lael-labs/linux

Documentation/admin-guide/kernel-parameters.rst+1−0

@@ -109,6 +109,7 @@ parameter is applicable:: · 108 unmodified lines
109	IPV6 IPv6 support is enabled.	109	IPV6 IPv6 support is enabled.
110	ISAPNP ISA PnP code is enabled.	110	ISAPNP ISA PnP code is enabled.
111	ISDN Appropriate ISDN support is enabled.	111	ISDN Appropriate ISDN support is enabled.
		112	ISOL CPU Isolation is enabled.
112	JOY Appropriate joystick support is enabled.	113	JOY Appropriate joystick support is enabled.
113	KGDB Kernel debugger support is enabled.	114	KGDB Kernel debugger support is enabled.
114	KVM Kernel Virtual Machine support is enabled.	115	KVM Kernel Virtual Machine support is enabled.

Documentation/admin-guide/kernel-parameters.txt+15−3

 			not play well with APC CPU idle - disable it if you have
 			APC and your system crashes randomly.
-	apic=		[APIC,X86-32] Advanced Programmable Interrupt Controller
+	apic=		[APIC,X86] Advanced Programmable Interrupt Controller
 			Change the output verbosity whilst booting
 			Format: { quiet (default) | verbose | debug }
 			Change the amount of debugging information output
 			when initialising the APIC and IO-APIC components.
+			For X86-32, this can also be used to specify an APIC
+			driver name.
+			Format: apic=driver_name
+			Examples: apic=bigsmp
 	apic_extnmi=	[APIC,X86] External NMI delivery setting
 			Format: { bsp (default) | all | none }
 	isapnp=		[ISAPNP]
 			Format: <RDP>,<reset>,<pci_scan>,<verbosity>
-	isolcpus=	[KNL,SMP] Isolate a given set of CPUs from disturbance.
+	isolcpus=	[KNL,SMP,ISOL] Isolate a given set of CPUs from disturbance.
 			[Deprecated - use cpusets instead]
 			Format: [flag-list,]<cpu-list>
 			Valid arguments: on, off
 			Default: on
-	nohz_full=	[KNL,BOOT]
+	nohz_full=	[KNL,BOOT,SMP,ISOL]
 			The argument is a cpu list, as described above.
 			In kernels built with CONFIG_NO_HZ_FULL=y, set
 			the specified list of CPUs whose tick will be stopped
 			steal time is computed, but won't influence scheduler
 			behaviour
+	nopti		[X86-64] Disable kernel page table isolation
 	nolapic		[X86-32,APIC] Do not enable or use the local APIC.
 	nolapic_timer	[X86-32,APIC] Do not use the local APIC timer.
 	pt.		[PARIDE]
 			See Documentation/blockdev/paride.txt.
+	pti=		[X86_64]
+			Control user/kernel address space isolation:
+			on - enable
+			off - disable
+			auto - default setting
 	pty.legacy_count=
 			[KNL] Number of legacy pty's. Overwrites compiled-in
 			default number.

Documentation/admin-guide/thunderbolt.rst+1−1

@@ -230,7 +230,7 @@ If supported by your machine this will be exposed by the WMI bus with · 229 unmodified lines
230	a sysfs attribute called "force_power".	230	a sysfs attribute called "force_power".
231		231
232	For example the intel-wmi-thunderbolt driver exposes this attribute in:	232	For example the intel-wmi-thunderbolt driver exposes this attribute in:
233	/sys/devices/platform/PNP0C14:00/wmi_bus/wmi_bus-PNP0C14:00/86CCFD48-205E-4A77-9C48-2021CBEDE341/force_power	233	/sys/bus/wmi/devices/86CCFD48-205E-4A77-9C48-2021CBEDE341/force_power
234		234
235	To force the power to on, write 1 to this attribute file.	235	To force the power to on, write 1 to this attribute file.
236	To disable force power, write 0 to this attribute file.	236	To disable force power, write 0 to this attribute file.

Documentation/arm64/silicon-errata.txt+1−0

@@ -75,3 +75,4 @@ stable kernels. · 74 unmodified lines
75	\| Qualcomm Tech. \| Falkor v1 \| E1003 \| QCOM_FALKOR_ERRATUM_1003 \|	75	\| Qualcomm Tech. \| Falkor v1 \| E1003 \| QCOM_FALKOR_ERRATUM_1003 \|
76	\| Qualcomm Tech. \| Falkor v1 \| E1009 \| QCOM_FALKOR_ERRATUM_1009 \|	76	\| Qualcomm Tech. \| Falkor v1 \| E1009 \| QCOM_FALKOR_ERRATUM_1009 \|
77	\| Qualcomm Tech. \| QDF2400 ITS \| E0065 \| QCOM_QDF2400_ERRATUM_0065 \|	77	\| Qualcomm Tech. \| QDF2400 ITS \| E0065 \| QCOM_QDF2400_ERRATUM_0065 \|
		78	\| Qualcomm Tech. \| Falkor v{1,2} \| E1041 \| QCOM_FALKOR_ERRATUM_1041 \|

Documentation/cgroup-v2.txt+7−0

@@ -898,6 +898,13 @@ controller implements weight and absolute bandwidth limit models for · 897 unmodified lines
898	normal scheduling policy and absolute bandwidth allocation model for	898	normal scheduling policy and absolute bandwidth allocation model for
899	realtime scheduling policy.	899	realtime scheduling policy.
900		900
		901	WARNING: cgroup2 doesn't yet support control of realtime processes and
		902	the cpu controller can only be enabled when all RT processes are in
		903	the root cgroup. Be aware that system management software may already
		904	have placed RT processes into nonroot cgroups during the system boot
		905	process, and these processes may need to be moved to the root cgroup
		906	before the cpu controller can be enabled.
		907
901		908
902	CPU Interface Files	909	CPU Interface Files
903	~~~~~~~~~~~~~~~~~~~	910	~~~~~~~~~~~~~~~~~~~

Documentation/devicetree/bindings/mtd/jedec,spi-nor.txt+0−2

                  at25df321a
                  at25df641
                  at26df081a
-                 en25s64
                  mr25h128
                  mr25h256
                  mr25h10
                  s25fl008k
                  s25fl064k
                  sst25vf040b
-                 sst25wf040b
                  m25p40
                  m25p80
                  m25p16

Documentation/devicetree/bindings/sound/da7218.txt+1−1

@@ -73,7 +73,7 @@ Example: · 72 unmodified lines
73	compatible = "dlg,da7218";	73	compatible = "dlg,da7218";
74	reg = <0x1a>;	74	reg = <0x1a>;
75	interrupt-parent = <&gpio6>;	75	interrupt-parent = <&gpio6>;
76	interrupts = <11 IRQ_TYPE_LEVEL_HIGH>;	76	interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
77	wakeup-source;	77	wakeup-source;
78		78
79	VDD-supply = <&reg_audio>;	79	VDD-supply = <&reg_audio>;

Documentation/devicetree/bindings/sound/da7219.txt+1−1

@@ -77,7 +77,7 @@ Example: · 76 unmodified lines
77	reg = <0x1a>;	77	reg = <0x1a>;
78		78
79	interrupt-parent = <&gpio6>;	79	interrupt-parent = <&gpio6>;
80	interrupts = <11 IRQ_TYPE_LEVEL_HIGH>;	80	interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
81		81
82	VDD-supply = <&reg_audio>;	82	VDD-supply = <&reg_audio>;
83	VDDMIC-supply = <&reg_audio>;	83	VDDMIC-supply = <&reg_audio>;

Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt+12−6

@@ -12,24 +12,30 @@ Required properties: · 11 unmodified lines
12	- "fsl,imx53-ecspi" for SPI compatible with the one integrated on i.MX53 and later Soc	12	- "fsl,imx53-ecspi" for SPI compatible with the one integrated on i.MX53 and later Soc
13	- reg : Offset and length of the register set for the device	13	- reg : Offset and length of the register set for the device
14	- interrupts : Should contain CSPI/eCSPI interrupt	14	- interrupts : Should contain CSPI/eCSPI interrupt
15	- cs-gpios : Specifies the gpio pins to be used for chipselects.
16	- clocks : Clock specifiers for both ipg and per clocks.	15	- clocks : Clock specifiers for both ipg and per clocks.
17	- clock-names : Clock names should include both "ipg" and "per"	16	- clock-names : Clock names should include both "ipg" and "per"
18	See the clock consumer binding,	17	See the clock consumer binding,
19	Documentation/devicetree/bindings/clock/clock-bindings.txt	18	Documentation/devicetree/bindings/clock/clock-bindings.txt
20	- dmas: DMA specifiers for tx and rx dma. See the DMA client binding,
21	Documentation/devicetree/bindings/dma/dma.txt
22	- dma-names: DMA request names should include "tx" and "rx" if present.
23		19
24	Obsolete properties:	20	Recommended properties:
25	- fsl,spi-num-chipselects : Contains the number of the chipselect	21	- cs-gpios : GPIOs to use as chip selects, see spi-bus.txt. While the native chip
		22	select lines can be used, they appear to always generate a pulse between each
		23	word of a transfer. Most use cases will require GPIO based chip selects to
		24	generate a valid transaction.
26		25
27	Optional properties:	26	Optional properties:
		27	- num-cs : Number of total chip selects, see spi-bus.txt.
		28	- dmas: DMA specifiers for tx and rx dma. See the DMA client binding,
		29	Documentation/devicetree/bindings/dma/dma.txt.
		30	- dma-names: DMA request names, if present, should include "tx" and "rx".
28	- fsl,spi-rdy-drctl: Integer, representing the value of DRCTL, the register	31	- fsl,spi-rdy-drctl: Integer, representing the value of DRCTL, the register
29	controlling the SPI_READY handling. Note that to enable the DRCTL consideration,	32	controlling the SPI_READY handling. Note that to enable the DRCTL consideration,
30	the SPI_READY mode-flag needs to be set too.	33	the SPI_READY mode-flag needs to be set too.
31	Valid values are: 0 (disabled), 1 (edge-triggered burst) and 2 (level-triggered burst).	34	Valid values are: 0 (disabled), 1 (edge-triggered burst) and 2 (level-triggered burst).
32		35
		36	Obsolete properties:
		37	- fsl,spi-num-chipselects : Contains the number of the chipselect
		38
33	Example:	39	Example:
34		40
35	ecspi@70010000 {	41	ecspi@70010000 {

Documentation/filesystems/overlayfs.txt+34−0

@@ -156,6 +156,40 @@ handle it in two different ways: · 155 unmodified lines
156	root of the overlay. Finally the directory is moved to the new	156	root of the overlay. Finally the directory is moved to the new
157	location.	157	location.
158		158
		159	There are several ways to tune the "redirect_dir" feature.
		160
		161	Kernel config options:
		162
		163	- OVERLAY_FS_REDIRECT_DIR:
		164	If this is enabled, then redirect_dir is turned on by default.
		165	- OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:
		166	If this is enabled, then redirects are always followed by default. Enabling
		167	this results in a less secure configuration. Enable this option only when
		168	worried about backward compatibility with kernels that have the redirect_dir
		169	feature and follow redirects even if turned off.
		170
		171	Module options (can also be changed through /sys/module/overlay/parameters/*):
		172
		173	- "redirect_dir=BOOL":
		174	See OVERLAY_FS_REDIRECT_DIR kernel config option above.
		175	- "redirect_always_follow=BOOL":
		176	See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.
		177	- "redirect_max=NUM":
		178	The maximum number of bytes in an absolute redirect (default is 256).
		179
		180	Mount options:
		181
		182	- "redirect_dir=on":
		183	Redirects are enabled.
		184	- "redirect_dir=follow":
		185	Redirects are not created, but followed.
		186	- "redirect_dir=off":
		187	Redirects are not created and only followed if "redirect_always_follow"
		188	feature is enabled in the kernel/module config.
		189	- "redirect_dir=nofollow":
		190	Redirects are not created and not followed (equivalent to "redirect_dir=off"
		191	if "redirect_always_follow" feature is not enabled).
		192
159	Non-directories	193	Non-directories
160	---------------	194	---------------
161		195

Documentation/locking/crossrelease.txt+0−874

@@ -1,874 +0,0 @@
1	Crossrelease
2	============
3
4	Started by Byungchul Park <byungchul.park@lge.com>
5
6	Contents:
7
8	(*) Background
9
10	- What causes deadlock
11	- How lockdep works
12
13	(*) Limitation
14
15	- Limit lockdep
16	- Pros from the limitation
17	- Cons from the limitation
18	- Relax the limitation
19
20	(*) Crossrelease
21
22	- Introduce crossrelease
23	- Introduce commit
24
25	(*) Implementation
26
27	- Data structures
28	- How crossrelease works
29
30	(*) Optimizations
31
32	- Avoid duplication
33	- Lockless for hot paths
34
35	(*) APPENDIX A: What lockdep does to work aggresively
36
37	(*) APPENDIX B: How to avoid adding false dependencies
38
39
40	==========
41	Background
42	==========
43
44	What causes deadlock
45	--------------------
46
47	A deadlock occurs when a context is waiting for an event to happen,
48	which is impossible because another (or the) context who can trigger the
49	event is also waiting for another (or the) event to happen, which is
50	also impossible due to the same reason.
51
52	For example:
53
54	A context going to trigger event C is waiting for event A to happen.
55	A context going to trigger event A is waiting for event B to happen.
56	A context going to trigger event B is waiting for event C to happen.
57
58	A deadlock occurs when these three wait operations run at the same time,
59	because event C cannot be triggered if event A does not happen, which in
60	turn cannot be triggered if event B does not happen, which in turn
61	cannot be triggered if event C does not happen. After all, no event can
62	be triggered since any of them never meets its condition to wake up.
63
64	A dependency might exist between two waiters and a deadlock might happen
65	due to an incorrect releationship between dependencies. Thus, we must
66	define what a dependency is first. A dependency exists between them if:
67
68	1. There are two waiters waiting for each event at a given time.
69	2. The only way to wake up each waiter is to trigger its event.
70	3. Whether one can be woken up depends on whether the other can.
71
72	Each wait in the example creates its dependency like:
73
74	Event C depends on event A.
75	Event A depends on event B.
76	Event B depends on event C.
77
78	NOTE: Precisely speaking, a dependency is one between whether a
79	waiter for an event can be woken up and whether another waiter for
80	another event can be woken up. However from now on, we will describe
81	a dependency as if it's one between an event and another event for
82	simplicity.
83
84	And they form circular dependencies like:
85
86	-> C -> A -> B -
87	/ \
88	\ /
89	----------------
90
91	where 'A -> B' means that event A depends on event B.
92
93	Such circular dependencies lead to a deadlock since no waiter can meet
94	its condition to wake up as described.
95
96	CONCLUSION
97
98	Circular dependencies cause a deadlock.
99
100
101	How lockdep works
102	-----------------
103
104	Lockdep tries to detect a deadlock by checking dependencies created by
105	lock operations, acquire and release. Waiting for a lock corresponds to
106	waiting for an event, and releasing a lock corresponds to triggering an
107	event in the previous section.
108
109	In short, lockdep does:
110
111	1. Detect a new dependency.
112	2. Add the dependency into a global graph.
113	3. Check if that makes dependencies circular.
114	4. Report a deadlock or its possibility if so.
115
116	For example, consider a graph built by lockdep that looks like:
117
118	A -> B -
119	\
120	-> E
121	/
122	C -> D -
123
124	where A, B,..., E are different lock classes.
125
126	Lockdep will add a dependency into the graph on detection of a new
127	dependency. For example, it will add a dependency 'E -> C' when a new
128	dependency between lock E and lock C is detected. Then the graph will be:
129
130	A -> B -
131	\
132	-> E -
133	/ \
134	-> C -> D - \
135	/ /
136	\ /
137	------------------
138
139	where A, B,..., E are different lock classes.
140
141	This graph contains a subgraph which demonstrates circular dependencies:
142
143	-> E -
144	/ \
145	-> C -> D - \
146	/ /
147	\ /
148	------------------
149
150	where C, D and E are different lock classes.
151
152	This is the condition under which a deadlock might occur. Lockdep
153	reports it on detection after adding a new dependency. This is the way
154	how lockdep works.
155
156	CONCLUSION
157
158	Lockdep detects a deadlock or its possibility by checking if circular
159	dependencies were created after adding each new dependency.
160
161
162	==========
163	Limitation
164	==========
165
166	Limit lockdep
167	-------------
168
169	Limiting lockdep to work on only typical locks e.g. spin locks and
170	mutexes, which are released within the acquire context, the
171	implementation becomes simple but its capacity for detection becomes
172	limited. Let's check pros and cons in next section.
173
174
175	Pros from the limitation
176	------------------------
177
178	Given the limitation, when acquiring a lock, locks in a held_locks
179	cannot be released if the context cannot acquire it so has to wait to
180	acquire it, which means all waiters for the locks in the held_locks are
181	stuck. It's an exact case to create dependencies between each lock in
182	the held_locks and the lock to acquire.
183
184	For example:
185
186	CONTEXT X
187	---------
188	acquire A
189	acquire B /* Add a dependency 'A -> B' */
190	release B
191	release A
192
193	where A and B are different lock classes.
194
195	When acquiring lock A, the held_locks of CONTEXT X is empty thus no
196	dependency is added. But when acquiring lock B, lockdep detects and adds
197	a new dependency 'A -> B' between lock A in the held_locks and lock B.
198	They can be simply added whenever acquiring each lock.
199
200	And data required by lockdep exists in a local structure, held_locks
201	embedded in task_struct. Forcing to access the data within the context,
202	lockdep can avoid racy problems without explicit locks while handling
203	the local data.
204
205	Lastly, lockdep only needs to keep locks currently being held, to build
206	a dependency graph. However, relaxing the limitation, it needs to keep
207	even locks already released, because a decision whether they created
208	dependencies might be long-deferred.
209
210	To sum up, we can expect several advantages from the limitation:
211
212	1. Lockdep can easily identify a dependency when acquiring a lock.
213	2. Races are avoidable while accessing local locks in a held_locks.
214	3. Lockdep only needs to keep locks currently being held.
215
216	CONCLUSION
217
218	Given the limitation, the implementation becomes simple and efficient.
219
220
221	Cons from the limitation
222	------------------------
223
224	Given the limitation, lockdep is applicable only to typical locks. For
225	example, page locks for page access or completions for synchronization
226	cannot work with lockdep.
227
228	Can we detect deadlocks below, under the limitation?
229
230	Example 1:
231
232	CONTEXT X CONTEXT Y CONTEXT Z
233	--------- --------- ----------
234	mutex_lock A
235	lock_page B
236	lock_page B
237	mutex_lock A /* DEADLOCK */
238	unlock_page B held by X
239	unlock_page B
240	mutex_unlock A
241	mutex_unlock A
242
243	where A and B are different lock classes.
244
245	No, we cannot.
246
247	Example 2:
248
249	CONTEXT X CONTEXT Y
250	--------- ---------
251	mutex_lock A
252	mutex_lock A
253	wait_for_complete B /* DEADLOCK */
254	complete B
255	mutex_unlock A
256	mutex_unlock A
257
258	where A is a lock class and B is a completion variable.
259
260	No, we cannot.
261
262	CONCLUSION
263
264	Given the limitation, lockdep cannot detect a deadlock or its
265	possibility caused by page locks or completions.
266
267
268	Relax the limitation
269	--------------------
270
271	Under the limitation, things to create dependencies are limited to
272	typical locks. However, synchronization primitives like page locks and
273	completions, which are allowed to be released in any context, also
274	create dependencies and can cause a deadlock. So lockdep should track
275	these locks to do a better job. We have to relax the limitation for
276	these locks to work with lockdep.
277
278	Detecting dependencies is very important for lockdep to work because
279	adding a dependency means adding an opportunity to check whether it
280	causes a deadlock. The more lockdep adds dependencies, the more it
281	thoroughly works. Thus Lockdep has to do its best to detect and add as
282	many true dependencies into a graph as possible.
283
284	For example, considering only typical locks, lockdep builds a graph like:
285
286	A -> B -
287	\
288	-> E
289	/
290	C -> D -
291
292	where A, B,..., E are different lock classes.
293
294	On the other hand, under the relaxation, additional dependencies might
295	be created and added. Assuming additional 'FX -> C' and 'E -> GX' are
296	added thanks to the relaxation, the graph will be:
297
298	A -> B -
299	\
300	-> E -> GX
301	/
302	FX -> C -> D -
303
304	where A, B,..., E, FX and GX are different lock classes, and a suffix
305	'X' is added on non-typical locks.
306
307	The latter graph gives us more chances to check circular dependencies
308	than the former. However, it might suffer performance degradation since
309	relaxing the limitation, with which design and implementation of lockdep
310	can be efficient, might introduce inefficiency inevitably. So lockdep
311	should provide two options, strong detection and efficient detection.
312
313	Choosing efficient detection:
314
315	Lockdep works with only locks restricted to be released within the
316	acquire context. However, lockdep works efficiently.
317
318	Choosing strong detection:
319
320	Lockdep works with all synchronization primitives. However, lockdep
321	suffers performance degradation.
322
323	CONCLUSION
324
325	Relaxing the limitation, lockdep can add additional dependencies giving
326	additional opportunities to check circular dependencies.
327
328
329	============
330	Crossrelease
331	============
332
333	Introduce crossrelease
334	----------------------
335
336	In order to allow lockdep to handle additional dependencies by what
337	might be released in any context, namely 'crosslock', we have to be able
338	to identify those created by crosslocks. The proposed 'crossrelease'
339	feature provoides a way to do that.
340
341	Crossrelease feature has to do:
342
343	1. Identify dependencies created by crosslocks.
344	2. Add the dependencies into a dependency graph.
345
346	That's all. Once a meaningful dependency is added into graph, then
347	lockdep would work with the graph as it did. The most important thing
348	crossrelease feature has to do is to correctly identify and add true
349	dependencies into the global graph.
350
351	A dependency e.g. 'A -> B' can be identified only in the A's release
352	context because a decision required to identify the dependency can be
353	made only in the release context. That is to decide whether A can be
354	released so that a waiter for A can be woken up. It cannot be made in
355	other than the A's release context.
356
357	It's no matter for typical locks because each acquire context is same as
358	its release context, thus lockdep can decide whether a lock can be
359	released in the acquire context. However for crosslocks, lockdep cannot
360	make the decision in the acquire context but has to wait until the
361	release context is identified.
362
363	Therefore, deadlocks by crosslocks cannot be detected just when it
364	happens, because those cannot be identified until the crosslocks are
365	released. However, deadlock possibilities can be detected and it's very
366	worth. See 'APPENDIX A' section to check why.
367
368	CONCLUSION
369
370	Using crossrelease feature, lockdep can work with what might be released
371	in any context, namely crosslock.
372
373
374	Introduce commit
375	----------------
376
377	Since crossrelease defers the work adding true dependencies of
378	crosslocks until they are actually released, crossrelease has to queue
379	all acquisitions which might create dependencies with the crosslocks.
380	Then it identifies dependencies using the queued data in batches at a
381	proper time. We call it 'commit'.
382
383	There are four types of dependencies:
384
385	1. TT type: 'typical lock A -> typical lock B'
386
387	Just when acquiring B, lockdep can see it's in the A's release
388	context. So the dependency between A and B can be identified
389	immediately. Commit is unnecessary.
390
391	2. TC type: 'typical lock A -> crosslock BX'
392
393	Just when acquiring BX, lockdep can see it's in the A's release
394	context. So the dependency between A and BX can be identified
395	immediately. Commit is unnecessary, too.
396
397	3. CT type: 'crosslock AX -> typical lock B'
398
399	When acquiring B, lockdep cannot identify the dependency because
400	there's no way to know if it's in the AX's release context. It has
401	to wait until the decision can be made. Commit is necessary.
402
403	4. CC type: 'crosslock AX -> crosslock BX'
404
405	When acquiring BX, lockdep cannot identify the dependency because
406	there's no way to know if it's in the AX's release context. It has
407	to wait until the decision can be made. Commit is necessary.
408	But, handling CC type is not implemented yet. It's a future work.
409
410	Lockdep can work without commit for typical locks, but commit step is
411	necessary once crosslocks are involved. Introducing commit, lockdep
412	performs three steps. What lockdep does in each step is:
413
414	1. Acquisition: For typical locks, lockdep does what it originally did
415	and queues the lock so that CT type dependencies can be checked using
416	it at the commit step. For crosslocks, it saves data which will be
417	used at the commit step and increases a reference count for it.
418
419	2. Commit: No action is reauired for typical locks. For crosslocks,
420	lockdep adds CT type dependencies using the data saved at the
421	acquisition step.
422
423	3. Release: No changes are required for typical locks. When a crosslock
424	is released, it decreases a reference count for it.
425
426	CONCLUSION
427
428	Crossrelease introduces commit step to handle dependencies of crosslocks
429	in batches at a proper time.
430
431
432	==============
433	Implementation
434	==============
435
436	Data structures
437	---------------
438
439	Crossrelease introduces two main data structures.
440
441	1. hist_lock
442
443	This is an array embedded in task_struct, for keeping lock history so
444	that dependencies can be added using them at the commit step. Since
445	it's local data, it can be accessed locklessly in the owner context.
446	The array is filled at the acquisition step and consumed at the
447	commit step. And it's managed in circular manner.
448
449	2. cross_lock
450
451	One per lockdep_map exists. This is for keeping data of crosslocks
452	and used at the commit step.
453
454
455	How crossrelease works
456	----------------------
457
458	It's the key of how crossrelease works, to defer necessary works to an
459	appropriate point in time and perform in at once at the commit step.
460	Let's take a look with examples step by step, starting from how lockdep
461	works without crossrelease for typical locks.
462
463	acquire A /* Push A onto held_locks */
464	acquire B /* Push B onto held_locks and add 'A -> B' */
465	acquire C /* Push C onto held_locks and add 'B -> C' */
466	release C /* Pop C from held_locks */
467	release B /* Pop B from held_locks */
468	release A /* Pop A from held_locks */
469
470	where A, B and C are different lock classes.
471
472	NOTE: This document assumes that readers already understand how
473	lockdep works without crossrelease thus omits details. But there's
474	one thing to note. Lockdep pretends to pop a lock from held_locks
475	when releasing it. But it's subtly different from the original pop
476	operation because lockdep allows other than the top to be poped.
477
478	In this case, lockdep adds 'the top of held_locks -> the lock to acquire'
479	dependency every time acquiring a lock.
480
481	After adding 'A -> B', a dependency graph will be:
482
483	A -> B
484
485	where A and B are different lock classes.
486
487	And after adding 'B -> C', the graph will be:
488
489	A -> B -> C
490
491	where A, B and C are different lock classes.
492
493	Let's performs commit step even for typical locks to add dependencies.
494	Of course, commit step is not necessary for them, however, it would work
495	well because this is a more general way.
496
497	acquire A
498	/*
499	* Queue A into hist_locks
500	*
501	* In hist_locks: A
502	* In graph: Empty
503	*/
504
505	acquire B
506	/*
507	* Queue B into hist_locks
508	*
509	* In hist_locks: A, B
510	* In graph: Empty
511	*/
512
513	acquire C
514	/*
515	* Queue C into hist_locks
516	*
517	* In hist_locks: A, B, C
518	* In graph: Empty
519	*/
520
521	commit C
522	/*
523	* Add 'C -> ?'
524	* Answer the following to decide '?'
525	* What has been queued since acquire C: Nothing
526	*
527	* In hist_locks: A, B, C
528	* In graph: Empty
529	*/
530
531	release C
532
533	commit B
534	/*
535	* Add 'B -> ?'
536	* Answer the following to decide '?'
537	* What has been queued since acquire B: C
538	*
539	* In hist_locks: A, B, C
540	* In graph: 'B -> C'
541	*/
542
543	release B
544
545	commit A
546	/*
547	* Add 'A -> ?'
548	* Answer the following to decide '?'
549	* What has been queued since acquire A: B, C
550	*
551	* In hist_locks: A, B, C
552	* In graph: 'B -> C', 'A -> B', 'A -> C'
553	*/
554
555	release A
556
557	where A, B and C are different lock classes.
558
559	In this case, dependencies are added at the commit step as described.
560
561	After commits for A, B and C, the graph will be:
562
563	A -> B -> C
564
565	where A, B and C are different lock classes.
566
567	NOTE: A dependency 'A -> C' is optimized out.
568
569	We can see the former graph built without commit step is same as the
570	latter graph built using commit steps. Of course the former way leads to
571	earlier finish for building the graph, which means we can detect a
572	deadlock or its possibility sooner. So the former way would be prefered
573	when possible. But we cannot avoid using the latter way for crosslocks.
574
575	Let's look at how commit steps work for crosslocks. In this case, the
576	commit step is performed only on crosslock AX as real. And it assumes
577	that the AX release context is different from the AX acquire context.
578
579	BX RELEASE CONTEXT BX ACQUIRE CONTEXT
580	------------------ ------------------
581	acquire A
582	/*
583	* Push A onto held_locks
584	* Queue A into hist_locks
585	*
586	* In held_locks: A
587	* In hist_locks: A
588	* In graph: Empty
589	*/
590
591	acquire BX
592	/*
593	* Add 'the top of held_locks -> BX'
594	*
595	* In held_locks: A
596	* In hist_locks: A
597	* In graph: 'A -> BX'
598	*/
599
600	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
601	It must be guaranteed that the following operations are seen after
602	acquiring BX globally. It can be done by things like barrier.
603	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
604
605	acquire C
606	/*
607	* Push C onto held_locks
608	* Queue C into hist_locks
609	*
610	* In held_locks: C
611	* In hist_locks: C
612	* In graph: 'A -> BX'
613	*/
614
615	release C
616	/*
617	* Pop C from held_locks
618	*
619	* In held_locks: Empty
620	* In hist_locks: C
621	* In graph: 'A -> BX'
622	*/
623	acquire D
624	/*
625	* Push D onto held_locks
626	* Queue D into hist_locks
627	* Add 'the top of held_locks -> D'
628	*
629	* In held_locks: A, D
630	* In hist_locks: A, D
631	* In graph: 'A -> BX', 'A -> D'
632	*/
633	acquire E
634	/*
635	* Push E onto held_locks
636	* Queue E into hist_locks
637	*
638	* In held_locks: E
639	* In hist_locks: C, E
640	* In graph: 'A -> BX', 'A -> D'
641	*/
642
643	release E
644	/*
645	* Pop E from held_locks
646	*
647	* In held_locks: Empty
648	* In hist_locks: D, E
649	* In graph: 'A -> BX', 'A -> D'
650	*/
651	release D
652	/*
653	* Pop D from held_locks
654	*
655	* In held_locks: A
656	* In hist_locks: A, D
657	* In graph: 'A -> BX', 'A -> D'
658	*/
659	commit BX
660	/*
661	* Add 'BX -> ?'
662	* What has been queued since acquire BX: C, E
663	*
664	* In held_locks: Empty
665	* In hist_locks: D, E
666	* In graph: 'A -> BX', 'A -> D',
667	* 'BX -> C', 'BX -> E'
668	*/
669
670	release BX
671	/*
672	* In held_locks: Empty
673	* In hist_locks: D, E
674	* In graph: 'A -> BX', 'A -> D',
675	* 'BX -> C', 'BX -> E'
676	*/
677	release A
678	/*
679	* Pop A from held_locks
680	*
681	* In held_locks: Empty
682	* In hist_locks: A, D
683	* In graph: 'A -> BX', 'A -> D',
684	* 'BX -> C', 'BX -> E'
685	*/
686
687	where A, BX, C,..., E are different lock classes, and a suffix 'X' is
688	added on crosslocks.
689
690	Crossrelease considers all acquisitions after acqiuring BX are
691	candidates which might create dependencies with BX. True dependencies
692	will be determined when identifying the release context of BX. Meanwhile,
693	all typical locks are queued so that they can be used at the commit step.
694	And then two dependencies 'BX -> C' and 'BX -> E' are added at the
695	commit step when identifying the release context.
696
697	The final graph will be, with crossrelease:
698
699	-> C
700	/
701	-> BX -
702	/ \
703	A - -> E
704	\
705	-> D
706
707	where A, BX, C,..., E are different lock classes, and a suffix 'X' is
708	added on crosslocks.
709
710	However, the final graph will be, without crossrelease:
711
712	A -> D
713
714	where A and D are different lock classes.
715
716	The former graph has three more dependencies, 'A -> BX', 'BX -> C' and
717	'BX -> E' giving additional opportunities to check if they cause
718	deadlocks. This way lockdep can detect a deadlock or its possibility
719	caused by crosslocks.
720
721	CONCLUSION
722
723	We checked how crossrelease works with several examples.
724
725
726	=============
727	Optimizations
728	=============
729
730	Avoid duplication
731	-----------------
732
733	Crossrelease feature uses a cache like what lockdep already uses for
734	dependency chains, but this time it's for caching CT type dependencies.
735	Once that dependency is cached, the same will never be added again.
736
737
738	Lockless for hot paths
739	----------------------
740
741	To keep all locks for later use at the commit step, crossrelease adopts
742	a local array embedded in task_struct, which makes access to the data
743	lockless by forcing it to happen only within the owner context. It's
744	like how lockdep handles held_locks. Lockless implmentation is important
745	since typical locks are very frequently acquired and released.
746
747
748	=================================================
749	APPENDIX A: What lockdep does to work aggresively
750	=================================================
751
752	A deadlock actually occurs when all wait operations creating circular
753	dependencies run at the same time. Even though they don't, a potential
754	deadlock exists if the problematic dependencies exist. Thus it's
755	meaningful to detect not only an actual deadlock but also its potential
756	possibility. The latter is rather valuable. When a deadlock occurs
757	actually, we can identify what happens in the system by some means or
758	other even without lockdep. However, there's no way to detect possiblity
759	without lockdep unless the whole code is parsed in head. It's terrible.
760	Lockdep does the both, and crossrelease only focuses on the latter.
761
762	Whether or not a deadlock actually occurs depends on several factors.
763	For example, what order contexts are switched in is a factor. Assuming
764	circular dependencies exist, a deadlock would occur when contexts are
765	switched so that all wait operations creating the dependencies run
766	simultaneously. Thus to detect a deadlock possibility even in the case
767	that it has not occured yet, lockdep should consider all possible
768	combinations of dependencies, trying to:
769
770	1. Use a global dependency graph.
771
772	Lockdep combines all dependencies into one global graph and uses them,
773	regardless of which context generates them or what order contexts are
774	switched in. Aggregated dependencies are only considered so they are
775	prone to be circular if a problem exists.
776
777	2. Check dependencies between classes instead of instances.
778
779	What actually causes a deadlock are instances of lock. However,
780	lockdep checks dependencies between classes instead of instances.
781	This way lockdep can detect a deadlock which has not happened but
782	might happen in future by others but the same class.
783
784	3. Assume all acquisitions lead to waiting.
785
786	Although locks might be acquired without waiting which is essential
787	to create dependencies, lockdep assumes all acquisitions lead to
788	waiting since it might be true some time or another.
789
790	CONCLUSION
791
792	Lockdep detects not only an actual deadlock but also its possibility,
793	and the latter is more valuable.
794
795
796	==================================================
797	APPENDIX B: How to avoid adding false dependencies
798	==================================================
799
800	Remind what a dependency is. A dependency exists if:
801
802	1. There are two waiters waiting for each event at a given time.
803	2. The only way to wake up each waiter is to trigger its event.
804	3. Whether one can be woken up depends on whether the other can.
805
806	For example:
807
808	acquire A
809	acquire B /* A dependency 'A -> B' exists */
810	release B
811	release A
812
813	where A and B are different lock classes.
814
815	A depedency 'A -> B' exists since:
816
817	1. A waiter for A and a waiter for B might exist when acquiring B.
818	2. Only way to wake up each is to release what it waits for.
819	3. Whether the waiter for A can be woken up depends on whether the
820	other can. IOW, TASK X cannot release A if it fails to acquire B.
821
822	For another example:
823
824	TASK X TASK Y
825	------ ------
826	acquire AX
827	acquire B /* A dependency 'AX -> B' exists */
828	release B
829	release AX held by Y
830
831	where AX and B are different lock classes, and a suffix 'X' is added
832	on crosslocks.
833
834	Even in this case involving crosslocks, the same rule can be applied. A
835	depedency 'AX -> B' exists since:
836
837	1. A waiter for AX and a waiter for B might exist when acquiring B.
838	2. Only way to wake up each is to release what it waits for.
839	3. Whether the waiter for AX can be woken up depends on whether the
840	other can. IOW, TASK X cannot release AX if it fails to acquire B.
841
842	Let's take a look at more complicated example:
843
844	TASK X TASK Y
845	------ ------
846	acquire B
847	release B
848	fork Y
849	acquire AX
850	acquire C /* A dependency 'AX -> C' exists */
851	release C
852	release AX held by Y
853
854	where AX, B and C are different lock classes, and a suffix 'X' is
855	added on crosslocks.
856
857	Does a dependency 'AX -> B' exist? Nope.
858
859	Two waiters are essential to create a dependency. However, waiters for
860	AX and B to create 'AX -> B' cannot exist at the same time in this
861	example. Thus the dependency 'AX -> B' cannot be created.
862
863	It would be ideal if the full set of true ones can be considered. But
864	we can ensure nothing but what actually happened. Relying on what
865	actually happens at runtime, we can anyway add only true ones, though
866	they might be a subset of true ones. It's similar to how lockdep works
867	for typical locks. There might be more true dependencies than what
868	lockdep has detected in runtime. Lockdep has no choice but to rely on
869	what actually happens. Crossrelease also relies on it.
870
871	CONCLUSION
872
873	Relying on what actually happens, lockdep can avoid adding false
874	dependencies.

