear MMFR to avoid to generate MII event by writing MSCR. ++ * MII event generation condition: ++ * - writing MSCR: ++ * - mmfr[31:0]_not_zero & mscr[7:0]_is_zero & ++ * mscr_reg_data_in[7:0] != 0 ++ * - writing MMFR: ++ * - mscr[7:0]_not_zero ++ */ ++ writel(0, fep->hwp + FEC_MII_DATA); ++ } + + writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED); + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 41dd3d0f34524..d391a45cebb66 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1829,20 +1829,12 @@ static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev) + fcb_len = GMAC_FCB_LEN + GMAC_TXPAL_LEN; + + /* make space for additional header when fcb is needed */ +- if (fcb_len && unlikely(skb_headroom(skb) < fcb_len)) { +- struct sk_buff *skb_new; +- +- skb_new = skb_realloc_headroom(skb, fcb_len); +- if (!skb_new) { ++ if (fcb_len) { ++ if (unlikely(skb_cow_head(skb, fcb_len))) { + dev->stats.tx_errors++; + dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } +- +- if (skb->sk) +- skb_set_owner_w(skb_new, skb->sk); +- dev_consume_skb_any(skb); +- skb = skb_new; + } + + /* total number of fragments in the SKB */ +@@ -3380,7 +3372,7 @@ static int gfar_probe(struct platform_device *ofdev) + + if (dev->features & NETIF_F_IP_CSUM || + priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) +- dev->needed_headroom = GMAC_FCB_LEN; ++ dev->needed_headroom = GMAC_FCB_LEN + GMAC_TXPAL_LEN; + + /* Initializing some of the rx/tx queue level parameters */ + for (i = 0; i < priv->num_tx_queues; i++) { +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index f96bb3dab5a8b..c6ee42278fdcf 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1197,18 +1197,27 @@ static int ibmvnic_open(struct net_device *netdev) + if (adapter->state != VNIC_CLOSED) { + rc = ibmvnic_login(netdev); + if (rc) +- return rc; ++ goto out; + + rc = init_resources(adapter); + if (rc) { + netdev_err(netdev, "failed to initialize resources\n"); + release_resources(adapter); +- return rc; ++ goto out; + } + } + + rc = __ibmvnic_open(netdev); + ++out: ++ /* ++ * If open fails due to a pending failover, set device state and ++ * return. Device operation will be handled by reset routine. ++ */ ++ if (rc && adapter->failover_pending) { ++ adapter->state = VNIC_OPEN; ++ rc = 0; ++ } + return rc; + } + +@@ -1935,6 +1944,13 @@ static int do_reset(struct ibmvnic_adapter *adapter, + rwi->reset_reason); + + rtnl_lock(); ++ /* ++ * Now that we have the rtnl lock, clear any pending failover. ++ * This will ensure ibmvnic_open() has either completed or will ++ * block until failover is complete. ++ */ ++ if (rwi->reset_reason == VNIC_RESET_FAILOVER) ++ adapter->failover_pending = false; + + netif_carrier_off(netdev); + adapter->reset_reason = rwi->reset_reason; +@@ -2215,6 +2231,13 @@ static void __ibmvnic_reset(struct work_struct *work) + /* CHANGE_PARAM requestor holds rtnl_lock */ + rc = do_change_param_reset(adapter, rwi, reset_state); + } else if (adapter->force_reset_recovery) { ++ /* ++ * Since we are doing a hard reset now, clear the ++ * failover_pending flag so we don't ignore any ++ * future MOBILITY or other resets. ++ */ ++ adapter->failover_pending = false; ++ + /* Transport event occurred during previous reset */ + if (adapter->wait_for_reset) { + /* Previous was CHANGE_PARAM; caller locked */ +@@ -2279,9 +2302,15 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter, + unsigned long flags; + int ret; + ++ /* ++ * If failover is pending don't schedule any other reset. ++ * Instead let the failover complete. If there is already a ++ * a failover reset scheduled, we will detect and drop the ++ * duplicate reset when walking the ->rwi_list below. ++ */ + if (adapter->state == VNIC_REMOVING || + adapter->state == VNIC_REMOVED || +- adapter->failover_pending) { ++ (adapter->failover_pending && reason != VNIC_RESET_FAILOVER)) { + ret = EBUSY; + netdev_dbg(netdev, "Adapter removing or pending failover, skipping reset\n"); + goto err; +@@ -4665,7 +4694,6 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq, + case IBMVNIC_CRQ_INIT: + dev_info(dev, "Partner initialized\n"); + adapter->from_passive_init = true; +- adapter->failover_pending = false; + if (!completion_done(&adapter->init_done)) { + complete(&adapter->init_done); + adapter->init_done_rc = -EIO; +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +index 3c57c331729f2..807a90963618b 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c +@@ -126,6 +126,11 @@ static int ionic_get_link_ksettings(struct net_device *netdev, + + ethtool_link_ksettings_zero_link_mode(ks, supported); + ++ if (!idev->port_info) { ++ netdev_err(netdev, "port_info not initialized\n"); ++ return -EOPNOTSUPP; ++ } ++ + /* The port_info data is found in a DMA space that the NIC keeps + * up-to-date, so there's no need to request the data from the + * NIC, we already have it in our memory space. +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 434bc0a7aa95c..c74d9c02a805f 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4062,9 +4062,17 @@ err_out: + return -EIO; + } + +-static bool rtl_test_hw_pad_bug(struct rtl8169_private *tp, struct sk_buff *skb) ++static bool rtl_test_hw_pad_bug(struct rtl8169_private *tp) + { +- return skb->len < ETH_ZLEN && tp->mac_version == RTL_GIGA_MAC_VER_34; ++ switch (tp->mac_version) { ++ case RTL_GIGA_MAC_VER_34: ++ case RTL_GIGA_MAC_VER_60: ++ case RTL_GIGA_MAC_VER_61: ++ case RTL_GIGA_MAC_VER_63: ++ return true; ++ default: ++ return false; ++ } + } + + static void rtl8169_tso_csum_v1(struct sk_buff *skb, u32 *opts) +@@ -4136,7 +4144,7 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, + + opts[1] |= transport_offset << TCPHO_SHIFT; + } else { +- if (unlikely(rtl_test_hw_pad_bug(tp, skb))) ++ if (unlikely(skb->len < ETH_ZLEN && rtl_test_hw_pad_bug(tp))) + return !eth_skb_pad(skb); + } + +diff --git a/drivers/net/ethernet/ti/cpsw_ethtool.c b/drivers/net/ethernet/ti/cpsw_ethtool.c +index fa54efe3be635..6c21347305907 100644 +--- a/drivers/net/ethernet/ti/cpsw_ethtool.c ++++ b/drivers/net/ethernet/ti/cpsw_ethtool.c +@@ -727,7 +727,6 @@ int cpsw_get_ts_info(struct net_device *ndev, struct ethtool_ts_info *info) + (1 << HWTSTAMP_TX_ON); + info->rx_filters = + (1 << HWTSTAMP_FILTER_NONE) | +- (1 << HWTSTAMP_FILTER_PTP_V1_L4_EVENT) | + (1 << HWTSTAMP_FILTER_PTP_V2_EVENT); + return 0; + } +diff --git a/drivers/net/ethernet/ti/cpsw_priv.c b/drivers/net/ethernet/ti/cpsw_priv.c +index 482a1a451e437..cf395ced48cd8 100644 +--- a/drivers/net/ethernet/ti/cpsw_priv.c ++++ b/drivers/net/ethernet/ti/cpsw_priv.c +@@ -639,13 +639,10 @@ static int cpsw_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) + break; + case HWTSTAMP_FILTER_ALL: + case HWTSTAMP_FILTER_NTP_ALL: +- return -ERANGE; + case HWTSTAMP_FILTER_PTP_V1_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V1_L4_SYNC: + case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ: +- priv->rx_ts_enabled = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; +- break; ++ return -ERANGE; + case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: + case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ: +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index cf83314c8591e..60b934482dbba 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -2389,7 +2389,8 @@ static int sfp_probe(struct platform_device *pdev) + continue; + + sfp->gpio_irq[i] = gpiod_to_irq(sfp->gpio[i]); +- if (!sfp->gpio_irq[i]) { ++ if (sfp->gpio_irq[i] < 0) { ++ sfp->gpio_irq[i] = 0; + sfp->need_poll = true; + continue; + } +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 5ca1356b8656f..3db5b5d104798 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1331,6 +1331,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1230, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 116902b1b2c34..3a598e91e816d 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1767,6 +1767,14 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) + return; + } + ++ /* sanity checking for received data length */ ++ if (unlikely(wc->byte_len < len)) { ++ dev_err(queue->ctrl->ctrl.device, ++ "Unexpected nvme completion length(%d)\n", wc->byte_len); ++ nvme_rdma_error_recovery(queue->ctrl); ++ return; ++ } ++ + ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE); + /* + * AEN requests are special as they don't time out and can +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 90e0c84df2af9..754287709ec49 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -907,8 +907,6 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, + req->error_loc = NVMET_NO_ERROR_LOC; + req->error_slba = 0; + +- trace_nvmet_req_init(req, req->cmd); +- + /* no support for fused commands yet */ + if (unlikely(flags & (NVME_CMD_FUSE_FIRST | NVME_CMD_FUSE_SECOND))) { + req->error_loc = offsetof(struct nvme_common_command, flags); +@@ -938,6 +936,8 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, + if (status) + goto fail; + ++ trace_nvmet_req_init(req, req->cmd); ++ + if (unlikely(!percpu_ref_tryget_live(&sq->ref))) { + status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto fail; +diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h +index 0458046d65017..c14e3249a14dc 100644 +--- a/drivers/nvme/target/trace.h ++++ b/drivers/nvme/target/trace.h +@@ -46,19 +46,12 @@ static inline struct nvmet_ctrl *nvmet_req_to_ctrl(struct nvmet_req *req) + return req->sq->ctrl; + } + +-static inline void __assign_disk_name(char *name, struct nvmet_req *req, +- bool init) ++static inline void __assign_req_name(char *name, struct nvmet_req *req) + { +- struct nvmet_ctrl *ctrl = nvmet_req_to_ctrl(req); +- struct nvmet_ns *ns; +- +- if ((init && req->sq->qid) || (!init && req->cq->qid)) { +- ns = nvmet_find_namespace(ctrl, req->cmd->rw.nsid); +- strncpy(name, ns->device_path, DISK_NAME_LEN); +- return; +- } +- +- memset(name, 0, DISK_NAME_LEN); ++ if (req->ns) ++ strncpy(name, req->ns->device_path, DISK_NAME_LEN); ++ else ++ memset(name, 0, DISK_NAME_LEN); + } + #endif + +@@ -81,7 +74,7 @@ TRACE_EVENT(nvmet_req_init, + TP_fast_assign( + __entry->cmd = cmd; + __entry->ctrl = nvmet_req_to_ctrl(req); +- __assign_disk_name(__entry->disk, req, true); ++ __assign_req_name(__entry->disk, req); + __entry->qid = req->sq->qid; + __entry->cid = cmd->common.command_id; + __entry->opcode = cmd->common.opcode; +@@ -121,7 +114,7 @@ TRACE_EVENT(nvmet_req_complete, + __entry->cid = req->cqe->command_id; + __entry->result = le64_to_cpu(req->cqe->result.u64); + __entry->status = le16_to_cpu(req->cqe->status) >> 1; +- __assign_disk_name(__entry->disk, req, false); ++ __assign_req_name(__entry->disk, req); + ), + TP_printk("nvmet%s: %sqid=%d, cmdid=%u, res=%#llx, status=%#x", + __print_ctrl_name(__entry->ctrl), +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index 46b9371c8a332..6530b8b9160f1 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -200,6 +200,16 @@ static int __init __rmem_cmp(const void *a, const void *b) + if (ra->base > rb->base) + return 1; + ++ /* ++ * Put the dynamic allocations (address == 0, size == 0) before static ++ * allocations at address 0x0 so that overlap detection works ++ * correctly. ++ */ ++ if (ra->size < rb->size) ++ return -1; ++ if (ra->size > rb->size) ++ return 1; ++ + return 0; + } + +@@ -217,8 +227,7 @@ static void __init __rmem_check_for_overlap(void) + + this = &reserved_mem[i]; + next = &reserved_mem[i + 1]; +- if (!(this->base && next->base)) +- continue; ++ + if (this->base + this->size > next->base) { + phys_addr_t this_end, next_end; + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 4859cf84c0b2f..79317d6bf8513 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4128,6 +4128,8 @@ int regulator_get_voltage_rdev(struct regulator_dev *rdev) + ret = rdev->desc->fixed_uV; + } else if (rdev->supply) { + ret = regulator_get_voltage_rdev(rdev->supply->rdev); ++ } else if (rdev->supply_name) { ++ return -EPROBE_DEFER; + } else { + return -EINVAL; + } +diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c +index 5896e5282a4e8..120330236647a 100644 +--- a/drivers/s390/crypto/pkey_api.c ++++ b/drivers/s390/crypto/pkey_api.c +@@ -34,9 +34,6 @@ MODULE_DESCRIPTION("s390 protected key interface"); + #define KEYBLOBBUFSIZE 8192 /* key buffer size used for internal processing */ + #define MAXAPQNSINLIST 64 /* max 64 apqns within a apqn list */ + +-/* mask of available pckmo subfunctions, fetched once at module init */ +-static cpacf_mask_t pckmo_functions; +- + /* + * debug feature data and functions + */ +@@ -90,6 +87,9 @@ static int pkey_clr2protkey(u32 keytype, + const struct pkey_clrkey *clrkey, + struct pkey_protkey *protkey) + { ++ /* mask of available pckmo subfunctions */ ++ static cpacf_mask_t pckmo_functions; ++ + long fc; + int keysize; + u8 paramblock[64]; +@@ -113,11 +113,13 @@ static int pkey_clr2protkey(u32 keytype, + return -EINVAL; + } + +- /* +- * Check if the needed pckmo subfunction is available. +- * These subfunctions can be enabled/disabled by customers +- * in the LPAR profile or may even change on the fly. +- */ ++ /* Did we already check for PCKMO ? */ ++ if (!pckmo_functions.bytes[0]) { ++ /* no, so check now */ ++ if (!cpacf_query(CPACF_PCKMO, &pckmo_functions)) ++ return -ENODEV; ++ } ++ /* check for the pckmo subfunction we need now */ + if (!cpacf_test_func(&pckmo_functions, fc)) { + DEBUG_ERR("%s pckmo functions not available\n", __func__); + return -ENODEV; +@@ -1838,7 +1840,7 @@ static struct miscdevice pkey_dev = { + */ + static int __init pkey_init(void) + { +- cpacf_mask_t kmc_functions; ++ cpacf_mask_t func_mask; + + /* + * The pckmo instruction should be available - even if we don't +@@ -1846,15 +1848,15 @@ static int __init pkey_init(void) + * is also the minimum level for the kmc instructions which + * are able to work with protected keys. + */ +- if (!cpacf_query(CPACF_PCKMO, &pckmo_functions)) ++ if (!cpacf_query(CPACF_PCKMO, &func_mask)) + return -ENODEV; + + /* check for kmc instructions available */ +- if (!cpacf_query(CPACF_KMC, &kmc_functions)) ++ if (!cpacf_query(CPACF_KMC, &func_mask)) + return -ENODEV; +- if (!cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_128) || +- !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_192) || +- !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_256)) ++ if (!cpacf_test_func(&func_mask, CPACF_KMC_PAES_128) || ++ !cpacf_test_func(&func_mask, CPACF_KMC_PAES_192) || ++ !cpacf_test_func(&func_mask, CPACF_KMC_PAES_256)) + return -ENODEV; + + pkey_debug_init(); +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index b1f3017b6547a..29fcc44be2d57 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -806,6 +806,22 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code) + spin_unlock_irqrestore(hostdata->host->host_lock, flags); + } + ++/** ++ * ibmvscsi_set_request_limit - Set the adapter request_limit in response to ++ * an adapter failure, reset, or SRP Login. Done under host lock to prevent ++ * race with SCSI command submission. ++ * @hostdata: adapter to adjust ++ * @limit: new request limit ++ */ ++static void ibmvscsi_set_request_limit(struct ibmvscsi_host_data *hostdata, int limit) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(hostdata->host->host_lock, flags); ++ atomic_set(&hostdata->request_limit, limit); ++ spin_unlock_irqrestore(hostdata->host->host_lock, flags); ++} ++ + /** + * ibmvscsi_reset_host - Reset the connection to the server + * @hostdata: struct ibmvscsi_host_data to reset +@@ -813,7 +829,7 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code) + static void ibmvscsi_reset_host(struct ibmvscsi_host_data *hostdata) + { + scsi_block_requests(hostdata->host); +- atomic_set(&hostdata->request_limit, 0); ++ ibmvscsi_set_request_limit(hostdata, 0); + + purge_requests(hostdata, DID_ERROR); + hostdata->action = IBMVSCSI_HOST_ACTION_RESET; +@@ -1146,13 +1162,13 @@ static void login_rsp(struct srp_event_struct *evt_struct) + dev_info(hostdata->dev, "SRP_LOGIN_REJ reason %u\n", + evt_struct->xfer_iu->srp.login_rej.reason); + /* Login failed. */ +- atomic_set(&hostdata->request_limit, -1); ++ ibmvscsi_set_request_limit(hostdata, -1); + return; + default: + dev_err(hostdata->dev, "Invalid login response typecode 0x%02x!\n", + evt_struct->xfer_iu->srp.login_rsp.opcode); + /* Login failed. */ +- atomic_set(&hostdata->request_limit, -1); ++ ibmvscsi_set_request_limit(hostdata, -1); + return; + } + +@@ -1163,7 +1179,7 @@ static void login_rsp(struct srp_event_struct *evt_struct) + * This value is set rather than added to request_limit because + * request_limit could have been set to -1 by this client. + */ +- atomic_set(&hostdata->request_limit, ++ ibmvscsi_set_request_limit(hostdata, + be32_to_cpu(evt_struct->xfer_iu->srp.login_rsp.req_lim_delta)); + + /* If we had any pending I/Os, kick them */ +@@ -1195,13 +1211,13 @@ static int send_srp_login(struct ibmvscsi_host_data *hostdata) + login->req_buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT | + SRP_BUF_FORMAT_INDIRECT); + +- spin_lock_irqsave(hostdata->host->host_lock, flags); + /* Start out with a request limit of 0, since this is negotiated in + * the login request we are just sending and login requests always + * get sent by the driver regardless of request_limit. + */ +- atomic_set(&hostdata->request_limit, 0); ++ ibmvscsi_set_request_limit(hostdata, 0); + ++ spin_lock_irqsave(hostdata->host->host_lock, flags); + rc = ibmvscsi_send_srp_event(evt_struct, hostdata, login_timeout * 2); + spin_unlock_irqrestore(hostdata->host->host_lock, flags); + dev_info(hostdata->dev, "sent SRP login\n"); +@@ -1781,7 +1797,7 @@ static void ibmvscsi_handle_crq(struct viosrp_crq *crq, + return; + case VIOSRP_CRQ_XPORT_EVENT: /* Hypervisor telling us the connection is closed */ + scsi_block_requests(hostdata->host); +- atomic_set(&hostdata->request_limit, 0); ++ ibmvscsi_set_request_limit(hostdata, 0); + if (crq->format == 0x06) { + /* We need to re-setup the interpartition connection */ + dev_info(hostdata->dev, "Re-enabling adapter!