Documentation/vm/zswap.txt+21−1

@@ -98,5 +98,25 @@ request is made for a page in an old zpool, it is uncompressed using its · 97 unmodified lines
98	original compressor. Once all pages are removed from an old zpool, the zpool	98	original compressor. Once all pages are removed from an old zpool, the zpool
99	and its compressor are freed.	99	and its compressor are freed.
100		100
		101	Some of the pages in zswap are same-value filled pages (i.e. contents of the
		102	page have same value or repetitive pattern). These pages include zero-filled
		103	pages and they are handled differently. During store operation, a page is
		104	checked if it is a same-value filled page before compressing it. If true, the
		105	compressed length of the page is set to zero and the pattern or same-filled
		106	value is stored.
		107
		108	Same-value filled pages identification feature is enabled by default and can be
		109	disabled at boot time by setting the "same_filled_pages_enabled" attribute to 0,
		110	e.g. zswap.same_filled_pages_enabled=0. It can also be enabled and disabled at
		111	runtime using the sysfs "same_filled_pages_enabled" attribute, e.g.
		112
		113	echo 1 > /sys/module/zswap/parameters/same_filled_pages_enabled
		114
		115	When zswap same-filled page identification is disabled at runtime, it will stop
		116	checking for the same-value filled pages during store operation. However, the
		117	existing pages which are marked as same-value filled pages remain stored
		118	unchanged in zswap until they are either loaded or invalidated.
		119
101	A debugfs interface is provided for various statistic about pool size, number	120	A debugfs interface is provided for various statistic about pool size, number
102	of pages stored, and various counters for the reasons pages are rejected.	121	of pages stored, same-value filled pages and various counters for the reasons
		122	pages are rejected.

Documentation/x86/x86_64/mm.txt+14−15

-<previous description obsolete, deleted>
 Virtual memory map with 4 level page tables:
 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm
 ... unused hole ...
 ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB)
 ... unused hole ...
+fffffe0000000000 - fffffe7fffffffff (=39 bits) LDT remap for PTI
+fffffe8000000000 - fffffeffffffffff (=39 bits) cpu_entry_area mapping
 ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
 ... unused hole ...
 ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space
 ... unused hole ...
 ffffffff80000000 - ffffffff9fffffff (=512 MB)  kernel text mapping, from phys 0
-ffffffffa0000000 - ffffffffff5fffff (=1526 MB) module mapping space (variable)
+ffffffffa0000000 - [fixmap start]   (~1526 MB) module mapping space (variable)
-ffffffffff600000 - ffffffffffdfffff (=8 MB) vsyscalls
+[fixmap start]   - ffffffffff5fffff kernel-internal fixmap range
+ffffffffff600000 - ffffffffff600fff (=4 kB) legacy vsyscall ABI
 ffffffffffe00000 - ffffffffffffffff (=2 MB) unused hole
 Virtual memory map with 5 level page tables:
 hole caused by [56:63] sign extension
 ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor
 ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory
-ff90000000000000 - ff91ffffffffffff (=49 bits) hole
+ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI
-ff92000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space
+ffa0000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space (12800 TB)
 ffd2000000000000 - ffd3ffffffffffff (=49 bits) hole
 ffd4000000000000 - ffd5ffffffffffff (=49 bits) virtual memory map (512TB)
 ... unused hole ...
 ffdf000000000000 - fffffc0000000000 (=53 bits) kasan shadow memory (8PB)
 ... unused hole ...
+fffffe8000000000 - fffffeffffffffff (=39 bits) cpu_entry_area mapping
 ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
 ... unused hole ...
 ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space
 ... unused hole ...
 ffffffff80000000 - ffffffff9fffffff (=512 MB)  kernel text mapping, from phys 0
-ffffffffa0000000 - ffffffffff5fffff (=1526 MB) module mapping space
+ffffffffa0000000 - [fixmap start]   (~1526 MB) module mapping space
-ffffffffff600000 - ffffffffffdfffff (=8 MB) vsyscalls
+[fixmap start]   - ffffffffff5fffff kernel-internal fixmap range
+ffffffffff600000 - ffffffffff600fff (=4 kB) legacy vsyscall ABI
 ffffffffffe00000 - ffffffffffffffff (=2 MB) unused hole
 Architecture defines a 64-bit virtual address. Implementations can support
 less. Currently supported are 48- and 57-bit virtual addresses. Bits 63
-through to the most-significant implemented bit are set to either all ones
+through to the most-significant implemented bit are sign extended.
-or all zero. This causes hole between user space and kernel addresses.
+This causes hole between user space and kernel addresses if you interpret them
+as unsigned.
 The direct mapping covers all memory in the system up to the highest
 memory address (this means in some cases it can also include PCI memory
 the processes using the page fault handler, with init_top_pgt as
 reference.
-Current X86-64 implementations support up to 46 bits of address space (64 TB),
-which is our current limit. This expands into MBZ space in the page tables.
 We map EFI runtime services in the 'efi_pgd' PGD in a 64Gb large virtual
 memory window (this size is arbitrary, it can be raised later if needed).
 The mappings are not part of any other kernel PGD and are only available
 Note that if CONFIG_RANDOMIZE_MEMORY is enabled, the direct mapping of all
 physical memory, vmalloc/ioremap space and virtual memory map are randomized.
 Their order is preserved but their base will be offset early at boot time.
--Andi Kleen, Jul 2004

MAINTAINERS+10−10

@@ -2621,24 +2621,22 @@ F: fs/bfs/ · 2620 unmodified lines
2621	F: include/uapi/linux/bfs_fs.h	2621	F: include/uapi/linux/bfs_fs.h
2622		2622
2623	BLACKFIN ARCHITECTURE	2623	BLACKFIN ARCHITECTURE
2624	M: Steven Miao <realmz6@gmail.com>
2625	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2624	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2626	T: git git://git.code.sf.net/p/adi-linux/code	2625	T: git git://git.code.sf.net/p/adi-linux/code
2627	W: http://blackfin.uclinux.org	2626	W: http://blackfin.uclinux.org
2628	S: Supported	2627	S: Orphan
2629	F: arch/blackfin/	2628	F: arch/blackfin/
2630		2629
2631	BLACKFIN EMAC DRIVER	2630	BLACKFIN EMAC DRIVER
2632	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2631	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2633	W: http://blackfin.uclinux.org	2632	W: http://blackfin.uclinux.org
2634	S: Supported	2633	S: Orphan
2635	F: drivers/net/ethernet/adi/	2634	F: drivers/net/ethernet/adi/
2636		2635
2637	BLACKFIN MEDIA DRIVER	2636	BLACKFIN MEDIA DRIVER
2638	M: Scott Jiang <scott.jiang.linux@gmail.com>
2639	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2637	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2640	W: http://blackfin.uclinux.org/	2638	W: http://blackfin.uclinux.org/
2641	S: Supported	2639	S: Orphan
2642	F: drivers/media/platform/blackfin/	2640	F: drivers/media/platform/blackfin/
2643	F: drivers/media/i2c/adv7183*	2641	F: drivers/media/i2c/adv7183*
2644	F: drivers/media/i2c/vs6624*	2642	F: drivers/media/i2c/vs6624*
@@ -2646,25 +2644,25 @@ F: drivers/media/i2c/vs6624* · 1 unmodified line
2646	BLACKFIN RTC DRIVER	2644	BLACKFIN RTC DRIVER
2647	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2645	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2648	W: http://blackfin.uclinux.org	2646	W: http://blackfin.uclinux.org
2649	S: Supported	2647	S: Orphan
2650	F: drivers/rtc/rtc-bfin.c	2648	F: drivers/rtc/rtc-bfin.c
2651		2649
2652	BLACKFIN SDH DRIVER	2650	BLACKFIN SDH DRIVER
2653	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2651	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2654	W: http://blackfin.uclinux.org	2652	W: http://blackfin.uclinux.org
2655	S: Supported	2653	S: Orphan
2656	F: drivers/mmc/host/bfin_sdh.c	2654	F: drivers/mmc/host/bfin_sdh.c
2657		2655
2658	BLACKFIN SERIAL DRIVER	2656	BLACKFIN SERIAL DRIVER
2659	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2657	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2660	W: http://blackfin.uclinux.org	2658	W: http://blackfin.uclinux.org
2661	S: Supported	2659	S: Orphan
2662	F: drivers/tty/serial/bfin_uart.c	2660	F: drivers/tty/serial/bfin_uart.c
2663		2661
2664	BLACKFIN WATCHDOG DRIVER	2662	BLACKFIN WATCHDOG DRIVER
2665	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)	2663	L: adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
2666	W: http://blackfin.uclinux.org	2664	W: http://blackfin.uclinux.org
2667	S: Supported	2665	S: Orphan
2668	F: drivers/watchdog/bfin_wdt.c	2666	F: drivers/watchdog/bfin_wdt.c
2669		2667
2670	BLINKM RGB LED DRIVER	2668	BLINKM RGB LED DRIVER
@@ -5431,7 +5429,7 @@ F: drivers/media/tuners/fc2580* · 2760 unmodified lines
5431		5429
5432	FCOE SUBSYSTEM (libfc, libfcoe, fcoe)	5430	FCOE SUBSYSTEM (libfc, libfcoe, fcoe)
5433	M: Johannes Thumshirn <jth@kernel.org>	5431	M: Johannes Thumshirn <jth@kernel.org>
5434	L: fcoe-devel@open-fcoe.org	5432	L: linux-scsi@vger.kernel.org
5435	W: www.Open-FCoE.org	5433	W: www.Open-FCoE.org
5436	S: Supported	5434	S: Supported
5437	F: drivers/scsi/libfc/	5435	F: drivers/scsi/libfc/
@@ -13141,6 +13139,7 @@ F: drivers/dma/dw/ · 7703 unmodified lines
13141		13139
13142	SYNOPSYS DESIGNWARE ENTERPRISE ETHERNET DRIVER	13140	SYNOPSYS DESIGNWARE ENTERPRISE ETHERNET DRIVER
13143	M: Jie Deng <jiedeng@synopsys.com>	13141	M: Jie Deng <jiedeng@synopsys.com>
		13142	M: Jose Abreu <Jose.Abreu@synopsys.com>
13144	L: netdev@vger.kernel.org	13143	L: netdev@vger.kernel.org
13145	S: Supported	13144	S: Supported
13146	F: drivers/net/ethernet/synopsys/	13145	F: drivers/net/ethernet/synopsys/
@@ -13516,6 +13515,7 @@ M: Mika Westerberg <mika.westerberg@linux.intel.com> · 369 unmodified lines
13516	M: Yehezkel Bernat <yehezkel.bernat@intel.com>	13515	M: Yehezkel Bernat <yehezkel.bernat@intel.com>
13517	T: git git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git	13516	T: git git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git
13518	S: Maintained	13517	S: Maintained
		13518	F: Documentation/admin-guide/thunderbolt.rst
13519	F: drivers/thunderbolt/	13519	F: drivers/thunderbolt/
13520	F: include/linux/thunderbolt.h	13520	F: include/linux/thunderbolt.h
13521		13521

Makefile+4−1

 VERSION = 4
 PATCHLEVEL = 15
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 # *DOCUMENTATION*
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
+# Make sure -fstack-check isn't enabled (like gentoo apparently did)
+KBUILD_CFLAGS  += $(call cc-option,-fno-stack-check,)
 # conserve stack if available
 KBUILD_CFLAGS   += $(call cc-option,-fconserve-stack)

arch/arm/boot/dts/vf610-zii-dev-rev-c.dts+2−2

@@ -121,7 +121,7 @@ · 120 unmodified lines
121	switch0port10: port@10 {	121	switch0port10: port@10 {
122	reg = <10>;	122	reg = <10>;
123	label = "dsa";	123	label = "dsa";
124	phy-mode = "xgmii";	124	phy-mode = "xaui";
125	link = <&switch1port10>;	125	link = <&switch1port10>;
126	};	126	};
127	};	127	};
@@ -208,7 +208,7 @@ · 80 unmodified lines
208	switch1port10: port@10 {	208	switch1port10: port@10 {
209	reg = <10>;	209	reg = <10>;
210	label = "dsa";	210	label = "dsa";
211	phy-mode = "xgmii";	211	phy-mode = "xaui";
212	link = <&switch0port10>;	212	link = <&switch0port10>;
213	};	213	};
214	};	214	};

arch/arm/lib/csumpartialcopyuser.S+4−0

 		.pushsection .text.fixup,"ax"
 		.align	4
 9001:		mov	r4, #-EFAULT
+#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+		ldr	r5, [sp, #9*4]		@ *err_ptr
+#else
 		ldr	r5, [sp, #8*4]		@ *err_ptr
+#endif
 		str	r4, [r5]
 		ldmia	sp, {r1, r2}		@ retrieve dst, len
 		add	r2, r2, r1

arch/arm64/Kconfig+11−1

 	  If unsure, say Y.
 config SOCIONEXT_SYNQUACER_PREITS
 	bool "Socionext Synquacer: Workaround for GICv3 pre-ITS"
 	default y
 	  a 128kB offset to be applied to the target address in this commands.
 	  If unsure, say Y.
+config QCOM_FALKOR_ERRATUM_E1041
+	bool "Falkor E1041: Speculative instruction fetches might cause errant memory access"
+	default y
+	help
+	  Falkor CPU may speculatively fetch instructions from an improper
+	  memory location when MMU translation is changed from SCTLR_ELn[M]=1
+	  to SCTLR_ELn[M]=0. Prefix an ISB instruction to fix the problem.
+	  If unsure, say Y.
 endmenu

arch/arm64/include/asm/assembler.h+10−0

@@ -512,4 +512,14 @@ alternative_else_nop_endif · 511 unmodified lines
512	#endif	512	#endif
513	.endm	513	.endm
514		514
		515	/**
		516	* Errata workaround prior to disable MMU. Insert an ISB immediately prior
		517	* to executing the MSR that will change SCTLR_ELn[M] from a value of 1 to 0.
		518	*/
		519	.macro pre_disable_mmu_workaround
		520	#ifdef CONFIG_QCOM_FALKOR_ERRATUM_E1041
		521	isb
		522	#endif
		523	.endm
		524
515	#endif /* __ASM_ASSEMBLER_H */	525	#endif /* __ASM_ASSEMBLER_H */

arch/arm64/include/asm/cpufeature.h+3−0

@@ -60,6 +60,9 @@ enum ftr_type { · 59 unmodified lines
60	#define FTR_VISIBLE true /* Feature visible to the user space */	60	#define FTR_VISIBLE true /* Feature visible to the user space */
61	#define FTR_HIDDEN false /* Feature is hidden from the user */	61	#define FTR_HIDDEN false /* Feature is hidden from the user */
62		62
		63	#define FTR_VISIBLE_IF_IS_ENABLED(config) \
		64	(IS_ENABLED(config) ? FTR_VISIBLE : FTR_HIDDEN)
		65
63	struct arm64_ftr_bits {	66	struct arm64_ftr_bits {
64	bool sign; /* Value is signed ? */	67	bool sign; /* Value is signed ? */
65	bool visible;	68	bool visible;

arch/arm64/include/asm/cputype.h+2−0

 #define BRCM_CPU_PART_VULCAN		0x516
 #define QCOM_CPU_PART_FALKOR_V1		0x800
+#define QCOM_CPU_PART_FALKOR		0xC00
 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
 #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
 #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1)
+#define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR)
 #ifndef __ASSEMBLY__

arch/arm64/include/asm/pgtable.h+22−19

 #include <asm/cmpxchg.h>
 #include <asm/fixmap.h>
 #include <linux/mmdebug.h>
+#include <linux/mm_types.h>
+#include <linux/sched.h>
 extern void __pte_error(const char *file, int line, unsigned long val);
 extern void __pmd_error(const char *file, int line, unsigned long val);
 static inline pte_t pte_mkclean(pte_t pte)
 {
-	return clear_pte_bit(pte, __pgprot(PTE_DIRTY));
+	pte = clear_pte_bit(pte, __pgprot(PTE_DIRTY));
+	pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+	return pte;
 }
 static inline pte_t pte_mkdirty(pte_t pte)
 {
-	return set_pte_bit(pte, __pgprot(PTE_DIRTY));
+	pte = set_pte_bit(pte, __pgprot(PTE_DIRTY));
+	if (pte_write(pte))
+		pte = clear_pte_bit(pte, __pgprot(PTE_RDONLY));
+	return pte;
 }
 static inline pte_t pte_mkold(pte_t pte)
 	}
 }
-struct mm_struct;
-struct vm_area_struct;
 extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 /*
 	 * hardware updates of the pte (ptep_set_access_flags safely changes
 	 * valid ptes without going through an invalid entry).
 	 */
-	if (pte_valid(*ptep) && pte_valid(pte)) {
+	if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(*ptep) && pte_valid(pte) &&
+	   (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
 		VM_WARN_ONCE(!pte_young(pte),
 			     "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
 			     __func__, pte_val(*ptep), pte_val(pte));
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 /*
- * ptep_set_wrprotect - mark read-only while preserving the hardware update of
+ * ptep_set_wrprotect - mark read-only while trasferring potential hardware
- * the Access Flag.
+ * dirty status (PTE_DBM && !PTE_RDONLY) to the software PTE_DIRTY bit.
  */
 #define __HAVE_ARCH_PTEP_SET_WRPROTECT
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long address, pte_t *ptep)
 {
 	pte_t old_pte, pte;
-	/*
-	 * ptep_set_wrprotect() is only called on CoW mappings which are
-	 * private (!VM_SHARED) with the pte either read-only (!PTE_WRITE &&
-	 * PTE_RDONLY) or writable and software-dirty (PTE_WRITE &&
-	 * !PTE_RDONLY && PTE_DIRTY); see is_cow_mapping() and
-	 * protection_map[]. There is no race with the hardware update of the
-	 * dirty state: clearing of PTE_RDONLY when PTE_WRITE (a.k.a. PTE_DBM)
-	 * is set.
-	 */
-	VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(*ptep),
-		     "%s: potential race with hardware DBM", __func__);
 	pte = READ_ONCE(*ptep);
 	do {
 		old_pte = pte;
+		/*
+		 * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
+		 * clear), set the PTE_DIRTY bit.
+		 */
+		if (pte_hw_dirty(pte))
+			pte = pte_mkdirty(pte);
 		pte = pte_wrprotect(pte);
 		pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep),
 					       pte_val(old_pte), pte_val(pte));

arch/arm64/kernel/cpu-reset.S+1−0

@@ -37,6 +37,7 @@ ENTRY(__cpu_soft_restart) · 36 unmodified lines
37	mrs x12, sctlr_el1	37	mrs x12, sctlr_el1
38	ldr x13, =SCTLR_ELx_FLAGS	38	ldr x13, =SCTLR_ELx_FLAGS
39	bic x12, x12, x13	39	bic x12, x12, x13
		40	pre_disable_mmu_workaround
40	msr sctlr_el1, x12	41	msr sctlr_el1, x12
41	isb	42	isb
42		43

arch/arm64/kernel/cpufeature.c+2−1

@@ -145,7 +145,8 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { · 144 unmodified lines
145	};	145	};
146		146
147	static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {	147	static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
148	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_SVE_SHIFT, 4, 0),	148	ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_SVE),
		149	FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_SVE_SHIFT, 4, 0),
149	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_GIC_SHIFT, 4, 0),	150	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_GIC_SHIFT, 4, 0),
150	S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_ASIMD_SHIFT, 4, ID_AA64PFR0_ASIMD_NI),	151	S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_ASIMD_SHIFT, 4, ID_AA64PFR0_ASIMD_NI),
151	S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_FP_SHIFT, 4, ID_AA64PFR0_FP_NI),	152	S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_FP_SHIFT, 4, ID_AA64PFR0_FP_NI),

arch/arm64/kernel/efi-entry.S+2−0

 	mrs	x0, sctlr_el2
 	bic	x0, x0, #1 << 0	// clear SCTLR.M
 	bic	x0, x0, #1 << 2	// clear SCTLR.C
+	pre_disable_mmu_workaround
 	msr	sctlr_el2, x0
 	isb
 	b	2f
 	mrs	x0, sctlr_el1
 	bic	x0, x0, #1 << 0	// clear SCTLR.M
 	bic	x0, x0, #1 << 2	// clear SCTLR.C
+	pre_disable_mmu_workaround
 	msr	sctlr_el1, x0
 	isb
 2:

arch/arm64/kernel/fpsimd.c+1−1

@@ -1043,7 +1043,7 @@ void fpsimd_update_current_state(struct fpsimd_state *state) · 1042 unmodified lines
1043		1043
1044	local_bh_disable();	1044	local_bh_disable();
1045		1045
1046	current->thread.fpsimd_state = *state;	1046	current->thread.fpsimd_state.user_fpsimd = state->user_fpsimd;
1047	if (system_supports_sve() && test_thread_flag(TIF_SVE))	1047	if (system_supports_sve() && test_thread_flag(TIF_SVE))
1048	fpsimd_to_sve(current);	1048	fpsimd_to_sve(current);
1049		1049

arch/arm64/kernel/head.S+1−0

@@ -750,6 +750,7 @@ __primary_switch: · 749 unmodified lines
750	* to take into account by discarding the current kernel mapping and	750	* to take into account by discarding the current kernel mapping and
751	* creating a new one.	751	* creating a new one.
752	*/	752	*/
		753	pre_disable_mmu_workaround
753	msr sctlr_el1, x20 // disable the MMU	754	msr sctlr_el1, x20 // disable the MMU
754	isb	755	isb
755	bl __create_page_tables // recreate kernel mapping	756	bl __create_page_tables // recreate kernel mapping

arch/arm64/kernel/hw_breakpoint.c+1−1

 #include <linux/perf_event.h>
 #include <linux/ptrace.h>
 #include <linux/smp.h>
+#include <linux/uaccess.h>
 #include <asm/compat.h>
 #include <asm/current.h>
 #include <asm/traps.h>
 #include <asm/cputype.h>
 #include <asm/system_misc.h>
-#include <asm/uaccess.h>
 /* Breakpoint currently in use for each BRP. */
 static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);

arch/arm64/kernel/relocate_kernel.S+1−0

@@ -45,6 +45,7 @@ ENTRY(arm64_relocate_new_kernel) · 44 unmodified lines
45	mrs x0, sctlr_el2	45	mrs x0, sctlr_el2
46	ldr x1, =SCTLR_ELx_FLAGS	46	ldr x1, =SCTLR_ELx_FLAGS
47	bic x0, x0, x1	47	bic x0, x0, x1
		48	pre_disable_mmu_workaround
48	msr sctlr_el2, x0	49	msr sctlr_el2, x0
49	isb	50	isb
50	1:	51	1:

arch/arm64/kvm/hyp-init.S+1−0

@@ -151,6 +151,7 @@ reset: · 150 unmodified lines
151	mrs x5, sctlr_el2	151	mrs x5, sctlr_el2
152	ldr x6, =SCTLR_ELx_FLAGS	152	ldr x6, =SCTLR_ELx_FLAGS
153	bic x5, x5, x6 // Clear SCTL_M and etc	153	bic x5, x5, x6 // Clear SCTL_M and etc
		154	pre_disable_mmu_workaround
154	msr sctlr_el2, x5	155	msr sctlr_el2, x5
155	isb	156	isb
156		157

arch/arm64/kvm/hyp/debug-sr.c+3−0

@@ -74,6 +74,9 @@ static void __hyp_text __debug_save_spe_nvhe(u64 *pmscr_el1) · 73 unmodified lines
74	{	74	{
75	u64 reg;	75	u64 reg;
76		76
		77	/* Clear pmscr in case of early return */
		78	*pmscr_el1 = 0;
		79
77	/* SPE present on this CPU? */	80	/* SPE present on this CPU? */
78	if (!cpuid_feature_extract_unsigned_field(read_sysreg(id_aa64dfr0_el1),	81	if (!cpuid_feature_extract_unsigned_field(read_sysreg(id_aa64dfr0_el1),
79	ID_AA64DFR0_PMSVER_SHIFT))	82	ID_AA64DFR0_PMSVER_SHIFT))

arch/arm64/mm/dump.c+1−1

@@ -389,7 +389,7 @@ void ptdump_check_wx(void) · 388 unmodified lines
389	.check_wx = true,	389	.check_wx = true,
390	};	390	};
391		391
392	walk_pgd(&st, &init_mm, 0);	392	walk_pgd(&st, &init_mm, VA_START);
393	note_page(&st, 0, 0, 0);	393	note_page(&st, 0, 0, 0);
394	if (st.wx_pages \|\| st.uxn_pages)	394	if (st.wx_pages \|\| st.uxn_pages)
395	pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n",	395	pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n",

arch/arm64/mm/fault.c+2−3

 {
 	struct siginfo info;
 	const struct fault_info *inf;
-	int ret = 0;
 	inf = esr_to_fault_info(esr);
 	pr_err("Synchronous External Abort: %s (0x%08x) at 0x%016lx\n",
 		if (interrupts_enabled(regs))
 			nmi_enter();
-		ret = ghes_notify_sea();
+		ghes_notify_sea();
 		if (interrupts_enabled(regs))
 			nmi_exit();
 		info.si_addr  = (void __user *)addr;
 	arm64_notify_die("", regs, &info, esr);
-	return ret;
+	return 0;
 }
 static const struct fault_info fault_info[] = {

arch/arm64/mm/init.c+2−1

 	reserve_elfcorehdr();
+	high_memory = __va(memblock_end_of_DRAM() - 1) + 1;
 	dma_contiguous_reserve(arm64_dma_phys_limit);
 	memblock_allow_resize();
 	sparse_init();
 	zone_sizes_init(min, max);
-	high_memory = __va((max << PAGE_SHIFT) - 1) + 1;
 	memblock_dump_all();
 }

arch/parisc/boot/compressed/misc.c+2−2

@@ -123,8 +123,8 @@ int puts(const char *s) · 122 unmodified lines
123	while ((nuline = strchr(s, '\n')) != NULL) {	123	while ((nuline = strchr(s, '\n')) != NULL) {
124	if (nuline != s)	124	if (nuline != s)
125	pdc_iodc_print(s, nuline - s);	125	pdc_iodc_print(s, nuline - s);
126	pdc_iodc_print("\r\n", 2);	126	pdc_iodc_print("\r\n", 2);
127	s = nuline + 1;	127	s = nuline + 1;
128	}	128	}
129	if (*s != '\0')	129	if (*s != '\0')
130	pdc_iodc_print(s, strlen(s));	130	pdc_iodc_print(s, strlen(s));

arch/parisc/include/asm/thread_info.h+5−0

 /* thread information allocation */
+#ifdef CONFIG_IRQSTACKS
+#define THREAD_SIZE_ORDER	2 /* PA-RISC requires at least 16k stack */
+#else
 #define THREAD_SIZE_ORDER	3 /* PA-RISC requires at least 32k stack */
+#endif
 /* Be sure to hunt all references to this down when you change the size of
  * the kernel stack */
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)

arch/parisc/kernel/entry.S+9−3

 	STREG   %r19,PT_SR7(%r16)
 intr_return:
-	/* NOTE: Need to enable interrupts incase we schedule. */
-	ssm     PSW_SM_I, %r0
 	/* check for reschedule */
 	mfctl   %cr30,%r1
 	LDREG   TI_FLAGS(%r1),%r19	/* sched.h: TIF_NEED_RESCHED */
 	LDREG	PT_IASQ1(%r16), %r20
 	cmpib,COND(=),n 0,%r20,intr_restore /* backward */
+	/* NOTE: We need to enable interrupts if we have to deliver
+	 * signals. We used to do this earlier but it caused kernel
+	 * stack overflows. */
+	ssm     PSW_SM_I, %r0
 	copy	%r0, %r25			/* long in_syscall = 0 */
 #ifdef CONFIG_64BIT
 	ldo	-16(%r30),%r29			/* Reference param save area */
 	cmpib,COND(=)	0, %r20, intr_do_preempt
 	nop
+	/* NOTE: We need to enable interrupts if we schedule.  We used
+	 * to do this earlier but it caused kernel stack overflows. */
+	ssm     PSW_SM_I, %r0
 #ifdef CONFIG_64BIT
 	ldo	-16(%r30),%r29		/* Reference param save area */
 #endif

arch/parisc/kernel/hpmc.S+1−0

@@ -305,6 +305,7 @@ ENDPROC_CFI(os_hpmc) · 304 unmodified lines
305		305
306		306
307	__INITRODATA	307	__INITRODATA
		308	.align 4
308	.export os_hpmc_size	309	.export os_hpmc_size
309	os_hpmc_size:	310	os_hpmc_size:
310	.word .os_hpmc_end-.os_hpmc	311	.word .os_hpmc_end-.os_hpmc

arch/parisc/kernel/unwind.c+0−1

@@ -15,7 +15,6 @@ · 14 unmodified lines
15	#include <linux/slab.h>	15	#include <linux/slab.h>
16	#include <linux/kallsyms.h>	16	#include <linux/kallsyms.h>
17	#include <linux/sort.h>	17	#include <linux/sort.h>
18	#include <linux/sched.h>
19		18
20	#include <linux/uaccess.h>	19	#include <linux/uaccess.h>
21	#include <asm/assembly.h>	20	#include <asm/assembly.h>

arch/parisc/lib/delay.c+0−2

@@ -16,9 +16,7 @@ · 15 unmodified lines
16	#include <linux/preempt.h>	16	#include <linux/preempt.h>
17	#include <linux/init.h>	17	#include <linux/init.h>
18		18
19	#include <asm/processor.h>
20	#include <asm/delay.h>	19	#include <asm/delay.h>
21
22	#include <asm/special_insns.h> /* for mfctl() */	20	#include <asm/special_insns.h> /* for mfctl() */
23	#include <asm/processor.h> /* for boot_cpu_data */	21	#include <asm/processor.h> /* for boot_cpu_data */
24		22

arch/powerpc/include/asm/mmu_context.h+3−2

 #endif
 }
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
-				 struct mm_struct *mm)
+				struct mm_struct *mm)
 {
+	return 0;
 }
 #ifndef CONFIG_PPC_BOOK3S_64

arch/powerpc/kernel/process.c+1−1

@@ -1403,7 +1403,7 @@ void show_regs(struct pt_regs * regs) · 1402 unmodified lines
1403		1403
1404	printk("NIP: "REG" LR: "REG" CTR: "REG"\n",	1404	printk("NIP: "REG" LR: "REG" CTR: "REG"\n",
1405	regs->nip, regs->link, regs->ctr);	1405	regs->nip, regs->link, regs->ctr);
1406	printk("REGS: %p TRAP: %04lx %s (%s)\n",	1406	printk("REGS: %px TRAP: %04lx %s (%s)\n",
1407	regs, regs->trap, print_tainted(), init_utsname()->release);	1407	regs, regs->trap, print_tainted(), init_utsname()->release);
1408	printk("MSR: "REG" ", regs->msr);	1408	printk("MSR: "REG" ", regs->msr);
1409	print_msr_bits(regs->msr);	1409	print_msr_bits(regs->msr);

arch/powerpc/kvm/book3s_xive.c+4−3

 	/* Return the per-cpu state for state saving/migration */
 	return (u64)xc->cppr << KVM_REG_PPC_ICP_CPPR_SHIFT |
-	       (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT;
+	       (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT |
+	       (u64)0xff << KVM_REG_PPC_ICP_PPRI_SHIFT;
 }
 int kvmppc_xive_set_icp(struct kvm_vcpu *vcpu, u64 icpval)
 	/*
 	 * Restore P and Q. If the interrupt was pending, we
-	 * force both P and Q, which will trigger a resend.
+	 * force Q and !P, which will trigger a resend.
 	 *
 	 * That means that a guest that had both an interrupt
 	 * pending (queued) and Q set will restore with only
 	 * is perfectly fine as coalescing interrupts that haven't
 	 * been presented yet is always allowed.
 	 */
-	if (val & KVM_XICS_PRESENTED || val & KVM_XICS_PENDING)
+	if (val & KVM_XICS_PRESENTED && !(val & KVM_XICS_PENDING))
 		state->old_p = true;
 	if (val & KVM_XICS_QUEUED || val & KVM_XICS_PENDING)
 		state->old_q = true;

arch/powerpc/net/bpf_jit_comp64.c+4−2

 			func = (u8 *) __bpf_call_base + imm;
 			/* Save skb pointer if we need to re-cache skb data */
-			if (bpf_helper_changes_pkt_data(func))
+			if ((ctx->seen & SEEN_SKB) &&
+			    bpf_helper_changes_pkt_data(func))
 				PPC_BPF_STL(3, 1, bpf_jit_stack_local(ctx));
 			bpf_jit_emit_func_call(image, ctx, (u64)func);
 			PPC_MR(b2p[BPF_REG_0], 3);
 			/* refresh skb cache */
-			if (bpf_helper_changes_pkt_data(func)) {
+			if ((ctx->seen & SEEN_SKB) &&
+			    bpf_helper_changes_pkt_data(func)) {
 				/* reload skb pointer to r3 */
 				PPC_BPF_LL(3, 1, bpf_jit_stack_local(ctx));
 				bpf_jit_emit_skb_loads(image, ctx);

arch/powerpc/perf/core-book3s.c+6−2

 	int ret;
 	__u64 target;
-	if (is_kernel_addr(addr))
+	if (is_kernel_addr(addr)) {
-		return branch_target((unsigned int *)addr);
+		if (probe_kernel_read(&instr, (void *)addr, sizeof(instr)))
+			return 0;
+		return branch_target(&instr);
+	}
 	/* Userspace: need copy instruction here then translate it */
 	pagefault_disable();

arch/powerpc/perf/imc-pmu.c+16−1

 	if (!cpumask_test_and_clear_cpu(cpu, &nest_imc_cpumask))
 		return 0;
+	/*
+	 * Check whether nest_imc is registered. We could end up here if the
+	 * cpuhotplug callback registration fails. i.e, callback invokes the
+	 * offline path for all successfully registered nodes. At this stage,
+	 * nest_imc pmu will not be registered and we should return here.
+	 *
+	 * We return with a zero since this is not an offline failure. And
+	 * cpuhp_setup_state() returns the actual failure reason to the caller,
+	 * which in turn will call the cleanup routine.
+	 */
+	if (!nest_pmus)
+		return 0;
 	/*
 	 * Now that this cpu is one of the designated,
 	 * find a next cpu a) which is online and b) in same chip.
 		if (nest_pmus == 1) {
 			cpuhp_remove_state(CPUHP_AP_PERF_POWERPC_NEST_IMC_ONLINE);
 			kfree(nest_imc_refc);
+			kfree(per_nest_pmu_arr);
 		}
 		if (nest_pmus > 0)
 		kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
 	kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]);
 	kfree(pmu_ptr);
-	kfree(per_nest_pmu_arr);
 	return;
 }
 			ret = nest_pmu_cpumask_init();
 			if (ret) {
 				mutex_unlock(&nest_init_lock);
+				kfree(nest_imc_refc);
+				kfree(per_nest_pmu_arr);
 				goto err_free;
 			}
 		}

arch/powerpc/sysdev/fsl_msi.c+3−1

 }
 static struct lock_class_key fsl_msi_irq_class;
+static struct lock_class_key fsl_msi_irq_request_class;
 static int fsl_msi_setup_hwirq(struct fsl_msi *msi, struct platform_device *dev,
 			       int offset, int irq_index)
 		dev_err(&dev->dev, "No memory for MSI cascade data\n");
 		return -ENOMEM;
 	}
-	irq_set_lockdep_class(virt_msir, &fsl_msi_irq_class);
+	irq_set_lockdep_class(virt_msir, &fsl_msi_irq_class,
+			      &fsl_msi_irq_request_class);
 	cascade_data->index = offset;
 	cascade_data->msi_data = msi;
 	cascade_data->virq = virt_msir;

arch/riscv/include/asm/barrier.h+19−0

@@ -38,6 +38,25 @@ · 37 unmodified lines
38	#define smp_rmb() RISCV_FENCE(r,r)	38	#define smp_rmb() RISCV_FENCE(r,r)
39	#define smp_wmb() RISCV_FENCE(w,w)	39	#define smp_wmb() RISCV_FENCE(w,w)
40		40
		41	/*
		42	* This is a very specific barrier: it's currently only used in two places in
		43	* the kernel, both in the scheduler. See include/linux/spinlock.h for the two
		44	* orderings it guarantees, but the "critical section is RCsc" guarantee
		45	* mandates a barrier on RISC-V. The sequence looks like:
		46	*
		47	* lr.aq lock
		48	* sc lock <= LOCKED
		49	* smp_mb__after_spinlock()
		50	* // critical section
		51	* lr lock
		52	* sc.rl lock <= UNLOCKED
		53	*
		54	* The AQ/RL pair provides a RCpc critical section, but there's not really any
		55	* way we can take advantage of that here because the ordering is only enforced
		56	* on that one lock. Thus, we're just doing a full fence.
		57	*/
		58	#define smp_mb__after_spinlock() RISCV_FENCE(rw,rw)
		59
41	#include <asm-generic/barrier.h>	60	#include <asm-generic/barrier.h>
42		61
43	#endif /* __ASSEMBLY__ */	62	#endif /* __ASSEMBLY__ */

arch/riscv/kernel/setup.c+0−11

 #include <asm/tlbflush.h>
 #include <asm/thread_info.h>
-#ifdef CONFIG_HVC_RISCV_SBI
-#include <asm/hvc_riscv_sbi.h>
-#endif
 #ifdef CONFIG_DUMMY_CONSOLE
 struct screen_info screen_info = {
 	.orig_video_lines	= 30,
 void __init setup_arch(char **cmdline_p)
 {
-#if defined(CONFIG_HVC_RISCV_SBI)
-	if (likely(early_console == NULL)) {
-		early_console = &riscv_sbi_early_console_dev;
-		register_console(early_console);
-	}
-#endif
 #ifdef CONFIG_CMDLINE_BOOL
 #ifdef CONFIG_CMDLINE_OVERRIDE
 	strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);

arch/riscv/kernel/sys_riscv.c+1−1

@@ -70,7 +70,7 @@ SYSCALL_DEFINE3(riscv_flush_icache, uintptr_t, start, uintptr_t, end, · 69 unmodified lines
70	bool local = (flags & SYS_RISCV_FLUSH_ICACHE_LOCAL) != 0;	70	bool local = (flags & SYS_RISCV_FLUSH_ICACHE_LOCAL) != 0;
71		71
72	/* Check the reserved flags. */	72	/* Check the reserved flags. */
73	if (unlikely(flags & !SYS_RISCV_FLUSH_ICACHE_ALL))	73	if (unlikely(flags & ~SYS_RISCV_FLUSH_ICACHE_ALL))
74	return -EINVAL;	74	return -EINVAL;
75		75
76	flush_icache_mm(mm, local);	76	flush_icache_mm(mm, local);

arch/s390/include/asm/pgtable.h+0−6

 	return pud;
 }
-#define pud_write pud_write
-static inline int pud_write(pud_t pud)
-{
-	return (pud_val(pud) & _REGION3_ENTRY_WRITE) != 0;
-}
 static inline pud_t pud_mkclean(pud_t pud)
 {
 	if (pud_large(pud)) {

arch/s390/kernel/compat_linux.c+1−0

@@ -263,6 +263,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setgroups16, int, gidsetsize, u16 __user *, grouplis · 262 unmodified lines
263	return retval;	263	return retval;
264	}	264	}
265		265
		266	groups_sort(group_info);
266	retval = set_current_groups(group_info);	267	retval = set_current_groups(group_info);
267	put_group_info(group_info);	268	put_group_info(group_info);
268		269

arch/s390/net/bpf_jit_comp.c+5−6

 #define SEEN_LITERAL	8	/* code uses literals */
 #define SEEN_FUNC	16	/* calls C functions */
 #define SEEN_TAIL_CALL	32	/* code uses tail calls */
-#define SEEN_SKB_CHANGE	64	/* code changes skb data */
+#define SEEN_REG_AX	64	/* code uses constant blinding */
-#define SEEN_REG_AX	128	/* code uses constant blinding */
 #define SEEN_STACK	(SEEN_FUNC | SEEN_MEM | SEEN_SKB)
 /*
 			EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
 				      REG_15, 152);
 	}
-	if (jit->seen & SEEN_SKB)
+	if (jit->seen & SEEN_SKB) {
 		emit_load_skb_data_hlen(jit);
-	if (jit->seen & SEEN_SKB_CHANGE)
 		/* stg %b1,ST_OFF_SKBP(%r0,%r15) */
 		EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_1, REG_0, REG_15,
 			      STK_OFF_SKBP);
+	}
 }
 /*
 		EMIT2(0x0d00, REG_14, REG_W1);
 		/* lgr %b0,%r2: load return value into %b0 */
 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
-		if (bpf_helper_changes_pkt_data((void *)func)) {
+		if ((jit->seen & SEEN_SKB) &&
-			jit->seen |= SEEN_SKB_CHANGE;
+		    bpf_helper_changes_pkt_data((void *)func)) {
 			/* lg %b1,ST_OFF_SKBP(%r15) */
 			EMIT6_DISP_LH(0xe3000000, 0x0004, BPF_REG_1, REG_0,
 				      REG_15, STK_OFF_SKBP);

arch/sparc/lib/hweight.S+2−2

@@ -44,8 +44,8 @@ EXPORT_SYMBOL(__arch_hweight32) · 43 unmodified lines
44	.previous	44	.previous
45		45
46	ENTRY(__arch_hweight64)	46	ENTRY(__arch_hweight64)
47	sethi %hi(__sw_hweight16), %g1	47	sethi %hi(__sw_hweight64), %g1
48	jmpl %g1 + %lo(__sw_hweight16), %g0	48	jmpl %g1 + %lo(__sw_hweight64), %g0
49	nop	49	nop
50	ENDPROC(__arch_hweight64)	50	ENDPROC(__arch_hweight64)
51	EXPORT_SYMBOL(__arch_hweight64)	51	EXPORT_SYMBOL(__arch_hweight64)

arch/sparc/mm/fault_32.c+1−1

@@ -113,7 +113,7 @@ show_signal_msg(struct pt_regs *regs, int sig, int code, · 112 unmodified lines
113	if (!printk_ratelimit())	113	if (!printk_ratelimit())
114	return;	114	return;
115		115
116	printk("%s%s[%d]: segfault at %lx ip %p (rpc %p) sp %p error %x",	116	printk("%s%s[%d]: segfault at %lx ip %px (rpc %px) sp %px error %x",
117	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,	117	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
118	tsk->comm, task_pid_nr(tsk), address,	118	tsk->comm, task_pid_nr(tsk), address,
119	(void )regs->pc, (void )regs->u_regs[UREG_I7],	119	(void )regs->pc, (void )regs->u_regs[UREG_I7],

arch/sparc/mm/fault_64.c+1−1

@@ -154,7 +154,7 @@ show_signal_msg(struct pt_regs *regs, int sig, int code, · 153 unmodified lines
154	if (!printk_ratelimit())	154	if (!printk_ratelimit())
155	return;	155	return;
156		156
157	printk("%s%s[%d]: segfault at %lx ip %p (rpc %p) sp %p error %x",	157	printk("%s%s[%d]: segfault at %lx ip %px (rpc %px) sp %px error %x",
158	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,	158	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
159	tsk->comm, task_pid_nr(tsk), address,	159	tsk->comm, task_pid_nr(tsk), address,
160	(void )regs->tpc, (void )regs->u_regs[UREG_I7],	160	(void )regs->tpc, (void )regs->u_regs[UREG_I7],

arch/sparc/mm/gup.c+2−2

@@ -75,7 +75,7 @@ static int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, · 74 unmodified lines
75	if (!(pmd_val(pmd) & _PAGE_VALID))	75	if (!(pmd_val(pmd) & _PAGE_VALID))
76	return 0;	76	return 0;
77		77
78	if (!pmd_access_permitted(pmd, write))	78	if (write && !pmd_write(pmd))
79	return 0;	79	return 0;
80		80
81	refs = 0;	81	refs = 0;
@@ -114,7 +114,7 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr, · 32 unmodified lines
114	if (!(pud_val(pud) & _PAGE_VALID))	114	if (!(pud_val(pud) & _PAGE_VALID))
115	return 0;	115	return 0;
116		116
117	if (!pud_access_permitted(pud, write))	117	if (write && !pud_write(pud))
118	return 0;	118	return 0;
119		119
120	refs = 0;	120	refs = 0;

arch/sparc/net/bpf_jit_comp_64.c+4−2

 		u8 *func = ((u8 *)__bpf_call_base) + imm;
 		ctx->saw_call = true;
+		if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
+			emit_reg_move(bpf2sparc[BPF_REG_1], L7, ctx);
 		emit_call((u32 *)func, ctx);
 		emit_nop(ctx);
 		emit_reg_move(O0, bpf2sparc[BPF_REG_0], ctx);
-		if (bpf_helper_changes_pkt_data(func) && ctx->saw_ld_abs_ind)
+		if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
-			load_skb_regs(ctx, bpf2sparc[BPF_REG_6]);
+			load_skb_regs(ctx, L7);
 		break;
 	}

arch/um/include/asm/Kbuild+1−0

@@ -1,4 +1,5 @@
1	generic-y += barrier.h	1	generic-y += barrier.h
		2	generic-y += bpf_perf_event.h
2	generic-y += bug.h	3	generic-y += bug.h
3	generic-y += clkdev.h	4	generic-y += clkdev.h
4	generic-y += current.h	5	generic-y += current.h

arch/um/include/asm/mmu_context.h+2−1

 /*
  * Needed since we do not use the asm-generic/mm_hooks.h:
  */
-static inline void arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
+static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 {
 	uml_setup_stubs(mm);
+	return 0;
 }
 extern void arch_exit_mmap(struct mm_struct *mm);
 static inline void arch_unmap(struct mm_struct *mm,

arch/um/kernel/trap.c+1−1

@@ -150,7 +150,7 @@ static void show_segv_info(struct uml_pt_regs *regs) · 149 unmodified lines
150	if (!printk_ratelimit())	150	if (!printk_ratelimit())
151	return;	151	return;
152		152
153	printk("%s%s[%d]: segfault at %lx ip %p sp %p error %x",	153	printk("%s%s[%d]: segfault at %lx ip %px sp %px error %x",
154	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,	154	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
155	tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi),	155	tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi),
156	(void )UPT_IP(regs), (void )UPT_SP(regs),	156	(void )UPT_IP(regs), (void )UPT_SP(regs),

arch/unicore32/include/asm/mmu_context.h+3−2

 	} \
 } while (0)
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
-				 struct mm_struct *mm)
+				struct mm_struct *mm)
 {
+	return 0;
 }
 static inline void arch_unmap(struct mm_struct *mm,

arch/x86/Kconfig+2−1

 config NR_CPUS
 	int "Maximum number of CPUs" if SMP && !MAXSMP
 	range 2 8 if SMP && X86_32 && !X86_BIGSMP
-	range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK
+	range 2 64 if SMP && X86_32 && X86_BIGSMP
+	range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK && X86_64
 	range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64
 	default "1" if !SMP
 	default "8192" if MAXSMP

arch/x86/Kconfig.debug+1−0

@@ -400,6 +400,7 @@ config UNWINDER_FRAME_POINTER · 399 unmodified lines
400	config UNWINDER_GUESS	400	config UNWINDER_GUESS
401	bool "Guess unwinder"	401	bool "Guess unwinder"
402	depends on EXPERT	402	depends on EXPERT
		403	depends on !STACKDEPOT
403	---help---	404	---help---
404	This option enables the "guess" unwinder for unwinding kernel stack	405	This option enables the "guess" unwinder for unwinding kernel stack
405	traces. It scans the stack and reports every kernel text address it	406	traces. It scans the stack and reports every kernel text address it

arch/x86/boot/compressed/Makefile+1−0

@@ -80,6 +80,7 @@ vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/kaslr.o · 79 unmodified lines
80	ifdef CONFIG_X86_64	80	ifdef CONFIG_X86_64
81	vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/pagetable.o	81	vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/pagetable.o
82	vmlinux-objs-y += $(obj)/mem_encrypt.o	82	vmlinux-objs-y += $(obj)/mem_encrypt.o
		83	vmlinux-objs-y += $(obj)/pgtable_64.o
83	endif	84	endif
84		85
85	$(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone	86	$(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone

arch/x86/boot/compressed/head_64.S+12−4

 	leaq	boot_stack_end(%rbx), %rsp
 #ifdef CONFIG_X86_5LEVEL
-	/* Check if 5-level paging has already enabled */
+	/*
-	movq	%cr4, %rax
+	 * Check if we need to enable 5-level paging.
-	testl	$X86_CR4_LA57, %eax
+	 * RSI holds real mode data and need to be preserved across
-	jnz	lvl5
+	 * a function call.
+	 */
+	pushq	%rsi
+	call	l5_paging_required
+	popq	%rsi
+	/* If l5_paging_required() returned zero, we're done here. */
+	cmpq	$0, %rax
+	je	lvl5
 	/*
 	 * At this point we are in long mode with 4-level paging enabled,

arch/x86/boot/compressed/misc.c+16−0

@@ -169,6 +169,16 @@ void __puthex(unsigned long value) · 168 unmodified lines
169	}	169	}
170	}	170	}
171		171
		172	static bool l5_supported(void)
		173	{
		174	/* Check if leaf 7 is supported. */
		175	if (native_cpuid_eax(0) < 7)
		176	return 0;
		177
		178	/* Check if la57 is supported. */
		179	return native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31));
		180	}
		181
172	#if CONFIG_X86_NEED_RELOCS	182	#if CONFIG_X86_NEED_RELOCS
173	static void handle_relocations(void *output, unsigned long output_len,	183	static void handle_relocations(void *output, unsigned long output_len,
174	unsigned long virt_addr)	184	unsigned long virt_addr)
@@ -362,6 +372,12 @@ asmlinkage __visible void extract_kernel(void rmode, memptr heap, · 187 unmodified lines
362	console_init();	372	console_init();
363	debug_putstr("early console in extract_kernel\n");	373	debug_putstr("early console in extract_kernel\n");
364		374
		375	if (IS_ENABLED(CONFIG_X86_5LEVEL) && !l5_supported()) {
		376	error("This linux kernel as configured requires 5-level paging\n"
		377	"This CPU does not support the required 'cr4.la57' feature\n"
		378	"Unable to boot - please use a kernel appropriate for your CPU\n");
		379	}
		380
365	free_mem_ptr = heap; /* Heap */	381	free_mem_ptr = heap; /* Heap */
366	free_mem_end_ptr = heap + BOOT_HEAP_SIZE;	382	free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
367		383

arch/x86/boot/compressed/pagetable.c+3−0

@@ -23,6 +23,9 @@ · 22 unmodified lines
23	*/	23	*/
24	#undef CONFIG_AMD_MEM_ENCRYPT	24	#undef CONFIG_AMD_MEM_ENCRYPT
25		25
		26	/* No PAGE_TABLE_ISOLATION support needed either: */
		27	#undef CONFIG_PAGE_TABLE_ISOLATION
		28
26	#include "misc.h"	29	#include "misc.h"
27		30
28	/* These actually do the work of building the kernel identity maps. */	31	/* These actually do the work of building the kernel identity maps. */

arch/x86/boot/compressed/pgtable_64.c+28−0

@@ -0,0 +1,28 @@
	1	#include <asm/processor.h>
	2
	3	/*
	4	* __force_order is used by special_insns.h asm code to force instruction
	5	* serialization.
	6	*
	7	* It is not referenced from the code, but GCC < 5 with -fPIE would fail
	8	* due to an undefined symbol. Define it to make these ancient GCCs work.
	9	*/
	10	unsigned long __force_order;
	11
	12	int l5_paging_required(void)
	13	{
	14	/* Check if leaf 7 is supported. */
	15
	16	if (native_cpuid_eax(0) < 7)
	17	return 0;
	18
	19	/* Check if la57 is supported. */
	20	if (!(native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31))))
	21	return 0;
	22
	23	/* Check if 5-level paging has already been enabled. */
	24	if (native_read_cr4() & X86_CR4_LA57)
	25	return 0;
	26
	27	return 1;
	28	}

arch/x86/boot/genimage.sh+19−13

 # Make sure the files actually exist
 verify "$FBZIMAGE"
-verify "$MTOOLSRC"
 genbzdisk() {
+	verify "$MTOOLSRC"
 	mformat a:
 	syslinux $FIMAGE
 	echo "$KCMDLINE" | mcopy - a:syslinux.cfg
 }
 genfdimage144() {
+	verify "$MTOOLSRC"
 	dd if=/dev/zero of=$FIMAGE bs=1024 count=1440 2> /dev/null
 	mformat v:
 	syslinux $FIMAGE
 }
 genfdimage288() {
+	verify "$MTOOLSRC"
 	dd if=/dev/zero of=$FIMAGE bs=1024 count=2880 2> /dev/null
 	mformat w:
 	syslinux $FIMAGE
 	mcopy $FBZIMAGE w:linux
 }
-genisoimage() {
+geniso() {
 	tmp_dir=`dirname $FIMAGE`/isoimage
 	rm -rf $tmp_dir
 	mkdir $tmp_dir
-	for i in lib lib64 share end ; do
+	for i in lib lib64 share ; do
 		for j in syslinux ISOLINUX ; do
 			if [ -f /usr/$i/$j/isolinux.bin ] ; then
 				isolinux=/usr/$i/$j/isolinux.bin
-				cp $isolinux $tmp_dir
 			fi
 		done
 		for j in syslinux syslinux/modules/bios ; do
 			if [ -f /usr/$i/$j/ldlinux.c32 ]; then
 				ldlinux=/usr/$i/$j/ldlinux.c32
-				cp $ldlinux $tmp_dir
 			fi
 		done
 		if [ -n "$isolinux" -a -n "$ldlinux" ] ; then
 			break
 		fi
-		if [ $i = end -a -z "$isolinux" ] ; then
-			echo 'Need an isolinux.bin file, please install syslinux/isolinux.'
-			exit 1
-		fi
 	done
+	if [ -z "$isolinux" ] ; then
+		echo 'Need an isolinux.bin file, please install syslinux/isolinux.'
+		exit 1
+	fi
+	if [ -z "$ldlinux" ] ; then
+		echo 'Need an ldlinux.c32 file, please install syslinux/isolinux.'
+		exit 1
+	fi
+	cp $isolinux $tmp_dir
+	cp $ldlinux $tmp_dir
 	cp $FBZIMAGE $tmp_dir/linux
 	echo "$KCMDLINE" > $tmp_dir/isolinux.cfg
 	if [ -f "$FDINITRD" ] ; then
 		cp "$FDINITRD" $tmp_dir/initrd.img
 	fi
-	mkisofs -J -r -input-charset=utf-8 -quiet -o $FIMAGE -b isolinux.bin \
+	genisoimage -J -r -input-charset=utf-8 -quiet -o $FIMAGE \
-		-c boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table \
+		-b isolinux.bin -c boot.cat -no-emul-boot -boot-load-size 4 \
-		$tmp_dir
+		-boot-info-table $tmp_dir
 	isohybrid $FIMAGE 2>/dev/null || true
 	rm -rf $tmp_dir
 }
 	bzdisk)     genbzdisk;;
 	fdimage144) genfdimage144;;
 	fdimage288) genfdimage288;;
-	isoimage)   genisoimage;;
+	isoimage)   geniso;;
 	*)          echo 'Unknown image format'; exit 1;
 esac

arch/x86/crypto/salsa20_glue.c+0−7

@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc, · 58 unmodified lines
59		59
60	salsa20_ivsetup(ctx, walk.iv);	60	salsa20_ivsetup(ctx, walk.iv);
61		61
62	if (likely(walk.nbytes == nbytes))
63	{
64	salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
65	walk.dst.virt.addr, nbytes);
66	return blkcipher_walk_done(desc, &walk, 0);
67	}
68
69	while (walk.nbytes >= 64) {	62	while (walk.nbytes >= 64) {
70	salsa20_encrypt_bytes(ctx, walk.src.virt.addr,	63	salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
71	walk.dst.virt.addr,	64	walk.dst.virt.addr,

arch/x86/entry/calling.h+145−0

@@ -1,6 +1,11 @@
1	/* SPDX-License-Identifier: GPL-2.0 */	1	/* SPDX-License-Identifier: GPL-2.0 */
2	#include <linux/jump_label.h>	2	#include <linux/jump_label.h>
3	#include <asm/unwind_hints.h>	3	#include <asm/unwind_hints.h>
		4	#include <asm/cpufeatures.h>
		5	#include <asm/page_types.h>
		6	#include <asm/percpu.h>
		7	#include <asm/asm-offsets.h>
		8	#include <asm/processor-flags.h>
4		9
5	/*	10	/*
6		11
@@ -187,6 +192,146 @@ For 32-bit we have the following conventions - kernel is built with · 180 unmodified lines
187	#endif	192	#endif
188	.endm	193	.endm
189		194
		195	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		196
		197	/*
		198	* PAGE_TABLE_ISOLATION PGDs are 8k. Flip bit 12 to switch between the two
		199	* halves:
		200	*/
		201	#define PTI_SWITCH_PGTABLES_MASK (1<<PAGE_SHIFT)
		202	#define PTI_SWITCH_MASK (PTI_SWITCH_PGTABLES_MASK\|(1<<X86_CR3_PTI_SWITCH_BIT))
		203
		204	.macro SET_NOFLUSH_BIT reg:req
		205	bts $X86_CR3_PCID_NOFLUSH_BIT, \reg
		206	.endm
		207
		208	.macro ADJUST_KERNEL_CR3 reg:req
		209	ALTERNATIVE "", "SET_NOFLUSH_BIT \reg", X86_FEATURE_PCID
		210	/* Clear PCID and "PAGE_TABLE_ISOLATION bit", point CR3 at kernel pagetables: */
		211	andq $(~PTI_SWITCH_MASK), \reg
		212	.endm
		213
		214	.macro SWITCH_TO_KERNEL_CR3 scratch_reg:req
		215	ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
		216	mov %cr3, \scratch_reg
		217	ADJUST_KERNEL_CR3 \scratch_reg
		218	mov \scratch_reg, %cr3
		219	.Lend_\@:
		220	.endm
		221
		222	#define THIS_CPU_user_pcid_flush_mask \
		223	PER_CPU_VAR(cpu_tlbstate) + TLB_STATE_user_pcid_flush_mask
		224
		225	.macro SWITCH_TO_USER_CR3_NOSTACK scratch_reg:req scratch_reg2:req
		226	ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
		227	mov %cr3, \scratch_reg
		228
		229	ALTERNATIVE "jmp .Lwrcr3_\@", "", X86_FEATURE_PCID
		230
		231	/*
		232	* Test if the ASID needs a flush.
		233	*/
		234	movq \scratch_reg, \scratch_reg2
		235	andq $(0x7FF), \scratch_reg /* mask ASID */
		236	bt \scratch_reg, THIS_CPU_user_pcid_flush_mask
		237	jnc .Lnoflush_\@
		238
		239	/* Flush needed, clear the bit */
		240	btr \scratch_reg, THIS_CPU_user_pcid_flush_mask
		241	movq \scratch_reg2, \scratch_reg
		242	jmp .Lwrcr3_\@
		243
		244	.Lnoflush_\@:
		245	movq \scratch_reg2, \scratch_reg
		246	SET_NOFLUSH_BIT \scratch_reg
		247
		248	.Lwrcr3_\@:
		249	/* Flip the PGD and ASID to the user version */
		250	orq $(PTI_SWITCH_MASK), \scratch_reg
		251	mov \scratch_reg, %cr3
		252	.Lend_\@:
		253	.endm
		254
		255	.macro SWITCH_TO_USER_CR3_STACK scratch_reg:req
		256	pushq %rax
		257	SWITCH_TO_USER_CR3_NOSTACK scratch_reg=\scratch_reg scratch_reg2=%rax
		258	popq %rax
		259	.endm
		260
		261	.macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req
		262	ALTERNATIVE "jmp .Ldone_\@", "", X86_FEATURE_PTI
		263	movq %cr3, \scratch_reg
		264	movq \scratch_reg, \save_reg
		265	/*
		266	* Is the "switch mask" all zero? That means that both of
		267	* these are zero:
		268	*
		269	* 1. The user/kernel PCID bit, and
		270	* 2. The user/kernel "bit" that points CR3 to the
		271	* bottom half of the 8k PGD
		272	*
		273	* That indicates a kernel CR3 value, not a user CR3.
		274	*/
		275	testq $(PTI_SWITCH_MASK), \scratch_reg
		276	jz .Ldone_\@
		277
		278	ADJUST_KERNEL_CR3 \scratch_reg
		279	movq \scratch_reg, %cr3
		280
		281	.Ldone_\@:
		282	.endm
		283
		284	.macro RESTORE_CR3 scratch_reg:req save_reg:req
		285	ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
		286
		287	ALTERNATIVE "jmp .Lwrcr3_\@", "", X86_FEATURE_PCID
		288
		289	/*
		290	* KERNEL pages can always resume with NOFLUSH as we do
		291	* explicit flushes.
		292	*/
		293	bt $X86_CR3_PTI_SWITCH_BIT, \save_reg
		294	jnc .Lnoflush_\@
		295
		296	/*
		297	* Check if there's a pending flush for the user ASID we're
		298	* about to set.
		299	*/
		300	movq \save_reg, \scratch_reg
		301	andq $(0x7FF), \scratch_reg
		302	bt \scratch_reg, THIS_CPU_user_pcid_flush_mask
		303	jnc .Lnoflush_\@
		304
		305	btr \scratch_reg, THIS_CPU_user_pcid_flush_mask
		306	jmp .Lwrcr3_\@
		307
		308	.Lnoflush_\@:
		309	SET_NOFLUSH_BIT \save_reg
		310
		311	.Lwrcr3_\@:
		312	/*
		313	* The CR3 write could be avoided when not changing its value,
		314	* but would require a CR3 read and a scratch register.
		315	*/
		316	movq \save_reg, %cr3
		317	.Lend_\@:
		318	.endm
		319
		320	#else /* CONFIG_PAGE_TABLE_ISOLATION=n: */
		321
		322	.macro SWITCH_TO_KERNEL_CR3 scratch_reg:req
		323	.endm
		324	.macro SWITCH_TO_USER_CR3_NOSTACK scratch_reg:req scratch_reg2:req
		325	.endm
		326	.macro SWITCH_TO_USER_CR3_STACK scratch_reg:req
		327	.endm
		328	.macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req
		329	.endm
		330	.macro RESTORE_CR3 scratch_reg:req save_reg:req
		331	.endm
		332
		333	#endif
		334
190	#endif /* CONFIG_X86_64 */	335	#endif /* CONFIG_X86_64 */
191		336
192	/*	337	/*

arch/x86/entry/entry_32.S+8−6

 	movl	%esp, %eax			# pt_regs pointer
 	/* Are we currently on the SYSENTER stack? */
-	PER_CPU(cpu_tss + CPU_TSS_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx)
+	movl	PER_CPU_VAR(cpu_entry_area), %ecx
-	subl	%eax, %ecx	/* ecx = (end of SYSENTER_stack) - esp */
+	addl	$CPU_ENTRY_AREA_entry_stack + SIZEOF_entry_stack, %ecx
-	cmpl	$SIZEOF_SYSENTER_stack, %ecx
+	subl	%eax, %ecx	/* ecx = (end of entry_stack) - esp */
+	cmpl	$SIZEOF_entry_stack, %ecx
 	jb	.Ldebug_from_sysenter_stack
 	TRACE_IRQS_OFF
 	movl	%esp, %eax			# pt_regs pointer
 	/* Are we currently on the SYSENTER stack? */
-	PER_CPU(cpu_tss + CPU_TSS_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx)
+	movl	PER_CPU_VAR(cpu_entry_area), %ecx
-	subl	%eax, %ecx	/* ecx = (end of SYSENTER_stack) - esp */
+	addl	$CPU_ENTRY_AREA_entry_stack + SIZEOF_entry_stack, %ecx
-	cmpl	$SIZEOF_SYSENTER_stack, %ecx
+	subl	%eax, %ecx	/* ecx = (end of entry_stack) - esp */
+	cmpl	$SIZEOF_entry_stack, %ecx
 	jb	.Lnmi_from_sysenter_stack
 	/* Not on SYSENTER stack. */

arch/x86/entry/entry_64.S+205−32

@@ -23,7 +23,6 @@ · 22 unmodified lines
23	#include <asm/segment.h>	23	#include <asm/segment.h>
24	#include <asm/cache.h>	24	#include <asm/cache.h>
25	#include <asm/errno.h>	25	#include <asm/errno.h>
26	#include "calling.h"
27	#include <asm/asm-offsets.h>	26	#include <asm/asm-offsets.h>
28	#include <asm/msr.h>	27	#include <asm/msr.h>
29	#include <asm/unistd.h>	28	#include <asm/unistd.h>
@@ -40,6 +39,8 @@ · 10 unmodified lines
40	#include <asm/frame.h>	39	#include <asm/frame.h>
41	#include <linux/err.h>	40	#include <linux/err.h>
42		41
		42	#include "calling.h"
		43
43	.code64	44	.code64
44	.section .entry.text, "ax"	45	.section .entry.text, "ax"
45		46
@@ -140,6 +141,67 @@ END(native_usergs_sysret64) · 94 unmodified lines
140	* with them due to bugs in both AMD and Intel CPUs.	141	* with them due to bugs in both AMD and Intel CPUs.
141	*/	142	*/
142		143
		144	.pushsection .entry_trampoline, "ax"
		145
		146	/*
		147	* The code in here gets remapped into cpu_entry_area's trampoline. This means
		148	* that the assembler and linker have the wrong idea as to where this code
		149	* lives (and, in fact, it's mapped more than once, so it's not even at a
		150	* fixed address). So we can't reference any symbols outside the entry
		151	* trampoline and expect it to work.
		152	*
		153	* Instead, we carefully abuse %rip-relative addressing.
		154	* _entry_trampoline(%rip) refers to the start of the remapped) entry
		155	* trampoline. We can thus find cpu_entry_area with this macro:
		156	*/
		157
		158	#define CPU_ENTRY_AREA \
		159	_entry_trampoline - CPU_ENTRY_AREA_entry_trampoline(%rip)
		160
		161	/* The top word of the SYSENTER stack is hot and is usable as scratch space. */
		162	#define RSP_SCRATCH CPU_ENTRY_AREA_entry_stack + \
		163	SIZEOF_entry_stack - 8 + CPU_ENTRY_AREA
		164
		165	ENTRY(entry_SYSCALL_64_trampoline)
		166	UNWIND_HINT_EMPTY
		167	swapgs
		168
		169	/* Stash the user RSP. */
		170	movq %rsp, RSP_SCRATCH
		171
		172	/* Note: using %rsp as a scratch reg. */
		173	SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
		174
		175	/* Load the top of the task stack into RSP */
		176	movq CPU_ENTRY_AREA_tss + TSS_sp1 + CPU_ENTRY_AREA, %rsp
		177
		178	/* Start building the simulated IRET frame. */
		179	pushq $__USER_DS /* pt_regs->ss */
		180	pushq RSP_SCRATCH /* pt_regs->sp */
		181	pushq %r11 /* pt_regs->flags */
		182	pushq $__USER_CS /* pt_regs->cs */
		183	pushq %rcx /* pt_regs->ip */
		184
		185	/*
		186	* x86 lacks a near absolute jump, and we can't jump to the real
		187	* entry text with a relative jump. We could push the target
		188	* address and then use retq, but this destroys the pipeline on
		189	* many CPUs (wasting over 20 cycles on Sandy Bridge). Instead,
		190	* spill RDI and restore it in a second-stage trampoline.
		191	*/
		192	pushq %rdi
		193	movq $entry_SYSCALL_64_stage2, %rdi
		194	jmp *%rdi
		195	END(entry_SYSCALL_64_trampoline)
		196
		197	.popsection
		198
		199	ENTRY(entry_SYSCALL_64_stage2)
		200	UNWIND_HINT_EMPTY
		201	popq %rdi
		202	jmp entry_SYSCALL_64_after_hwframe
		203	END(entry_SYSCALL_64_stage2)
		204
143	ENTRY(entry_SYSCALL_64)	205	ENTRY(entry_SYSCALL_64)
144	UNWIND_HINT_EMPTY	206	UNWIND_HINT_EMPTY
145	/*	207	/*
@@ -149,6 +211,10 @@ ENTRY(entry_SYSCALL_64) · 3 unmodified lines
149	*/	211	*/
150		212
151	swapgs	213	swapgs
		214	/*
		215	* This path is not taken when PAGE_TABLE_ISOLATION is disabled so it
		216	* is not required to switch CR3.
		217	*/
152	movq %rsp, PER_CPU_VAR(rsp_scratch)	218	movq %rsp, PER_CPU_VAR(rsp_scratch)
153	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp	219	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
154		220
@@ -330,8 +396,25 @@ syscall_return_via_sysret: · 175 unmodified lines
330	popq %rsi /* skip rcx */	396	popq %rsi /* skip rcx */
331	popq %rdx	397	popq %rdx
332	popq %rsi	398	popq %rsi
		399
		400	/*
		401	* Now all regs are restored except RSP and RDI.
		402	* Save old stack pointer and switch to trampoline stack.
		403	*/
		404	movq %rsp, %rdi
		405	movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
		406
		407	pushq RSP-RDI(%rdi) /* RSP */
		408	pushq (%rdi) /* RDI */
		409
		410	/*
		411	* We are on the trampoline stack. All regs except RDI are live.
		412	* We can do future final exit work right here.
		413	*/
		414	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
		415
333	popq %rdi	416	popq %rdi
334	movq RSP-ORIG_RAX(%rsp), %rsp	417	popq %rsp
335	USERGS_SYSRET64	418	USERGS_SYSRET64
336	END(entry_SYSCALL_64)	419	END(entry_SYSCALL_64)
337		420
@@ -466,12 +549,13 @@ END(irq_entries_start) · 128 unmodified lines
466		549
467	.macro DEBUG_ENTRY_ASSERT_IRQS_OFF	550	.macro DEBUG_ENTRY_ASSERT_IRQS_OFF
468	#ifdef CONFIG_DEBUG_ENTRY	551	#ifdef CONFIG_DEBUG_ENTRY
469	pushfq	552	pushq %rax
470	testl $X86_EFLAGS_IF, (%rsp)	553	SAVE_FLAGS(CLBR_RAX)
		554	testl $X86_EFLAGS_IF, %eax
471	jz .Lokay_\@	555	jz .Lokay_\@
472	ud2	556	ud2
473	.Lokay_\@:	557	.Lokay_\@:
474	addq $8, %rsp	558	popq %rax
475	#endif	559	#endif
476	.endm	560	.endm
477		561
@@ -563,6 +647,13 @@ END(irq_entries_start) · 85 unmodified lines
563	/* 0(%rsp): ~(interrupt number) */	647	/* 0(%rsp): ~(interrupt number) */
564	.macro interrupt func	648	.macro interrupt func
565	cld	649	cld
		650
		651	testb $3, CS-ORIG_RAX(%rsp)
		652	jz 1f
		653	SWAPGS
		654	call switch_to_thread_stack
		655	1:
		656
566	ALLOC_PT_GPREGS_ON_STACK	657	ALLOC_PT_GPREGS_ON_STACK
567	SAVE_C_REGS	658	SAVE_C_REGS
568	SAVE_EXTRA_REGS	659	SAVE_EXTRA_REGS
@@ -572,12 +663,8 @@ END(irq_entries_start) · 3 unmodified lines
572	jz 1f	663	jz 1f
573		664
574	/*	665	/*
575	* IRQ from user mode. Switch to kernel gsbase and inform context	666	* IRQ from user mode.
576	* tracking that we're in kernel mode.	667	*
577	*/
578	SWAPGS
579
580	/*
581	* We need to tell lockdep that IRQs are off. We can't do this until	668	* We need to tell lockdep that IRQs are off. We can't do this until
582	* we fix gsbase, and we should do it before enter_from_user_mode	669	* we fix gsbase, and we should do it before enter_from_user_mode
583	* (which can take locks). Since TRACE_IRQS_OFF idempotent,	670	* (which can take locks). Since TRACE_IRQS_OFF idempotent,
@@ -630,10 +717,43 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode) · 46 unmodified lines
630	ud2	717	ud2
631	1:	718	1:
632	#endif	719	#endif
633	SWAPGS
634	POP_EXTRA_REGS	720	POP_EXTRA_REGS
635	POP_C_REGS	721	popq %r11
636	addq $8, %rsp /* skip regs->orig_ax */	722	popq %r10
		723	popq %r9
		724	popq %r8
		725	popq %rax
		726	popq %rcx
		727	popq %rdx
		728	popq %rsi
		729
		730	/*
		731	* The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
		732	* Save old stack pointer and switch to trampoline stack.
		733	*/
		734	movq %rsp, %rdi
		735	movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
		736
		737	/* Copy the IRET frame to the trampoline stack. */
		738	pushq 68(%rdi) / SS */
		739	pushq 58(%rdi) / RSP */
		740	pushq 48(%rdi) / EFLAGS */
		741	pushq 38(%rdi) / CS */
		742	pushq 28(%rdi) / RIP */
		743
		744	/* Push user RDI on the trampoline stack. */
		745	pushq (%rdi)
		746
		747	/*
		748	* We are on the trampoline stack. All regs except RDI are live.
		749	* We can do future final exit work right here.
		750	*/
		751
		752	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
		753
		754	/* Restore RDI. */
		755	popq %rdi
		756	SWAPGS
637	INTERRUPT_RETURN	757	INTERRUPT_RETURN
638		758
639		759
@@ -713,7 +833,9 @@ native_irq_return_ldt: · 73 unmodified lines
713	*/	833	*/
714		834
715	pushq %rdi /* Stash user RDI */	835	pushq %rdi /* Stash user RDI */
716	SWAPGS	836	SWAPGS /* to kernel GS */
		837	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi /* to kernel CR3 */
		838
717	movq PER_CPU_VAR(espfix_waddr), %rdi	839	movq PER_CPU_VAR(espfix_waddr), %rdi
718	movq %rax, (08)(%rdi) / user RAX */	840	movq %rax, (08)(%rdi) / user RAX */
719	movq (18)(%rsp), %rax / user RIP */	841	movq (18)(%rsp), %rax / user RIP */
@@ -729,7 +851,6 @@ native_irq_return_ldt: · 9 unmodified lines
729	/* Now RAX == RSP. */	851	/* Now RAX == RSP. */
730		852
731	andl $0xffff0000, %eax /* RAX = (RSP & 0xffff0000) */	853	andl $0xffff0000, %eax /* RAX = (RSP & 0xffff0000) */
732	popq %rdi /* Restore user RDI */
733		854
734	/*	855	/*
735	* espfix_stack[31:16] == 0. The page tables are set up such that	856	* espfix_stack[31:16] == 0. The page tables are set up such that
@@ -740,7 +861,11 @@ native_irq_return_ldt: · 4 unmodified lines
740	* still points to an RO alias of the ESPFIX stack.	861	* still points to an RO alias of the ESPFIX stack.
741	*/	862	*/
742	orq PER_CPU_VAR(espfix_stack), %rax	863	orq PER_CPU_VAR(espfix_stack), %rax
743	SWAPGS	864
		865	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
		866	SWAPGS /* to user GS */
		867	popq %rdi /* Restore user RDI */
		868
744	movq %rax, %rsp	869	movq %rax, %rsp
745	UNWIND_HINT_IRET_REGS offset=8	870	UNWIND_HINT_IRET_REGS offset=8
746		871
@@ -829,7 +954,35 @@ apicinterrupt IRQ_WORK_VECTOR irq_work_interrupt smp_irq_work_interrupt · 82 unmodified lines
829	/*	954	/*
830	* Exception entry points.	955	* Exception entry points.
831	*/	956	*/
832	#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss) + (TSS_ist + ((x) - 1) * 8)	957	#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss_rw) + (TSS_ist + ((x) - 1) * 8)
		958
		959	/*
		960	* Switch to the thread stack. This is called with the IRET frame and
		961	* orig_ax on the stack. (That is, RDI..R12 are not on the stack and
		962	* space has not been allocated for them.)
		963	*/
		964	ENTRY(switch_to_thread_stack)
		965	UNWIND_HINT_FUNC
		966
		967	pushq %rdi
		968	/* Need to switch before accessing the thread stack. */
		969	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
		970	movq %rsp, %rdi
		971	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
		972	UNWIND_HINT sp_offset=16 sp_reg=ORC_REG_DI
		973
		974	pushq 78(%rdi) / regs->ss */
		975	pushq 68(%rdi) / regs->rsp */
		976	pushq 58(%rdi) / regs->eflags */
		977	pushq 48(%rdi) / regs->cs */
		978	pushq 38(%rdi) / regs->ip */
		979	pushq 28(%rdi) / regs->orig_ax */
		980	pushq 8(%rdi) /* return address */
		981	UNWIND_HINT_FUNC
		982
		983	movq (%rdi), %rdi
		984	ret
		985	END(switch_to_thread_stack)
833		986
834	.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1	987	.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
835	ENTRY(\sym)	988	ENTRY(\sym)
@@ -848,11 +1001,12 @@ ENTRY(\sym) · 12 unmodified lines
848		1001
849	ALLOC_PT_GPREGS_ON_STACK	1002	ALLOC_PT_GPREGS_ON_STACK
850		1003
851	.if \paranoid	1004	.if \paranoid < 2
852	.if \paranoid == 1
853	testb $3, CS(%rsp) /* If coming from userspace, switch stacks */	1005	testb $3, CS(%rsp) /* If coming from userspace, switch stacks */
854	jnz 1f	1006	jnz .Lfrom_usermode_switch_stack_\@
855	.endif	1007	.endif
		1008
		1009	.if \paranoid
856	call paranoid_entry	1010	call paranoid_entry
857	.else	1011	.else
858	call error_entry	1012	call error_entry
@@ -894,20 +1048,15 @@ ENTRY(\sym) · 35 unmodified lines
894	jmp error_exit	1048	jmp error_exit
895	.endif	1049	.endif
896		1050
897	.if \paranoid == 1	1051	.if \paranoid < 2
898	/*	1052	/*
899	* Paranoid entry from userspace. Switch stacks and treat it	1053	* Entry from userspace. Switch stacks and treat it
900	* as a normal entry. This means that paranoid handlers	1054	* as a normal entry. This means that paranoid handlers
901	* run in real process context if user_mode(regs).	1055	* run in real process context if user_mode(regs).
902	*/	1056	*/
903	1:	1057	.Lfrom_usermode_switch_stack_\@:
904	call error_entry	1058	call error_entry
905		1059
906
907	movq %rsp, %rdi /* pt_regs pointer */
908	call sync_regs
909	movq %rax, %rsp /* switch stack */
910
911	movq %rsp, %rdi /* pt_regs pointer */	1060	movq %rsp, %rdi /* pt_regs pointer */
912		1061
913	.if \has_error_code	1062	.if \has_error_code
@@ -1119,7 +1268,11 @@ ENTRY(paranoid_entry) · 205 unmodified lines
1119	js 1f /* negative -> in kernel */	1268	js 1f /* negative -> in kernel */
1120	SWAPGS	1269	SWAPGS
1121	xorl %ebx, %ebx	1270	xorl %ebx, %ebx
1122	1: ret	1271
		1272	1:
		1273	SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14
		1274
		1275	ret
1123	END(paranoid_entry)	1276	END(paranoid_entry)
1124		1277
1125	/*	1278	/*
@@ -1141,6 +1294,7 @@ ENTRY(paranoid_exit) · 15 unmodified lines
1141	testl %ebx, %ebx /* swapgs needed? */	1294	testl %ebx, %ebx /* swapgs needed? */
1142	jnz .Lparanoid_exit_no_swapgs	1295	jnz .Lparanoid_exit_no_swapgs
1143	TRACE_IRQS_IRETQ	1296	TRACE_IRQS_IRETQ
		1297	RESTORE_CR3 scratch_reg=%rbx save_reg=%r14
1144	SWAPGS_UNSAFE_STACK	1298	SWAPGS_UNSAFE_STACK
1145	jmp .Lparanoid_exit_restore	1299	jmp .Lparanoid_exit_restore
1146	.Lparanoid_exit_no_swapgs:	1300	.Lparanoid_exit_no_swapgs:
@@ -1168,8 +1322,18 @@ ENTRY(error_entry) · 21 unmodified lines
1168	* from user mode due to an IRET fault.	1322	* from user mode due to an IRET fault.
1169	*/	1323	*/
1170	SWAPGS	1324	SWAPGS
		1325	/* We have user CR3. Change to kernel CR3. */
		1326	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
1171		1327
1172	.Lerror_entry_from_usermode_after_swapgs:	1328	.Lerror_entry_from_usermode_after_swapgs:
		1329	/* Put us onto the real thread stack. */
		1330	popq %r12 /* save return addr in %12 */
		1331	movq %rsp, %rdi /* arg0 = pt_regs pointer */
		1332	call sync_regs
		1333	movq %rax, %rsp /* switch stack */
		1334	ENCODE_FRAME_POINTER
		1335	pushq %r12
		1336
1173	/*	1337	/*
1174	* We need to tell lockdep that IRQs are off. We can't do this until	1338	* We need to tell lockdep that IRQs are off. We can't do this until
1175	* we fix gsbase, and we should do it before enter_from_user_mode	1339	* we fix gsbase, and we should do it before enter_from_user_mode
@@ -1206,6 +1370,7 @@ ENTRY(error_entry) · 30 unmodified lines
1206	* .Lgs_change's error handler with kernel gsbase.	1370	* .Lgs_change's error handler with kernel gsbase.
1207	*/	1371	*/
1208	SWAPGS	1372	SWAPGS
		1373	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
1209	jmp .Lerror_entry_done	1374	jmp .Lerror_entry_done
1210		1375
1211	.Lbstep_iret:	1376	.Lbstep_iret:
@@ -1215,10 +1380,11 @@ ENTRY(error_entry) · 3 unmodified lines
1215		1380
1216	.Lerror_bad_iret:	1381	.Lerror_bad_iret:
1217	/*	1382	/*
1218	* We came from an IRET to user mode, so we have user gsbase.	1383	* We came from an IRET to user mode, so we have user
1219	* Switch to kernel gsbase:	1384	* gsbase and CR3. Switch to kernel gsbase and CR3:
1220	*/	1385	*/
1221	SWAPGS	1386	SWAPGS
		1387	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
1222		1388
1223	/*	1389	/*
1224	* Pretend that the exception came from user mode: set up pt_regs	1390	* Pretend that the exception came from user mode: set up pt_regs
@@ -1250,6 +1416,10 @@ END(error_exit) · 25 unmodified lines
1250	/*	1416	/*
1251	* Runs on exception stack. Xen PV does not go through this path at all,	1417	* Runs on exception stack. Xen PV does not go through this path at all,
1252	* so we can use real assembly here.	1418	* so we can use real assembly here.
		1419	*
		1420	* Registers:
		1421	* %r14: Used to save/restore the CR3 of the interrupted context
		1422	* when PAGE_TABLE_ISOLATION is in use. Do not clobber.
1253	*/	1423	*/
1254	ENTRY(nmi)	1424	ENTRY(nmi)
1255	UNWIND_HINT_IRET_REGS	1425	UNWIND_HINT_IRET_REGS
@@ -1313,6 +1483,7 @@ ENTRY(nmi) · 57 unmodified lines
1313		1483
1314	swapgs	1484	swapgs
1315	cld	1485	cld
		1486	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdx
1316	movq %rsp, %rdx	1487	movq %rsp, %rdx
1317	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp	1488	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
1318	UNWIND_HINT_IRET_REGS base=%rdx offset=8	1489	UNWIND_HINT_IRET_REGS base=%rdx offset=8
@@ -1565,6 +1736,8 @@ end_repeat_nmi: · 246 unmodified lines
1565	movq $-1, %rsi	1736	movq $-1, %rsi
1566	call do_nmi	1737	call do_nmi
1567		1738
		1739	RESTORE_CR3 scratch_reg=%r15 save_reg=%r14
		1740
1568	testl %ebx, %ebx /* swapgs needed? */	1741	testl %ebx, %ebx /* swapgs needed? */
1569	jnz nmi_restore	1742	jnz nmi_restore
1570	nmi_swapgs:	1743	nmi_swapgs:

arch/x86/entry/entry_64_compat.S+28−3

  */
 ENTRY(entry_SYSENTER_compat)
 	/* Interrupts are off on entry. */
-	SWAPGS_UNSAFE_STACK
+	SWAPGS
+	/* We are about to clobber %rsp anyway, clobbering here is OK */
+	SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
 	/*
 	pushq   $0			/* pt_regs->r14 = 0 */
 	pushq   $0			/* pt_regs->r15 = 0 */
+	/*
+	 * We just saved %rdi so it is safe to clobber.  It is not
+	 * preserved during the C calls inside TRACE_IRQS_OFF anyway.
+	 */
+	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
 	/*
 	 * User mode is traced as though IRQs are on, and SYSENTER
 	 * turned them off.
 	 * when the system call started, which is already known to user
 	 * code.  We zero R8-R10 to avoid info leaks.
          */
+	movq	RSP-ORIG_RAX(%rsp), %rsp
+	/*
+	 * The original userspace %rsp (RSP-ORIG_RAX(%rsp)) is stored
+	 * on the process stack which is not mapped to userspace and
+	 * not readable after we SWITCH_TO_USER_CR3.  Delay the CR3
+	 * switch until after after the last reference to the process
+	 * stack.
+	 *
+	 * %r8/%r9 are zeroed before the sysret, thus safe to clobber.
+	 */
+	SWITCH_TO_USER_CR3_NOSTACK scratch_reg=%r8 scratch_reg2=%r9
 	xorq	%r8, %r8
 	xorq	%r9, %r9
 	xorq	%r10, %r10
-	movq	RSP-ORIG_RAX(%rsp), %rsp
 	swapgs
 	sysretl
 END(entry_SYSCALL_compat)
 	 */
 	movl	%eax, %eax
-	/* Construct struct pt_regs on stack (iret frame is already on stack) */
 	pushq	%rax			/* pt_regs->orig_ax */
+	/* switch to thread stack expects orig_ax to be pushed */
+	call	switch_to_thread_stack
 	pushq	%rdi			/* pt_regs->di */
 	pushq	%rsi			/* pt_regs->si */
 	pushq	%rdx			/* pt_regs->dx */

arch/x86/entry/vsyscall/vsyscall_64.c+37−1

@@ -37,6 +37,7 @@ · 36 unmodified lines
37	#include <asm/unistd.h>	37	#include <asm/unistd.h>
38	#include <asm/fixmap.h>	38	#include <asm/fixmap.h>
39	#include <asm/traps.h>	39	#include <asm/traps.h>
		40	#include <asm/paravirt.h>
40		41
41	#define CREATE_TRACE_POINTS	42	#define CREATE_TRACE_POINTS
42	#include "vsyscall_trace.h"	43	#include "vsyscall_trace.h"
@@ -138,6 +139,10 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) · 95 unmodified lines
138		139
139	WARN_ON_ONCE(address != regs->ip);	140	WARN_ON_ONCE(address != regs->ip);
140		141
		142	/* This should be unreachable in NATIVE mode. */
		143	if (WARN_ON(vsyscall_mode == NATIVE))
		144	return false;
		145
141	if (vsyscall_mode == NONE) {	146	if (vsyscall_mode == NONE) {
142	warn_bad_vsyscall(KERN_INFO, regs,	147	warn_bad_vsyscall(KERN_INFO, regs,
143	"vsyscall attempted with vsyscall=none");	148	"vsyscall attempted with vsyscall=none");
@@ -329,16 +334,47 @@ int in_gate_area_no_mm(unsigned long addr) · 185 unmodified lines
329	return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;	334	return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
330	}	335	}
331		336
		337	/*
		338	* The VSYSCALL page is the only user-accessible page in the kernel address
		339	* range. Normally, the kernel page tables can have _PAGE_USER clear, but
		340	* the tables covering VSYSCALL_ADDR need _PAGE_USER set if vsyscalls
		341	* are enabled.
		342	*
		343	* Some day we may create a "minimal" vsyscall mode in which we emulate
		344	* vsyscalls but leave the page not present. If so, we skip calling
		345	* this.
		346	*/
		347	void __init set_vsyscall_pgtable_user_bits(pgd_t *root)
		348	{
		349	pgd_t *pgd;
		350	p4d_t *p4d;
		351	pud_t *pud;
		352	pmd_t *pmd;
		353
		354	pgd = pgd_offset_pgd(root, VSYSCALL_ADDR);
		355	set_pgd(pgd, __pgd(pgd_val(*pgd) \| _PAGE_USER));
		356	p4d = p4d_offset(pgd, VSYSCALL_ADDR);
		357	#if CONFIG_PGTABLE_LEVELS >= 5
		358	p4d->p4d \|= _PAGE_USER;
		359	#endif
		360	pud = pud_offset(p4d, VSYSCALL_ADDR);
		361	set_pud(pud, __pud(pud_val(*pud) \| _PAGE_USER));
		362	pmd = pmd_offset(pud, VSYSCALL_ADDR);
		363	set_pmd(pmd, __pmd(pmd_val(*pmd) \| _PAGE_USER));
		364	}
		365
332	void __init map_vsyscall(void)	366	void __init map_vsyscall(void)
333	{	367	{
334	extern char __vsyscall_page;	368	extern char __vsyscall_page;
335	unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);	369	unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
336		370
337	if (vsyscall_mode != NONE)	371	if (vsyscall_mode != NONE) {
338	__set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,	372	__set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
339	vsyscall_mode == NATIVE	373	vsyscall_mode == NATIVE
340	? PAGE_KERNEL_VSYSCALL	374	? PAGE_KERNEL_VSYSCALL
341	: PAGE_KERNEL_VVAR);	375	: PAGE_KERNEL_VVAR);
		376	set_vsyscall_pgtable_user_bits(swapper_pg_dir);
		377	}
342		378
343	BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=	379	BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
344	(unsigned long)VSYSCALL_ADDR);	380	(unsigned long)VSYSCALL_ADDR);

arch/x86/events/intel/core.c+4−1

 __init int intel_pmu_init(void)
 {
+	struct attribute **extra_attr = NULL;
+	struct attribute **to_free = NULL;
 	union cpuid10_edx edx;
 	union cpuid10_eax eax;
 	union cpuid10_ebx ebx;
 	unsigned int unused;
 	struct extra_reg *er;
 	int version, i;
-	struct attribute **extra_attr = NULL;
 	char *name;
 	if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) {
 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
 			hsw_format_attr : nhm_format_attr;
 		extra_attr = merge_attr(extra_attr, skl_format_attr);
+		to_free = extra_attr;
 		x86_pmu.cpu_events = get_hsw_events_attrs();
 		intel_pmu_pebs_data_source_skl(
 			boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);
 		pr_cont("full-width counters, ");
 	}
+	kfree(to_free);
 	return 0;
 }

arch/x86/events/intel/ds.c+83−47

@@ -3,16 +3,18 @@ · 2 unmodified lines
3	#include <linux/types.h>	3	#include <linux/types.h>
4	#include <linux/slab.h>	4	#include <linux/slab.h>
5		5
		6	#include <asm/cpu_entry_area.h>
6	#include <asm/perf_event.h>	7	#include <asm/perf_event.h>
7	#include <asm/insn.h>	8	#include <asm/insn.h>
8		9
9	#include "../perf_event.h"	10	#include "../perf_event.h"
10		11
		12	/* Waste a full page so it can be mapped into the cpu_entry_area */
		13	DEFINE_PER_CPU_PAGE_ALIGNED(struct debug_store, cpu_debug_store);
		14
11	/* The size of a BTS record in bytes: */	15	/* The size of a BTS record in bytes: */
12	#define BTS_RECORD_SIZE 24	16	#define BTS_RECORD_SIZE 24
13		17
14	#define BTS_BUFFER_SIZE (PAGE_SIZE << 4)
15	#define PEBS_BUFFER_SIZE (PAGE_SIZE << 4)
16	#define PEBS_FIXUP_SIZE PAGE_SIZE	18	#define PEBS_FIXUP_SIZE PAGE_SIZE
17		19
18	/*	20	/*
@@ -279,17 +281,52 @@ void fini_debug_store_on_cpu(int cpu) · 260 unmodified lines
279		281
280	static DEFINE_PER_CPU(void *, insn_buffer);	282	static DEFINE_PER_CPU(void *, insn_buffer);
281		283
282	static int alloc_pebs_buffer(int cpu)	284	static void ds_update_cea(void cea, void addr, size_t size, pgprot_t prot)
283	{	285	{
284	struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;	286	phys_addr_t pa;
		287	size_t msz = 0;
		288
		289	pa = virt_to_phys(addr);
		290	for (; msz < size; msz += PAGE_SIZE, pa += PAGE_SIZE, cea += PAGE_SIZE)
		291	cea_set_pte(cea, pa, prot);
		292	}
		293
		294	static void ds_clear_cea(void *cea, size_t size)
		295	{
		296	size_t msz = 0;
		297
		298	for (; msz < size; msz += PAGE_SIZE, cea += PAGE_SIZE)
		299	cea_set_pte(cea, 0, PAGE_NONE);
		300	}
		301
		302	static void *dsalloc_pages(size_t size, gfp_t flags, int cpu)
		303	{
		304	unsigned int order = get_order(size);
285	int node = cpu_to_node(cpu);	305	int node = cpu_to_node(cpu);
286	int max;	306	struct page *page;
287	void buffer, ibuffer;	307
		308	page = __alloc_pages_node(node, flags \| __GFP_ZERO, order);
		309	return page ? page_address(page) : NULL;
		310	}
		311
		312	static void dsfree_pages(const void *buffer, size_t size)
		313	{
		314	if (buffer)
		315	free_pages((unsigned long)buffer, get_order(size));
		316	}
		317
		318	static int alloc_pebs_buffer(int cpu)
		319	{
		320	struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
		321	struct debug_store *ds = hwev->ds;
		322	size_t bsiz = x86_pmu.pebs_buffer_size;
		323	int max, node = cpu_to_node(cpu);
		324	void buffer, ibuffer, *cea;
288		325
289	if (!x86_pmu.pebs)	326	if (!x86_pmu.pebs)
290	return 0;	327	return 0;
291		328
292	buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node);	329	buffer = dsalloc_pages(bsiz, GFP_KERNEL, cpu);
293	if (unlikely(!buffer))	330	if (unlikely(!buffer))
294	return -ENOMEM;	331	return -ENOMEM;
295		332
@@ -300,25 +337,27 @@ static int alloc_pebs_buffer(int cpu) · 4 unmodified lines
300	if (x86_pmu.intel_cap.pebs_format < 2) {	337	if (x86_pmu.intel_cap.pebs_format < 2) {
301	ibuffer = kzalloc_node(PEBS_FIXUP_SIZE, GFP_KERNEL, node);	338	ibuffer = kzalloc_node(PEBS_FIXUP_SIZE, GFP_KERNEL, node);
302	if (!ibuffer) {	339	if (!ibuffer) {
303	kfree(buffer);	340	dsfree_pages(buffer, bsiz);
304	return -ENOMEM;	341	return -ENOMEM;
305	}	342	}
306	per_cpu(insn_buffer, cpu) = ibuffer;	343	per_cpu(insn_buffer, cpu) = ibuffer;
307	}	344	}
308		345	hwev->ds_pebs_vaddr = buffer;
309	max = x86_pmu.pebs_buffer_size / x86_pmu.pebs_record_size;	346	/* Update the cpu entry area mapping */
310		347	cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.pebs_buffer;
311	ds->pebs_buffer_base = (u64)(unsigned long)buffer;	348	ds->pebs_buffer_base = (unsigned long) cea;
		349	ds_update_cea(cea, buffer, bsiz, PAGE_KERNEL);
312	ds->pebs_index = ds->pebs_buffer_base;	350	ds->pebs_index = ds->pebs_buffer_base;
313	ds->pebs_absolute_maximum = ds->pebs_buffer_base +	351	max = x86_pmu.pebs_record_size * (bsiz / x86_pmu.pebs_record_size);
314	max * x86_pmu.pebs_record_size;	352	ds->pebs_absolute_maximum = ds->pebs_buffer_base + max;
315
316	return 0;	353	return 0;
317	}	354	}
318		355
319	static void release_pebs_buffer(int cpu)	356	static void release_pebs_buffer(int cpu)
320	{	357	{
321	struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;	358	struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
		359	struct debug_store *ds = hwev->ds;
		360	void *cea;
322		361
323	if (!ds \|\| !x86_pmu.pebs)	362	if (!ds \|\| !x86_pmu.pebs)
324	return;	363	return;
@@ -326,73 +365,70 @@ static void release_pebs_buffer(int cpu) · 1 unmodified line
326	kfree(per_cpu(insn_buffer, cpu));	365	kfree(per_cpu(insn_buffer, cpu));
327	per_cpu(insn_buffer, cpu) = NULL;	366	per_cpu(insn_buffer, cpu) = NULL;
328		367
329	kfree((void *)(unsigned long)ds->pebs_buffer_base);	368	/* Clear the fixmap */
		369	cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.pebs_buffer;
		370	ds_clear_cea(cea, x86_pmu.pebs_buffer_size);
330	ds->pebs_buffer_base = 0;	371	ds->pebs_buffer_base = 0;
		372	dsfree_pages(hwev->ds_pebs_vaddr, x86_pmu.pebs_buffer_size);
		373	hwev->ds_pebs_vaddr = NULL;
331	}	374	}
332		375
333	static int alloc_bts_buffer(int cpu)	376	static int alloc_bts_buffer(int cpu)
334	{	377	{
335	struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;	378	struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
336	int node = cpu_to_node(cpu);	379	struct debug_store *ds = hwev->ds;
337	int max, thresh;	380	void buffer, cea;
338	void *buffer;	381	int max;
339		382
340	if (!x86_pmu.bts)	383	if (!x86_pmu.bts)
341	return 0;	384	return 0;
342		385
343	buffer = kzalloc_node(BTS_BUFFER_SIZE, GFP_KERNEL \| __GFP_NOWARN, node);	386	buffer = dsalloc_pages(BTS_BUFFER_SIZE, GFP_KERNEL \| __GFP_NOWARN, cpu);
344	if (unlikely(!buffer)) {	387	if (unlikely(!buffer)) {
345	WARN_ONCE(1, "%s: BTS buffer allocation failure\n", __func__);	388	WARN_ONCE(1, "%s: BTS buffer allocation failure\n", __func__);
346	return -ENOMEM;	389	return -ENOMEM;
347	}	390	}
348		391	hwev->ds_bts_vaddr = buffer;
349	max = BTS_BUFFER_SIZE / BTS_RECORD_SIZE;	392	/* Update the fixmap */
350	thresh = max / 16;	393	cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.bts_buffer;
351		394	ds->bts_buffer_base = (unsigned long) cea;
352	ds->bts_buffer_base = (u64)(unsigned long)buffer;	395	ds_update_cea(cea, buffer, BTS_BUFFER_SIZE, PAGE_KERNEL);
353	ds->bts_index = ds->bts_buffer_base;	396	ds->bts_index = ds->bts_buffer_base;
354	ds->bts_absolute_maximum = ds->bts_buffer_base +	397	max = BTS_RECORD_SIZE * (BTS_BUFFER_SIZE / BTS_RECORD_SIZE);
355	max * BTS_RECORD_SIZE;	398	ds->bts_absolute_maximum = ds->bts_buffer_base + max;
356	ds->bts_interrupt_threshold = ds->bts_absolute_maximum -	399	ds->bts_interrupt_threshold = ds->bts_absolute_maximum - (max / 16);
357	thresh * BTS_RECORD_SIZE;
358
359	return 0;	400	return 0;
360	}	401	}
361		402
362	static void release_bts_buffer(int cpu)	403	static void release_bts_buffer(int cpu)
363	{	404	{
364	struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;	405	struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
		406	struct debug_store *ds = hwev->ds;
		407	void *cea;
365		408
366	if (!ds \|\| !x86_pmu.bts)	409	if (!ds \|\| !x86_pmu.bts)
367	return;	410	return;
368		411
369	kfree((void *)(unsigned long)ds->bts_buffer_base);	412	/* Clear the fixmap */
		413	cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.bts_buffer;
		414	ds_clear_cea(cea, BTS_BUFFER_SIZE);
370	ds->bts_buffer_base = 0;	415	ds->bts_buffer_base = 0;
		416	dsfree_pages(hwev->ds_bts_vaddr, BTS_BUFFER_SIZE);
		417	hwev->ds_bts_vaddr = NULL;
371	}	418	}
372		419
373	static int alloc_ds_buffer(int cpu)	420	static int alloc_ds_buffer(int cpu)
374	{	421	{
375	int node = cpu_to_node(cpu);	422	struct debug_store *ds = &get_cpu_entry_area(cpu)->cpu_debug_store;
376	struct debug_store *ds;
377
378	ds = kzalloc_node(sizeof(*ds), GFP_KERNEL, node);
379	if (unlikely(!ds))
380	return -ENOMEM;
381		423
		424	memset(ds, 0, sizeof(*ds));
382	per_cpu(cpu_hw_events, cpu).ds = ds;	425	per_cpu(cpu_hw_events, cpu).ds = ds;
383
384	return 0;	426	return 0;
385	}	427	}
386		428
387	static void release_ds_buffer(int cpu)	429	static void release_ds_buffer(int cpu)
388	{	430	{
389	struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;
390
391	if (!ds)
392	return;
393
394	per_cpu(cpu_hw_events, cpu).ds = NULL;	431	per_cpu(cpu_hw_events, cpu).ds = NULL;
395	kfree(ds);
396	}	432	}
397		433
398	void release_ds_buffers(void)	434	void release_ds_buffers(void)

arch/x86/events/perf_event.h+4−19

 #include <linux/perf_event.h>
+#include <asm/intel_ds.h>
 /* To enable MSR tracing please use the generic trace points. */
 /*
 	struct event_constraint event_constraints[X86_PMC_IDX_MAX];
 };
-/* The maximal number of PEBS events: */
-#define MAX_PEBS_EVENTS		8
 #define PEBS_COUNTER_MASK	((1ULL << MAX_PEBS_EVENTS) - 1)
 /*
 	PERF_SAMPLE_TRANSACTION | PERF_SAMPLE_PHYS_ADDR | \
 	PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_REGS_USER)
-/*
- * A debug store configuration.
- *
- * We only support architectures that use 64bit fields.
- */
-struct debug_store {
-	u64	bts_buffer_base;
-	u64	bts_index;
-	u64	bts_absolute_maximum;
-	u64	bts_interrupt_threshold;
-	u64	pebs_buffer_base;
-	u64	pebs_index;
-	u64	pebs_absolute_maximum;
-	u64	pebs_interrupt_threshold;
-	u64	pebs_event_reset[MAX_PEBS_EVENTS];
-};
 #define PEBS_REGS \
 	(PERF_REG_X86_AX | \
 	 PERF_REG_X86_BX | \
 	 * Intel DebugStore bits
 	 */
 	struct debug_store	*ds;
+	void			*ds_pebs_vaddr;
+	void			*ds_bts_vaddr;
 	u64			pebs_enabled;
 	int			n_pebs;
 	int			n_large_pebs;

arch/x86/include/asm/asm.h+2−0

 #endif
 #ifndef __ASSEMBLY__
+#ifndef __BPF__
 /*
  * This output constraint should be used for any inline asm which has a "call"
  * instruction.  Otherwise the asm may be inserted before the frame pointer
 register unsigned long current_stack_pointer asm(_ASM_SP);
 #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
 #endif
+#endif
 #endif /* _ASM_X86_ASM_H */

arch/x86/include/asm/cpu_entry_area.h+81−0

@@ -0,0 +1,81 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2
	3	#ifndef _ASM_X86_CPU_ENTRY_AREA_H
	4	#define _ASM_X86_CPU_ENTRY_AREA_H
	5
	6	#include <linux/percpu-defs.h>
	7	#include <asm/processor.h>
	8	#include <asm/intel_ds.h>
	9
	10	/*
	11	* cpu_entry_area is a percpu region that contains things needed by the CPU
	12	* and early entry/exit code. Real types aren't used for all fields here
	13	* to avoid circular header dependencies.
	14	*
	15	* Every field is a virtual alias of some other allocated backing store.
	16	* There is no direct allocation of a struct cpu_entry_area.
	17	*/
	18	struct cpu_entry_area {
	19	char gdt[PAGE_SIZE];
	20
	21	/*
	22	* The GDT is just below entry_stack and thus serves (on x86_64) as
	23	* a a read-only guard page.
	24	*/
	25	struct entry_stack_page entry_stack_page;
	26
	27	/*
	28	* On x86_64, the TSS is mapped RO. On x86_32, it's mapped RW because
	29	* we need task switches to work, and task switches write to the TSS.
	30	*/
	31	struct tss_struct tss;
	32
	33	char entry_trampoline[PAGE_SIZE];
	34
	35	#ifdef CONFIG_X86_64
	36	/*
	37	* Exception stacks used for IST entries.
	38	*
	39	* In the future, this should have a separate slot for each stack
	40	* with guard pages between them.
	41	*/
	42	char exception_stacks[(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ];
	43	#endif
	44	#ifdef CONFIG_CPU_SUP_INTEL
	45	/*
	46	* Per CPU debug store for Intel performance monitoring. Wastes a
	47	* full page at the moment.
	48	*/
	49	struct debug_store cpu_debug_store;
	50	/*
	51	* The actual PEBS/BTS buffers must be mapped to user space
	52	* Reserve enough fixmap PTEs.
	53	*/
	54	struct debug_store_buffers cpu_debug_buffers;
	55	#endif
	56	};
	57
	58	#define CPU_ENTRY_AREA_SIZE (sizeof(struct cpu_entry_area))
	59	#define CPU_ENTRY_AREA_TOT_SIZE (CPU_ENTRY_AREA_SIZE * NR_CPUS)
	60
	61	DECLARE_PER_CPU(struct cpu_entry_area *, cpu_entry_area);
	62
	63	extern void setup_cpu_entry_areas(void);
	64	extern void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags);
	65
	66	#define CPU_ENTRY_AREA_RO_IDT CPU_ENTRY_AREA_BASE
	67	#define CPU_ENTRY_AREA_PER_CPU (CPU_ENTRY_AREA_RO_IDT + PAGE_SIZE)
	68
	69	#define CPU_ENTRY_AREA_RO_IDT_VADDR ((void *)CPU_ENTRY_AREA_RO_IDT)
	70
	71	#define CPU_ENTRY_AREA_MAP_SIZE \
	72	(CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_TOT_SIZE - CPU_ENTRY_AREA_BASE)
	73
	74	extern struct cpu_entry_area *get_cpu_entry_area(int cpu);
	75
	76	static inline struct entry_stack *cpu_entry_stack(int cpu)
	77	{
	78	return &get_cpu_entry_area(cpu)->entry_stack_page.stack;
	79	}
	80
	81	#endif

arch/x86/include/asm/cpufeature.h+2−0

@@ -135,6 +135,8 @@ extern void clear_cpu_cap(struct cpuinfo_x86 *c, unsigned int bit); · 134 unmodified lines
135	set_bit(bit, (unsigned long *)cpu_caps_set); \	135	set_bit(bit, (unsigned long *)cpu_caps_set); \
136	} while (0)	136	} while (0)
137		137
		138	#define setup_force_cpu_bug(bit) setup_force_cpu_cap(bit)
		139
138	#if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_X86_FAST_FEATURE_TESTS)	140	#if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_X86_FAST_FEATURE_TESTS)
139	/*	141	/*
140	* Static testing of CPU features. Used the same as boot_cpu_has().	142	* Static testing of CPU features. Used the same as boot_cpu_has().

arch/x86/include/asm/cpufeatures.h+3−1

arch/x86/include/asm/desc.h+5−9

 #include <asm/mmu.h>
 #include <asm/fixmap.h>
 #include <asm/irq_vectors.h>
+#include <asm/cpu_entry_area.h>
 #include <linux/smp.h>
 #include <linux/percpu.h>
 	desc->type		= (info->read_exec_only ^ 1) << 1;
 	desc->type	       |= info->contents << 2;
+	/* Set the ACCESS bit so it can be mapped RO */
+	desc->type	       |= 1;
 	desc->s			= 1;
 	desc->dpl		= 0x3;
 	return this_cpu_ptr(&gdt_page)->gdt;
 }
-/* Get the fixmap index for a specific processor */
-static inline unsigned int get_cpu_gdt_ro_index(int cpu)
-{
-	return FIX_GDT_REMAP_BEGIN + cpu;
-}
 /* Provide the fixmap address of the remapped GDT */
 static inline struct desc_struct *get_cpu_gdt_ro(int cpu)
 {
-	unsigned int idx = get_cpu_gdt_ro_index(cpu);
+	return (struct desc_struct *)&get_cpu_entry_area(cpu)->gdt;
-	return (struct desc_struct *)__fix_to_virt(idx);
 }
 /* Provide the current read-only GDT */
 #endif
 }
-static inline void __set_tss_desc(unsigned cpu, unsigned int entry, void *addr)
+static inline void __set_tss_desc(unsigned cpu, unsigned int entry, struct x86_hw_tss *addr)
 {
 	struct desc_struct *d = get_cpu_gdt_rw(cpu);
 	tss_desc tss;

arch/x86/include/asm/disabled-features.h+7−1

 # define DISABLE_LA57	(1<<(X86_FEATURE_LA57 & 31))
 #endif
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+# define DISABLE_PTI		0
+#else
+# define DISABLE_PTI		(1 << (X86_FEATURE_PTI & 31))
+#endif
 /*
  * Make sure to add features to the correct mask
  */
 #define DISABLED_MASK4	(DISABLE_PCID)
 #define DISABLED_MASK5	0
 #define DISABLED_MASK6	0
-#define DISABLED_MASK7	0
+#define DISABLED_MASK7	(DISABLE_PTI)
 #define DISABLED_MASK8	0
 #define DISABLED_MASK9	(DISABLE_MPX)
 #define DISABLED_MASK10	0

arch/x86/include/asm/espfix.h+4−3

@@ -2,7 +2,7 @@ · 1 unmodified line
2	#ifndef _ASM_X86_ESPFIX_H	2	#ifndef _ASM_X86_ESPFIX_H
3	#define _ASM_X86_ESPFIX_H	3	#define _ASM_X86_ESPFIX_H
4		4
5	#ifdef CONFIG_X86_64	5	#ifdef CONFIG_X86_ESPFIX64
6		6
7	#include <asm/percpu.h>	7	#include <asm/percpu.h>
8		8
@@ -11,7 +11,8 @@ DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr); · 2 unmodified lines
11		11
12	extern void init_espfix_bsp(void);	12	extern void init_espfix_bsp(void);
13	extern void init_espfix_ap(int cpu);	13	extern void init_espfix_ap(int cpu);
14		14	#else
15	#endif /* CONFIG_X86_64 */	15	static inline void init_espfix_ap(int cpu) { }
		16	#endif
16		17
17	#endif /* _ASM_X86_ESPFIX_H */	18	#endif /* _ASM_X86_ESPFIX_H */

arch/x86/include/asm/fixmap.h+1−6

 			 PAGE_SIZE)
 #endif
 /*
  * Here we define all the compile-time 'special' virtual
  * addresses. The point is to have a constant address at
 	FIX_IO_APIC_BASE_0,
 	FIX_IO_APIC_BASE_END = FIX_IO_APIC_BASE_0 + MAX_IO_APICS - 1,
 #endif
-	FIX_RO_IDT,	/* Virtual mapping for read-only IDT */
 #ifdef CONFIG_X86_32
 	FIX_KMAP_BEGIN,	/* reserved pte's for temporary kernel mappings */
 	FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
 #ifdef	CONFIG_X86_INTEL_MID
 	FIX_LNW_VRTC,
 #endif
-	/* Fixmap entries to remap the GDTs, one per processor. */
-	FIX_GDT_REMAP_BEGIN,
-	FIX_GDT_REMAP_END = FIX_GDT_REMAP_BEGIN + NR_CPUS - 1,
 #ifdef CONFIG_ACPI_APEI_GHES
 	/* Used for GHES mapping from assorted contexts */
 extern void reserve_top_address(unsigned long reserve);
 #define FIXADDR_SIZE	(__end_of_permanent_fixed_addresses << PAGE_SHIFT)
-#define FIXADDR_START		(FIXADDR_TOP - FIXADDR_SIZE)
+#define FIXADDR_START	(FIXADDR_TOP - FIXADDR_SIZE)
 extern int fixmaps_set;

arch/x86/include/asm/hypervisor.h+15−10

 #ifndef _ASM_X86_HYPERVISOR_H
 #define _ASM_X86_HYPERVISOR_H
-#ifdef CONFIG_HYPERVISOR_GUEST
+/* x86 hypervisor types  */
-#include <asm/kvm_para.h>
-#include <asm/x86_init.h>
-#include <asm/xen/hypervisor.h>
-/*
- * x86 hypervisor information
- */
 enum x86_hypervisor_type {
 	X86_HYPER_NATIVE = 0,
 	X86_HYPER_VMWARE,
 	X86_HYPER_KVM,
 };
+#ifdef CONFIG_HYPERVISOR_GUEST
+#include <asm/kvm_para.h>
+#include <asm/x86_init.h>
+#include <asm/xen/hypervisor.h>
 struct hypervisor_x86 {
 	/* Hypervisor name */
 	const char	*name;
 extern enum x86_hypervisor_type x86_hyper_type;
 extern void init_hypervisor_platform(void);
+static inline bool hypervisor_is_type(enum x86_hypervisor_type type)
+{
+	return x86_hyper_type == type;
+}
 #else
 static inline void init_hypervisor_platform(void) { }
+static inline bool hypervisor_is_type(enum x86_hypervisor_type type)
+{
+	return type == X86_HYPER_NATIVE;
+}
 #endif /* CONFIG_HYPERVISOR_GUEST */
 #endif /* _ASM_X86_HYPERVISOR_H */