\n"); +@@ -2137,12 +2153,12 @@ static void ibmvscsi_do_work(struct ibmvscsi_host_data *hostdata) + } + + hostdata->action = IBMVSCSI_HOST_ACTION_NONE; ++ spin_unlock_irqrestore(hostdata->host->host_lock, flags); + + if (rc) { +- atomic_set(&hostdata->request_limit, -1); ++ ibmvscsi_set_request_limit(hostdata, -1); + dev_err(hostdata->dev, "error after %s\n", action); + } +- spin_unlock_irqrestore(hostdata->host->host_lock, flags); + + scsi_unblock_requests(hostdata->host); + } +@@ -2226,7 +2242,7 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + init_waitqueue_head(&hostdata->work_wait_q); + hostdata->host = host; + hostdata->dev = dev; +- atomic_set(&hostdata->request_limit, -1); ++ ibmvscsi_set_request_limit(hostdata, -1); + hostdata->host->max_sectors = IBMVSCSI_MAX_SECTORS_DEFAULT; + + if (map_persist_bufs(hostdata)) { +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index f2437a7570ce8..9af50e6f94c4c 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -1714,15 +1714,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost) + */ + static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) + { +- struct async_scan_data *data; ++ struct async_scan_data *data = NULL; + unsigned long flags; + + if (strncmp(scsi_scan_type, "sync", 4) == 0) + return NULL; + ++ mutex_lock(&shost->scan_mutex); + if (shost->async_scan) { + shost_printk(KERN_DEBUG, shost, "%s called twice\n", __func__); +- return NULL; ++ goto err; + } + + data = kmalloc(sizeof(*data), GFP_KERNEL); +@@ -1733,7 +1734,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) + goto err; + init_completion(&data->prev_finished); + +- mutex_lock(&shost->scan_mutex); + spin_lock_irqsave(shost->host_lock, flags); + shost->async_scan = 1; + spin_unlock_irqrestore(shost->host_lock, flags); +@@ -1748,6 +1748,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) + return data; + + err: ++ mutex_unlock(&shost->scan_mutex); + kfree(data); + return NULL; + } +diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c +index 41986ac0fbfb2..8ed3623be8a4b 100644 +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -1259,18 +1259,6 @@ static int bcm2835_spi_setup(struct spi_device *spi) + if (!chip) + return 0; + +- /* +- * Retrieve the corresponding GPIO line used for CS. +- * The inversion semantics will be handled by the GPIO core +- * code, so we pass GPIOD_OUT_LOW for "unasserted" and +- * the correct flag for inversion semantics. The SPI_CS_HIGH +- * on spi->mode cannot be checked for polarity in this case +- * as the flag use_gpio_descriptors enforces SPI_CS_HIGH. +- */ +- if (of_property_read_bool(spi->dev.of_node, "spi-cs-high")) +- lflags = GPIO_ACTIVE_HIGH; +- else +- lflags = GPIO_ACTIVE_LOW; + spi->cs_gpiod = gpiochip_request_own_desc(chip, 8 - spi->chip_select, + DRV_NAME, + lflags, +diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c +index e798d494f00ff..bbf033ca47362 100644 +--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c ++++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c +@@ -179,6 +179,9 @@ struct vchiq_mmal_instance { + + /* ordered workqueue to process all bulk operations */ + struct workqueue_struct *bulk_wq; ++ ++ /* handle for a vchiq instance */ ++ struct vchiq_instance *vchiq_instance; + }; + + static struct mmal_msg_context * +@@ -1840,6 +1843,7 @@ int vchiq_mmal_finalise(struct vchiq_mmal_instance *instance) + + mutex_unlock(&instance->vchiq_mutex); + ++ vchiq_shutdown(instance->vchiq_instance); + flush_workqueue(instance->bulk_wq); + destroy_workqueue(instance->bulk_wq); + +@@ -1856,6 +1860,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_finalise); + int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance) + { + int status; ++ int err = -ENODEV; + struct vchiq_mmal_instance *instance; + static struct vchiq_instance *vchiq_instance; + struct vchiq_service_params params = { +@@ -1890,17 +1895,21 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance) + status = vchiq_connect(vchiq_instance); + if (status) { + pr_err("Failed to connect VCHI instance (status=%d)\n", status); +- return -EIO; ++ err = -EIO; ++ goto err_shutdown_vchiq; + } + + instance = kzalloc(sizeof(*instance), GFP_KERNEL); + +- if (!instance) +- return -ENOMEM; ++ if (!instance) { ++ err = -ENOMEM; ++ goto err_shutdown_vchiq; ++ } + + mutex_init(&instance->vchiq_mutex); + + instance->bulk_scratch = vmalloc(PAGE_SIZE); ++ instance->vchiq_instance = vchiq_instance; + + mutex_init(&instance->context_map_lock); + idr_init_base(&instance->context_map, 1); +@@ -1932,7 +1941,9 @@ err_close_services: + err_free: + vfree(instance->bulk_scratch); + kfree(instance); +- return -ENODEV; ++err_shutdown_vchiq: ++ vchiq_shutdown(vchiq_instance); ++ return err; + } + EXPORT_SYMBOL_GPL(vchiq_mmal_init); + +diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c +index 7b0dec14c8b80..a96677f97d4d9 100644 +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -317,7 +317,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios, + */ + baud = tty_termios_baud_rate(termios); + +- serial8250_do_set_termios(port, termios, old); ++ serial8250_do_set_termios(port, termios, NULL); + + tty_termios_encode_baud_rate(termios, baud, baud); + +diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig +index 20b98a3ba0466..1a7e84a0db649 100644 +--- a/drivers/tty/serial/Kconfig ++++ b/drivers/tty/serial/Kconfig +@@ -522,6 +522,7 @@ config SERIAL_IMX_EARLYCON + depends on OF + select SERIAL_EARLYCON + select SERIAL_CORE_CONSOLE ++ default y if SERIAL_IMX_CONSOLE + help + If you have enabled the earlycon on the Freescale IMX + CPU you can make it the earlycon by answering Y to this option. +diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c +index b4d89e31730e3..7a07e7272de12 100644 +--- a/drivers/tty/serial/serial_txx9.c ++++ b/drivers/tty/serial/serial_txx9.c +@@ -1280,6 +1280,9 @@ static int __init serial_txx9_init(void) + + #ifdef ENABLE_SERIAL_TXX9_PCI + ret = pci_register_driver(&serial_txx9_pci_driver); ++ if (ret) { ++ platform_driver_unregister(&serial_txx9_plat_driver); ++ } + #endif + if (ret == 0) + goto out; +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index ceed72c9a88f7..5667410d4a035 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1514,10 +1514,12 @@ static void release_tty(struct tty_struct *tty, int idx) + tty->ops->shutdown(tty); + tty_save_termios(tty); + tty_driver_remove_tty(tty->driver, tty); +- tty->port->itty = NULL; ++ if (tty->port) ++ tty->port->itty = NULL; + if (tty->link) + tty->link->port->itty = NULL; +- tty_buffer_cancel_work(tty->port); ++ if (tty->port) ++ tty_buffer_cancel_work(tty->port); + if (tty->link) + tty_buffer_cancel_work(tty->link->port); + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 19cd4a4b19399..e7ef807bcaaaf 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4700,27 +4700,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) + return rc; + } + +-static int con_font_copy(struct vc_data *vc, struct console_font_op *op) +-{ +- int con = op->height; +- int rc; +- +- +- console_lock(); +- if (vc->vc_mode != KD_TEXT) +- rc = -EINVAL; +- else if (!vc->vc_sw->con_font_copy) +- rc = -ENOSYS; +- else if (con < 0 || !vc_cons_allocated(con)) +- rc = -ENOTTY; +- else if (con == vc->vc_num) /* nothing to do */ +- rc = 0; +- else +- rc = vc->vc_sw->con_font_copy(vc, con); +- console_unlock(); +- return rc; +-} +- + int con_font_op(struct vc_data *vc, struct console_font_op *op) + { + switch (op->op) { +@@ -4731,7 +4710,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) + case KD_FONT_OP_SET_DEFAULT: + return con_font_default(vc, op); + case KD_FONT_OP_COPY: +- return con_font_copy(vc, op); ++ /* was buggy and never really used */ ++ return -EINVAL; + } + return -ENOSYS; + } +diff --git a/drivers/usb/cdns3/gadget.h b/drivers/usb/cdns3/gadget.h +index 8212bddf6c8d1..5be0ff2ae079c 100644 +--- a/drivers/usb/cdns3/gadget.h ++++ b/drivers/usb/cdns3/gadget.h +@@ -1067,7 +1067,7 @@ struct cdns3_trb { + #define TRB_TDL_SS_SIZE_GET(p) (((p) & GENMASK(23, 17)) >> 17) + + /* transfer_len bitmasks - bits 31:24 */ +-#define TRB_BURST_LEN(p) (((p) << 24) & GENMASK(31, 24)) ++#define TRB_BURST_LEN(p) ((unsigned int)((p) << 24) & GENMASK(31, 24)) + #define TRB_BURST_LEN_GET(p) (((p) & GENMASK(31, 24)) >> 24) + + /* Data buffer pointer bitmasks*/ +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 10574fa3f9277..a1e3a037a2892 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -378,6 +378,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Kingston DataTraveler 3.0 */ ++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index cc816142eb95e..1f29a6abeb194 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -1058,10 +1058,11 @@ void dwc3_ep0_send_delayed_status(struct dwc3 *dwc) + { + unsigned int direction = !dwc->ep0_expect_in; + ++ dwc->delayed_status = false; ++ + if (dwc->ep0state != EP0_STATUS_PHASE) + return; + +- dwc->delayed_status = false; + __dwc3_ep0_do_control_status(dwc, dwc->eps[direction]); + } + +diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c +index 1de5c9a1d20a1..38f17d66d5bc1 100644 +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g) + + spin_unlock_irqrestore(&mtu->lock, flags); + ++ synchronize_irq(mtu->irq); + return 0; + } + +diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c +index 821970609695b..2e40908963daf 100644 +--- a/drivers/usb/serial/cyberjack.c ++++ b/drivers/usb/serial/cyberjack.c +@@ -357,11 +357,12 @@ static void cyberjack_write_bulk_callback(struct urb *urb) + struct device *dev = &port->dev; + int status = urb->status; + unsigned long flags; ++ bool resubmitted = false; + +- set_bit(0, &port->write_urbs_free); + if (status) { + dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", + __func__, status); ++ set_bit(0, &port->write_urbs_free); + return; + } + +@@ -394,6 +395,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb) + goto exit; + } + ++ resubmitted = true; ++ + dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent); + dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled); + +@@ -410,6 +413,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb) + + exit: + spin_unlock_irqrestore(&priv->lock, flags); ++ if (!resubmitted) ++ set_bit(0, &port->write_urbs_free); + usb_serial_port_softint(port); + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2a3bfd6f867ed..54ca85cc920dc 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -250,6 +250,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 ++#define QUECTEL_PRODUCT_EC200T 0x6026 + + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 +@@ -1117,6 +1118,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, +@@ -1189,6 +1191,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +@@ -1201,6 +1205,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), +@@ -1215,6 +1221,10 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 02411d89cb462..e36fb1a0ecdbd 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -1114,8 +1114,15 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + getmem_done: + remove_conflicting_framebuffers(info->apertures, + KBUILD_MODNAME, false); +- if (!gen2vm) ++ ++ if (gen2vm) { ++ /* framebuffer is reallocated, clear screen_info to avoid misuse from kexec */ ++ screen_info.lfb_size = 0; ++ screen_info.lfb_base = 0; ++ screen_info.orig_video_isVGA = 0; ++ } else { + pci_dev_put(pdev); ++ } + kfree(info->apertures); + + return 0; +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index ea1c28ccb44ff..b948df7a929eb 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -544,7 +544,18 @@ static int resolve_indirect_ref(struct btrfs_fs_info *fs_info, + int level = ref->level; + struct btrfs_key search_key = ref->key_for_search; + +- root = btrfs_get_fs_root(fs_info, ref->root_id, false); ++ /* ++ * If we're search_commit_root we could possibly be holding locks on ++ * other tree nodes. This happens when qgroups does backref walks when ++ * adding new delayed refs. To deal with this we need to look in cache ++ * for the root, and if we don't find it then we need to search the ++ * tree_root's commit root, thus the btrfs_get_fs_root_commit_root usage ++ * here. ++ */ ++ if (path->search_commit_root) ++ root = btrfs_get_fs_root_commit_root(fs_info, path, ref->root_id); ++ else ++ root = btrfs_get_fs_root(fs_info, ref->root_id, false); + if (IS_ERR(root)) { + ret = PTR_ERR(root); + goto out_free; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 7882c07645014..2a0a1c032a72c 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1338,32 +1338,26 @@ int btrfs_add_log_tree(struct btrfs_trans_handle *trans, + return 0; + } + +-struct btrfs_root *btrfs_read_tree_root(struct btrfs_root *tree_root, +- struct btrfs_key *key) ++static struct btrfs_root *read_tree_root_path(struct btrfs_root *tree_root, ++ struct btrfs_path *path, ++ struct btrfs_key *key) + { + struct btrfs_root *root; + struct btrfs_fs_info *fs_info = tree_root->fs_info; +- struct btrfs_path *path; + u64 generation; + int ret; + int level; + +- path = btrfs_alloc_path(); +- if (!path) +- return ERR_PTR(-ENOMEM); +- + root = btrfs_alloc_root(fs_info, key->objectid, GFP_NOFS); +- if (!root) { +- ret = -ENOMEM; +- goto alloc_fail; +- } ++ if (!root) ++ return ERR_PTR(-ENOMEM); + + ret = btrfs_find_root(tree_root, key, path, + &root->root_item, &root->root_key); + if (ret) { + if (ret > 0) + ret = -ENOENT; +- goto find_fail; ++ goto fail; + } + + generation = btrfs_root_generation(&root->root_item); +@@ -1374,21 +1368,31 @@ struct btrfs_root *btrfs_read_tree_root(struct btrfs_root *tree_root, + if (IS_ERR(root->node)) { + ret = PTR_ERR(root->node); + root->node = NULL; +- goto find_fail; ++ goto fail; + } else if (!btrfs_buffer_uptodate(root->node, generation, 0)) { + ret = -EIO; +- goto find_fail; ++ goto fail; + } + root->commit_root = btrfs_root_node(root); +-out: +- btrfs_free_path(path); + return root; +- +-find_fail: ++fail: + btrfs_put_root(root); +-alloc_fail: +- root = ERR_PTR(ret); +- goto out; ++ return ERR_PTR(ret); ++} ++ ++struct btrfs_root *btrfs_read_tree_root(struct btrfs_root *tree_root, ++ struct btrfs_key *key) ++{ ++ struct btrfs_root *root; ++ struct btrfs_path *path; ++ ++ path = btrfs_alloc_path(); ++ if (!path) ++ return ERR_PTR(-ENOMEM); ++ root = read_tree_root_path(tree_root, path, key); ++ btrfs_free_path(path); ++ ++ return root; + } + + /* +@@ -1476,6 +1480,31 @@ static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, + return root; + } + ++static struct btrfs_root *btrfs_get_global_root(struct btrfs_fs_info *fs_info, ++ u64 objectid) ++{ ++ if (objectid == BTRFS_ROOT_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->tree_root); ++ if (objectid == BTRFS_EXTENT_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->extent_root); ++ if (objectid == BTRFS_CHUNK_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->chunk_root); ++ if (objectid == BTRFS_DEV_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->dev_root); ++ if (objectid == BTRFS_CSUM_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->csum_root); ++ if (objectid == BTRFS_QUOTA_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->quota_root) ? ++ fs_info->quota_root : ERR_PTR(-ENOENT); ++ if (objectid == BTRFS_UUID_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->uuid_root) ? ++ fs_info->uuid_root : ERR_PTR(-ENOENT); ++ if (objectid == BTRFS_FREE_SPACE_TREE_OBJECTID) ++ return btrfs_grab_root(fs_info->free_space_root) ? ++ fs_info->free_space_root : ERR_PTR(-ENOENT); ++ return NULL; ++} ++ + int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info, + struct btrfs_root *root) + { +@@ -1573,25 +1602,9 @@ static struct btrfs_root *btrfs_get_root_ref(struct btrfs_fs_info *fs_info, + struct btrfs_key key; + int ret; + +- if (objectid == BTRFS_ROOT_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->tree_root); +- if (objectid == BTRFS_EXTENT_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->extent_root); +- if (objectid == BTRFS_CHUNK_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->chunk_root); +- if (objectid == BTRFS_DEV_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->dev_root); +- if (objectid == BTRFS_CSUM_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->csum_root); +- if (objectid == BTRFS_QUOTA_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->quota_root) ? +- fs_info->quota_root : ERR_PTR(-ENOENT); +- if (objectid == BTRFS_UUID_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->uuid_root) ? +- fs_info->uuid_root : ERR_PTR(-ENOENT); +- if (objectid == BTRFS_FREE_SPACE_TREE_OBJECTID) +- return btrfs_grab_root(fs_info->free_space_root) ? +- fs_info->free_space_root : ERR_PTR(-ENOENT); ++ root = btrfs_get_global_root(fs_info, objectid); ++ if (root) ++ return root; + again: + root = btrfs_lookup_fs_root(fs_info, objectid); + if (root) { +@@ -1676,6 +1689,52 @@ struct btrfs_root *btrfs_get_new_fs_root(struct btrfs_fs_info *fs_info, + return btrfs_get_root_ref(fs_info, objectid, anon_dev, true); + } + ++/* ++ * btrfs_get_fs_root_commit_root - return a root for the given objectid ++ * @fs_info: the fs_info ++ * @objectid: the objectid we need to lookup ++ * ++ * This is exclusively used for backref walking, and exists specifically because ++ * of how qgroups does lookups. Qgroups will do a backref lookup at delayed ref ++ * creation time, which means we may have to read the tree_root in order to look ++ * up a fs root that is not in memory. If the root is not in memory we will ++ * read the tree root commit root and look up the fs root from there. This is a ++ * temporary root, it will not be inserted into the radix tree as it doesn't ++ * have the most uptodate information, it'll simply be discarded once the ++ * backref code is finished using the root. ++ */ ++struct btrfs_root *btrfs_get_fs_root_commit_root(struct btrfs_fs_info *fs_info, ++ struct btrfs_path *path, ++ u64 objectid) ++{ ++ struct btrfs_root *root; ++ struct btrfs_key key; ++ ++ ASSERT(path->search_commit_root && path->skip_locking); ++ ++ /* ++ * This can return -ENOENT if we ask for a root that doesn't exist, but ++ * since this is called via the backref walking code we won't be looking ++ * up a root that doesn't exist, unless there's corruption. So if root ++ * != NULL just return it. ++ */ ++ root = btrfs_get_global_root(fs_info, objectid); ++ if (root) ++ return root; ++ ++ root = btrfs_lookup_fs_root(fs_info, objectid); ++ if (root) ++ return root; ++ ++ key.objectid = objectid; ++ key.type = BTRFS_ROOT_ITEM_KEY; ++ key.offset = (u64)-1; ++ root = read_tree_root_path(fs_info->tree_root, path, &key); ++ btrfs_release_path(path); ++ ++ return root; ++} ++ + /* + * called by the kthread helper functions to finally call the bio end_io + * functions. This is where read checksum verification actually happens +diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h +index 00dc39d47ed34..2e6da9ae8462f 100644 +--- a/fs/btrfs/disk-io.h ++++ b/fs/btrfs/disk-io.h +@@ -69,6 +69,9 @@ struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info, + u64 objectid, bool check_ref); + struct btrfs_root *btrfs_get_new_fs_root(struct btrfs_fs_info *fs_info, + u64 objectid, dev_t anon_dev); ++struct btrfs_root *btrfs_get_fs_root_commit_root(struct btrfs_fs_info *fs_info, ++ struct btrfs_path *path, ++ u64 objectid); + + void btrfs_free_fs_info(struct btrfs_fs_info *fs_info); + int btrfs_cleanup_fs_roots(struct btrfs_fs_info *fs_info); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index c0f350c3a0cf4..db953cb947bc4 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1026,6 +1026,10 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + btrfs_item_key_to_cpu(leaf, &found_key, slot); + + if (found_key.type == BTRFS_ROOT_REF_KEY) { ++ ++ /* Release locks on tree_root before we access quota_root */ ++ btrfs_release_path(path); ++ + ret = add_qgroup_item(trans, quota_root, + found_key.offset); + if (ret) { +@@ -1044,6 +1048,20 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + btrfs_abort_transaction(trans, ret); + goto out_free_path; + } ++ ret = btrfs_search_slot_for_read(tree_root, &found_key, ++ path, 1, 0); ++ if (ret < 0) { ++ btrfs_abort_transaction(trans, ret); ++ goto out_free_path; ++ } ++ if (ret > 0) { ++ /* ++ * Shouldn't happen, but in case it does we ++ * don't need to do the btrfs_next_item, just ++ * continue. ++ */ ++ continue; ++ } + } + ret = btrfs_next_item(tree_root, path); + if (ret < 0) { +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 1192fcd8ee41c..120a4193a75a7 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -1081,7 +1081,8 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, + out_free: + kfree(gl->gl_lksb.sb_lvbptr); + kmem_cache_free(cachep, gl); +- atomic_dec(&sdp->sd_glock_disposal); ++ if (atomic_dec_and_test(&sdp->sd_glock_disposal)) ++ wake_up(&sdp->sd_glock_wait); + + out: + return ret; +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 6774865f5b5b5..077ccb1b3ccc6 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -180,7 +180,8 @@ struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned int type, + error = gfs2_glock_nq_init(io_gl, LM_ST_SHARED, GL_EXACT, &ip->i_iopen_gh); + if (unlikely(error)) + goto fail; +- gfs2_cancel_delete_work(ip->i_iopen_gh.gh_gl); ++ if (blktype != GFS2_BLKST_UNLINKED) ++ gfs2_cancel_delete_work(ip->i_iopen_gh.gh_gl); + glock_set_object(ip->i_iopen_gh.gh_gl, ip); + gfs2_glock_put(io_gl); + io_gl = NULL; +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 64f214a3dc9dd..1033e0e18f24f 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -1140,6 +1140,9 @@ static void io_prep_async_work(struct io_kiocb *req) + + io_req_init_async(req); + ++ if (req->flags & REQ_F_FORCE_ASYNC) ++ req->work.flags |= IO_WQ_WORK_CONCURRENT; ++ + if (req->flags & REQ_F_ISREG) { + if (def->hash_reg_file || (req->ctx->flags & IORING_SETUP_IOPOLL)) + io_wq_hash_work(&req->work, file_inode(req->file)); +@@ -6281,13 +6284,6 @@ fail_req: + if (unlikely(ret)) + goto fail_req; + } +- +- /* +- * Never try inline submit of IOSQE_ASYNC is set, go straight +- * to async execution. +- */ +- io_req_init_async(req); +- req->work.flags |= IO_WQ_WORK_CONCURRENT; + io_queue_async_work(req); + } else { + __io_queue_sqe(req, sqe, cs); +@@ -8180,7 +8176,21 @@ static bool io_timeout_remove_link(struct io_ring_ctx *ctx, + + static bool io_cancel_link_cb(struct io_wq_work *work, void *data) + { +- return io_match_link(container_of(work, struct io_kiocb, work), data); ++ struct io_kiocb *req = container_of(work, struct io_kiocb, work); ++ bool ret; ++ ++ if (req->flags & REQ_F_LINK_TIMEOUT) { ++ unsigned long flags; ++ struct io_ring_ctx *ctx = req->ctx; ++ ++ /* protect against races with linked timeouts */ ++ spin_lock_irqsave(&ctx->completion_lock, flags); ++ ret = io_match_link(req, data); ++ spin_unlock_irqrestore(&ctx->completion_lock, flags); ++ } else { ++ ret = io_match_link(req, data); ++ } ++ return ret; + } + + static void io_attempt_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req) +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 16b799a0522cd..8615504c5a487 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2735,6 +2735,15 @@ static inline vm_fault_t vmf_insert_page(struct vm_area_struct *vma, + return VM_FAULT_NOPAGE; + } + ++#ifndef io_remap_pfn_range ++static inline int io_remap_pfn_range(struct vm_area_struct *vma, ++ unsigned long addr, unsigned long pfn, ++ unsigned long size, pgprot_t prot) ++{ ++ return remap_pfn_range(vma, addr, pfn, size, pgprot_decrypted(prot)); ++} ++#endif ++ + static inline vm_fault_t vmf_error(int err) + { + if (err == -ENOMEM) +diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h +index 90654cb63e9ed..0cb5fe3afd164 100644 +--- a/include/linux/pgtable.h ++++ b/include/linux/pgtable.h +@@ -1399,10 +1399,6 @@ typedef unsigned int pgtbl_mod_mask; + + #endif /* !__ASSEMBLY__ */ + +-#ifndef io_remap_pfn_range +-#define io_remap_pfn_range remap_pfn_range +-#endif +- + #ifndef has_transparent_hugepage + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + #define has_transparent_hugepage() 1 +diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h +index 6245caa18034c..940f136d88524 100644 +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -54,11 +54,10 @@ extern u64 pm_runtime_autosuspend_expiration(struct device *dev); + extern void pm_runtime_update_max_time_suspended(struct device *dev, + s64 delta_ns); + extern void pm_runtime_set_memalloc_noio(struct device *dev, bool enable); +-extern void pm_runtime_clean_up_links(struct device *dev); + extern void pm_runtime_get_suppliers(struct device *dev); + extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); +-extern void pm_runtime_drop_link(struct device *dev); ++extern void pm_runtime_drop_link(struct device_link *link); + + /** + * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter. +@@ -276,11 +275,10 @@ static inline u64 pm_runtime_autosuspend_expiration( + struct device *dev) { return 0; } + static inline void pm_runtime_set_memalloc_noio(struct device *dev, + bool enable){} +-static inline void pm_runtime_clean_up_links(struct device *dev) {} + static inline void pm_runtime_get_suppliers(struct device *dev) {} + static inline void pm_runtime_put_suppliers(struct device *dev) {} + static inline void pm_runtime_new_link(struct device *dev) {} +-static inline void pm_runtime_drop_link(struct device *dev) {} ++static inline void pm_runtime_drop_link(struct device_link *link) {} + + #endif /* !CONFIG_PM */ + +diff --git a/kernel/entry/common.c b/kernel/entry/common.c +index 6fdb6105e6d61..73f4e33cf92e0 100644 +--- a/kernel/entry/common.c ++++ b/kernel/entry/common.c +@@ -338,10 +338,10 @@ noinstr irqentry_state_t irqentry_enter(struct pt_regs *regs) + * already contains a warning when RCU is not watching, so no point + * in having another one here. + */ ++ lockdep_hardirqs_off(CALLER_ADDR0); + instrumentation_begin(); + rcu_irq_enter_check_tick(); +- /* Use the combo lockdep/tracing function */ +- trace_hardirqs_off(); ++ trace_hardirqs_off_finish(); + instrumentation_end(); + + return ret; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 6a1ae6a62d489..98a603098f23e 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -10058,6 +10058,7 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + if (token == IF_SRC_FILE || token == IF_SRC_FILEADDR) { + int fpos = token == IF_SRC_FILE ? 2 : 1; + ++ kfree(filename); + filename = match_strdup(&args[fpos]); + if (!filename) { + ret = -ENOMEM; +@@ -10104,16 +10105,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + */ + ret = -EOPNOTSUPP; + if (!event->ctx->task) +- goto fail_free_name; ++ goto fail; + + /* look up the path and grab its inode */ + ret = kern_path(filename, LOOKUP_FOLLOW, + &filter->path); + if (ret) +- goto fail_free_name; +- +- kfree(filename); +- filename = NULL; ++ goto fail; + + ret = -EINVAL; + if (!filter->path.dentry || +@@ -10133,13 +10131,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + if (state != IF_STATE_ACTION) + goto fail; + ++ kfree(filename); + kfree(orig); + + return 0; + +-fail_free_name: +- kfree(filename); + fail: ++ kfree(filename); + free_filters_list(filters); + kfree(orig); + +diff --git a/kernel/fork.c b/kernel/fork.c +index 8934886d16549..5fe09d4e6d6a0 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2167,14 +2167,9 @@ static __latent_entropy struct task_struct *copy_process( + /* ok, now we should be set up.. */ + p->pid = pid_nr(pid); + if (clone_flags & CLONE_THREAD) { +- p->exit_signal = -1; + p->group_leader = current->group_leader; + p->tgid = current->tgid; + } else { +- if (clone_flags & CLONE_PARENT) +- p->exit_signal = current->group_leader->exit_signal; +- else +- p->exit_signal = args->exit_signal; + p->group_leader = p; + p->tgid = p->pid; + } +@@ -2218,9 +2213,14 @@ static __latent_entropy struct task_struct *copy_process( + if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { + p->real_parent = current->real_parent; + p->parent_exec_id = current->parent_exec_id; ++ if (clone_flags & CLONE_THREAD) ++ p->exit_signal = -1; ++ else ++ p->exit_signal = current->group_leader->exit_signal; + } else { + p->real_parent = current; + p->parent_exec_id = current->self_exec_id; ++ p->exit_signal = args->exit_signal; + } + + klp_copy_process(p); +diff --git a/kernel/futex.c b/kernel/futex.c +index 044c1a4fbece0..6c00c0952313a 