arch/x86/include/asm/intel_ds.h+36−0

@@ -0,0 +1,36 @@
	1	#ifndef _ASM_INTEL_DS_H
	2	#define _ASM_INTEL_DS_H
	3
	4	#include <linux/percpu-defs.h>
	5
	6	#define BTS_BUFFER_SIZE (PAGE_SIZE << 4)
	7	#define PEBS_BUFFER_SIZE (PAGE_SIZE << 4)
	8
	9	/* The maximal number of PEBS events: */
	10	#define MAX_PEBS_EVENTS 8
	11
	12	/*
	13	* A debug store configuration.
	14	*
	15	* We only support architectures that use 64bit fields.
	16	*/
	17	struct debug_store {
	18	u64 bts_buffer_base;
	19	u64 bts_index;
	20	u64 bts_absolute_maximum;
	21	u64 bts_interrupt_threshold;
	22	u64 pebs_buffer_base;
	23	u64 pebs_index;
	24	u64 pebs_absolute_maximum;
	25	u64 pebs_interrupt_threshold;
	26	u64 pebs_event_reset[MAX_PEBS_EVENTS];
	27	} __aligned(PAGE_SIZE);
	28
	29	DECLARE_PER_CPU_PAGE_ALIGNED(struct debug_store, cpu_debug_store);
	30
	31	struct debug_store_buffers {
	32	char bts_buffer[BTS_BUFFER_SIZE];
	33	char pebs_buffer[PEBS_BUFFER_SIZE];
	34	};
	35
	36	#endif

arch/x86/include/asm/invpcid.h+53−0

@@ -0,0 +1,53 @@
	1	/* SPDX-License-Identifier: GPL-2.0 */
	2	#ifndef _ASM_X86_INVPCID
	3	#define _ASM_X86_INVPCID
	4
	5	static inline void __invpcid(unsigned long pcid, unsigned long addr,
	6	unsigned long type)
	7	{
	8	struct { u64 d[2]; } desc = { { pcid, addr } };
	9
	10	/*
	11	* The memory clobber is because the whole point is to invalidate
	12	* stale TLB entries and, especially if we're flushing global
	13	* mappings, we don't want the compiler to reorder any subsequent
	14	* memory accesses before the TLB flush.
	15	*
	16	* The hex opcode is invpcid (%ecx), %eax in 32-bit mode and
	17	* invpcid (%rcx), %rax in long mode.
	18	*/
	19	asm volatile (".byte 0x66, 0x0f, 0x38, 0x82, 0x01"
	20	: : "m" (desc), "a" (type), "c" (&desc) : "memory");
	21	}
	22
	23	#define INVPCID_TYPE_INDIV_ADDR 0
	24	#define INVPCID_TYPE_SINGLE_CTXT 1
	25	#define INVPCID_TYPE_ALL_INCL_GLOBAL 2
	26	#define INVPCID_TYPE_ALL_NON_GLOBAL 3
	27
	28	/* Flush all mappings for a given pcid and addr, not including globals. */
	29	static inline void invpcid_flush_one(unsigned long pcid,
	30	unsigned long addr)
	31	{
	32	__invpcid(pcid, addr, INVPCID_TYPE_INDIV_ADDR);
	33	}
	34
	35	/* Flush all mappings for a given PCID, not including globals. */
	36	static inline void invpcid_flush_single_context(unsigned long pcid)
	37	{
	38	__invpcid(pcid, 0, INVPCID_TYPE_SINGLE_CTXT);
	39	}
	40
	41	/* Flush all mappings, including globals, for all PCIDs. */
	42	static inline void invpcid_flush_all(void)
	43	{
	44	__invpcid(0, 0, INVPCID_TYPE_ALL_INCL_GLOBAL);
	45	}
	46
	47	/* Flush all mappings for all PCIDs except globals. */
	48	static inline void invpcid_flush_all_nonglobals(void)
	49	{
	50	__invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL);
	51	}
	52
	53	#endif /* _ASM_X86_INVPCID */

arch/x86/include/asm/irqdomain.h+1−1

@@ -44,7 +44,7 @@ extern int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq, · 43 unmodified lines
44	extern void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,	44	extern void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,
45	unsigned int nr_irqs);	45	unsigned int nr_irqs);
46	extern int mp_irqdomain_activate(struct irq_domain *domain,	46	extern int mp_irqdomain_activate(struct irq_domain *domain,
47	struct irq_data *irq_data, bool early);	47	struct irq_data *irq_data, bool reserve);
48	extern void mp_irqdomain_deactivate(struct irq_domain *domain,	48	extern void mp_irqdomain_deactivate(struct irq_domain *domain,
49	struct irq_data *irq_data);	49	struct irq_data *irq_data);
50	extern int mp_irqdomain_ioapic_idx(struct irq_domain *domain);	50	extern int mp_irqdomain_ioapic_idx(struct irq_domain *domain);

arch/x86/include/asm/irqflags.h+3−0

 	swapgs;					\
 	sysretl
+#ifdef CONFIG_DEBUG_ENTRY
+#define SAVE_FLAGS(x)		pushfq; popq %rax
+#endif
 #else
 #define INTERRUPT_RETURN		iret
 #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit

arch/x86/include/asm/kdebug.h+1−0

@@ -26,6 +26,7 @@ extern void die(const char , struct pt_regs ,long); · 25 unmodified lines
26	extern int __must_check __die(const char , struct pt_regs , long);	26	extern int __must_check __die(const char , struct pt_regs , long);
27	extern void show_stack_regs(struct pt_regs *regs);	27	extern void show_stack_regs(struct pt_regs *regs);
28	extern void __show_regs(struct pt_regs *regs, int all);	28	extern void __show_regs(struct pt_regs *regs, int all);
		29	extern void show_iret_regs(struct pt_regs *regs);
29	extern unsigned long oops_begin(void);	30	extern unsigned long oops_begin(void);
30	extern void oops_end(unsigned long, struct pt_regs *, int signr);	31	extern void oops_end(unsigned long, struct pt_regs *, int signr);
31		32

arch/x86/include/asm/mmu.h+3−1

 #define _ASM_X86_MMU_H
 #include <linux/spinlock.h>
+#include <linux/rwsem.h>
 #include <linux/mutex.h>
 #include <linux/atomic.h>
 	atomic64_t tlb_gen;
 #ifdef CONFIG_MODIFY_LDT_SYSCALL
-	struct ldt_struct *ldt;
+	struct rw_semaphore	ldt_usr_sem;
+	struct ldt_struct	*ldt;
 #endif
 #ifdef CONFIG_X86_64

arch/x86/include/asm/mmu_context.h+71−42

 	 * call gates.  On native, we could merge the ldt_struct and LDT
 	 * allocations, but it's not worth trying to optimize.
 	 */
-	struct desc_struct *entries;
+	struct desc_struct	*entries;
-	unsigned int nr_entries;
+	unsigned int		nr_entries;
+	/*
+	 * If PTI is in use, then the entries array is not mapped while we're
+	 * in user mode.  The whole array will be aliased at the addressed
+	 * given by ldt_slot_va(slot).  We use two slots so that we can allocate
+	 * and map, and enable a new LDT without invalidating the mapping
+	 * of an older, still-in-use LDT.
+	 *
+	 * slot will be -1 if this LDT doesn't have an alias mapping.
+	 */
+	int			slot;
 };
+/* This is a multiple of PAGE_SIZE. */
+#define LDT_SLOT_STRIDE (LDT_ENTRIES * LDT_ENTRY_SIZE)
+static inline void *ldt_slot_va(int slot)
+{
+#ifdef CONFIG_X86_64
+	return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
+#else
+	BUG();
+#endif
+}
 /*
  * Used for LDT copy/destruction.
  */
-int init_new_context_ldt(struct task_struct *tsk, struct mm_struct *mm);
+static inline void init_new_context_ldt(struct mm_struct *mm)
+{
+	mm->context.ldt = NULL;
+	init_rwsem(&mm->context.ldt_usr_sem);
+}
+int ldt_dup_context(struct mm_struct *oldmm, struct mm_struct *mm);
 void destroy_context_ldt(struct mm_struct *mm);
+void ldt_arch_exit_mmap(struct mm_struct *mm);
 #else	/* CONFIG_MODIFY_LDT_SYSCALL */
-static inline int init_new_context_ldt(struct task_struct *tsk,
+static inline void init_new_context_ldt(struct mm_struct *mm) { }
-				       struct mm_struct *mm)
+static inline int ldt_dup_context(struct mm_struct *oldmm,
+				  struct mm_struct *mm)
 {
 	return 0;
 }
-static inline void destroy_context_ldt(struct mm_struct *mm) {}
+static inline void destroy_context_ldt(struct mm_struct *mm) { }
+static inline void ldt_arch_exit_mmap(struct mm_struct *mm) { }
 #endif
 static inline void load_mm_ldt(struct mm_struct *mm)
 	 * that we can see.
 	 */
-	if (unlikely(ldt))
+	if (unlikely(ldt)) {
-		set_ldt(ldt->entries, ldt->nr_entries);
+		if (static_cpu_has(X86_FEATURE_PTI)) {
-	else
+			if (WARN_ON_ONCE((unsigned long)ldt->slot > 1)) {
+				/*
+				 * Whoops -- either the new LDT isn't mapped
+				 * (if slot == -1) or is mapped into a bogus
+				 * slot (if slot > 1).
+				 */
+				clear_LDT();
+				return;
+			}
+			/*
+			 * If page table isolation is enabled, ldt->entries
+			 * will not be mapped in the userspace pagetables.
+			 * Tell the CPU to access the LDT through the alias
+			 * at ldt_slot_va(ldt->slot).
+			 */
+			set_ldt(ldt_slot_va(ldt->slot), ldt->nr_entries);
+		} else {
+			set_ldt(ldt->entries, ldt->nr_entries);
+		}
+	} else {
 		clear_LDT();
+	}
 #else
 	clear_LDT();
 #endif
 static inline int init_new_context(struct task_struct *tsk,
 				   struct mm_struct *mm)
 {
+	mutex_init(&mm->context.lock);
 	mm->context.ctx_id = atomic64_inc_return(&last_mm_ctx_id);
 	atomic64_set(&mm->context.tlb_gen, 0);
-	#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
 	if (cpu_feature_enabled(X86_FEATURE_OSPKE)) {
 		/* pkey 0 is the default and always allocated */
 		mm->context.pkey_allocation_map = 0x1;
 		/* -1 means unallocated or invalid */
 		mm->context.execute_only_pkey = -1;
 	}
-	#endif
+#endif
-	return init_new_context_ldt(tsk, mm);
+	init_new_context_ldt(mm);
+	return 0;
 }
 static inline void destroy_context(struct mm_struct *mm)
 {
 } while (0)
 #endif
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
+static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
-				 struct mm_struct *mm)
 {
 	paravirt_arch_dup_mmap(oldmm, mm);
+	return ldt_dup_context(oldmm, mm);
 }
 static inline void arch_exit_mmap(struct mm_struct *mm)
 {
 	paravirt_arch_exit_mmap(mm);
+	ldt_arch_exit_mmap(mm);
 }
 #ifdef CONFIG_X86_64
 	return __pkru_allows_pkey(vma_pkey(vma), write);
 }
-/*
- * If PCID is on, ASID-aware code paths put the ASID+1 into the PCID
- * bits.  This serves two purposes.  It prevents a nasty situation in
- * which PCID-unaware code saves CR3, loads some other value (with PCID
- * == 0), and then restores CR3, thus corrupting the TLB for ASID 0 if
- * the saved ASID was nonzero.  It also means that any bugs involving
- * loading a PCID-enabled CR3 with CR4.PCIDE off will trigger
- * deterministically.
- */
-static inline unsigned long build_cr3(struct mm_struct *mm, u16 asid)
-{
-	if (static_cpu_has(X86_FEATURE_PCID)) {
-		VM_WARN_ON_ONCE(asid > 4094);
-		return __sme_pa(mm->pgd) | (asid + 1);
-	} else {
-		VM_WARN_ON_ONCE(asid != 0);
-		return __sme_pa(mm->pgd);
-	}
-}
-static inline unsigned long build_cr3_noflush(struct mm_struct *mm, u16 asid)
-{
-	VM_WARN_ON_ONCE(asid > 4094);
-	return __sme_pa(mm->pgd) | (asid + 1) | CR3_NOFLUSH;
-}
 /*
  * This can be used from process context to figure out what the value of
  * CR3 is without needing to do a (slow) __read_cr3().
  */
 static inline unsigned long __get_current_cr3_fast(void)
 {
-	unsigned long cr3 = build_cr3(this_cpu_read(cpu_tlbstate.loaded_mm),
+	unsigned long cr3 = build_cr3(this_cpu_read(cpu_tlbstate.loaded_mm)->pgd,
 		this_cpu_read(cpu_tlbstate.loaded_mm_asid));
 	/* For now, be very restrictive about when this can be called. */

arch/x86/include/asm/paravirt.h+9−0

@@ -927,6 +927,15 @@ extern void default_banner(void); · 926 unmodified lines
927	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64), \	927	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64), \
928	CLBR_NONE, \	928	CLBR_NONE, \
929	jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))	929	jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))
		930
		931	#ifdef CONFIG_DEBUG_ENTRY
		932	#define SAVE_FLAGS(clobbers) \
		933	PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_save_fl), clobbers, \
		934	PV_SAVE_REGS(clobbers \| CLBR_CALLEE_SAVE); \
		935	call PARA_INDIRECT(pv_irq_ops+PV_IRQ_save_fl); \
		936	PV_RESTORE_REGS(clobbers \| CLBR_CALLEE_SAVE);)
		937	#endif
		938
930	#endif /* CONFIG_X86_32 */	939	#endif /* CONFIG_X86_32 */
931		940
932	#endif /* __ASSEMBLY__ */	941	#endif /* __ASSEMBLY__ */

arch/x86/include/asm/pgalloc.h+11−0

@@ -30,6 +30,17 @@ static inline void paravirt_release_p4d(unsigned long pfn) {} · 29 unmodified lines
30	*/	30	*/
31	extern gfp_t __userpte_alloc_gfp;	31	extern gfp_t __userpte_alloc_gfp;
32		32
		33	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		34	/*
		35	* Instead of one PGD, we acquire two PGDs. Being order-1, it is
		36	* both 8k in size and 8k-aligned. That lets us just flip bit 12
		37	* in a pointer to swap between the two 4k halves.
		38	*/
		39	#define PGD_ALLOCATION_ORDER 1
		40	#else
		41	#define PGD_ALLOCATION_ORDER 0
		42	#endif
		43
33	/*	44	/*
34	* Allocate and free page tables.	45	* Allocate and free page tables.
35	*/	46	*/

arch/x86/include/asm/pgtable.h+26−4

 int __init __early_make_pgtable(unsigned long address, pmdval_t pmd);
 void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd);
+void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user);
 void ptdump_walk_pgd_level_checkwx(void);
 #ifdef CONFIG_DEBUG_WX
 static inline int p4d_bad(p4d_t p4d)
 {
-	return (p4d_flags(p4d) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
+	unsigned long ignore_flags = _KERNPG_TABLE | _PAGE_USER;
+	if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+		ignore_flags |= _PAGE_NX;
+	return (p4d_flags(p4d) & ~ignore_flags) != 0;
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 static inline int pgd_bad(pgd_t pgd)
 {
-	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
+	unsigned long ignore_flags = _PAGE_USER;
+	if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+		ignore_flags |= _PAGE_NX;
+	return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
 }
 static inline int pgd_none(pgd_t pgd)
  * pgd_offset() returns a (pgd_t *)
  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
  */
-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
+#define pgd_offset_pgd(pgd, address) (pgd + pgd_index((address)))
+/*
+ * a shortcut to get a pgd_t in a given mm
+ */
+#define pgd_offset(mm, address) pgd_offset_pgd((mm)->pgd, (address))
 /*
  * a shortcut which implies the use of the kernel's pgd, instead
  * of a process's
  */
 static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
 {
-       memcpy(dst, src, count * sizeof(pgd_t));
+	memcpy(dst, src, count * sizeof(pgd_t));
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+	if (!static_cpu_has(X86_FEATURE_PTI))
+		return;
+	/* Clone the user space pgd as well */
+	memcpy(kernel_to_user_pgdp(dst), kernel_to_user_pgdp(src),
+	       count * sizeof(pgd_t));
+#endif
 }
 #define PTE_SHIFT ilog2(PTRS_PER_PTE)

arch/x86/include/asm/pgtable_32_types.h+12−3

 #define LAST_PKMAP 1024
 #endif
-#define PKMAP_BASE ((FIXADDR_START - PAGE_SIZE * (LAST_PKMAP + 1))	\
+/*
-		    & PMD_MASK)
+ * Define this here and validate with BUILD_BUG_ON() in pgtable_32.c
+ * to avoid include recursion hell
+ */
+#define CPU_ENTRY_AREA_PAGES	(NR_CPUS * 40)
+#define CPU_ENTRY_AREA_BASE				\
+	((FIXADDR_START - PAGE_SIZE * (CPU_ENTRY_AREA_PAGES + 1)) & PMD_MASK)
+#define PKMAP_BASE		\
+	((CPU_ENTRY_AREA_BASE - PAGE_SIZE) & PMD_MASK)
 #ifdef CONFIG_HIGHMEM
 # define VMALLOC_END	(PKMAP_BASE - 2 * PAGE_SIZE)
 #else
-# define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
+# define VMALLOC_END	(CPU_ENTRY_AREA_BASE - 2 * PAGE_SIZE)
 #endif
 #define MODULES_VADDR	VMALLOC_START

arch/x86/include/asm/pgtable_64.h+92−0

@@ -131,9 +131,97 @@ static inline pud_t native_pudp_get_and_clear(pud_t *xp) · 130 unmodified lines
131	#endif	131	#endif
132	}	132	}
133		133
		134	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		135	/*
		136	* All top-level PAGE_TABLE_ISOLATION page tables are order-1 pages
		137	* (8k-aligned and 8k in size). The kernel one is at the beginning 4k and
		138	* the user one is in the last 4k. To switch between them, you
		139	* just need to flip the 12th bit in their addresses.
		140	*/
		141	#define PTI_PGTABLE_SWITCH_BIT PAGE_SHIFT
		142
		143	/*
		144	* This generates better code than the inline assembly in
		145	* __set_bit().
		146	*/
		147	static inline void ptr_set_bit(void ptr, int bit)
		148	{
		149	unsigned long __ptr = (unsigned long)ptr;
		150
		151	__ptr \|= BIT(bit);
		152	return (void *)__ptr;
		153	}
		154	static inline void ptr_clear_bit(void ptr, int bit)
		155	{
		156	unsigned long __ptr = (unsigned long)ptr;
		157
		158	__ptr &= ~BIT(bit);
		159	return (void *)__ptr;
		160	}
		161
		162	static inline pgd_t kernel_to_user_pgdp(pgd_t pgdp)
		163	{
		164	return ptr_set_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
		165	}
		166
		167	static inline pgd_t user_to_kernel_pgdp(pgd_t pgdp)
		168	{
		169	return ptr_clear_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
		170	}
		171
		172	static inline p4d_t kernel_to_user_p4dp(p4d_t p4dp)
		173	{
		174	return ptr_set_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
		175	}
		176
		177	static inline p4d_t user_to_kernel_p4dp(p4d_t p4dp)
		178	{
		179	return ptr_clear_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
		180	}
		181	#endif /* CONFIG_PAGE_TABLE_ISOLATION */
		182
		183	/*
		184	* Page table pages are page-aligned. The lower half of the top
		185	* level is used for userspace and the top half for the kernel.
		186	*
		187	* Returns true for parts of the PGD that map userspace and
		188	* false for the parts that map the kernel.
		189	*/
		190	static inline bool pgdp_maps_userspace(void *__ptr)
		191	{
		192	unsigned long ptr = (unsigned long)__ptr;
		193
		194	return (ptr & ~PAGE_MASK) < (PAGE_SIZE / 2);
		195	}
		196
		197	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		198	pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd);
		199
		200	/*
		201	* Take a PGD location (pgdp) and a pgd value that needs to be set there.
		202	* Populates the user and returns the resulting PGD that must be set in
		203	* the kernel copy of the page tables.
		204	*/
		205	static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
		206	{
		207	if (!static_cpu_has(X86_FEATURE_PTI))
		208	return pgd;
		209	return __pti_set_user_pgd(pgdp, pgd);
		210	}
		211	#else
		212	static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
		213	{
		214	return pgd;
		215	}
		216	#endif
		217
134	static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)	218	static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
135	{	219	{
		220	#if defined(CONFIG_PAGE_TABLE_ISOLATION) && !defined(CONFIG_X86_5LEVEL)
		221	p4dp->pgd = pti_set_user_pgd(&p4dp->pgd, p4d.pgd);
		222	#else
136	*p4dp = p4d;	223	*p4dp = p4d;
		224	#endif
137	}	225	}
138		226
139	static inline void native_p4d_clear(p4d_t *p4d)	227	static inline void native_p4d_clear(p4d_t *p4d)
@@ -147,7 +235,11 @@ static inline void native_p4d_clear(p4d_t *p4d) · 7 unmodified lines
147		235
148	static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)	236	static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
149	{	237	{
		238	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		239	*pgdp = pti_set_user_pgd(pgdp, pgd);
		240	#else
150	*pgdp = pgd;	241	*pgdp = pgd;
		242	#endif
151	}	243	}
152		244
153	static inline void native_pgd_clear(pgd_t *pgd)	245	static inline void native_pgd_clear(pgd_t *pgd)

arch/x86/include/asm/pgtable_64_types.h+32−19

@@ -76,32 +76,45 @@ typedef struct { pteval_t pte; } pte_t; · 75 unmodified lines
76	#define PGDIR_MASK (~(PGDIR_SIZE - 1))	76	#define PGDIR_MASK (~(PGDIR_SIZE - 1))
77		77
78	/* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */	78	/* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
79	#define MAXMEM _AC(__AC(1, UL) << MAX_PHYSMEM_BITS, UL)	79	#define MAXMEM _AC(__AC(1, UL) << MAX_PHYSMEM_BITS, UL)
		80
80	#ifdef CONFIG_X86_5LEVEL	81	#ifdef CONFIG_X86_5LEVEL
81	#define VMALLOC_SIZE_TB _AC(16384, UL)	82	# define VMALLOC_SIZE_TB _AC(12800, UL)
82	#define __VMALLOC_BASE _AC(0xff92000000000000, UL)	83	# define __VMALLOC_BASE _AC(0xffa0000000000000, UL)
83	#define __VMEMMAP_BASE _AC(0xffd4000000000000, UL)	84	# define __VMEMMAP_BASE _AC(0xffd4000000000000, UL)
		85	# define LDT_PGD_ENTRY _AC(-112, UL)
		86	# define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
84	#else	87	#else
85	#define VMALLOC_SIZE_TB _AC(32, UL)	88	# define VMALLOC_SIZE_TB _AC(32, UL)
86	#define __VMALLOC_BASE _AC(0xffffc90000000000, UL)	89	# define __VMALLOC_BASE _AC(0xffffc90000000000, UL)
87	#define __VMEMMAP_BASE _AC(0xffffea0000000000, UL)	90	# define __VMEMMAP_BASE _AC(0xffffea0000000000, UL)
		91	# define LDT_PGD_ENTRY _AC(-4, UL)
		92	# define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
88	#endif	93	#endif
		94
89	#ifdef CONFIG_RANDOMIZE_MEMORY	95	#ifdef CONFIG_RANDOMIZE_MEMORY
90	#define VMALLOC_START vmalloc_base	96	# define VMALLOC_START vmalloc_base
91	#define VMEMMAP_START vmemmap_base	97	# define VMEMMAP_START vmemmap_base
92	#else	98	#else
93	#define VMALLOC_START __VMALLOC_BASE	99	# define VMALLOC_START __VMALLOC_BASE
94	#define VMEMMAP_START __VMEMMAP_BASE	100	# define VMEMMAP_START __VMEMMAP_BASE
95	#endif /* CONFIG_RANDOMIZE_MEMORY */	101	#endif /* CONFIG_RANDOMIZE_MEMORY */
96	#define VMALLOC_END (VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL))	102
97	#define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE)	103	#define VMALLOC_END (VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL))
		104
		105	#define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
98	/* The module sections ends with the start of the fixmap */	106	/* The module sections ends with the start of the fixmap */
99	#define MODULES_END __fix_to_virt(__end_of_fixed_addresses + 1)	107	#define MODULES_END __fix_to_virt(__end_of_fixed_addresses + 1)
100	#define MODULES_LEN (MODULES_END - MODULES_VADDR)	108	#define MODULES_LEN (MODULES_END - MODULES_VADDR)
101	#define ESPFIX_PGD_ENTRY _AC(-2, UL)	109
102	#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << P4D_SHIFT)	110	#define ESPFIX_PGD_ENTRY _AC(-2, UL)
103	#define EFI_VA_START ( -4 * (_AC(1, UL) << 30))	111	#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << P4D_SHIFT)
104	#define EFI_VA_END (-68 * (_AC(1, UL) << 30))	112
		113	#define CPU_ENTRY_AREA_PGD _AC(-3, UL)
		114	#define CPU_ENTRY_AREA_BASE (CPU_ENTRY_AREA_PGD << P4D_SHIFT)
		115
		116	#define EFI_VA_START ( -4 * (_AC(1, UL) << 30))
		117	#define EFI_VA_END (-68 * (_AC(1, UL) << 30))
105		118
106	#define EARLY_DYNAMIC_PAGE_TABLES 64	119	#define EARLY_DYNAMIC_PAGE_TABLES 64
107		120

arch/x86/include/asm/processor-flags.h+5−0

 #define CR3_ADDR_MASK	__sme_clr(0x7FFFFFFFFFFFF000ull)
 #define CR3_PCID_MASK	0xFFFull
 #define CR3_NOFLUSH	BIT_ULL(63)
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+# define X86_CR3_PTI_SWITCH_BIT	11
+#endif
 #else
 /*
  * CR3_ADDR_MASK needs at least bits 31:5 set on PAE systems, and we save

arch/x86/include/asm/processor.h+53−29

 extern struct cpuinfo_x86	boot_cpu_data;
 extern struct cpuinfo_x86	new_cpu_data;
-extern struct tss_struct	doublefault_tss;
+extern struct x86_hw_tss	doublefault_tss;
-extern __u32			cpu_caps_cleared[NCAPINTS];
+extern __u32			cpu_caps_cleared[NCAPINTS + NBUGINTS];
-extern __u32			cpu_caps_set[NCAPINTS];
+extern __u32			cpu_caps_set[NCAPINTS + NBUGINTS];
 #ifdef CONFIG_SMP
 DECLARE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info);
 	write_cr3(__sme_pa(pgdir));
 }
+/*
+ * Note that while the legacy 'TSS' name comes from 'Task State Segment',
+ * on modern x86 CPUs the TSS also holds information important to 64-bit mode,
+ * unrelated to the task-switch mechanism:
+ */
 #ifdef CONFIG_X86_32
 /* This is the TSS defined by the hardware. */
 struct x86_hw_tss {
 struct x86_hw_tss {
 	u32			reserved1;
 	u64			sp0;
+	/*
+	 * We store cpu_current_top_of_stack in sp1 so it's always accessible.
+	 * Linux does not use ring 1, so sp1 is not otherwise needed.
+	 */
 	u64			sp1;
 	u64			sp2;
 	u64			reserved2;
 	u64			ist[7];
 #define IO_BITMAP_BITS			65536
 #define IO_BITMAP_BYTES			(IO_BITMAP_BITS/8)
 #define IO_BITMAP_LONGS			(IO_BITMAP_BYTES/sizeof(long))
-#define IO_BITMAP_OFFSET		offsetof(struct tss_struct, io_bitmap)
+#define IO_BITMAP_OFFSET		(offsetof(struct tss_struct, io_bitmap) - offsetof(struct tss_struct, x86_tss))
 #define INVALID_IO_BITMAP_OFFSET	0x8000
+struct entry_stack {
+	unsigned long		words[64];
+};
+struct entry_stack_page {
+	struct entry_stack stack;
+} __aligned(PAGE_SIZE);
 struct tss_struct {
 	/*
-	 * The hardware state:
+	 * The fixed hardware portion.  This must not cross a page boundary
+	 * at risk of violating the SDM's advice and potentially triggering
+	 * errata.
 	 */
 	struct x86_hw_tss	x86_tss;
 	 * be within the limit.
 	 */
 	unsigned long		io_bitmap[IO_BITMAP_LONGS + 1];
+} __aligned(PAGE_SIZE);
-#ifdef CONFIG_X86_32
+DECLARE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss_rw);
-	/*
-	 * Space for the temporary SYSENTER stack.
-	 */
-	unsigned long		SYSENTER_stack_canary;
-	unsigned long		SYSENTER_stack[64];
-#endif
-} ____cacheline_aligned;
-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss);
 /*
  * sizeof(unsigned long) coming from an extra "long" at the end
 #ifdef CONFIG_X86_32
 DECLARE_PER_CPU(unsigned long, cpu_current_top_of_stack);
+#else
+/* The RO copy can't be accessed with this_cpu_xyz(), so use the RW copy. */
+#define cpu_current_top_of_stack cpu_tss_rw.x86_tss.sp1
 #endif
 /*
 static inline void
 native_load_sp0(unsigned long sp0)
 {
-	this_cpu_write(cpu_tss.x86_tss.sp0, sp0);
+	this_cpu_write(cpu_tss_rw.x86_tss.sp0, sp0);
 }
 static inline void native_swapgs(void)
 static inline unsigned long current_top_of_stack(void)
 {
-#ifdef CONFIG_X86_64
+	/*
-	return this_cpu_read_stable(cpu_tss.x86_tss.sp0);
+	 *  We can't read directly from tss.sp0: sp0 on x86_32 is special in
-#else
+	 *  and around vm86 mode and sp0 on x86_64 is special because of the
-	/* sp0 on x86_32 is special in and around vm86 mode. */
+	 *  entry trampoline.
+	 */
 	return this_cpu_read_stable(cpu_current_top_of_stack);
-#endif
 }
 static inline bool on_thread_stack(void)
 #else
 /*
- * User space process size. 47bits minus one guard page.  The guard
+ * User space process size.  This is the first address outside the user range.
- * page is necessary on Intel CPUs: if a SYSCALL instruction is at
+ * There are a few constraints that determine this:
- * the highest possible canonical userspace address, then that
+ *
- * syscall will enter the kernel with a non-canonical return
+ * On Intel CPUs, if a SYSCALL instruction is at the highest canonical
- * address, and SYSRET will explode dangerously.  We avoid this
+ * address, then that syscall will enter the kernel with a
- * particular problem by preventing anything from being mapped
+ * non-canonical return address, and SYSRET will explode dangerously.
- * at the maximum canonical address.
+ * We avoid this particular problem by preventing anything executable
+ * from being mapped at the maximum canonical address.
+ *
+ * On AMD CPUs in the Ryzen family, there's a nasty bug in which the
+ * CPUs malfunction if they execute code from the highest canonical page.
+ * They'll speculate right off the end of the canonical space, and
+ * bad things happen.  This is worked around in the same way as the
+ * Intel problem.
+ *
+ * With page table isolation enabled, we map the LDT in ... [stay tuned]
  */
 #define TASK_SIZE_MAX	((1UL << __VIRTUAL_MASK_SHIFT) - PAGE_SIZE)

arch/x86/include/asm/pti.h+14−0

@@ -0,0 +1,14 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	#ifndef _ASM_X86_PTI_H
	3	#define _ASM_X86_PTI_H
	4	#ifndef __ASSEMBLY__
	5
	6	#ifdef CONFIG_PAGE_TABLE_ISOLATION
	7	extern void pti_init(void);
	8	extern void pti_check_boottime_disable(void);
	9	#else
	10	static inline void pti_check_boottime_disable(void) { }
	11	#endif
	12
	13	#endif /* __ASSEMBLY__ */
	14	#endif /* _ASM_X86_PTI_H */

arch/x86/include/asm/stacktrace.h+3−0

 	STACK_TYPE_TASK,
 	STACK_TYPE_IRQ,
 	STACK_TYPE_SOFTIRQ,
+	STACK_TYPE_ENTRY,
 	STACK_TYPE_EXCEPTION,
 	STACK_TYPE_EXCEPTION_LAST = STACK_TYPE_EXCEPTION + N_EXCEPTION_STACKS-1,
 };
 bool in_task_stack(unsigned long *stack, struct task_struct *task,
 		   struct stack_info *info);
+bool in_entry_stack(unsigned long *stack, struct stack_info *info);
 int get_stack_info(unsigned long *stack, struct task_struct *task,
 		   struct stack_info *info, unsigned long *visit_mask);

arch/x86/include/asm/suspend_32.h+7−1

 /* image of the saved processor state */
 struct saved_context {
-	u16 es, fs, gs, ss;
+	/*
+	 * On x86_32, all segment registers, with the possible exception of
+	 * gs, are saved at kernel entry in pt_regs.
+	 */
+#ifdef CONFIG_X86_32_LAZY_GS
+	u16 gs;
+#endif
 	unsigned long cr0, cr2, cr3, cr4;
 	u64 misc_enable;
 	bool misc_enable_saved;

arch/x86/include/asm/suspend_64.h+15−4

@@ -20,8 +20,20 @@ · 19 unmodified lines
20	*/	20	*/
21	struct saved_context {	21	struct saved_context {
22	struct pt_regs regs;	22	struct pt_regs regs;
23	u16 ds, es, fs, gs, ss;	23
24	unsigned long gs_base, gs_kernel_base, fs_base;	24	/*
		25	* User CS and SS are saved in current_pt_regs(). The rest of the
		26	* segment selectors need to be saved and restored here.
		27	*/
		28	u16 ds, es, fs, gs;
		29
		30	/*
		31	* Usermode FSBASE and GSBASE may not match the fs and gs selectors,
		32	* so we save them separately. We save the kernelmode GSBASE to
		33	* restore percpu access after resume.
		34	*/
		35	unsigned long kernelmode_gs_base, usermode_gs_base, fs_base;
		36
25	unsigned long cr0, cr2, cr3, cr4, cr8;	37	unsigned long cr0, cr2, cr3, cr4, cr8;
26	u64 misc_enable;	38	u64 misc_enable;
27	bool misc_enable_saved;	39	bool misc_enable_saved;
@@ -30,8 +42,7 @@ struct saved_context { · 2 unmodified lines
30	u16 gdt_pad; /* Unused */	42	u16 gdt_pad; /* Unused */
31	struct desc_ptr gdt_desc;	43	struct desc_ptr gdt_desc;
32	u16 idt_pad;	44	u16 idt_pad;
33	u16 idt_limit;	45	struct desc_ptr idt;
34	unsigned long idt_base;
35	u16 ldt;	46	u16 ldt;
36	u16 tss;	47	u16 tss;
37	unsigned long tr;	48	unsigned long tr;

arch/x86/include/asm/switch_to.h+7−6

 		      struct tss_struct *tss);
 /* This runs runs on the previous thread's stack. */
-static inline void prepare_switch_to(struct task_struct *prev,
+static inline void prepare_switch_to(struct task_struct *next)
-				     struct task_struct *next)
 {
 #ifdef CONFIG_VMAP_STACK
 	/*
 #define switch_to(prev, next, last)					\
 do {									\
-	prepare_switch_to(prev, next);					\
+	prepare_switch_to(next);					\
 									\
 	((last) = __switch_to_asm((prev), (next)));			\
 } while (0)
 static inline void refresh_sysenter_cs(struct thread_struct *thread)
 {
 	/* Only happens when SEP is enabled, no need to test "SEP"arately: */
-	if (unlikely(this_cpu_read(cpu_tss.x86_tss.ss1) == thread->sysenter_cs))
+	if (unlikely(this_cpu_read(cpu_tss_rw.x86_tss.ss1) == thread->sysenter_cs))
 		return;
-	this_cpu_write(cpu_tss.x86_tss.ss1, thread->sysenter_cs);
+	this_cpu_write(cpu_tss_rw.x86_tss.ss1, thread->sysenter_cs);
 	wrmsr(MSR_IA32_SYSENTER_CS, thread->sysenter_cs, 0);
 }
 #endif
 /* This is used when switching tasks or entering/exiting vm86 mode. */
 static inline void update_sp0(struct task_struct *task)
 {
+	/* On x86_64, sp0 always points to the entry trampoline stack, which is constant: */
 #ifdef CONFIG_X86_32
 	load_sp0(task->thread.sp0);
 #else
-	load_sp0(task_top_of_stack(task));
+	if (static_cpu_has(X86_FEATURE_XENPV))
+		load_sp0(task_top_of_stack(task));
 #endif
 }

arch/x86/include/asm/thread_info.h+1−1

@@ -207,7 +207,7 @@ static inline int arch_within_stack_frames(const void * const stack, · 206 unmodified lines
207	#else /* !__ASSEMBLY__ */	207	#else /* !__ASSEMBLY__ */
208		208
209	#ifdef CONFIG_X86_64	209	#ifdef CONFIG_X86_64
210	# define cpu_current_top_of_stack (cpu_tss + TSS_sp0)	210	# define cpu_current_top_of_stack (cpu_tss_rw + TSS_sp1)
211	#endif	211	#endif
212		212
213	#endif	213	#endif