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2380,10 +2380,22 @@ retry: + } + + /* +- * Since we just failed the trylock; there must be an owner. ++ * The trylock just failed, so either there is an owner or ++ * there is a higher priority waiter than this one. + */ + newowner = rt_mutex_owner(&pi_state->pi_mutex); +- BUG_ON(!newowner); ++ /* ++ * If the higher priority waiter has not yet taken over the ++ * rtmutex then newowner is NULL. We can't return here with ++ * that state because it's inconsistent vs. the user space ++ * state. So drop the locks and try again. It's a valid ++ * situation and not any different from the other retry ++ * conditions. ++ */ ++ if (unlikely(!newowner)) { ++ err = -EAGAIN; ++ goto handle_err; ++ } + } else { + WARN_ON_ONCE(argowner != current); + if (oldowner == current) { +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 3edaa380dc7b4..85a2c9b320497 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -897,7 +897,8 @@ void kthread_delayed_work_timer_fn(struct timer_list *t) + /* Move the work from worker->delayed_work_list. */ + WARN_ON_ONCE(list_empty(&work->node)); + list_del_init(&work->node); +- kthread_insert_work(worker, work, &worker->work_list); ++ if (!work->canceling) ++ kthread_insert_work(worker, work, &worker->work_list); + + raw_spin_unlock_irqrestore(&worker->lock, flags); + } +diff --git a/kernel/signal.c b/kernel/signal.c +index a38b3edc68511..ef8f2a28d37c5 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -391,16 +391,17 @@ static bool task_participate_group_stop(struct task_struct *task) + + void task_join_group_stop(struct task_struct *task) + { ++ unsigned long mask = current->jobctl & JOBCTL_STOP_SIGMASK; ++ struct signal_struct *sig = current->signal; ++ ++ if (sig->group_stop_count) { ++ sig->group_stop_count++; ++ mask |= JOBCTL_STOP_CONSUME; ++ } else if (!(sig->flags & SIGNAL_STOP_STOPPED)) ++ return; ++ + /* Have the new thread join an on-going signal group stop */ +- unsigned long jobctl = current->jobctl; +- if (jobctl & JOBCTL_STOP_PENDING) { +- struct signal_struct *sig = current->signal; +- unsigned long signr = jobctl & JOBCTL_STOP_SIGMASK; +- unsigned long gstop = JOBCTL_STOP_PENDING | JOBCTL_STOP_CONSUME; +- if (task_set_jobctl_pending(task, signr | gstop)) { +- sig->group_stop_count++; +- } +- } ++ task_set_jobctl_pending(task, mask | JOBCTL_STOP_PENDING); + } + + /* +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 5c6a9c6a058fa..9d69fdf0c5205 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -438,14 +438,16 @@ enum { + }; + /* + * Used for which event context the event is in. +- * NMI = 0 +- * IRQ = 1 +- * SOFTIRQ = 2 +- * NORMAL = 3 ++ * TRANSITION = 0 ++ * NMI = 1 ++ * IRQ = 2 ++ * SOFTIRQ = 3 ++ * NORMAL = 4 + * + * See trace_recursive_lock() comment below for more details. + */ + enum { ++ RB_CTX_TRANSITION, + RB_CTX_NMI, + RB_CTX_IRQ, + RB_CTX_SOFTIRQ, +@@ -3014,10 +3016,10 @@ rb_wakeups(struct trace_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer) + * a bit of overhead in something as critical as function tracing, + * we use a bitmask trick. + * +- * bit 0 = NMI context +- * bit 1 = IRQ context +- * bit 2 = SoftIRQ context +- * bit 3 = normal context. ++ * bit 1 = NMI context ++ * bit 2 = IRQ context ++ * bit 3 = SoftIRQ context ++ * bit 4 = normal context. + * + * This works because this is the order of contexts that can + * preempt other contexts. A SoftIRQ never preempts an IRQ +@@ -3040,6 +3042,30 @@ rb_wakeups(struct trace_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer) + * The least significant bit can be cleared this way, and it + * just so happens that it is the same bit corresponding to + * the current context. ++ * ++ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit ++ * is set when a recursion is detected at the current context, and if ++ * the TRANSITION bit is already set, it will fail the recursion. ++ * This is needed because there's a lag between the changing of ++ * interrupt context and updating the preempt count. In this case, ++ * a false positive will be found. To handle this, one extra recursion ++ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION ++ * bit is already set, then it is considered a recursion and the function ++ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned. ++ * ++ * On the trace_recursive_unlock(), the TRANSITION bit will be the first ++ * to be cleared. Even if it wasn't the context that set it. That is, ++ * if an interrupt comes in while NORMAL bit is set and the ring buffer ++ * is called before preempt_count() is updated, since the check will ++ * be on the NORMAL bit, the TRANSITION bit will then be set. If an ++ * NMI then comes in, it will set the NMI bit, but when the NMI code ++ * does the trace_recursive_unlock() it will clear the TRANSTION bit ++ * and leave the NMI bit set. But this is fine, because the interrupt ++ * code that set the TRANSITION bit will then clear the NMI bit when it ++ * calls trace_recursive_unlock(). If another NMI comes in, it will ++ * set the TRANSITION bit and continue. ++ * ++ * Note: The TRANSITION bit only handles a single transition between context. + */ + + static __always_inline int +@@ -3055,8 +3081,16 @@ trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer) + bit = pc & NMI_MASK ? RB_CTX_NMI : + pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ; + +- if (unlikely(val & (1 << (bit + cpu_buffer->nest)))) +- return 1; ++ if (unlikely(val & (1 << (bit + cpu_buffer->nest)))) { ++ /* ++ * It is possible that this was called by transitioning ++ * between interrupt context, and preempt_count() has not ++ * been updated yet. In this case, use the TRANSITION bit. ++ */ ++ bit = RB_CTX_TRANSITION; ++ if (val & (1 << (bit + cpu_buffer->nest))) ++ return 1; ++ } + + val |= (1 << (bit + cpu_buffer->nest)); + cpu_buffer->current_context = val; +@@ -3071,8 +3105,8 @@ trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer) + cpu_buffer->current_context - (1 << cpu_buffer->nest); + } + +-/* The recursive locking above uses 4 bits */ +-#define NESTED_BITS 4 ++/* The recursive locking above uses 5 bits */ ++#define NESTED_BITS 5 + + /** + * ring_buffer_nest_start - Allow to trace while nested +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index d3e5de717df2f..6e2fb7dc41bf3 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3114,7 +3114,7 @@ static char *get_trace_buf(void) + + /* Interrupts must see nesting incremented before we use the buffer */ + barrier(); +- return &buffer->buffer[buffer->nesting][0]; ++ return &buffer->buffer[buffer->nesting - 1][0]; + } + + static void put_trace_buf(void) +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 610d21355526d..a4dbe3b0b2b13 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -636,6 +636,12 @@ enum { + * function is called to clear it. + */ + TRACE_GRAPH_NOTRACE_BIT, ++ ++ /* ++ * When transitioning between context, the preempt_count() may ++ * not be correct. Allow for a single recursion to cover this case. ++ */ ++ TRACE_TRANSITION_BIT, + }; + + #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0) +@@ -690,14 +696,27 @@ static __always_inline int trace_test_and_set_recursion(int start, int max) + return 0; + + bit = trace_get_context_bit() + start; +- if (unlikely(val & (1 << bit))) +- return -1; ++ if (unlikely(val & (1 << bit))) { ++ /* ++ * It could be that preempt_count has not been updated during ++ * a switch between contexts. Allow for a single recursion. ++ */ ++ bit = TRACE_TRANSITION_BIT; ++ if (trace_recursion_test(bit)) ++ return -1; ++ trace_recursion_set(bit); ++ barrier(); ++ return bit + 1; ++ } ++ ++ /* Normal check passed, clear the transition to allow it again */ ++ trace_recursion_clear(TRACE_TRANSITION_BIT); + + val |= 1 << bit; + current->trace_recursion = val; + barrier(); + +- return bit; ++ return bit + 1; + } + + static __always_inline void trace_clear_recursion(int bit) +@@ -707,6 +726,7 @@ static __always_inline void trace_clear_recursion(int bit) + if (!bit) + return; + ++ bit--; + bit = 1 << bit; + val &= ~bit; + +diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c +index b5e3496cf8033..4738ad48a6674 100644 +--- a/kernel/trace/trace_selftest.c ++++ b/kernel/trace/trace_selftest.c +@@ -492,8 +492,13 @@ trace_selftest_function_recursion(void) + unregister_ftrace_function(&test_rec_probe); + + ret = -1; +- if (trace_selftest_recursion_cnt != 1) { +- pr_cont("*callback not called once (%d)* ", ++ /* ++ * Recursion allows for transitions between context, ++ * and may call the callback twice. ++ */ ++ if (trace_selftest_recursion_cnt != 1 && ++ trace_selftest_recursion_cnt != 2) { ++ pr_cont("*callback not called once (or twice) (%d)* ", + trace_selftest_recursion_cnt); + goto out; + } +diff --git a/lib/crc32test.c b/lib/crc32test.c +index 97d6a57cefcc5..61ddce2cff777 100644 +--- a/lib/crc32test.c ++++ b/lib/crc32test.c +@@ -683,7 +683,6 @@ static int __init crc32c_test(void) + + /* reduce OS noise */ + local_irq_save(flags); +- local_irq_disable(); + + nsec = ktime_get_ns(); + for (i = 0; i < 100; i++) { +@@ -694,7 +693,6 @@ static int __init crc32c_test(void) + nsec = ktime_get_ns() - nsec; + + local_irq_restore(flags); +- local_irq_enable(); + + pr_info("crc32c: CRC_LE_BITS = %d\n", CRC_LE_BITS); + +@@ -768,7 +766,6 @@ static int __init crc32_test(void) + + /* reduce OS noise */ + local_irq_save(flags); +- local_irq_disable(); + + nsec = ktime_get_ns(); + for (i = 0; i < 100; i++) { +@@ -783,7 +780,6 @@ static int __init crc32_test(void) + nsec = ktime_get_ns() - nsec; + + local_irq_restore(flags); +- local_irq_enable(); + + pr_info("crc32: CRC_LE_BITS = %d, CRC_BE BITS = %d\n", + CRC_LE_BITS, CRC_BE_BITS); +diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c +index 0e2deac97da0d..e02f9df24d1ee 100644 +--- a/lib/fonts/font_10x18.c ++++ b/lib/fonts/font_10x18.c +@@ -8,7 +8,7 @@ + + #define FONTDATAMAX 9216 + +-static struct font_data fontdata_10x18 = { ++static const struct font_data fontdata_10x18 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, 0x00, /* 0000000000 */ +diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c +index 87da8acd07db0..6e3c4b7691c85 100644 +--- a/lib/fonts/font_6x10.c ++++ b/lib/fonts/font_6x10.c +@@ -3,7 +3,7 @@ + + #define FONTDATAMAX 2560 + +-static struct font_data fontdata_6x10 = { ++static const struct font_data fontdata_6x10 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ +diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c +index 5e975dfa10a53..2d22a24e816f0 100644 +--- a/lib/fonts/font_6x11.c ++++ b/lib/fonts/font_6x11.c +@@ -9,7 +9,7 @@ + + #define FONTDATAMAX (11*256) + +-static struct font_data fontdata_6x11 = { ++static const struct font_data fontdata_6x11 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ +diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c +index 86d298f385058..9cc7ae2e03f7d 100644 +--- a/lib/fonts/font_7x14.c ++++ b/lib/fonts/font_7x14.c +@@ -8,7 +8,7 @@ + + #define FONTDATAMAX 3584 + +-static struct font_data fontdata_7x14 = { ++static const struct font_data fontdata_7x14 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 0000000 */ +diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c +index 37cedd36ca5ef..bab25dc59e8dd 100644 +--- a/lib/fonts/font_8x16.c ++++ b/lib/fonts/font_8x16.c +@@ -10,7 +10,7 @@ + + #define FONTDATAMAX 4096 + +-static struct font_data fontdata_8x16 = { ++static const struct font_data fontdata_8x16 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ +diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c +index 8ab695538395d..109d0572368f4 100644 +--- a/lib/fonts/font_8x8.c ++++ b/lib/fonts/font_8x8.c +@@ -9,7 +9,7 @@ + + #define FONTDATAMAX 2048 + +-static struct font_data fontdata_8x8 = { ++static const struct font_data fontdata_8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ +diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c +index 069b3e80c4344..fb395f0d40317 100644 +--- a/lib/fonts/font_acorn_8x8.c ++++ b/lib/fonts/font_acorn_8x8.c +@@ -5,7 +5,7 @@ + + #define FONTDATAMAX 2048 + +-static struct font_data acorndata_8x8 = { ++static const struct font_data acorndata_8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ + /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ +diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c +index 1449876c6a270..592774a90917b 100644 +--- a/lib/fonts/font_mini_4x6.c ++++ b/lib/fonts/font_mini_4x6.c +@@ -43,7 +43,7 @@ __END__; + + #define FONTDATAMAX 1536 + +-static struct font_data fontdata_mini_4x6 = { ++static const struct font_data fontdata_mini_4x6 = { + { 0, 0, FONTDATAMAX, 0 }, { + /*{*/ + /* Char 0: ' ' */ +diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c +index 32d65551e7ed2..a6f95ebce9507 100644 +--- a/lib/fonts/font_pearl_8x8.c ++++ b/lib/fonts/font_pearl_8x8.c +@@ -14,7 +14,7 @@ + + #define FONTDATAMAX 2048 + +-static struct font_data fontdata_pearl8x8 = { ++static const struct font_data fontdata_pearl8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ +diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c +index 641a6b4dca424..a5b65bd496045 100644 +--- a/lib/fonts/font_sun12x22.c ++++ b/lib/fonts/font_sun12x22.c +@@ -3,7 +3,7 @@ + + #define FONTDATAMAX 11264 + +-static struct font_data fontdata_sun12x22 = { ++static const struct font_data fontdata_sun12x22 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, 0x00, /* 000000000000 */ +diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c +index 193fe6d988e08..e577e76a6a7c0 100644 +--- a/lib/fonts/font_sun8x16.c ++++ b/lib/fonts/font_sun8x16.c +@@ -3,7 +3,7 @@ + + #define FONTDATAMAX 4096 + +-static struct font_data fontdata_sun8x16 = { ++static const struct font_data fontdata_sun8x16 = { + { 0, 0, FONTDATAMAX, 0 }, { + /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, +diff --git a/lib/fonts/font_ter16x32.c b/lib/fonts/font_ter16x32.c +index 91b9c283bd9cc..f7c3abb6b99e2 100644 +--- a/lib/fonts/font_ter16x32.c ++++ b/lib/fonts/font_ter16x32.c +@@ -4,7 +4,7 @@ + + #define FONTDATAMAX 16384 + +-static struct font_data fontdata_ter16x32 = { ++static const struct font_data fontdata_ter16x32 = { + { 0, 0, FONTDATAMAX, 0 }, { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x7f, 0xfc, 0x7f, 0xfc, +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 67fc6383995b4..b853a11de14f2 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -655,6 +655,8 @@ retry: + } + + del += t - f; ++ hugetlb_cgroup_uncharge_file_region( ++ resv, rg, t - f); + + /* New entry for end of split region */ + nrg->from = t; +@@ -667,9 +669,6 @@ retry: + /* Original entry is trimmed */ + rg->to = f; + +- hugetlb_cgroup_uncharge_file_region( +- resv, rg, nrg->to - nrg->from); +- + list_add(&nrg->link, &rg->link); + nrg = NULL; + break; +@@ -685,17 +684,17 @@ retry: + } + + if (f <= rg->from) { /* Trim beginning of region */ +- del += t - rg->from; +- rg->from = t; +- + hugetlb_cgroup_uncharge_file_region(resv, rg, + t - rg->from); +- } else { /* Trim end of region */ +- del += rg->to - f; +- rg->to = f; + ++ del += t - rg->from; ++ rg->from = t; ++ } else { /* Trim end of region */ + hugetlb_cgroup_uncharge_file_region(resv, rg, + rg->to - f); ++ ++ del += rg->to - f; ++ rg->to = f; + } + } + +@@ -2454,6 +2453,9 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, + + rsv_adjust = hugepage_subpool_put_pages(spool, 1); + hugetlb_acct_memory(h, -rsv_adjust); ++ if (deferred_reserve) ++ hugetlb_cgroup_uncharge_page_rsvd(hstate_index(h), ++ pages_per_huge_page(h), page); + } + return page; + +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index eddbe4e56c739..8cc1fc9c4d13b 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -525,7 +525,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, + unsigned long flags = qp->flags; + int ret; + bool has_unmovable = false; +- pte_t *pte; ++ pte_t *pte, *mapped_pte; + spinlock_t *ptl; + + ptl = pmd_trans_huge_lock(pmd, vma); +@@ -539,7 +539,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, + if (pmd_trans_unstable(pmd)) + return 0; + +- pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); ++ mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); + for (; addr != end; pte++, addr += PAGE_SIZE) { + if (!pte_present(*pte)) + continue; +@@ -571,7 +571,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, + } else + break; + } +- pte_unmap_unlock(pte - 1, ptl); ++ pte_unmap_unlock(mapped_pte, ptl); + cond_resched(); + + if (has_unmovable) +diff --git a/net/core/dev.c b/net/core/dev.c +index 4906b44af8506..010de57488ce7 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -10134,7 +10134,7 @@ void netdev_run_todo(void) + struct net_device *dev = list_first_entry(&unlink_list, + struct net_device, + unlink_list); +- list_del(&dev->unlink_list); ++ list_del_init(&dev->unlink_list); + dev->nested_level = dev->lower_level - 1; + } + #endif +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 0c1f364044715..457d780ff5331 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -614,9 +614,6 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + ttl = ip4_dst_hoplimit(&rt->dst); + } + +- if (!df && skb->protocol == htons(ETH_P_IP)) +- df = inner_iph->frag_off & htons(IP_DF); +- + headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; + if (headroom > dev->needed_headroom) + dev->needed_headroom = headroom; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index a0217e5bf3bc1..648db3fe508f0 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1271,6 +1271,8 @@ route_lookup: + if (max_headroom > dev->needed_headroom) + dev->needed_headroom = max_headroom; + ++ skb_set_inner_ipproto(skb, proto); ++ + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) + return err; +@@ -1280,8 +1282,6 @@ route_lookup: + ipv6_push_frag_opts(skb, &opt.ops, &proto); + } + +- skb_set_inner_ipproto(skb, proto); +- + skb_push(skb, sizeof(struct ipv6hdr)); + skb_reset_network_header(skb); + ipv6h = ipv6_hdr(skb); +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 282b0bc201eeb..aa486e202a57c 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3613,13 +3613,14 @@ begin: + tx.skb = skb; + tx.sdata = vif_to_sdata(info->control.vif); + +- if (txq->sta && !