arch/x86/include/asm/tlbflush.h+231−81

@@ -9,70 +9,130 @@ · 8 unmodified lines
9	#include <asm/cpufeature.h>	9	#include <asm/cpufeature.h>
10	#include <asm/special_insns.h>	10	#include <asm/special_insns.h>
11	#include <asm/smp.h>	11	#include <asm/smp.h>
		12	#include <asm/invpcid.h>
		13	#include <asm/pti.h>
		14	#include <asm/processor-flags.h>
12		15
13	static inline void __invpcid(unsigned long pcid, unsigned long addr,	16	/*
14	unsigned long type)	17	* The x86 feature is called PCID (Process Context IDentifier). It is similar
15	{	18	* to what is traditionally called ASID on the RISC processors.
16	struct { u64 d[2]; } desc = { { pcid, addr } };	19	*
		20	* We don't use the traditional ASID implementation, where each process/mm gets
		21	* its own ASID and flush/restart when we run out of ASID space.
		22	*
		23	* Instead we have a small per-cpu array of ASIDs and cache the last few mm's
		24	* that came by on this CPU, allowing cheaper switch_mm between processes on
		25	* this CPU.
		26	*
		27	* We end up with different spaces for different things. To avoid confusion we
		28	* use different names for each of them:
		29	*
		30	* ASID - [0, TLB_NR_DYN_ASIDS-1]
		31	* the canonical identifier for an mm
		32	*
		33	* kPCID - [1, TLB_NR_DYN_ASIDS]
		34	* the value we write into the PCID part of CR3; corresponds to the
		35	* ASID+1, because PCID 0 is special.
		36	*
		37	* uPCID - [2048 + 1, 2048 + TLB_NR_DYN_ASIDS]
		38	* for KPTI each mm has two address spaces and thus needs two
		39	* PCID values, but we can still do with a single ASID denomination
		40	* for each mm. Corresponds to kPCID + 2048.
		41	*
		42	*/
17		43
18	/*	44	/* There are 12 bits of space for ASIDS in CR3 */
19	* The memory clobber is because the whole point is to invalidate	45	#define CR3_HW_ASID_BITS 12
20	* stale TLB entries and, especially if we're flushing global
21	* mappings, we don't want the compiler to reorder any subsequent
22	* memory accesses before the TLB flush.
23	*
24	* The hex opcode is invpcid (%ecx), %eax in 32-bit mode and
25	* invpcid (%rcx), %rax in long mode.
26	*/
27	asm volatile (".byte 0x66, 0x0f, 0x38, 0x82, 0x01"
28	: : "m" (desc), "a" (type), "c" (&desc) : "memory");
29	}
30		46
31	#define INVPCID_TYPE_INDIV_ADDR 0	47	/*
32	#define INVPCID_TYPE_SINGLE_CTXT 1	48	* When enabled, PAGE_TABLE_ISOLATION consumes a single bit for
33	#define INVPCID_TYPE_ALL_INCL_GLOBAL 2	49	* user/kernel switches
34	#define INVPCID_TYPE_ALL_NON_GLOBAL 3	50	*/
		51	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		52	# define PTI_CONSUMED_PCID_BITS 1
		53	#else
		54	# define PTI_CONSUMED_PCID_BITS 0
		55	#endif
35		56
36	/* Flush all mappings for a given pcid and addr, not including globals. */	57	#define CR3_AVAIL_PCID_BITS (X86_CR3_PCID_BITS - PTI_CONSUMED_PCID_BITS)
37	static inline void invpcid_flush_one(unsigned long pcid,	58
38	unsigned long addr)	59	/*
39	{	60	* ASIDs are zero-based: 0->MAX_AVAIL_ASID are valid. -1 below to account
40	__invpcid(pcid, addr, INVPCID_TYPE_INDIV_ADDR);	61	* for them being zero-based. Another -1 is because PCID 0 is reserved for
41	}	62	* use by non-PCID-aware users.
		63	*/
		64	#define MAX_ASID_AVAILABLE ((1 << CR3_AVAIL_PCID_BITS) - 2)
		65
		66	/*
		67	* 6 because 6 should be plenty and struct tlb_state will fit in two cache
		68	* lines.
		69	*/
		70	#define TLB_NR_DYN_ASIDS 6
42		71
43	/* Flush all mappings for a given PCID, not including globals. */	72	/*
44	static inline void invpcid_flush_single_context(unsigned long pcid)	73	* Given @asid, compute kPCID
		74	*/
		75	static inline u16 kern_pcid(u16 asid)
45	{	76	{
46	__invpcid(pcid, 0, INVPCID_TYPE_SINGLE_CTXT);	77	VM_WARN_ON_ONCE(asid > MAX_ASID_AVAILABLE);
		78
		79	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		80	/*
		81	* Make sure that the dynamic ASID space does not confict with the
		82	* bit we are using to switch between user and kernel ASIDs.
		83	*/
		84	BUILD_BUG_ON(TLB_NR_DYN_ASIDS >= (1 << X86_CR3_PTI_SWITCH_BIT));
		85
		86	/*
		87	* The ASID being passed in here should have respected the
		88	* MAX_ASID_AVAILABLE and thus never have the switch bit set.
		89	*/
		90	VM_WARN_ON_ONCE(asid & (1 << X86_CR3_PTI_SWITCH_BIT));
		91	#endif
		92	/*
		93	* The dynamically-assigned ASIDs that get passed in are small
		94	* (<TLB_NR_DYN_ASIDS). They never have the high switch bit set,
		95	* so do not bother to clear it.
		96	*
		97	* If PCID is on, ASID-aware code paths put the ASID+1 into the
		98	* PCID bits. This serves two purposes. It prevents a nasty
		99	* situation in which PCID-unaware code saves CR3, loads some other
		100	* value (with PCID == 0), and then restores CR3, thus corrupting
		101	* the TLB for ASID 0 if the saved ASID was nonzero. It also means
		102	* that any bugs involving loading a PCID-enabled CR3 with
		103	* CR4.PCIDE off will trigger deterministically.
		104	*/
		105	return asid + 1;
47	}	106	}
48		107
49	/* Flush all mappings, including globals, for all PCIDs. */	108	/*
50	static inline void invpcid_flush_all(void)	109	* Given @asid, compute uPCID
		110	*/
		111	static inline u16 user_pcid(u16 asid)
51	{	112	{
52	__invpcid(0, 0, INVPCID_TYPE_ALL_INCL_GLOBAL);	113	u16 ret = kern_pcid(asid);
		114	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		115	ret \|= 1 << X86_CR3_PTI_SWITCH_BIT;
		116	#endif
		117	return ret;
53	}	118	}
54		119
55	/* Flush all mappings for all PCIDs except globals. */	120	struct pgd_t;
56	static inline void invpcid_flush_all_nonglobals(void)	121	static inline unsigned long build_cr3(pgd_t *pgd, u16 asid)
57	{	122	{
58	__invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL);	123	if (static_cpu_has(X86_FEATURE_PCID)) {
		124	return __sme_pa(pgd) \| kern_pcid(asid);
		125	} else {
		126	VM_WARN_ON_ONCE(asid != 0);
		127	return __sme_pa(pgd);
		128	}
59	}	129	}
60		130
61	static inline u64 inc_mm_tlb_gen(struct mm_struct *mm)	131	static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
62	{	132	{
63	u64 new_tlb_gen;	133	VM_WARN_ON_ONCE(asid > MAX_ASID_AVAILABLE);
64		134	VM_WARN_ON_ONCE(!this_cpu_has(X86_FEATURE_PCID));
65	/*	135	return __sme_pa(pgd) \| kern_pcid(asid) \| CR3_NOFLUSH;
66	* Bump the generation count. This also serves as a full barrier
67	* that synchronizes with switch_mm(): callers are required to order
68	* their read of mm_cpumask after their writes to the paging
69	* structures.
70	*/
71	smp_mb__before_atomic();
72	new_tlb_gen = atomic64_inc_return(&mm->context.tlb_gen);
73	smp_mb__after_atomic();
74
75	return new_tlb_gen;
76	}	136	}
77		137
78	#ifdef CONFIG_PARAVIRT	138	#ifdef CONFIG_PARAVIRT
@@ -99,12 +159,6 @@ static inline bool tlb_defer_switch_to_init_mm(void) · 20 unmodified lines
99	return !static_cpu_has(X86_FEATURE_PCID);	159	return !static_cpu_has(X86_FEATURE_PCID);
100	}	160	}
101		161
102	/*
103	* 6 because 6 should be plenty and struct tlb_state will fit in
104	* two cache lines.
105	*/
106	#define TLB_NR_DYN_ASIDS 6
107
108	struct tlb_context {	162	struct tlb_context {
109	u64 ctx_id;	163	u64 ctx_id;
110	u64 tlb_gen;	164	u64 tlb_gen;
@@ -138,6 +192,24 @@ struct tlb_state { · 27 unmodified lines
138	*/	192	*/
139	bool is_lazy;	193	bool is_lazy;
140		194
		195	/*
		196	* If set we changed the page tables in such a way that we
		197	* needed an invalidation of all contexts (aka. PCIDs / ASIDs).
		198	* This tells us to go invalidate all the non-loaded ctxs[]
		199	* on the next context switch.
		200	*
		201	* The current ctx was kept up-to-date as it ran and does not
		202	* need to be invalidated.
		203	*/
		204	bool invalidate_other;
		205
		206	/*
		207	* Mask that contains TLB_NR_DYN_ASIDS+1 bits to indicate
		208	* the corresponding user PCID needs a flush next time we
		209	* switch to it; see SWITCH_TO_USER_CR3.
		210	*/
		211	unsigned short user_pcid_flush_mask;
		212
141	/*	213	/*
142	* Access to this CR4 shadow and to H/W CR4 is protected by	214	* Access to this CR4 shadow and to H/W CR4 is protected by
143	* disabling interrupts when modifying either one.	215	* disabling interrupts when modifying either one.
@@ -218,6 +290,14 @@ static inline unsigned long cr4_read_shadow(void) · 74 unmodified lines
218	return this_cpu_read(cpu_tlbstate.cr4);	290	return this_cpu_read(cpu_tlbstate.cr4);
219	}	291	}
220		292
		293	/*
		294	* Mark all other ASIDs as invalid, preserves the current.
		295	*/
		296	static inline void invalidate_other_asid(void)
		297	{
		298	this_cpu_write(cpu_tlbstate.invalidate_other, true);
		299	}
		300
221	/*	301	/*
222	* Save some of cr4 feature set we're using (e.g. Pentium 4MB	302	* Save some of cr4 feature set we're using (e.g. Pentium 4MB
223	* enable and PPro Global page enable), so that any CPU's that boot	303	* enable and PPro Global page enable), so that any CPU's that boot
@@ -237,37 +317,63 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask) · 13 unmodified lines
237		317
238	extern void initialize_tlbstate_and_flush(void);	318	extern void initialize_tlbstate_and_flush(void);
239		319
240	static inline void __native_flush_tlb(void)	320	/*
		321	* Given an ASID, flush the corresponding user ASID. We can delay this
		322	* until the next time we switch to it.
		323	*
		324	* See SWITCH_TO_USER_CR3.
		325	*/
		326	static inline void invalidate_user_asid(u16 asid)
241	{	327	{
		328	/* There is no user ASID if address space separation is off */
		329	if (!IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
		330	return;
		331
242	/*	332	/*
243	* If current->mm == NULL then we borrow a mm which may change during a	333	* We only have a single ASID if PCID is off and the CR3
244	* task switch and therefore we must not be preempted while we write CR3	334	* write will have flushed it.
245	* back:
246	*/	335	*/
247	preempt_disable();	336	if (!cpu_feature_enabled(X86_FEATURE_PCID))
248	native_write_cr3(__native_read_cr3());	337	return;
249	preempt_enable();	338
		339	if (!static_cpu_has(X86_FEATURE_PTI))
		340	return;
		341
		342	__set_bit(kern_pcid(asid),
		343	(unsigned long *)this_cpu_ptr(&cpu_tlbstate.user_pcid_flush_mask));
250	}	344	}
251		345
252	static inline void __native_flush_tlb_global_irq_disabled(void)	346	/*
		347	* flush the entire current user mapping
		348	*/
		349	static inline void __native_flush_tlb(void)
253	{	350	{
254	unsigned long cr4;	351	/*
		352	* Preemption or interrupts must be disabled to protect the access
		353	* to the per CPU variable and to prevent being preempted between
		354	* read_cr3() and write_cr3().
		355	*/
		356	WARN_ON_ONCE(preemptible());
255		357
256	cr4 = this_cpu_read(cpu_tlbstate.cr4);	358	invalidate_user_asid(this_cpu_read(cpu_tlbstate.loaded_mm_asid));
257	/* clear PGE */	359
258	native_write_cr4(cr4 & ~X86_CR4_PGE);	360	/* If current->mm == NULL then the read_cr3() "borrows" an mm */
259	/* write old PGE again and flush TLBs */	361	native_write_cr3(__native_read_cr3());
260	native_write_cr4(cr4);
261	}	362	}
262		363
		364	/*
		365	* flush everything
		366	*/
263	static inline void __native_flush_tlb_global(void)	367	static inline void __native_flush_tlb_global(void)
264	{	368	{
265	unsigned long flags;	369	unsigned long cr4, flags;
266		370
267	if (static_cpu_has(X86_FEATURE_INVPCID)) {	371	if (static_cpu_has(X86_FEATURE_INVPCID)) {
268	/*	372	/*
269	* Using INVPCID is considerably faster than a pair of writes	373	* Using INVPCID is considerably faster than a pair of writes
270	* to CR4 sandwiched inside an IRQ flag save/restore.	374	* to CR4 sandwiched inside an IRQ flag save/restore.
		375	*
		376	* Note, this works with CR4.PCIDE=0 or 1.
271	*/	377	*/
272	invpcid_flush_all();	378	invpcid_flush_all();
273	return;	379	return;
@@ -280,36 +386,69 @@ static inline void __native_flush_tlb_global(void) · 6 unmodified lines
280	*/	386	*/
281	raw_local_irq_save(flags);	387	raw_local_irq_save(flags);
282		388
283	__native_flush_tlb_global_irq_disabled();	389	cr4 = this_cpu_read(cpu_tlbstate.cr4);
		390	/* toggle PGE */
		391	native_write_cr4(cr4 ^ X86_CR4_PGE);
		392	/* write old PGE again and flush TLBs */
		393	native_write_cr4(cr4);
284		394
285	raw_local_irq_restore(flags);	395	raw_local_irq_restore(flags);
286	}	396	}
287		397
		398	/*
		399	* flush one page in the user mapping
		400	*/
288	static inline void __native_flush_tlb_single(unsigned long addr)	401	static inline void __native_flush_tlb_single(unsigned long addr)
289	{	402	{
		403	u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
		404
290	asm volatile("invlpg (%0)" ::"r" (addr) : "memory");	405	asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
		406
		407	if (!static_cpu_has(X86_FEATURE_PTI))
		408	return;
		409
		410	/*
		411	* Some platforms #GP if we call invpcid(type=1/2) before CR4.PCIDE=1.
		412	* Just use invalidate_user_asid() in case we are called early.
		413	*/
		414	if (!this_cpu_has(X86_FEATURE_INVPCID_SINGLE))
		415	invalidate_user_asid(loaded_mm_asid);
		416	else
		417	invpcid_flush_one(user_pcid(loaded_mm_asid), addr);
291	}	418	}
292		419
		420	/*
		421	* flush everything
		422	*/
293	static inline void __flush_tlb_all(void)	423	static inline void __flush_tlb_all(void)
294	{	424	{
295	if (boot_cpu_has(X86_FEATURE_PGE))	425	if (boot_cpu_has(X86_FEATURE_PGE)) {
296	__flush_tlb_global();	426	__flush_tlb_global();
297	else	427	} else {
		428	/*
		429	* !PGE -> !PCID (setup_pcid()), thus every flush is total.
		430	*/
298	__flush_tlb();	431	__flush_tlb();
299		432	}
300	/*
301	* Note: if we somehow had PCID but not PGE, then this wouldn't work --
302	* we'd end up flushing kernel translations for the current ASID but
303	* we might fail to flush kernel translations for other cached ASIDs.
304	*
305	* To avoid this issue, we force PCID off if PGE is off.
306	*/
307	}	433	}
308		434
		435	/*
		436	* flush one page in the kernel mapping
		437	*/
309	static inline void __flush_tlb_one(unsigned long addr)	438	static inline void __flush_tlb_one(unsigned long addr)
310	{	439	{
311	count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);	440	count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
312	__flush_tlb_single(addr);	441	__flush_tlb_single(addr);
		442
		443	if (!static_cpu_has(X86_FEATURE_PTI))
		444	return;
		445
		446	/*
		447	* __flush_tlb_single() will have cleared the TLB entry for this ASID,
		448	* but since kernel space is replicated across all, we must also
		449	* invalidate all others.
		450	*/
		451	invalidate_other_asid();
313	}	452	}
314		453
315	#define TLB_FLUSH_ALL -1UL	454	#define TLB_FLUSH_ALL -1UL
@@ -370,6 +509,17 @@ static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long a) · 54 unmodified lines
370	void native_flush_tlb_others(const struct cpumask *cpumask,	509	void native_flush_tlb_others(const struct cpumask *cpumask,
371	const struct flush_tlb_info *info);	510	const struct flush_tlb_info *info);
372		511
		512	static inline u64 inc_mm_tlb_gen(struct mm_struct *mm)
		513	{
		514	/*
		515	* Bump the generation count. This also serves as a full barrier
		516	* that synchronizes with switch_mm(): callers are required to order
		517	* their read of mm_cpumask after their writes to the paging
		518	* structures.
		519	*/
		520	return atomic64_inc_return(&mm->context.tlb_gen);
		521	}
		522
373	static inline void arch_tlbbatch_add_mm(struct arch_tlbflush_unmap_batch *batch,	523	static inline void arch_tlbbatch_add_mm(struct arch_tlbflush_unmap_batch *batch,
374	struct mm_struct *mm)	524	struct mm_struct *mm)
375	{	525	{

arch/x86/include/asm/trace/irq_vectors.h+8−8

@@ -283,34 +283,34 @@ TRACE_EVENT(vector_alloc_managed, · 282 unmodified lines
283	DECLARE_EVENT_CLASS(vector_activate,	283	DECLARE_EVENT_CLASS(vector_activate,
284		284
285	TP_PROTO(unsigned int irq, bool is_managed, bool can_reserve,	285	TP_PROTO(unsigned int irq, bool is_managed, bool can_reserve,
286	bool early),	286	bool reserve),
287		287
288	TP_ARGS(irq, is_managed, can_reserve, early),	288	TP_ARGS(irq, is_managed, can_reserve, reserve),
289		289
290	TP_STRUCT__entry(	290	TP_STRUCT__entry(
291	__field( unsigned int, irq )	291	__field( unsigned int, irq )
292	__field( bool, is_managed )	292	__field( bool, is_managed )
293	__field( bool, can_reserve )	293	__field( bool, can_reserve )
294	__field( bool, early )	294	__field( bool, reserve )
295	),	295	),
296		296
297	TP_fast_assign(	297	TP_fast_assign(
298	__entry->irq = irq;	298	__entry->irq = irq;
299	__entry->is_managed = is_managed;	299	__entry->is_managed = is_managed;
300	__entry->can_reserve = can_reserve;	300	__entry->can_reserve = can_reserve;
301	__entry->early = early;	301	__entry->reserve = reserve;
302	),	302	),
303		303
304	TP_printk("irq=%u is_managed=%d can_reserve=%d early=%d",	304	TP_printk("irq=%u is_managed=%d can_reserve=%d reserve=%d",
305	__entry->irq, __entry->is_managed, __entry->can_reserve,	305	__entry->irq, __entry->is_managed, __entry->can_reserve,
306	__entry->early)	306	__entry->reserve)
307	);	307	);
308		308
309	#define DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(name) \	309	#define DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(name) \
310	DEFINE_EVENT_FN(vector_activate, name, \	310	DEFINE_EVENT_FN(vector_activate, name, \
311	TP_PROTO(unsigned int irq, bool is_managed, \	311	TP_PROTO(unsigned int irq, bool is_managed, \
312	bool can_reserve, bool early), \	312	bool can_reserve, bool reserve), \
313	TP_ARGS(irq, is_managed, can_reserve, early), NULL, NULL); \	313	TP_ARGS(irq, is_managed, can_reserve, reserve), NULL, NULL); \
314		314
315	DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(vector_activate);	315	DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(vector_activate);
316	DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(vector_deactivate);	316	DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(vector_deactivate);

arch/x86/include/asm/traps.h+0−1

@@ -75,7 +75,6 @@ dotraplinkage void do_segment_not_present(struct pt_regs *, long); · 74 unmodified lines
75	dotraplinkage void do_stack_segment(struct pt_regs *, long);	75	dotraplinkage void do_stack_segment(struct pt_regs *, long);
76	#ifdef CONFIG_X86_64	76	#ifdef CONFIG_X86_64
77	dotraplinkage void do_double_fault(struct pt_regs *, long);	77	dotraplinkage void do_double_fault(struct pt_regs *, long);
78	asmlinkage struct pt_regs sync_regs(struct pt_regs );
79	#endif	78	#endif
80	dotraplinkage void do_general_protection(struct pt_regs *, long);	79	dotraplinkage void do_general_protection(struct pt_regs *, long);
81	dotraplinkage void do_page_fault(struct pt_regs *, unsigned long);	80	dotraplinkage void do_page_fault(struct pt_regs *, unsigned long);

arch/x86/include/asm/unwind.h+7−0

 #include <asm/ptrace.h>
 #include <asm/stacktrace.h>
+#define IRET_FRAME_OFFSET (offsetof(struct pt_regs, ip))
+#define IRET_FRAME_SIZE   (sizeof(struct pt_regs) - IRET_FRAME_OFFSET)
 struct unwind_state {
 	struct stack_info stack_info;
 	unsigned long stack_mask;
 }
 #if defined(CONFIG_UNWINDER_ORC) || defined(CONFIG_UNWINDER_FRAME_POINTER)
+/*
+ * WARNING: The entire pt_regs may not be safe to dereference.  In some cases,
+ * only the iret frame registers are accessible.  Use with caution!
+ */
 static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state)
 {
 	if (unwind_done(state))

arch/x86/include/asm/vsyscall.h+1−0

@@ -7,6 +7,7 @@ · 6 unmodified lines
7		7
8	#ifdef CONFIG_X86_VSYSCALL_EMULATION	8	#ifdef CONFIG_X86_VSYSCALL_EMULATION
9	extern void map_vsyscall(void);	9	extern void map_vsyscall(void);
		10	extern void set_vsyscall_pgtable_user_bits(pgd_t *root);
10		11
11	/*	12	/*
12	* Called on instruction fetch fault in vsyscall page.	13	* Called on instruction fetch fault in vsyscall page.

arch/x86/include/uapi/asm/processor-flags.h+6−1

@@ -78,7 +78,12 @@ · 77 unmodified lines
78	#define X86_CR3_PWT _BITUL(X86_CR3_PWT_BIT)	78	#define X86_CR3_PWT _BITUL(X86_CR3_PWT_BIT)
79	#define X86_CR3_PCD_BIT 4 /* Page Cache Disable */	79	#define X86_CR3_PCD_BIT 4 /* Page Cache Disable */
80	#define X86_CR3_PCD _BITUL(X86_CR3_PCD_BIT)	80	#define X86_CR3_PCD _BITUL(X86_CR3_PCD_BIT)
81	#define X86_CR3_PCID_MASK _AC(0x00000fff,UL) /* PCID Mask */	81
		82	#define X86_CR3_PCID_BITS 12
		83	#define X86_CR3_PCID_MASK (_AC((1UL << X86_CR3_PCID_BITS) - 1, UL))
		84
		85	#define X86_CR3_PCID_NOFLUSH_BIT 63 /* Preserve old PCID */
		86	#define X86_CR3_PCID_NOFLUSH _BITULL(X86_CR3_PCID_NOFLUSH_BIT)
82		87
83	/*	88	/*
84	* Intel CPU features in CR4	89	* Intel CPU features in CR4

arch/x86/kernel/apic/apic.c+2−0

 		apic_verbosity = APIC_DEBUG;
 	else if (strcmp("verbose", arg) == 0)
 		apic_verbosity = APIC_VERBOSE;
+#ifdef CONFIG_X86_64
 	else {
 		pr_warning("APIC Verbosity level %s not recognised"
 			" use apic=verbose or apic=debug\n", arg);
 		return -EINVAL;
 	}
+#endif
 	return 0;
 }

arch/x86/kernel/apic/apic_flat_64.c+1−1

@@ -151,7 +151,7 @@ static struct apic apic_flat __ro_after_init = { · 150 unmodified lines
151	.apic_id_valid = default_apic_id_valid,	151	.apic_id_valid = default_apic_id_valid,
152	.apic_id_registered = flat_apic_id_registered,	152	.apic_id_registered = flat_apic_id_registered,
153		153
154	.irq_delivery_mode = dest_LowestPrio,	154	.irq_delivery_mode = dest_Fixed,
155	.irq_dest_mode = 1, /* logical */	155	.irq_dest_mode = 1, /* logical */
156		156
157	.disable_esr = 0,	157	.disable_esr = 0,

arch/x86/kernel/apic/apic_noop.c+1−1

@@ -110,7 +110,7 @@ struct apic apic_noop __ro_after_init = { · 109 unmodified lines
110	.apic_id_valid = default_apic_id_valid,	110	.apic_id_valid = default_apic_id_valid,
111	.apic_id_registered = noop_apic_id_registered,	111	.apic_id_registered = noop_apic_id_registered,
112		112
113	.irq_delivery_mode = dest_LowestPrio,	113	.irq_delivery_mode = dest_Fixed,
114	/* logical delivery broadcast to all CPUs: */	114	/* logical delivery broadcast to all CPUs: */
115	.irq_dest_mode = 1,	115	.irq_dest_mode = 1,
116		116

arch/x86/kernel/apic/io_apic.c+1−1

@@ -2988,7 +2988,7 @@ void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq, · 2987 unmodified lines
2988	}	2988	}
2989		2989
2990	int mp_irqdomain_activate(struct irq_domain *domain,	2990	int mp_irqdomain_activate(struct irq_domain *domain,
2991	struct irq_data *irq_data, bool early)	2991	struct irq_data *irq_data, bool reserve)
2992	{	2992	{
2993	unsigned long flags;	2993	unsigned long flags;
2994		2994

arch/x86/kernel/apic/msi.c+2−6

 		((apic->irq_dest_mode == 0) ?
 			MSI_ADDR_DEST_MODE_PHYSICAL :
 			MSI_ADDR_DEST_MODE_LOGICAL) |
-		((apic->irq_delivery_mode != dest_LowestPrio) ?
+		MSI_ADDR_REDIRECTION_CPU |
-			MSI_ADDR_REDIRECTION_CPU :
-			MSI_ADDR_REDIRECTION_LOWPRI) |
 		MSI_ADDR_DEST_ID(cfg->dest_apicid);
 	msg->data =
 		MSI_DATA_TRIGGER_EDGE |
 		MSI_DATA_LEVEL_ASSERT |
-		((apic->irq_delivery_mode != dest_LowestPrio) ?
+		MSI_DATA_DELIVERY_FIXED |
-			MSI_DATA_DELIVERY_FIXED :
-			MSI_DATA_DELIVERY_LOWPRI) |
 		MSI_DATA_VECTOR(cfg->vector);
 }

arch/x86/kernel/apic/probe_32.c+1−1

@@ -105,7 +105,7 @@ static struct apic apic_default __ro_after_init = { · 104 unmodified lines
105	.apic_id_valid = default_apic_id_valid,	105	.apic_id_valid = default_apic_id_valid,
106	.apic_id_registered = default_apic_id_registered,	106	.apic_id_registered = default_apic_id_registered,
107		107
108	.irq_delivery_mode = dest_LowestPrio,	108	.irq_delivery_mode = dest_Fixed,
109	/* logical delivery broadcast to all CPUs: */	109	/* logical delivery broadcast to all CPUs: */
110	.irq_dest_mode = 1,	110	.irq_dest_mode = 1,
111		111

arch/x86/kernel/apic/vector.c+16−4

 	irq_matrix_reserve(vector_matrix);
 	apicd->can_reserve = true;
 	apicd->has_reserved = true;
+	irqd_set_can_reserve(irqd);
 	trace_vector_reserve(irqd->irq, 0);
 	vector_assign_managed_shutdown(irqd);
 }
 	int ret;
 	ret = assign_irq_vector_any_locked(irqd);
-	if (!ret)
+	if (!ret) {
 		apicd->has_reserved = false;
+		/*
+		 * Core might have disabled reservation mode after
+		 * allocating the irq descriptor. Ideally this should
+		 * happen before allocation time, but that would require
+		 * completely convoluted ways of transporting that
+		 * information.
+		 */
+		if (!irqd_can_reserve(irqd))
+			apicd->can_reserve = false;
+	}
 	return ret;
 }
 }
 static int x86_vector_activate(struct irq_domain *dom, struct irq_data *irqd,
-			       bool early)
+			       bool reserve)
 {
 	struct apic_chip_data *apicd = apic_chip_data(irqd);
 	unsigned long flags;
 	int ret = 0;
 	trace_vector_activate(irqd->irq, apicd->is_managed,
-			      apicd->can_reserve, early);
+			      apicd->can_reserve, reserve);
 	/* Nothing to do for fixed assigned vectors */
 	if (!apicd->can_reserve && !apicd->is_managed)
 		return 0;
 	raw_spin_lock_irqsave(&vector_lock, flags);
-	if (early || irqd_is_managed_and_shutdown(irqd))
+	if (reserve || irqd_is_managed_and_shutdown(irqd))
 		vector_assign_managed_shutdown(irqd);
 	else if (apicd->is_managed)
 		ret = activate_managed(irqd);
 	} else {
 		/* Release the vector */
 		apicd->can_reserve = true;
+		irqd_set_can_reserve(irqd);
 		clear_irq_vector(irqd);
 		realloc = true;
 	}

arch/x86/kernel/apic/x2apic_cluster.c+1−1

@@ -184,7 +184,7 @@ static struct apic apic_x2apic_cluster __ro_after_init = { · 183 unmodified lines
184	.apic_id_valid = x2apic_apic_id_valid,	184	.apic_id_valid = x2apic_apic_id_valid,
185	.apic_id_registered = x2apic_apic_id_registered,	185	.apic_id_registered = x2apic_apic_id_registered,
186		186
187	.irq_delivery_mode = dest_LowestPrio,	187	.irq_delivery_mode = dest_Fixed,
188	.irq_dest_mode = 1, /* logical */	188	.irq_dest_mode = 1, /* logical */
189		189
190	.disable_esr = 0,	190	.disable_esr = 0,

arch/x86/kernel/asm-offsets.c+10−0

 #include <asm/sigframe.h>
 #include <asm/bootparam.h>
 #include <asm/suspend.h>
+#include <asm/tlbflush.h>
 #ifdef CONFIG_XEN
 #include <xen/interface/xen.h>
 	BLANK();
 	DEFINE(PTREGS_SIZE, sizeof(struct pt_regs));
+	/* TLB state for the entry code */
+	OFFSET(TLB_STATE_user_pcid_flush_mask, tlb_state, user_pcid_flush_mask);
+	/* Layout info for cpu_entry_area */
+	OFFSET(CPU_ENTRY_AREA_tss, cpu_entry_area, tss);
+	OFFSET(CPU_ENTRY_AREA_entry_trampoline, cpu_entry_area, entry_trampoline);
+	OFFSET(CPU_ENTRY_AREA_entry_stack, cpu_entry_area, entry_stack_page);
+	DEFINE(SIZEOF_entry_stack, sizeof(struct entry_stack));
 }

arch/x86/kernel/asm-offsets_32.c+2−7

 	BLANK();
 	/* Offset from the sysenter stack to tss.sp0 */
-	DEFINE(TSS_sysenter_sp0, offsetof(struct tss_struct, x86_tss.sp0) -
+	DEFINE(TSS_sysenter_sp0, offsetof(struct cpu_entry_area, tss.x86_tss.sp0) -
-	       offsetofend(struct tss_struct, SYSENTER_stack));
+	       offsetofend(struct cpu_entry_area, entry_stack_page.stack));
-	/* Offset from cpu_tss to SYSENTER_stack */
-	OFFSET(CPU_TSS_SYSENTER_stack, tss_struct, SYSENTER_stack);
-	/* Size of SYSENTER_stack */
-	DEFINE(SIZEOF_SYSENTER_stack, sizeof(((struct tss_struct *)0)->SYSENTER_stack));
 #ifdef CONFIG_CC_STACKPROTECTOR
 	BLANK();

arch/x86/kernel/asm-offsets_64.c+4−0

 #ifdef CONFIG_PARAVIRT
 	OFFSET(PV_CPU_usergs_sysret64, pv_cpu_ops, usergs_sysret64);
 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
+#ifdef CONFIG_DEBUG_ENTRY
+	OFFSET(PV_IRQ_save_fl, pv_irq_ops, save_fl);
+#endif
 	BLANK();
 #endif
 	OFFSET(TSS_ist, tss_struct, x86_tss.ist);
 	OFFSET(TSS_sp0, tss_struct, x86_tss.sp0);
+	OFFSET(TSS_sp1, tss_struct, x86_tss.sp1);
 	BLANK();
 #ifdef CONFIG_CC_STACKPROTECTOR

arch/x86/kernel/cpu/common.c+47−56

@@ -476,8 +476,8 @@ static const char table_lookup_model(struct cpuinfo_x86 c) · 475 unmodified lines
476	return NULL; /* Not found */	476	return NULL; /* Not found */
477	}	477	}
478		478
479	__u32 cpu_caps_cleared[NCAPINTS];	479	__u32 cpu_caps_cleared[NCAPINTS + NBUGINTS];
480	__u32 cpu_caps_set[NCAPINTS];	480	__u32 cpu_caps_set[NCAPINTS + NBUGINTS];
481		481
482	void load_percpu_segment(int cpu)	482	void load_percpu_segment(int cpu)
483	{	483	{
@@ -490,28 +490,23 @@ void load_percpu_segment(int cpu) · 6 unmodified lines
490	load_stack_canary_segment();	490	load_stack_canary_segment();
491	}	491	}
492		492
493	/* Setup the fixmap mapping only once per-processor */	493	#ifdef CONFIG_X86_32
494	static inline void setup_fixmap_gdt(int cpu)	494	/* The 32-bit entry code needs to find cpu_entry_area. */
495	{	495	DEFINE_PER_CPU(struct cpu_entry_area *, cpu_entry_area);
496	#ifdef CONFIG_X86_64
497	/* On 64-bit systems, we use a read-only fixmap GDT. */
498	pgprot_t prot = PAGE_KERNEL_RO;
499	#else
500	/*
501	* On native 32-bit systems, the GDT cannot be read-only because
502	* our double fault handler uses a task gate, and entering through
503	* a task gate needs to change an available TSS to busy. If the GDT
504	* is read-only, that will triple fault.
505	*
506	* On Xen PV, the GDT must be read-only because the hypervisor requires
507	* it.
508	*/
509	pgprot_t prot = boot_cpu_has(X86_FEATURE_XENPV) ?
510	PAGE_KERNEL_RO : PAGE_KERNEL;
511	#endif	496	#endif
512		497
513	__set_fixmap(get_cpu_gdt_ro_index(cpu), get_cpu_gdt_paddr(cpu), prot);	498	#ifdef CONFIG_X86_64
514	}	499	/*
		500	* Special IST stacks which the CPU switches to when it calls
		501	* an IST-marked descriptor entry. Up to 7 stacks (hardware
		502	* limit), all of them are 4K, except the debug stack which
		503	* is 8K.
		504	*/
		505	static const unsigned int exception_stack_sizes[N_EXCEPTION_STACKS] = {
		506	[0 ... N_EXCEPTION_STACKS - 1] = EXCEPTION_STKSZ,
		507	[DEBUG_STACK - 1] = DEBUG_STKSZ
		508	};
		509	#endif
515		510
516	/* Load the original GDT from the per-cpu structure */	511	/* Load the original GDT from the per-cpu structure */
517	void load_direct_gdt(int cpu)	512	void load_direct_gdt(int cpu)
@@ -747,7 +742,7 @@ static void apply_forced_caps(struct cpuinfo_x86 *c) · 229 unmodified lines
747	{	742	{
748	int i;	743	int i;
749		744
750	for (i = 0; i < NCAPINTS; i++) {	745	for (i = 0; i < NCAPINTS + NBUGINTS; i++) {
751	c->x86_capability[i] &= ~cpu_caps_cleared[i];	746	c->x86_capability[i] &= ~cpu_caps_cleared[i];
752	c->x86_capability[i] \|= cpu_caps_set[i];	747	c->x86_capability[i] \|= cpu_caps_set[i];
753	}	748	}
@@ -927,6 +922,10 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) · 173 unmodified lines
927	}	922	}
928		923
929	setup_force_cpu_cap(X86_FEATURE_ALWAYS);	924	setup_force_cpu_cap(X86_FEATURE_ALWAYS);
		925
		926	/* Assume for now that ALL x86 CPUs are insecure */
		927	setup_force_cpu_bug(X86_BUG_CPU_INSECURE);
		928
930	fpu__init_system(c);	929	fpu__init_system(c);
931		930
932	#ifdef CONFIG_X86_32	931	#ifdef CONFIG_X86_32
@@ -1250,7 +1249,7 @@ void enable_sep_cpu(void) · 317 unmodified lines
1250	return;	1249	return;
1251		1250
1252	cpu = get_cpu();	1251	cpu = get_cpu();
1253	tss = &per_cpu(cpu_tss, cpu);	1252	tss = &per_cpu(cpu_tss_rw, cpu);
1254		1253
1255	/*	1254	/*
1256	* We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field --	1255	* We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field --
@@ -1259,11 +1258,7 @@ void enable_sep_cpu(void) · 2 unmodified lines
1259		1258
1260	tss->x86_tss.ss1 = __KERNEL_CS;	1259	tss->x86_tss.ss1 = __KERNEL_CS;
1261	wrmsr(MSR_IA32_SYSENTER_CS, tss->x86_tss.ss1, 0);	1260	wrmsr(MSR_IA32_SYSENTER_CS, tss->x86_tss.ss1, 0);
1262		1261	wrmsr(MSR_IA32_SYSENTER_ESP, (unsigned long)(cpu_entry_stack(cpu) + 1), 0);
1263	wrmsr(MSR_IA32_SYSENTER_ESP,
1264	(unsigned long)tss + offsetofend(struct tss_struct, SYSENTER_stack),
1265	0);
1266
1267	wrmsr(MSR_IA32_SYSENTER_EIP, (unsigned long)entry_SYSENTER_32, 0);	1262	wrmsr(MSR_IA32_SYSENTER_EIP, (unsigned long)entry_SYSENTER_32, 0);
1268		1263
1269	put_cpu();	1264	put_cpu();
@@ -1357,25 +1352,22 @@ DEFINE_PER_CPU(unsigned int, irq_count) __visible = -1; · 87 unmodified lines
1357	DEFINE_PER_CPU(int, __preempt_count) = INIT_PREEMPT_COUNT;	1352	DEFINE_PER_CPU(int, __preempt_count) = INIT_PREEMPT_COUNT;
1358	EXPORT_PER_CPU_SYMBOL(__preempt_count);	1353	EXPORT_PER_CPU_SYMBOL(__preempt_count);
1359		1354
1360	/*
1361	* Special IST stacks which the CPU switches to when it calls
1362	* an IST-marked descriptor entry. Up to 7 stacks (hardware
1363	* limit), all of them are 4K, except the debug stack which
1364	* is 8K.
1365	*/
1366	static const unsigned int exception_stack_sizes[N_EXCEPTION_STACKS] = {
1367	[0 ... N_EXCEPTION_STACKS - 1] = EXCEPTION_STKSZ,
1368	[DEBUG_STACK - 1] = DEBUG_STKSZ
1369	};
1370
1371	static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks
1372	[(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ]);
1373
1374	/* May not be marked __init: used by software suspend */	1355	/* May not be marked __init: used by software suspend */
1375	void syscall_init(void)	1356	void syscall_init(void)
1376	{	1357	{
		1358	extern char _entry_trampoline[];
		1359	extern char entry_SYSCALL_64_trampoline[];
		1360
		1361	int cpu = smp_processor_id();
		1362	unsigned long SYSCALL64_entry_trampoline =
		1363	(unsigned long)get_cpu_entry_area(cpu)->entry_trampoline +
		1364	(entry_SYSCALL_64_trampoline - _entry_trampoline);
		1365
1377	wrmsr(MSR_STAR, 0, (__USER32_CS << 16) \| __KERNEL_CS);	1366	wrmsr(MSR_STAR, 0, (__USER32_CS << 16) \| __KERNEL_CS);
1378	wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64);	1367	if (static_cpu_has(X86_FEATURE_PTI))
		1368	wrmsrl(MSR_LSTAR, SYSCALL64_entry_trampoline);
		1369	else
		1370	wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64);
1379		1371
1380	#ifdef CONFIG_IA32_EMULATION	1372	#ifdef CONFIG_IA32_EMULATION
1381	wrmsrl(MSR_CSTAR, (unsigned long)entry_SYSCALL_compat);	1373	wrmsrl(MSR_CSTAR, (unsigned long)entry_SYSCALL_compat);
@@ -1386,7 +1378,7 @@ void syscall_init(void) · 4 unmodified lines
1386	* AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit).	1378	* AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit).
1387	*/	1379	*/
1388	wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS);	1380	wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS);
1389	wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL);	1381	wrmsrl_safe(MSR_IA32_SYSENTER_ESP, (unsigned long)(cpu_entry_stack(cpu) + 1));
1390	wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat);	1382	wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat);
1391	#else	1383	#else
1392	wrmsrl(MSR_CSTAR, (unsigned long)ignore_sysret);	1384	wrmsrl(MSR_CSTAR, (unsigned long)ignore_sysret);
@@ -1530,7 +1522,7 @@ void cpu_init(void) · 137 unmodified lines
1530	if (cpu)	1522	if (cpu)
1531	load_ucode_ap();	1523	load_ucode_ap();
1532		1524
1533	t = &per_cpu(cpu_tss, cpu);	1525	t = &per_cpu(cpu_tss_rw, cpu);
1534	oist = &per_cpu(orig_ist, cpu);	1526	oist = &per_cpu(orig_ist, cpu);
1535		1527
1536	#ifdef CONFIG_NUMA	1528	#ifdef CONFIG_NUMA
@@ -1569,7 +1561,7 @@ void cpu_init(void) · 32 unmodified lines
1569	* set up and load the per-CPU TSS	1561	* set up and load the per-CPU TSS
1570	*/	1562	*/
1571	if (!oist->ist[0]) {	1563	if (!oist->ist[0]) {
1572	char *estacks = per_cpu(exception_stacks, cpu);	1564	char *estacks = get_cpu_entry_area(cpu)->exception_stacks;
1573		1565
1574	for (v = 0; v < N_EXCEPTION_STACKS; v++) {	1566	for (v = 0; v < N_EXCEPTION_STACKS; v++) {
1575	estacks += exception_stack_sizes[v];	1567	estacks += exception_stack_sizes[v];
@@ -1580,7 +1572,7 @@ void cpu_init(void) · 4 unmodified lines
1580	}	1572	}
1581	}	1573	}
1582		1574
1583	t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);	1575	t->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET;
1584		1576
1585	/*	1577	/*
1586	* <= is required because the CPU will access up to	1578	* <= is required because the CPU will access up to
@@ -1596,11 +1588,12 @@ void cpu_init(void) · 9 unmodified lines
1596	enter_lazy_tlb(&init_mm, me);	1588	enter_lazy_tlb(&init_mm, me);
1597		1589
1598	/*	1590	/*
1599	* Initialize the TSS. Don't bother initializing sp0, as the initial	1591	* Initialize the TSS. sp0 points to the entry trampoline stack
1600	* task never enters user mode.	1592	* regardless of what task is running.
1601	*/	1593	*/
1602	set_tss_desc(cpu, t);	1594	set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
1603	load_TR_desc();	1595	load_TR_desc();
		1596	load_sp0((unsigned long)(cpu_entry_stack(cpu) + 1));
1604		1597
1605	load_mm_ldt(&init_mm);	1598	load_mm_ldt(&init_mm);
1606		1599
@@ -1612,7 +1605,6 @@ void cpu_init(void) · 5 unmodified lines
1612	if (is_uv_system())	1605	if (is_uv_system())
1613	uv_cpu_init();	1606	uv_cpu_init();
1614		1607
1615	setup_fixmap_gdt(cpu);
1616	load_fixmap_gdt(cpu);	1608	load_fixmap_gdt(cpu);
1617	}	1609	}
1618		1610
@@ -1622,7 +1614,7 @@ void cpu_init(void) · 3 unmodified lines
1622	{	1614	{
1623	int cpu = smp_processor_id();	1615	int cpu = smp_processor_id();
1624	struct task_struct *curr = current;	1616	struct task_struct *curr = current;
1625	struct tss_struct *t = &per_cpu(cpu_tss, cpu);	1617	struct tss_struct *t = &per_cpu(cpu_tss_rw, cpu);
1626		1618
1627	wait_for_master_cpu(cpu);	1619	wait_for_master_cpu(cpu);
1628		1620
@@ -1657,12 +1649,12 @@ void cpu_init(void) · 28 unmodified lines
1657	* Initialize the TSS. Don't bother initializing sp0, as the initial	1649	* Initialize the TSS. Don't bother initializing sp0, as the initial
1658	* task never enters user mode.	1650	* task never enters user mode.
1659	*/	1651	*/
1660	set_tss_desc(cpu, t);	1652	set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
1661	load_TR_desc();	1653	load_TR_desc();
1662		1654
1663	load_mm_ldt(&init_mm);	1655	load_mm_ldt(&init_mm);
1664		1656
1665	t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);	1657	t->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET;
1666		1658
1667	#ifdef CONFIG_DOUBLEFAULT	1659	#ifdef CONFIG_DOUBLEFAULT
1668	/* Set up doublefault TSS pointer in the GDT */	1660	/* Set up doublefault TSS pointer in the GDT */
@@ -1674,7 +1666,6 @@ void cpu_init(void) · 5 unmodified lines
1674		1666
1675	fpu__init_cpu();	1667	fpu__init_cpu();
1676		1668
1677	setup_fixmap_gdt(cpu);
1678	load_fixmap_gdt(cpu);	1669	load_fixmap_gdt(cpu);
1679	}	1670	}
1680	#endif	1671	#endif

arch/x86/kernel/cpu/microcode/intel.c+0−13

@@ -565,15 +565,6 @@ static void print_ucode(struct ucode_cpu_info *uci) · 564 unmodified lines
565	}	565	}
566	#else	566	#else
567		567
568	/*
569	* Flush global tlb. We only do this in x86_64 where paging has been enabled
570	* already and PGE should be enabled as well.
571	*/
572	static inline void flush_tlb_early(void)
573	{
574	__native_flush_tlb_global_irq_disabled();
575	}
576
577	static inline void print_ucode(struct ucode_cpu_info *uci)	568	static inline void print_ucode(struct ucode_cpu_info *uci)
578	{	569	{
579	struct microcode_intel *mc;	570	struct microcode_intel *mc;
@@ -602,10 +593,6 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early) · 22 unmodified lines
602	if (rev != mc->hdr.rev)	593	if (rev != mc->hdr.rev)
603	return -1;	594	return -1;
604		595
605	#ifdef CONFIG_X86_64
606	/* Flush global tlb. This is precaution. */
607	flush_tlb_early();
608	#endif
609	uci->cpu_sig.rev = rev;	596	uci->cpu_sig.rev = rev;
610		597
611	if (early)	598	if (early)

arch/x86/kernel/doublefault.c+17−19

@@ -50,25 +50,23 @@ static void doublefault_fn(void) · 49 unmodified lines
50	cpu_relax();	50	cpu_relax();
51	}	51	}
52		52
53	struct tss_struct doublefault_tss __cacheline_aligned = {	53	struct x86_hw_tss doublefault_tss __cacheline_aligned = {
54	.x86_tss = {	54	.sp0 = STACK_START,
55	.sp0 = STACK_START,	55	.ss0 = __KERNEL_DS,
56	.ss0 = __KERNEL_DS,	56	.ldt = 0,
57	.ldt = 0,	57	.io_bitmap_base = INVALID_IO_BITMAP_OFFSET,
58	.io_bitmap_base = INVALID_IO_BITMAP_OFFSET,	58
59		59	.ip = (unsigned long) doublefault_fn,
60	.ip = (unsigned long) doublefault_fn,	60	/* 0x2 bit is always set */
61	/* 0x2 bit is always set */	61	.flags = X86_EFLAGS_SF \| 0x2,
62	.flags = X86_EFLAGS_SF \| 0x2,	62	.sp = STACK_START,
63	.sp = STACK_START,	63	.es = __USER_DS,
64	.es = __USER_DS,	64	.cs = __KERNEL_CS,
65	.cs = __KERNEL_CS,	65	.ss = __KERNEL_DS,
66	.ss = __KERNEL_DS,	66	.ds = __USER_DS,
67	.ds = __USER_DS,	67	.fs = __KERNEL_PERCPU,
68	.fs = __KERNEL_PERCPU,	68
69		69	.__cr3 = __pa_nodebug(swapper_pg_dir),
70	.__cr3 = __pa_nodebug(swapper_pg_dir),
71	}
72	};	70	};
73		71
74	/* dummy for do_double_fault() call */	72	/* dummy for do_double_fault() call */

arch/x86/kernel/dumpstack.c+64−17

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	#include <linux/nmi.h>	18	#include <linux/nmi.h>
19	#include <linux/sysfs.h>	19	#include <linux/sysfs.h>
20		20
		21	#include <asm/cpu_entry_area.h>
21	#include <asm/stacktrace.h>	22	#include <asm/stacktrace.h>
22	#include <asm/unwind.h>	23	#include <asm/unwind.h>
23		24
@@ -43,6 +44,24 @@ bool in_task_stack(unsigned long stack, struct task_struct task, · 19 unmodified lines
43	return true;	44	return true;
44	}	45	}
45		46
		47	bool in_entry_stack(unsigned long stack, struct stack_info info)
		48	{
		49	struct entry_stack *ss = cpu_entry_stack(smp_processor_id());
		50
		51	void *begin = ss;
		52	void *end = ss + 1;
		53
		54	if ((void )stack < begin \|\| (void )stack >= end)
		55	return false;
		56
		57	info->type = STACK_TYPE_ENTRY;
		58	info->begin = begin;
		59	info->end = end;
		60	info->next_sp = NULL;
		61
		62	return true;
		63	}
		64
46	static void printk_stack_address(unsigned long address, int reliable,	65	static void printk_stack_address(unsigned long address, int reliable,
47	char *log_lvl)	66	char *log_lvl)
48	{	67	{
@@ -50,6 +69,28 @@ static void printk_stack_address(unsigned long address, int reliable, · 1 unmodified line
50	printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);	69	printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
51	}	70	}
52		71
		72	void show_iret_regs(struct pt_regs *regs)
		73	{
		74	printk(KERN_DEFAULT "RIP: %04x:%pS\n", (int)regs->cs, (void *)regs->ip);
		75	printk(KERN_DEFAULT "RSP: %04x:%016lx EFLAGS: %08lx", (int)regs->ss,
		76	regs->sp, regs->flags);
		77	}
		78
		79	static void show_regs_safe(struct stack_info info, struct pt_regs regs)
		80	{
		81	if (on_stack(info, regs, sizeof(*regs)))
		82	__show_regs(regs, 0);
		83	else if (on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
		84	IRET_FRAME_SIZE)) {
		85	/*
		86	* When an interrupt or exception occurs in entry code, the
		87	* full pt_regs might not have been saved yet. In that case
		88	* just print the iret frame.
		89	*/
		90	show_iret_regs(regs);
		91	}
		92	}
		93
53	void show_trace_log_lvl(struct task_struct task, struct pt_regs regs,	94	void show_trace_log_lvl(struct task_struct task, struct pt_regs regs,
54	unsigned long stack, char log_lvl)	95	unsigned long stack, char log_lvl)
55	{	96	{
@@ -71,31 +112,35 @@ void show_trace_log_lvl(struct task_struct task, struct pt_regs regs, · 15 unmodified lines
71	* - task stack	112	* - task stack
72	* - interrupt stack	113	* - interrupt stack
73	* - HW exception stacks (double fault, nmi, debug, mce)	114	* - HW exception stacks (double fault, nmi, debug, mce)
		115	* - entry stack
74	*	116	*
75	* x86-32 can have up to three stacks:	117	* x86-32 can have up to four stacks:
76	* - task stack	118	* - task stack
77	* - softirq stack	119	* - softirq stack
78	* - hardirq stack	120	* - hardirq stack
		121	* - entry stack
79	*/	122	*/
80	for (regs = NULL; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {	123	for (regs = NULL; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
81	const char *stack_name;	124	const char *stack_name;
82		125
83	/*	126	if (get_stack_info(stack, task, &stack_info, &visit_mask)) {
84	* If we overflowed the task stack into a guard page, jump back	127	/*
85	* to the bottom of the usable stack.	128	* We weren't on a valid stack. It's possible that
86	*/	129	* we overflowed a valid stack into a guard page.
87	if (task_stack_page(task) - (void *)stack < PAGE_SIZE)	130	* See if the next page up is valid so that we can
88	stack = task_stack_page(task);	131	* generate some kind of backtrace if this happens.
89		132	*/
90	if (get_stack_info(stack, task, &stack_info, &visit_mask))	133	stack = (unsigned long *)PAGE_ALIGN((unsigned long)stack);
91	break;	134	if (get_stack_info(stack, task, &stack_info, &visit_mask))
		135	break;
		136	}
92		137
93	stack_name = stack_type_name(stack_info.type);	138	stack_name = stack_type_name(stack_info.type);
94	if (stack_name)	139	if (stack_name)
95	printk("%s <%s>\n", log_lvl, stack_name);	140	printk("%s <%s>\n", log_lvl, stack_name);
96		141
97	if (regs && on_stack(&stack_info, regs, sizeof(*regs)))	142	if (regs)
98	__show_regs(regs, 0);	143	show_regs_safe(&stack_info, regs);
99		144
100	/*	145	/*
101	* Scan the stack, printing any text addresses we find. At the	146	* Scan the stack, printing any text addresses we find. At the
@@ -119,7 +164,7 @@ void show_trace_log_lvl(struct task_struct task, struct pt_regs regs, · 17 unmodified lines
119		164
120	/*	165	/*
121	* Don't print regs->ip again if it was already printed	166	* Don't print regs->ip again if it was already printed
122	* by __show_regs() below.	167	* by show_regs_safe() below.
123	*/	168	*/
124	if (regs && stack == &regs->ip)	169	if (regs && stack == &regs->ip)
125	goto next;	170	goto next;
@@ -155,8 +200,8 @@ next: · 29 unmodified lines
155		200
156	/* if the frame has entry regs, print them */	201	/* if the frame has entry regs, print them */
157	regs = unwind_get_entry_regs(&state);	202	regs = unwind_get_entry_regs(&state);
158	if (regs && on_stack(&stack_info, regs, sizeof(*regs)))	203	if (regs)
159	__show_regs(regs, 0);	204	show_regs_safe(&stack_info, regs);
160	}	205	}
161		206
162	if (stack_name)	207	if (stack_name)
@@ -252,11 +297,13 @@ int __die(const char str, struct pt_regs regs, long err) · 89 unmodified lines
252	unsigned long sp;	297	unsigned long sp;
253	#endif	298	#endif
254	printk(KERN_DEFAULT	299	printk(KERN_DEFAULT
255	"%s: %04lx [#%d]%s%s%s%s\n", str, err & 0xffff, ++die_counter,	300	"%s: %04lx [#%d]%s%s%s%s%s\n", str, err & 0xffff, ++die_counter,
256	IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "",	301	IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "",
257	IS_ENABLED(CONFIG_SMP) ? " SMP" : "",	302	IS_ENABLED(CONFIG_SMP) ? " SMP" : "",
258	debug_pagealloc_enabled() ? " DEBUG_PAGEALLOC" : "",	303	debug_pagealloc_enabled() ? " DEBUG_PAGEALLOC" : "",
259	IS_ENABLED(CONFIG_KASAN) ? " KASAN" : "");	304	IS_ENABLED(CONFIG_KASAN) ? " KASAN" : "",
		305	IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION) ?
		306	(boot_cpu_has(X86_FEATURE_PTI) ? " PTI" : " NOPTI") : "");
260		307
261	if (notify_die(DIE_OOPS, str, regs, err,	308	if (notify_die(DIE_OOPS, str, regs, err,
262	current->thread.trap_nr, SIGSEGV) == NOTIFY_STOP)	309	current->thread.trap_nr, SIGSEGV) == NOTIFY_STOP)

arch/x86/kernel/dumpstack_32.c+6−0

 	if (type == STACK_TYPE_SOFTIRQ)
 		return "SOFTIRQ";
+	if (type == STACK_TYPE_ENTRY)
+		return "ENTRY_TRAMPOLINE";
 	return NULL;
 }
 	if (task != current)
 		goto unknown;
+	if (in_entry_stack(stack, info))
+		goto recursion_check;
 	if (in_hardirq_stack(stack, info))
 		goto recursion_check;

arch/x86/kernel/dumpstack_64.c+12−0

 	if (type == STACK_TYPE_IRQ)
 		return "IRQ";
+	if (type == STACK_TYPE_ENTRY) {
+		/*
+		 * On 64-bit, we have a generic entry stack that we
+		 * use for all the kernel entry points, including
+		 * SYSENTER.
+		 */
+		return "ENTRY_TRAMPOLINE";
+	}
 	if (type >= STACK_TYPE_EXCEPTION && type <= STACK_TYPE_EXCEPTION_LAST)
 		return exception_stack_names[type - STACK_TYPE_EXCEPTION];
 	if (in_irq_stack(stack, info))
 		goto recursion_check;
+	if (in_entry_stack(stack, info))
+		goto recursion_check;
 	goto unknown;
 recursion_check:

arch/x86/kernel/head_64.S+27−3

 	.balign	PAGE_SIZE; \
 GLOBAL(name)
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+/*
+ * Each PGD needs to be 8k long and 8k aligned.  We do not
+ * ever go out to userspace with these, so we do not
+ * strictly *need* the second page, but this allows us to
+ * have a single set_pgd() implementation that does not
+ * need to worry about whether it has 4k or 8k to work
+ * with.
+ *
+ * This ensures PGDs are 8k long:
+ */
+#define PTI_USER_PGD_FILL	512
+/* This ensures they are 8k-aligned: */
+#define NEXT_PGD_PAGE(name) \
+	.balign 2 * PAGE_SIZE; \
+GLOBAL(name)
+#else
+#define NEXT_PGD_PAGE(name) NEXT_PAGE(name)
+#define PTI_USER_PGD_FILL	0
+#endif
 /* Automate the creation of 1 to 1 mapping pmd entries */
 #define PMDS(START, PERM, COUNT)			\
 	i = 0 ;						\
 	.endr
 	__INITDATA
-NEXT_PAGE(early_top_pgt)
+NEXT_PGD_PAGE(early_top_pgt)
 	.fill	511,8,0
 #ifdef CONFIG_X86_5LEVEL
 	.quad	level4_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #else
 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #endif
+	.fill	PTI_USER_PGD_FILL,8,0
 NEXT_PAGE(early_dynamic_pgts)
 	.fill	512*EARLY_DYNAMIC_PAGE_TABLES,8,0
 	.data
 #if defined(CONFIG_XEN_PV) || defined(CONFIG_XEN_PVH)
-NEXT_PAGE(init_top_pgt)
+NEXT_PGD_PAGE(init_top_pgt)
 	.quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
 	.org    init_top_pgt + PGD_PAGE_OFFSET*8, 0
 	.quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
 	.org    init_top_pgt + PGD_START_KERNEL*8, 0
 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
 	.quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
+	.fill	PTI_USER_PGD_FILL,8,0
 NEXT_PAGE(level3_ident_pgt)
 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
 	 */
 	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
 #else
-NEXT_PAGE(init_top_pgt)
+NEXT_PGD_PAGE(init_top_pgt)
 	.fill	512,8,0
+	.fill	PTI_USER_PGD_FILL,8,0
 #endif
 #ifdef CONFIG_X86_5LEVEL

arch/x86/kernel/ioport.c+1−1

@@ -67,7 +67,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) · 66 unmodified lines
67	* because the ->io_bitmap_max value must match the bitmap	67	* because the ->io_bitmap_max value must match the bitmap
68	* contents:	68	* contents:
69	*/	69	*/
70	tss = &per_cpu(cpu_tss, get_cpu());	70	tss = &per_cpu(cpu_tss_rw, get_cpu());
71		71
72	if (turn_on)	72	if (turn_on)
73	bitmap_clear(t->io_bitmap_ptr, from, num);	73	bitmap_clear(t->io_bitmap_ptr, from, num);

arch/x86/kernel/irq.c+0−12

@@ -219,18 +219,6 @@ __visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs) · 218 unmodified lines
219	/* high bit used in ret_from_ code */	219	/* high bit used in ret_from_ code */
220	unsigned vector = ~regs->orig_ax;	220	unsigned vector = ~regs->orig_ax;
221		221
222	/*
223	* NB: Unlike exception entries, IRQ entries do not reliably
224	* handle context tracking in the low-level entry code. This is
225	* because syscall entries execute briefly with IRQs on before
226	* updating context tracking state, so we can take an IRQ from
227	* kernel mode with CONTEXT_USER. The low-level entry code only
228	* updates the context if we came from user mode, so we won't
229	* switch to CONTEXT_KERNEL. We'll fix that once the syscall
230	* code is cleaned up enough that we can cleanly defer enabling
231	* IRQs.
232	*/
233
234	entering_irq();	222	entering_irq();
235		223
236	/* entering_irq() tells RCU that we're not quiescent. Check it. */	224	/* entering_irq() tells RCU that we're not quiescent. Check it. */

arch/x86/kernel/irq_64.c+2−2

@@ -57,10 +57,10 @@ static inline void stack_overflow_check(struct pt_regs *regs) · 56 unmodified lines
57	if (regs->sp >= estack_top && regs->sp <= estack_bottom)	57	if (regs->sp >= estack_top && regs->sp <= estack_bottom)
58	return;	58	return;
59		59
60	WARN_ONCE(1, "do_IRQ(): %s has overflown the kernel stack (cur:%Lx,sp:%lx,irq stk top-bottom:%Lx-%Lx,exception stk top-bottom:%Lx-%Lx)\n",	60	WARN_ONCE(1, "do_IRQ(): %s has overflown the kernel stack (cur:%Lx,sp:%lx,irq stk top-bottom:%Lx-%Lx,exception stk top-bottom:%Lx-%Lx,ip:%pF)\n",
61	current->comm, curbase, regs->sp,	61	current->comm, curbase, regs->sp,
62	irq_stack_top, irq_stack_bottom,	62	irq_stack_top, irq_stack_bottom,
63	estack_top, estack_bottom);	63	estack_top, estack_bottom, (void *)regs->ip);
64		64
65	if (sysctl_panic_on_stackoverflow)	65	if (sysctl_panic_on_stackoverflow)
66	panic("low stack detected by irq handler - check messages\n");	66	panic("low stack detected by irq handler - check messages\n");

arch/x86/kernel/ldt.c+172−26

@@ -5,6 +5,11 @@ · 4 unmodified lines
5	* Copyright (C) 2002 Andi Kleen	5	* Copyright (C) 2002 Andi Kleen
6	*	6	*
7	* This handles calls from both 32bit and 64bit mode.	7	* This handles calls from both 32bit and 64bit mode.
		8	*
		9	* Lock order:
		10	* contex.ldt_usr_sem
		11	* mmap_sem
		12	* context.lock
8	*/	13	*/
9		14
10	#include <linux/errno.h>	15	#include <linux/errno.h>
@@ -19,6 +24,7 @@ · 8 unmodified lines
19	#include <linux/uaccess.h>	24	#include <linux/uaccess.h>
20		25
21	#include <asm/ldt.h>	26	#include <asm/ldt.h>
		27	#include <asm/tlb.h>
22	#include <asm/desc.h>	28	#include <asm/desc.h>
23	#include <asm/mmu_context.h>	29	#include <asm/mmu_context.h>
24	#include <asm/syscalls.h>	30	#include <asm/syscalls.h>
@@ -42,17 +48,15 @@ static void refresh_ldt_segments(void) · 17 unmodified lines
42	#endif	48	#endif
43	}	49	}
44		50
45	/* context.lock is held for us, so we don't need any locking. */	51	/* context.lock is held by the task which issued the smp function call */
46	static void flush_ldt(void *__mm)	52	static void flush_ldt(void *__mm)
47	{	53	{
48	struct mm_struct *mm = __mm;	54	struct mm_struct *mm = __mm;
49	mm_context_t *pc;
50		55
51	if (this_cpu_read(cpu_tlbstate.loaded_mm) != mm)	56	if (this_cpu_read(cpu_tlbstate.loaded_mm) != mm)
52	return;	57	return;
53		58
54	pc = &mm->context;	59	load_mm_ldt(mm);
55	set_ldt(pc->ldt->entries, pc->ldt->nr_entries);
56		60
57	refresh_ldt_segments();	61	refresh_ldt_segments();
58	}	62	}
@@ -89,25 +93,143 @@ static struct ldt_struct *alloc_ldt_struct(unsigned int num_entries) · 30 unmodified lines
89	return NULL;	93	return NULL;
90	}	94	}
91		95
		96	/* The new LDT isn't aliased for PTI yet. */
		97	new_ldt->slot = -1;
		98
92	new_ldt->nr_entries = num_entries;	99	new_ldt->nr_entries = num_entries;
93	return new_ldt;	100	return new_ldt;
94	}	101	}
95		102
		103	/*
		104	* If PTI is enabled, this maps the LDT into the kernelmode and
		105	* usermode tables for the given mm.
		106	*
		107	* There is no corresponding unmap function. Even if the LDT is freed, we
		108	* leave the PTEs around until the slot is reused or the mm is destroyed.
		109	* This is harmless: the LDT is always in ordinary memory, and no one will
		110	* access the freed slot.
		111	*
		112	* If we wanted to unmap freed LDTs, we'd also need to do a flush to make
		113	* it useful, and the flush would slow down modify_ldt().
		114	*/
		115	static int
		116	map_ldt_struct(struct mm_struct mm, struct ldt_struct ldt, int slot)
		117	{
		118	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		119	bool is_vmalloc, had_top_level_entry;
		120	unsigned long va;
		121	spinlock_t *ptl;
		122	pgd_t *pgd;
		123	int i;
		124
		125	if (!static_cpu_has(X86_FEATURE_PTI))
		126	return 0;
		127
		128	/*
		129	* Any given ldt_struct should have map_ldt_struct() called at most
		130	* once.
		131	*/
		132	WARN_ON(ldt->slot != -1);
		133
		134	/*
		135	* Did we already have the top level entry allocated? We can't
		136	* use pgd_none() for this because it doens't do anything on
		137	* 4-level page table kernels.
		138	*/
		139	pgd = pgd_offset(mm, LDT_BASE_ADDR);
		140	had_top_level_entry = (pgd->pgd != 0);
		141
		142	is_vmalloc = is_vmalloc_addr(ldt->entries);
		143
		144	for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
		145	unsigned long offset = i << PAGE_SHIFT;
		146	const void src = (char )ldt->entries + offset;
		147	unsigned long pfn;
		148	pte_t pte, *ptep;
		149
		150	va = (unsigned long)ldt_slot_va(slot) + offset;
		151	pfn = is_vmalloc ? vmalloc_to_pfn(src) :
		152	page_to_pfn(virt_to_page(src));
		153	/*
		154	* Treat the PTI LDT range as a userspace range.
		155	* get_locked_pte() will allocate all needed pagetables
		156	* and account for them in this mm.
		157	*/
		158	ptep = get_locked_pte(mm, va, &ptl);
		159	if (!ptep)
		160	return -ENOMEM;
		161	/*
		162	* Map it RO so the easy to find address is not a primary
		163	* target via some kernel interface which misses a
		164	* permission check.
		165	*/
		166	pte = pfn_pte(pfn, __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL));
		167	set_pte_at(mm, va, ptep, pte);
		168	pte_unmap_unlock(ptep, ptl);
		169	}
		170
		171	if (mm->context.ldt) {
		172	/*
		173	* We already had an LDT. The top-level entry should already
		174	* have been allocated and synchronized with the usermode
		175	* tables.
		176	*/
		177	WARN_ON(!had_top_level_entry);
		178	if (static_cpu_has(X86_FEATURE_PTI))
		179	WARN_ON(!kernel_to_user_pgdp(pgd)->pgd);
		180	} else {
		181	/*
		182	* This is the first time we're mapping an LDT for this process.
		183	* Sync the pgd to the usermode tables.
		184	*/
		185	WARN_ON(had_top_level_entry);
		186	if (static_cpu_has(X86_FEATURE_PTI)) {
		187	WARN_ON(kernel_to_user_pgdp(pgd)->pgd);
		188	set_pgd(kernel_to_user_pgdp(pgd), *pgd);
		189	}
		190	}
		191
		192	va = (unsigned long)ldt_slot_va(slot);
		193	flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, 0);
		194
		195	ldt->slot = slot;
		196	#endif
		197	return 0;
		198	}
		199
		200	static void free_ldt_pgtables(struct mm_struct *mm)
		201	{
		202	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		203	struct mmu_gather tlb;
		204	unsigned long start = LDT_BASE_ADDR;
		205	unsigned long end = start + (1UL << PGDIR_SHIFT);
		206
		207	if (!static_cpu_has(X86_FEATURE_PTI))
		208	return;
		209
		210	tlb_gather_mmu(&tlb, mm, start, end);
		211	free_pgd_range(&tlb, start, end, start, end);
		212	tlb_finish_mmu(&tlb, start, end);
		213	#endif
		214	}
		215
96	/* After calling this, the LDT is immutable. */	216	/* After calling this, the LDT is immutable. */
97	static void finalize_ldt_struct(struct ldt_struct *ldt)	217	static void finalize_ldt_struct(struct ldt_struct *ldt)
98	{	218	{
99	paravirt_alloc_ldt(ldt->entries, ldt->nr_entries);	219	paravirt_alloc_ldt(ldt->entries, ldt->nr_entries);
100	}	220	}
101		221
102	/* context.lock is held */	222	static void install_ldt(struct mm_struct mm, struct ldt_struct ldt)
103	static void install_ldt(struct mm_struct *current_mm,
104	struct ldt_struct *ldt)
105	{	223	{
		224	mutex_lock(&mm->context.lock);
		225
106	/* Synchronizes with READ_ONCE in load_mm_ldt. */	226	/* Synchronizes with READ_ONCE in load_mm_ldt. */
107	smp_store_release(&current_mm->context.ldt, ldt);	227	smp_store_release(&mm->context.ldt, ldt);
108		228
109	/* Activate the LDT for all CPUs using current_mm. */	229	/* Activate the LDT for all CPUs using currents mm. */
110	on_each_cpu_mask(mm_cpumask(current_mm), flush_ldt, current_mm, true);	230	on_each_cpu_mask(mm_cpumask(mm), flush_ldt, mm, true);
		231
		232	mutex_unlock(&mm->context.lock);
111	}	233	}
112		234
113	static void free_ldt_struct(struct ldt_struct *ldt)	235	static void free_ldt_struct(struct ldt_struct *ldt)
@@ -124,27 +246,20 @@ static void free_ldt_struct(struct ldt_struct *ldt) · 10 unmodified lines
124	}	246	}
125		247
126	/*	248	/*
127	* we do not have to muck with descriptors here, that is	249	* Called on fork from arch_dup_mmap(). Just copy the current LDT state,
128	* done in switch_mm() as needed.	250	* the new task is not running, so nothing can be installed.
129	*/	251	*/
130	int init_new_context_ldt(struct task_struct tsk, struct mm_struct mm)	252	int ldt_dup_context(struct mm_struct old_mm, struct mm_struct mm)
131	{	253	{
132	struct ldt_struct *new_ldt;	254	struct ldt_struct *new_ldt;
133	struct mm_struct *old_mm;
134	int retval = 0;	255	int retval = 0;
135		256
136	mutex_init(&mm->context.lock);	257	if (!old_mm)
137	old_mm = current->mm;
138	if (!old_mm) {
139	mm->context.ldt = NULL;
140	return 0;	258	return 0;
141	}
142		259
143	mutex_lock(&old_mm->context.lock);	260	mutex_lock(&old_mm->context.lock);
144	if (!old_mm->context.ldt) {	261	if (!old_mm->context.ldt)
145	mm->context.ldt = NULL;
146	goto out_unlock;	262	goto out_unlock;
147	}
148		263
149	new_ldt = alloc_ldt_struct(old_mm->context.ldt->nr_entries);	264	new_ldt = alloc_ldt_struct(old_mm->context.ldt->nr_entries);
150	if (!new_ldt) {	265	if (!new_ldt) {
@@ -156,6 +271,12 @@ int init_new_context_ldt(struct task_struct tsk, struct mm_struct mm) · 5 unmodified lines
156	new_ldt->nr_entries * LDT_ENTRY_SIZE);	271	new_ldt->nr_entries * LDT_ENTRY_SIZE);
157	finalize_ldt_struct(new_ldt);	272	finalize_ldt_struct(new_ldt);
158		273
		274	retval = map_ldt_struct(mm, new_ldt, 0);
		275	if (retval) {
		276	free_ldt_pgtables(mm);
		277	free_ldt_struct(new_ldt);
		278	goto out_unlock;
		279	}
159	mm->context.ldt = new_ldt;	280	mm->context.ldt = new_ldt;
160		281
161	out_unlock:	282	out_unlock:
@@ -174,13 +295,18 @@ void destroy_context_ldt(struct mm_struct *mm) · 12 unmodified lines
174	mm->context.ldt = NULL;	295	mm->context.ldt = NULL;
175	}	296	}
176		297
		298	void ldt_arch_exit_mmap(struct mm_struct *mm)
		299	{
		300	free_ldt_pgtables(mm);
		301	}
		302
177	static int read_ldt(void __user *ptr, unsigned long bytecount)	303	static int read_ldt(void __user *ptr, unsigned long bytecount)
178	{	304	{
179	struct mm_struct *mm = current->mm;	305	struct mm_struct *mm = current->mm;
180	unsigned long entries_size;	306	unsigned long entries_size;
181	int retval;	307	int retval;
182		308
183	mutex_lock(&mm->context.lock);	309	down_read(&mm->context.ldt_usr_sem);
184		310
185	if (!mm->context.ldt) {	311	if (!mm->context.ldt) {
186	retval = 0;	312	retval = 0;
@@ -209,7 +335,7 @@ static int read_ldt(void __user *ptr, unsigned long bytecount) · 22 unmodified lines
209	retval = bytecount;	335	retval = bytecount;
210		336
211	out_unlock:	337	out_unlock:
212	mutex_unlock(&mm->context.lock);	338	up_read(&mm->context.ldt_usr_sem);
213	return retval;	339	return retval;
214	}	340	}
215		341
@@ -269,7 +395,8 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) · 53 unmodified lines
269	ldt.avl = 0;	395	ldt.avl = 0;
270	}	396	}
271		397
272	mutex_lock(&mm->context.lock);	398	if (down_write_killable(&mm->context.ldt_usr_sem))
		399	return -EINTR;
273		400
274	old_ldt = mm->context.ldt;	401	old_ldt = mm->context.ldt;
275	old_nr_entries = old_ldt ? old_ldt->nr_entries : 0;	402	old_nr_entries = old_ldt ? old_ldt->nr_entries : 0;
@@ -286,12 +413,31 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) · 10 unmodified lines
286	new_ldt->entries[ldt_info.entry_number] = ldt;	413	new_ldt->entries[ldt_info.entry_number] = ldt;
287	finalize_ldt_struct(new_ldt);	414	finalize_ldt_struct(new_ldt);
288		415
		416	/*
		417	* If we are using PTI, map the new LDT into the userspace pagetables.
		418	* If there is already an LDT, use the other slot so that other CPUs
		419	* will continue to use the old LDT until install_ldt() switches
		420	* them over to the new LDT.
		421	*/
		422	error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0);
		423	if (error) {
		424	/*
		425	* This only can fail for the first LDT setup. If an LDT is
		426	* already installed then the PTE page is already
		427	* populated. Mop up a half populated page table.
		428	*/
		429	if (!WARN_ON_ONCE(old_ldt))
		430	free_ldt_pgtables(mm);
		431	free_ldt_struct(new_ldt);
		432	goto out_unlock;
		433	}
		434
289	install_ldt(mm, new_ldt);	435	install_ldt(mm, new_ldt);
290	free_ldt_struct(old_ldt);	436	free_ldt_struct(old_ldt);
291	error = 0;	437	error = 0;
292		438
293	out_unlock:	439	out_unlock:
294	mutex_unlock(&mm->context.lock);	440	up_write(&mm->context.ldt_usr_sem);
295	out:	441	out:
296	return error;	442	return error;
297	}	443	}