(info->flags & IEEE80211_TX_CTL_INJECTED)) { ++ if (txq->sta) { + tx.sta = container_of(txq->sta, struct sta_info, sta); + /* + * Drop unicast frames to unauthorised stations unless they are +- * EAPOL frames from the local station. ++ * injected frames or EAPOL frames from the local station. + */ +- if (unlikely(ieee80211_is_data(hdr->frame_control) && ++ if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) && ++ ieee80211_is_data(hdr->frame_control) && + !ieee80211_vif_is_mesh(&tx.sdata->vif) && + tx.sdata->vif.type != NL80211_IFTYPE_OCB && + !is_multicast_ether_addr(hdr->addr1) && +diff --git a/net/mptcp/token.c b/net/mptcp/token.c +index 8b47c4bb1c6be..feb4b9ffd4625 100644 +--- a/net/mptcp/token.c ++++ b/net/mptcp/token.c +@@ -291,7 +291,7 @@ struct mptcp_sock *mptcp_token_iter_next(const struct net *net, long *s_slot, + { + struct mptcp_sock *ret = NULL; + struct hlist_nulls_node *pos; +- int slot, num; ++ int slot, num = 0; + + for (slot = *s_slot; slot <= token_mask; *s_num = 0, slot++) { + struct token_bucket *bucket = &token_hash[slot]; +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 6e47ef7ef0363..464a996a3a039 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -1699,13 +1699,13 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) + parms.port_no = OVSP_LOCAL; + parms.upcall_portids = a[OVS_DP_ATTR_UPCALL_PID]; + +- err = ovs_dp_change(dp, a); +- if (err) +- goto err_destroy_meters; +- + /* So far only local changes have been made, now need the lock. */ + ovs_lock(); + ++ err = ovs_dp_change(dp, a); ++ if (err) ++ goto err_unlock_and_destroy_meters; ++ + vport = new_vport(&parms); + if (IS_ERR(vport)) { + err = PTR_ERR(vport); +@@ -1721,8 +1721,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) + ovs_dp_reset_user_features(skb, info); + } + +- ovs_unlock(); +- goto err_destroy_meters; ++ goto err_unlock_and_destroy_meters; + } + + err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid, +@@ -1737,7 +1736,8 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) + ovs_notify(&dp_datapath_genl_family, reply, info); + return 0; + +-err_destroy_meters: ++err_unlock_and_destroy_meters: ++ ovs_unlock(); + ovs_meters_exit(dp); + err_destroy_ports: + kfree(dp->ports); +diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c +index 7d50c45fea376..5e4a8b99fc0ce 100644 +--- a/net/openvswitch/flow_table.c ++++ b/net/openvswitch/flow_table.c +@@ -387,7 +387,7 @@ static struct mask_cache *tbl_mask_cache_alloc(u32 size) + } + int ovs_flow_tbl_masks_cache_resize(struct flow_table *table, u32 size) + { +- struct mask_cache *mc = rcu_dereference(table->mask_cache); ++ struct mask_cache *mc = rcu_dereference_ovsl(table->mask_cache); + struct mask_cache *new; + + if (size == mc->cache_size) +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index aa821e71f05e7..813d307672041 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1601,12 +1601,12 @@ static int sctp_cmd_interpreter(enum sctp_event_type event_type, + break; + + case SCTP_CMD_INIT_FAILED: +- sctp_cmd_init_failed(commands, asoc, cmd->obj.u32); ++ sctp_cmd_init_failed(commands, asoc, cmd->obj.u16); + break; + + case SCTP_CMD_ASSOC_FAILED: + sctp_cmd_assoc_failed(commands, asoc, event_type, +- subtype, chunk, cmd->obj.u32); ++ subtype, chunk, cmd->obj.u16); + break; + + case SCTP_CMD_INIT_COUNTER_INC: +diff --git a/net/tipc/core.c b/net/tipc/core.c +index 4f6dc74adf455..37d8695548cf6 100644 +--- a/net/tipc/core.c ++++ b/net/tipc/core.c +@@ -109,6 +109,11 @@ static void __net_exit tipc_exit_net(struct net *net) + { + tipc_detach_loopback(net); + tipc_net_stop(net); ++ ++ /* Make sure the tipc_net_finalize_work stopped ++ * before releasing the resources. ++ */ ++ flush_scheduled_work(); + tipc_bcast_stop(net); + tipc_nametbl_stop(net); + tipc_sk_rht_destroy(net); +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 9e93bc201cc07..b4d7b8aba0037 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -739,7 +739,7 @@ static struct sock *__vsock_create(struct net *net, + vsk->buffer_min_size = psk->buffer_min_size; + vsk->buffer_max_size = psk->buffer_max_size; + } else { +- vsk->trusted = capable(CAP_NET_ADMIN); ++ vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); + vsk->owner = get_current_cred(); + vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT; + vsk->buffer_size = VSOCK_DEFAULT_BUFFER_SIZE; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f2398721ac1ef..6899089d132e7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6008,6 +6008,27 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec, + snd_hda_override_wcaps(codec, 0x03, 0); + } + ++static void alc_combo_jack_hp_jd_restart(struct hda_codec *codec) ++{ ++ switch (codec->core.vendor_id) { ++ case 0x10ec0274: ++ case 0x10ec0294: ++ case 0x10ec0225: ++ case 0x10ec0295: ++ case 0x10ec0299: ++ alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */ ++ alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15); ++ break; ++ case 0x10ec0235: ++ case 0x10ec0236: ++ case 0x10ec0255: ++ case 0x10ec0256: ++ alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ ++ alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); ++ break; ++ } ++} ++ + static void alc295_fixup_chromebook(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6018,16 +6039,7 @@ static void alc295_fixup_chromebook(struct hda_codec *codec, + spec->ultra_low_power = true; + break; + case HDA_FIXUP_ACT_INIT: +- switch (codec->core.vendor_id) { +- case 0x10ec0295: +- alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */ +- alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15); +- break; +- case 0x10ec0236: +- alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ +- alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); +- break; +- } ++ alc_combo_jack_hp_jd_restart(codec); + break; + } + } +@@ -6083,6 +6095,16 @@ static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, + alc_write_coef_idx(codec, 0x65, 0x0); + } + ++static void alc274_fixup_hp_headset_mic(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ switch (action) { ++ case HDA_FIXUP_ACT_INIT: ++ alc_combo_jack_hp_jd_restart(codec); ++ break; ++ } ++} ++ + /* for hda_fixup_thinkpad_acpi() */ + #include "thinkpad_helper.c" + +@@ -6277,6 +6299,8 @@ enum { + ALC256_FIXUP_INTEL_NUC8_RUGGED, + ALC255_FIXUP_XIAOMI_HEADSET_MIC, + ALC274_FIXUP_HP_MIC, ++ ALC274_FIXUP_HP_HEADSET_MIC, ++ ALC256_FIXUP_ASUS_HPE, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7664,6 +7688,23 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + }, ++ [ALC274_FIXUP_HP_HEADSET_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc274_fixup_hp_headset_mic, ++ .chained = true, ++ .chain_id = ALC274_FIXUP_HP_MIC ++ }, ++ [ALC256_FIXUP_ASUS_HPE] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* Set EAPD high */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x0f }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x7778 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7815,7 +7856,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), +- SND_PCI_QUIRK(0x103c, 0x874e, "HP", ALC274_FIXUP_HP_MIC), + SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED), +@@ -7848,6 +7888,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), +@@ -8339,6 +8380,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x1a, 0x90a70130}, + {0x1b, 0x90170110}, + {0x21, 0x03211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x103c, "HP", ALC274_FIXUP_HP_HEADSET_MIC, ++ {0x17, 0x90170110}, ++ {0x19, 0x03a11030}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, + {0x12, 0x90a60130}, + {0x14, 0x90170110}, +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index b401ee894e1bb..a860303cc5222 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -336,6 +336,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, + switch (subs->stream->chip->usb_id) { + case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */ + case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */ ++ case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */ + ep = 0x81; + ifnum = 3; + goto add_sync_ep_from_ifnum; +@@ -345,6 +346,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, + ifnum = 2; + goto add_sync_ep_from_ifnum; + case USB_ID(0x2466, 0x8003): /* Fractal Audio Axe-Fx II */ ++ case USB_ID(0x0499, 0x172a): /* Yamaha MODX */ + ep = 0x86; + ifnum = 2; + goto add_sync_ep_from_ifnum; +@@ -352,6 +354,10 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, + ep = 0x81; + ifnum = 2; + goto add_sync_ep_from_ifnum; ++ case USB_ID(0x1686, 0xf029): /* Zoom UAC-2 */ ++ ep = 0x82; ++ ifnum = 2; ++ goto add_sync_ep_from_ifnum; + case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */ + case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */ + ep = 0x81; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 892296df131d3..fd1dbe9acd74f 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1806,6 +1806,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case 0x278b: /* Rotel? */ + case 0x292b: /* Gustard/Ess based devices */ + case 0x2ab6: /* T+A devices */ ++ case 0x3353: /* Khadas devices */ + case 0x3842: /* EVGA */ + case 0xc502: /* HiBy devices */ + if (fp->dsd_raw) +diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c +index a07626f072087..b0e1880cf992b 100644 +--- a/tools/perf/ui/browsers/hists.c ++++ b/tools/perf/ui/browsers/hists.c +@@ -2963,7 +2963,7 @@ static int perf_evsel__hists_browse(struct evsel *evsel, int nr_events, + struct popup_action actions[MAX_OPTIONS]; + int nr_options = 0; + int key = -1; +- char buf[64]; ++ char buf[128]; + int delay_secs = hbt ? hbt->refresh : 0; + + #define HIST_BROWSER_HELP_COMMON \ |