arch/x86/kernel/machine_kexec_32.c+1−3

 		"\tmovl $"STR(__KERNEL_DS)",%%eax\n"
 		"\tmovl %%eax,%%ds\n"
 		"\tmovl %%eax,%%es\n"
-		"\tmovl %%eax,%%fs\n"
-		"\tmovl %%eax,%%gs\n"
 		"\tmovl %%eax,%%ss\n"
 		: : : "eax", "memory");
 #undef STR
 	 * The gdt & idt are now invalid.
 	 * If you want to load them you must set up your own idt & gdt.
 	 */
-	set_gdt(phys_to_virt(0), 0);
 	idt_invalidate(phys_to_virt(0));
+	set_gdt(phys_to_virt(0), 0);
 	/* now call it */
 	image->start = relocate_kernel_ptr((unsigned long)image->head,

arch/x86/kernel/paravirt_patch_64.c+0−2

 DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
 DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
 DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
-DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)");
 DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd");
 DEF_NATIVE(pv_cpu_ops, usergs_sysret64, "swapgs; sysretq");
 		PATCH_SITE(pv_mmu_ops, read_cr2);
 		PATCH_SITE(pv_mmu_ops, read_cr3);
 		PATCH_SITE(pv_mmu_ops, write_cr3);
-		PATCH_SITE(pv_mmu_ops, flush_tlb_single);
 		PATCH_SITE(pv_cpu_ops, wbinvd);
 #if defined(CONFIG_PARAVIRT_SPINLOCKS)
 		case PARAVIRT_PATCH(pv_lock_ops.queued_spin_unlock):

arch/x86/kernel/process.c+13−6

  * section. Since TSS's are completely CPU-local, we want them
  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
  */
-__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = {
+__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss_rw) = {
 	.x86_tss = {
 		/*
 		 * .sp0 is only used when entering ring 0 from a lower
 		 * Poison it.
 		 */
 		.sp0 = (1UL << (BITS_PER_LONG-1)) + 1,
+#ifdef CONFIG_X86_64
+		/*
+		 * .sp1 is cpu_current_top_of_stack.  The init task never
+		 * runs user code, but cpu_current_top_of_stack should still
+		 * be well defined before the first context switch.
+		 */
+		.sp1 = TOP_OF_INIT_STACK,
+#endif
 #ifdef CONFIG_X86_32
 		.ss0 = __KERNEL_DS,
 		.ss1 = __KERNEL_CS,
 	  */
 	.io_bitmap		= { [0 ... IO_BITMAP_LONGS] = ~0 },
 #endif
-#ifdef CONFIG_X86_32
-	.SYSENTER_stack_canary	= STACK_END_MAGIC,
-#endif
 };
-EXPORT_PER_CPU_SYMBOL(cpu_tss);
+EXPORT_PER_CPU_SYMBOL(cpu_tss_rw);
 DEFINE_PER_CPU(bool, __tss_limit_invalid);
 EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);
 	struct fpu *fpu = &t->fpu;
 	if (bp) {
-		struct tss_struct *tss = &per_cpu(cpu_tss, get_cpu());
+		struct tss_struct *tss = &per_cpu(cpu_tss_rw, get_cpu());
 		t->io_bitmap_ptr = NULL;
 		clear_thread_flag(TIF_IO_BITMAP);

arch/x86/kernel/process_32.c+1−1

@@ -234,7 +234,7 @@ __switch_to(struct task_struct prev_p, struct task_struct next_p) · 233 unmodified lines
234	struct fpu *prev_fpu = &prev->fpu;	234	struct fpu *prev_fpu = &prev->fpu;
235	struct fpu *next_fpu = &next->fpu;	235	struct fpu *next_fpu = &next->fpu;
236	int cpu = smp_processor_id();	236	int cpu = smp_processor_id();
237	struct tss_struct *tss = &per_cpu(cpu_tss, cpu);	237	struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
238		238
239	/* never put a printk in __switch_to... printk() calls wake_up() indirectly /	239	/* never put a printk in __switch_to... printk() calls wake_up() indirectly /
240		240

arch/x86/kernel/process_64.c+7−7

@@ -69,9 +69,8 @@ void __show_regs(struct pt_regs *regs, int all) · 68 unmodified lines
69	unsigned int fsindex, gsindex;	69	unsigned int fsindex, gsindex;
70	unsigned int ds, cs, es;	70	unsigned int ds, cs, es;
71		71
72	printk(KERN_DEFAULT "RIP: %04lx:%pS\n", regs->cs, (void *)regs->ip);	72	show_iret_regs(regs);
73	printk(KERN_DEFAULT "RSP: %04lx:%016lx EFLAGS: %08lx", regs->ss,	73
74	regs->sp, regs->flags);
75	if (regs->orig_ax != -1)	74	if (regs->orig_ax != -1)
76	pr_cont(" ORIG_RAX: %016lx\n", regs->orig_ax);	75	pr_cont(" ORIG_RAX: %016lx\n", regs->orig_ax);
77	else	76	else
@@ -88,6 +87,9 @@ void __show_regs(struct pt_regs *regs, int all) · 10 unmodified lines
88	printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",	87	printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
89	regs->r13, regs->r14, regs->r15);	88	regs->r13, regs->r14, regs->r15);
90		89
		90	if (!all)
		91	return;
		92
91	asm("movl %%ds,%0" : "=r" (ds));	93	asm("movl %%ds,%0" : "=r" (ds));
92	asm("movl %%cs,%0" : "=r" (cs));	94	asm("movl %%cs,%0" : "=r" (cs));
93	asm("movl %%es,%0" : "=r" (es));	95	asm("movl %%es,%0" : "=r" (es));
@@ -98,9 +100,6 @@ void __show_regs(struct pt_regs *regs, int all) · 4 unmodified lines
98	rdmsrl(MSR_GS_BASE, gs);	100	rdmsrl(MSR_GS_BASE, gs);
99	rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);	101	rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
100		102
101	if (!all)
102	return;
103
104	cr0 = read_cr0();	103	cr0 = read_cr0();
105	cr2 = read_cr2();	104	cr2 = read_cr2();
106	cr3 = __read_cr3();	105	cr3 = __read_cr3();
@@ -400,7 +399,7 @@ __switch_to(struct task_struct prev_p, struct task_struct next_p) · 293 unmodified lines
400	struct fpu *prev_fpu = &prev->fpu;	399	struct fpu *prev_fpu = &prev->fpu;
401	struct fpu *next_fpu = &next->fpu;	400	struct fpu *next_fpu = &next->fpu;
402	int cpu = smp_processor_id();	401	int cpu = smp_processor_id();
403	struct tss_struct *tss = &per_cpu(cpu_tss, cpu);	402	struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
404		403
405	WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&	404	WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
406	this_cpu_read(irq_count) != -1);	405	this_cpu_read(irq_count) != -1);
@@ -462,6 +461,7 @@ __switch_to(struct task_struct prev_p, struct task_struct next_p) · 55 unmodified lines
462	* Switch the PDA and FPU contexts.	461	* Switch the PDA and FPU contexts.
463	*/	462	*/
464	this_cpu_write(current_task, next_p);	463	this_cpu_write(current_task, next_p);
		464	this_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p));
465		465
466	/* Reload sp0. */	466	/* Reload sp0. */
467	update_sp0(next_p);	467	update_sp0(next_p);

arch/x86/kernel/smpboot.c+3−16

 static unsigned int logical_packages __read_mostly;
 /* Maximum number of SMT threads on any online core */
-int __max_smt_threads __read_mostly;
+int __read_mostly __max_smt_threads = 1;
 /* Flag to indicate if a complete sched domain rebuild is required */
 bool x86_topology_update;
 	spin_lock_irqsave(&rtc_lock, flags);
 	CMOS_WRITE(0xa, 0xf);
 	spin_unlock_irqrestore(&rtc_lock, flags);
-	local_flush_tlb();
-	pr_debug("1.\n");
 	*((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) =
 							start_eip >> 4;
-	pr_debug("2.\n");
 	*((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) =
 							start_eip & 0xf;
-	pr_debug("3.\n");
 }
 static inline void smpboot_restore_warm_reset_vector(void)
 {
 	unsigned long flags;
-	/*
-	 * Install writable page 0 entry to set BIOS data area.
-	 */
-	local_flush_tlb();
 	/*
 	 * Paranoid:  Set warm reset code and vector here back
 	 * to default values.
 	initial_code = (unsigned long)start_secondary;
 	initial_stack  = idle->thread.sp;
-	/*
+	/* Enable the espfix hack for this CPU */
-	 * Enable the espfix hack for this CPU
-	*/
-#ifdef CONFIG_X86_ESPFIX64
 	init_espfix_ap(cpu);
-#endif
 	/* So we see what's up */
 	announce_cpu(cpu, apicid);
 	 * Today neither Intel nor AMD support heterogenous systems so
 	 * extrapolate the boot cpu's data to all packages.
 	 */
-	ncpus = cpu_data(0).booted_cores * smp_num_siblings;
+	ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
 	__max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
 	pr_info("Max logical packages: %u\n", __max_logical_packages);

arch/x86/kernel/stacktrace.c+5−1

 {
 	int ret;
+	/*
+	 * If the task doesn't have a stack (e.g., a zombie), the stack is
+	 * "reliably" empty.
+	 */
 	if (!try_get_task_stack(tsk))
-		return -EINVAL;
+		return 0;
 	ret = __save_stack_trace_reliable(trace, tsk);

arch/x86/kernel/tls.c+2−9

 	cpu = get_cpu();
 	while (n-- > 0) {
-		if (LDT_empty(info) || LDT_zero(info)) {
+		if (LDT_empty(info) || LDT_zero(info))
 			memset(desc, 0, sizeof(*desc));
-		} else {
+		else
 			fill_ldt(desc, info);
-			/*
-			 * Always set the accessed bit so that the CPU
-			 * doesn't try to write to the (read-only) GDT.
-			 */
-			desc->type |= 1;
-		}
 		++info;
 		++desc;
 	}

arch/x86/kernel/traps.c+47−30

 #include <asm/traps.h>
 #include <asm/desc.h>
 #include <asm/fpu/internal.h>
+#include <asm/cpu_entry_area.h>
 #include <asm/mce.h>
 #include <asm/fixmap.h>
 #include <asm/mach_traps.h>
 	/*
 	 * If IRET takes a non-IST fault on the espfix64 stack, then we
-	 * end up promoting it to a doublefault.  In that case, modify
+	 * end up promoting it to a doublefault.  In that case, take
-	 * the stack to make it look like we just entered the #GP
+	 * advantage of the fact that we're not using the normal (TSS.sp0)
-	 * handler from user space, similar to bad_iret.
+	 * stack right now.  We can write a fake #GP(0) frame at TSS.sp0
+	 * and then modify our own IRET frame so that, when we return,
+	 * we land directly at the #GP(0) vector with the stack already
+	 * set up according to its expectations.
+	 *
+	 * The net result is that our #GP handler will think that we
+	 * entered from usermode with the bad user context.
 	 *
 	 * No need for ist_enter here because we don't use RCU.
 	 */
-	if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
+	if (((long)regs->sp >> P4D_SHIFT) == ESPFIX_PGD_ENTRY &&
 		regs->cs == __KERNEL_CS &&
 		regs->ip == (unsigned long)native_irq_return_iret)
 	{
-		struct pt_regs *normal_regs = task_pt_regs(current);
+		struct pt_regs *gpregs = (struct pt_regs *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
-		/* Fake a #GP(0) from userspace. */
+		/*
-		memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
+		 * regs->sp points to the failing IRET frame on the
-		normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */
+		 * ESPFIX64 stack.  Copy it to the entry stack.  This fills
+		 * in gpregs->ss through gpregs->ip.
+		 *
+		 */
+		memmove(&gpregs->ip, (void *)regs->sp, 5*8);
+		gpregs->orig_ax = 0;  /* Missing (lost) #GP error code */
+		/*
+		 * Adjust our frame so that we return straight to the #GP
+		 * vector with the expected RSP value.  This is safe because
+		 * we won't enable interupts or schedule before we invoke
+		 * general_protection, so nothing will clobber the stack
+		 * frame we just set up.
+		 */
 		regs->ip = (unsigned long)general_protection;
-		regs->sp = (unsigned long)&normal_regs->orig_ax;
+		regs->sp = (unsigned long)&gpregs->orig_ax;
 		return;
 	}
 	 *
 	 *   Processors update CR2 whenever a page fault is detected. If a
 	 *   second page fault occurs while an earlier page fault is being
-	 *   deliv- ered, the faulting linear address of the second fault will
+	 *   delivered, the faulting linear address of the second fault will
 	 *   overwrite the contents of CR2 (replacing the previous
 	 *   address). These updates to CR2 occur even if the page fault
 	 *   results in a double fault or occurs during the delivery of a
 #ifdef CONFIG_X86_64
 /*
- * Help handler running on IST stack to switch off the IST stack if the
+ * Help handler running on a per-cpu (IST or entry trampoline) stack
- * interrupted code was in user mode. The actual stack switch is done in
+ * to switch to the normal thread stack if the interrupted code was in
- * entry_64.S
+ * user mode. The actual stack switch is done in entry_64.S
  */
 asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
 {
-	struct pt_regs *regs = task_pt_regs(current);
+	struct pt_regs *regs = (struct pt_regs *)this_cpu_read(cpu_current_top_of_stack) - 1;
-	*regs = *eregs;
+	if (regs != eregs)
+		*regs = *eregs;
 	return regs;
 }
 NOKPROBE_SYMBOL(sync_regs);
 	/*
 	 * This is called from entry_64.S early in handling a fault
 	 * caused by a bad iret to user mode.  To handle the fault
-	 * correctly, we want move our stack frame to task_pt_regs
+	 * correctly, we want to move our stack frame to where it would
-	 * and we want to pretend that the exception came from the
+	 * be had we entered directly on the entry stack (rather than
-	 * iret target.
+	 * just below the IRET frame) and we want to pretend that the
+	 * exception came from the IRET target.
 	 */
 	struct bad_iret_stack *new_stack =
-		container_of(task_pt_regs(current),
+		(struct bad_iret_stack *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
-			     struct bad_iret_stack, regs);
 	/* Copy the IRET target to the new stack. */
 	memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
 	debug_stack_usage_dec();
 exit:
-#if defined(CONFIG_X86_32)
-	/*
-	 * This is the most likely code path that involves non-trivial use
-	 * of the SYSENTER stack.  Check that we haven't overrun it.
-	 */
-	WARN(this_cpu_read(cpu_tss.SYSENTER_stack_canary) != STACK_END_MAGIC,
-	     "Overran or corrupted SYSENTER stack\n");
-#endif
 	ist_exit(regs);
 }
 NOKPROBE_SYMBOL(do_debug);
 void __init trap_init(void)
 {
+	/* Init cpu_entry_area before IST entries are set up */
+	setup_cpu_entry_areas();
 	idt_setup_traps();
 	/*
 	 * "sidt" instruction will not leak the location of the kernel, and
 	 * to defend the IDT against arbitrary memory write vulnerabilities.
 	 * It will be reloaded in cpu_init() */
-	__set_fixmap(FIX_RO_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
+	cea_set_pte(CPU_ENTRY_AREA_RO_IDT_VADDR, __pa_symbol(idt_table),
-	idt_descr.address = fix_to_virt(FIX_RO_IDT);
+		    PAGE_KERNEL_RO);
+	idt_descr.address = CPU_ENTRY_AREA_RO_IDT;
 	/*
 	 * Should be a barrier for any external CPU state:

arch/x86/kernel/unwind_orc.c+37−51

 	return NULL;
 }
-static bool stack_access_ok(struct unwind_state *state, unsigned long addr,
+static bool stack_access_ok(struct unwind_state *state, unsigned long _addr,
 			    size_t len)
 {
 	struct stack_info *info = &state->stack_info;
+	void *addr = (void *)_addr;
-	/*
+	if (!on_stack(info, addr, len) &&
-	 * If the address isn't on the current stack, switch to the next one.
+	    (get_stack_info(addr, state->task, info, &state->stack_mask)))
-	 *
+		return false;
-	 * We may have to traverse multiple stacks to deal with the possibility
-	 * that info->next_sp could point to an empty stack and the address
-	 * could be on a subsequent stack.
-	 */
-	while (!on_stack(info, (void *)addr, len))
-		if (get_stack_info(info->next_sp, state->task, info,
-				   &state->stack_mask))
-			return false;
 	return true;
 }
 	return true;
 }
-#define REGS_SIZE (sizeof(struct pt_regs))
-#define SP_OFFSET (offsetof(struct pt_regs, sp))
-#define IRET_REGS_SIZE (REGS_SIZE - offsetof(struct pt_regs, ip))
-#define IRET_SP_OFFSET (SP_OFFSET - offsetof(struct pt_regs, ip))
 static bool deref_stack_regs(struct unwind_state *state, unsigned long addr,
-			     unsigned long *ip, unsigned long *sp, bool full)
+			     unsigned long *ip, unsigned long *sp)
 {
-	size_t regs_size = full ? REGS_SIZE : IRET_REGS_SIZE;
+	struct pt_regs *regs = (struct pt_regs *)addr;
-	size_t sp_offset = full ? SP_OFFSET : IRET_SP_OFFSET;
-	struct pt_regs *regs = (struct pt_regs *)(addr + regs_size - REGS_SIZE);
-	if (IS_ENABLED(CONFIG_X86_64)) {
-		if (!stack_access_ok(state, addr, regs_size))
-			return false;
-		*ip = regs->ip;
+	/* x86-32 support will be more complicated due to the &regs->sp hack */
-		*sp = regs->sp;
+	BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_32));
-		return true;
+	if (!stack_access_ok(state, addr, sizeof(struct pt_regs)))
-	}
-	if (!stack_access_ok(state, addr, sp_offset))
 		return false;
 	*ip = regs->ip;
+	*sp = regs->sp;
+	return true;
+}
-	if (user_mode(regs)) {
+static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr,
-		if (!stack_access_ok(state, addr + sp_offset,
+				  unsigned long *ip, unsigned long *sp)
-				     REGS_SIZE - SP_OFFSET))
+{
-			return false;
+	struct pt_regs *regs = (void *)addr - IRET_FRAME_OFFSET;
-		*sp = regs->sp;
+	if (!stack_access_ok(state, addr, IRET_FRAME_SIZE))
-	} else
+		return false;
-		*sp = (unsigned long)&regs->sp;
+	*ip = regs->ip;
+	*sp = regs->sp;
 	return true;
 }
 	unsigned long ip_p, sp, orig_ip, prev_sp = state->sp;
 	enum stack_type prev_type = state->stack_info.type;
 	struct orc_entry *orc;
-	struct pt_regs *ptregs;
 	bool indirect = false;
 	if (unwind_done(state))
 		break;
 	case ORC_TYPE_REGS:
-		if (!deref_stack_regs(state, sp, &state->ip, &state->sp, true)) {
+		if (!deref_stack_regs(state, sp, &state->ip, &state->sp)) {
 			orc_warn("can't dereference registers at %p for ip %pB\n",
 				 (void *)sp, (void *)orig_ip);
 			goto done;
 		break;
 	case ORC_TYPE_REGS_IRET:
-		if (!deref_stack_regs(state, sp, &state->ip, &state->sp, false)) {
+		if (!deref_stack_iret_regs(state, sp, &state->ip, &state->sp)) {
 			orc_warn("can't dereference iret registers at %p for ip %pB\n",
 				 (void *)sp, (void *)orig_ip);
 			goto done;
 		}
-		ptregs = container_of((void *)sp, struct pt_regs, ip);
+		state->regs = (void *)sp - IRET_FRAME_OFFSET;
-		if ((unsigned long)ptregs >= prev_sp &&
+		state->full_regs = false;
-		    on_stack(&state->stack_info, ptregs, REGS_SIZE)) {
-			state->regs = ptregs;
-			state->full_regs = false;
-		} else
-			state->regs = NULL;
 		state->signal = true;
 		break;
 	}
 	if (get_stack_info((unsigned long *)state->sp, state->task,
-			   &state->stack_info, &state->stack_mask))
+			   &state->stack_info, &state->stack_mask)) {
-		return;
+		/*
+		 * We weren't on a valid stack.  It's possible that
+		 * we overflowed a valid stack into a guard page.
+		 * See if the next page up is valid so that we can
+		 * generate some kind of backtrace if this happens.
+		 */
+		void *next_page = (void *)PAGE_ALIGN((unsigned long)state->sp);
+		if (get_stack_info(next_page, state->task, &state->stack_info,
+				   &state->stack_mask))
+			return;
+	}
 	/*
 	 * The caller can provide the address of the first frame directly

arch/x86/kernel/vmlinux.lds.S+17−0

 		. = ALIGN(HPAGE_SIZE);				\
 		__end_rodata_hpage_align = .;
+#define ALIGN_ENTRY_TEXT_BEGIN	. = ALIGN(PMD_SIZE);
+#define ALIGN_ENTRY_TEXT_END	. = ALIGN(PMD_SIZE);
 #else
 #define X64_ALIGN_RODATA_BEGIN
 #define X64_ALIGN_RODATA_END
+#define ALIGN_ENTRY_TEXT_BEGIN
+#define ALIGN_ENTRY_TEXT_END
 #endif
 PHDRS {
 		CPUIDLE_TEXT
 		LOCK_TEXT
 		KPROBES_TEXT
+		ALIGN_ENTRY_TEXT_BEGIN
 		ENTRY_TEXT
 		IRQENTRY_TEXT
+		ALIGN_ENTRY_TEXT_END
 		SOFTIRQENTRY_TEXT
 		*(.fixup)
 		*(.gnu.warning)
+#ifdef CONFIG_X86_64
+		. = ALIGN(PAGE_SIZE);
+		_entry_trampoline = .;
+		*(.entry_trampoline)
+		. = ALIGN(PAGE_SIZE);
+		ASSERT(. - _entry_trampoline == PAGE_SIZE, "entry trampoline is too big");
+#endif
 		/* End of text section */
 		_etext = .;
 	} :text = 0x9090

arch/x86/kvm/emulate.c+25−7

 }
 static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
-				     u64 cr0, u64 cr4)
+				    u64 cr0, u64 cr3, u64 cr4)
 {
 	int bad;
+	u64 pcid;
+	/* In order to later set CR4.PCIDE, CR3[11:0] must be zero.  */
+	pcid = 0;
+	if (cr4 & X86_CR4_PCIDE) {
+		pcid = cr3 & 0xfff;
+		cr3 &= ~0xfff;
+	}
+	bad = ctxt->ops->set_cr(ctxt, 3, cr3);
+	if (bad)
+		return X86EMUL_UNHANDLEABLE;
 	/*
 	 * First enable PAE, long mode needs it before CR0.PG = 1 is set.
 		bad = ctxt->ops->set_cr(ctxt, 4, cr4);
 		if (bad)
 			return X86EMUL_UNHANDLEABLE;
+		if (pcid) {
+			bad = ctxt->ops->set_cr(ctxt, 3, cr3 | pcid);
+			if (bad)
+				return X86EMUL_UNHANDLEABLE;
+		}
 	}
 	return X86EMUL_CONTINUE;
 	struct desc_struct desc;
 	struct desc_ptr dt;
 	u16 selector;
-	u32 val, cr0, cr4;
+	u32 val, cr0, cr3, cr4;
 	int i;
 	cr0 =                      GET_SMSTATE(u32, smbase, 0x7ffc);
-	ctxt->ops->set_cr(ctxt, 3, GET_SMSTATE(u32, smbase, 0x7ff8));
+	cr3 =                      GET_SMSTATE(u32, smbase, 0x7ff8);
 	ctxt->eflags =             GET_SMSTATE(u32, smbase, 0x7ff4) | X86_EFLAGS_FIXED;
 	ctxt->_eip =               GET_SMSTATE(u32, smbase, 0x7ff0);
 	ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7ef8));
-	return rsm_enter_protected_mode(ctxt, cr0, cr4);
+	return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
 }
 static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
 {
 	struct desc_struct desc;
 	struct desc_ptr dt;
-	u64 val, cr0, cr4;
+	u64 val, cr0, cr3, cr4;
 	u32 base3;
 	u16 selector;
 	int i, r;
 	ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1);
 	cr0 =                       GET_SMSTATE(u64, smbase, 0x7f58);
-	ctxt->ops->set_cr(ctxt, 3,  GET_SMSTATE(u64, smbase, 0x7f50));
+	cr3 =                       GET_SMSTATE(u64, smbase, 0x7f50);
 	cr4 =                       GET_SMSTATE(u64, smbase, 0x7f48);
 	ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7f00));
 	val =                       GET_SMSTATE(u64, smbase, 0x7ed0);
 	dt.address =                GET_SMSTATE(u64, smbase, 0x7e68);
 	ctxt->ops->set_gdt(ctxt, &dt);
-	r = rsm_enter_protected_mode(ctxt, cr0, cr4);
+	r = rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
 	if (r != X86EMUL_CONTINUE)
 		return r;

arch/x86/kvm/mmu.c+4−4

arch/x86/kvm/vmx.c+1−1

@@ -2302,7 +2302,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) · 2301 unmodified lines
2302	* processors. See 22.2.4.	2302	* processors. See 22.2.4.
2303	*/	2303	*/
2304	vmcs_writel(HOST_TR_BASE,	2304	vmcs_writel(HOST_TR_BASE,
2305	(unsigned long)this_cpu_ptr(&cpu_tss));	2305	(unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
2306	vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */	2306	vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */
2307		2307
2308	/*	2308	/*

arch/x86/kvm/x86.c+35−13

 					 addr, n, v))
 		    && kvm_io_bus_read(vcpu, KVM_MMIO_BUS, addr, n, v))
 			break;
-		trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, *(u64 *)v);
+		trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, v);
 		handled += n;
 		addr += n;
 		len -= n;
 {
 	if (vcpu->mmio_read_completed) {
 		trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes,
-			       vcpu->mmio_fragments[0].gpa, *(u64 *)val);
+			       vcpu->mmio_fragments[0].gpa, val);
 		vcpu->mmio_read_completed = 0;
 		return 1;
 	}
 static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val)
 {
-	trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val);
+	trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, val);
 	return vcpu_mmio_write(vcpu, gpa, bytes, val);
 }
 static int read_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa,
 			  void *val, int bytes)
 {
-	trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, 0);
+	trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, NULL);
 	return X86EMUL_IO_NEEDED;
 }
 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
-	struct fpu *fpu = &current->thread.fpu;
 	int r;
-	fpu__initialize(fpu);
 	kvm_sigset_activate(vcpu);
+	kvm_load_guest_fpu(vcpu);
 	if (unlikely(vcpu->arch.mp_state == KVM_MP_STATE_UNINITIALIZED)) {
 		if (kvm_run->immediate_exit) {
 			r = -EINTR;
 		}
 	}
-	kvm_load_guest_fpu(vcpu);
 	if (unlikely(vcpu->arch.complete_userspace_io)) {
 		int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io;
 		vcpu->arch.complete_userspace_io = NULL;
 		r = cui(vcpu);
 		if (r <= 0)
-			goto out_fpu;
+			goto out;
 	} else
 		WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
 	else
 		r = vcpu_run(vcpu);
-out_fpu:
-	kvm_put_guest_fpu(vcpu);
 out:
+	kvm_put_guest_fpu(vcpu);
 	post_kvm_run_save(vcpu);
 	kvm_sigset_deactivate(vcpu);
 #endif
 	kvm_rip_write(vcpu, regs->rip);
-	kvm_set_rflags(vcpu, regs->rflags);
+	kvm_set_rflags(vcpu, regs->rflags | X86_EFLAGS_FIXED);
 	vcpu->arch.exception.pending = false;
 }
 EXPORT_SYMBOL_GPL(kvm_task_switch);
+int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
+{
+	if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG_BIT)) {
+		/*
+		 * When EFER.LME and CR0.PG are set, the processor is in
+		 * 64-bit mode (though maybe in a 32-bit code segment).
+		 * CR4.PAE and EFER.LMA must be set.
+		 */
+		if (!(sregs->cr4 & X86_CR4_PAE_BIT)
+		    || !(sregs->efer & EFER_LMA))
+			return -EINVAL;
+	} else {
+		/*
+		 * Not in 64-bit mode: EFER.LMA is clear and the code
+		 * segment cannot be 64-bit.
+		 */
+		if (sregs->efer & EFER_LMA || sregs->cs.l)
+			return -EINVAL;
+	}
+	return 0;
+}
 int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
 				  struct kvm_sregs *sregs)
 {
 			(sregs->cr4 & X86_CR4_OSXSAVE))
 		return -EINVAL;
+	if (kvm_valid_sregs(vcpu, sregs))
+		return -EINVAL;
 	apic_base_msr.data = sregs->apic_base;
 	apic_base_msr.host_initiated = true;
 	if (kvm_set_apic_base(vcpu, &apic_base_msr))

arch/x86/lib/delay.c+2−2

@@ -107,10 +107,10 @@ static void delay_mwaitx(unsigned long __loops) · 106 unmodified lines
107	delay = min_t(u64, MWAITX_MAX_LOOPS, loops);	107	delay = min_t(u64, MWAITX_MAX_LOOPS, loops);
108		108
109	/*	109	/*
110	* Use cpu_tss as a cacheline-aligned, seldomly	110	* Use cpu_tss_rw as a cacheline-aligned, seldomly
111	* accessed per-cpu variable as the monitor target.	111	* accessed per-cpu variable as the monitor target.
112	*/	112	*/
113	__monitorx(raw_cpu_ptr(&cpu_tss), 0, 0);	113	__monitorx(raw_cpu_ptr(&cpu_tss_rw), 0, 0);
114		114
115	/*	115	/*
116	* AMD, like Intel, supports the EAX hint and EAX=0xf	116	* AMD, like Intel, supports the EAX hint and EAX=0xf

arch/x86/lib/x86-opcode-map.txt+11−2

 fc: paddb Pq,Qq | vpaddb Vx,Hx,Wx (66),(v1)
 fd: paddw Pq,Qq | vpaddw Vx,Hx,Wx (66),(v1)
 fe: paddd Pq,Qq | vpaddd Vx,Hx,Wx (66),(v1)
-ff:
+ff: UD0
 EndTable
 Table: 3-byte opcode 1 (0x0f 0x38)
 7e: vpermt2d/q Vx,Hx,Wx (66),(ev)
 7f: vpermt2ps/d Vx,Hx,Wx (66),(ev)
 80: INVEPT Gy,Mdq (66)
-81: INVPID Gy,Mdq (66)
+81: INVVPID Gy,Mdq (66)
 82: INVPCID Gy,Mdq (66)
 83: vpmultishiftqb Vx,Hx,Wx (66),(ev)
 88: vexpandps/d Vpd,Wpd (66),(ev)
 EndTable
 GrpTable: Grp10
+# all are UD1
+0: UD1
+1: UD1
+2: UD1
+3: UD1
+4: UD1
+5: UD1
+6: UD1
+7: UD1
 EndTable
 # Grp11A and Grp11B are expressed as Grp11 in Intel SDM

arch/x86/mm/Makefile+5−4

 endif
 obj-y	:=  init.o init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
-	    pat.o pgtable.o physaddr.o setup_nx.o tlb.o
+	    pat.o pgtable.o physaddr.o setup_nx.o tlb.o cpu_entry_area.o
 # Make sure __phys_addr has no stackprotector
 nostackp := $(call cc-option, -fno-stack-protector)
 obj-$(CONFIG_ACPI_NUMA)		+= srat.o
 obj-$(CONFIG_NUMA_EMU)		+= numa_emulation.o
-obj-$(CONFIG_X86_INTEL_MPX)	+= mpx.o
+obj-$(CONFIG_X86_INTEL_MPX)			+= mpx.o
-obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) += pkeys.o
+obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS)	+= pkeys.o
-obj-$(CONFIG_RANDOMIZE_MEMORY) += kaslr.o
+obj-$(CONFIG_RANDOMIZE_MEMORY)			+= kaslr.o
+obj-$(CONFIG_PAGE_TABLE_ISOLATION)		+= pti.o
 obj-$(CONFIG_AMD_MEM_ENCRYPT)	+= mem_encrypt.o
 obj-$(CONFIG_AMD_MEM_ENCRYPT)	+= mem_encrypt_boot.o

arch/x86/mm/cpu_entry_area.c+166−0

@@ -0,0 +1,166 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2
	3	#include <linux/spinlock.h>
	4	#include <linux/percpu.h>
	5
	6	#include <asm/cpu_entry_area.h>
	7	#include <asm/pgtable.h>
	8	#include <asm/fixmap.h>
	9	#include <asm/desc.h>
	10
	11	static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage);
	12
	13	#ifdef CONFIG_X86_64
	14	static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks
	15	[(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ]);
	16	#endif
	17
	18	struct cpu_entry_area *get_cpu_entry_area(int cpu)
	19	{
	20	unsigned long va = CPU_ENTRY_AREA_PER_CPU + cpu * CPU_ENTRY_AREA_SIZE;
	21	BUILD_BUG_ON(sizeof(struct cpu_entry_area) % PAGE_SIZE != 0);
	22
	23	return (struct cpu_entry_area *) va;
	24	}
	25	EXPORT_SYMBOL(get_cpu_entry_area);
	26
	27	void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags)
	28	{
	29	unsigned long va = (unsigned long) cea_vaddr;
	30
	31	set_pte_vaddr(va, pfn_pte(pa >> PAGE_SHIFT, flags));
	32	}
	33
	34	static void __init
	35	cea_map_percpu_pages(void cea_vaddr, void ptr, int pages, pgprot_t prot)
	36	{
	37	for ( ; pages; pages--, cea_vaddr+= PAGE_SIZE, ptr += PAGE_SIZE)
	38	cea_set_pte(cea_vaddr, per_cpu_ptr_to_phys(ptr), prot);
	39	}
	40
	41	static void percpu_setup_debug_store(int cpu)
	42	{
	43	#ifdef CONFIG_CPU_SUP_INTEL
	44	int npages;
	45	void *cea;
	46
	47	if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
	48	return;
	49
	50	cea = &get_cpu_entry_area(cpu)->cpu_debug_store;
	51	npages = sizeof(struct debug_store) / PAGE_SIZE;
	52	BUILD_BUG_ON(sizeof(struct debug_store) % PAGE_SIZE != 0);
	53	cea_map_percpu_pages(cea, &per_cpu(cpu_debug_store, cpu), npages,
	54	PAGE_KERNEL);
	55
	56	cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers;
	57	/*
	58	* Force the population of PMDs for not yet allocated per cpu
	59	* memory like debug store buffers.
	60	*/
	61	npages = sizeof(struct debug_store_buffers) / PAGE_SIZE;
	62	for (; npages; npages--, cea += PAGE_SIZE)
	63	cea_set_pte(cea, 0, PAGE_NONE);
	64	#endif
	65	}
	66
	67	/* Setup the fixmap mappings only once per-processor */
	68	static void __init setup_cpu_entry_area(int cpu)
	69	{
	70	#ifdef CONFIG_X86_64
	71	extern char _entry_trampoline[];
	72
	73	/* On 64-bit systems, we use a read-only fixmap GDT and TSS. */
	74	pgprot_t gdt_prot = PAGE_KERNEL_RO;
	75	pgprot_t tss_prot = PAGE_KERNEL_RO;
	76	#else
	77	/*
	78	* On native 32-bit systems, the GDT cannot be read-only because
	79	* our double fault handler uses a task gate, and entering through
	80	* a task gate needs to change an available TSS to busy. If the
	81	* GDT is read-only, that will triple fault. The TSS cannot be
	82	* read-only because the CPU writes to it on task switches.
	83	*
	84	* On Xen PV, the GDT must be read-only because the hypervisor
	85	* requires it.
	86	*/
	87	pgprot_t gdt_prot = boot_cpu_has(X86_FEATURE_XENPV) ?
	88	PAGE_KERNEL_RO : PAGE_KERNEL;
	89	pgprot_t tss_prot = PAGE_KERNEL;
	90	#endif
	91
	92	cea_set_pte(&get_cpu_entry_area(cpu)->gdt, get_cpu_gdt_paddr(cpu),
	93	gdt_prot);
	94
	95	cea_map_percpu_pages(&get_cpu_entry_area(cpu)->entry_stack_page,
	96	per_cpu_ptr(&entry_stack_storage, cpu), 1,
	97	PAGE_KERNEL);
	98
	99	/*
	100	* The Intel SDM says (Volume 3, 7.2.1):
	101	*
	102	* Avoid placing a page boundary in the part of the TSS that the
	103	* processor reads during a task switch (the first 104 bytes). The
	104	* processor may not correctly perform address translations if a
	105	* boundary occurs in this area. During a task switch, the processor
	106	* reads and writes into the first 104 bytes of each TSS (using
	107	* contiguous physical addresses beginning with the physical address
	108	* of the first byte of the TSS). So, after TSS access begins, if
	109	* part of the 104 bytes is not physically contiguous, the processor
	110	* will access incorrect information without generating a page-fault
	111	* exception.
	112	*
	113	* There are also a lot of errata involving the TSS spanning a page
	114	* boundary. Assert that we're not doing that.
	115	*/
	116	BUILD_BUG_ON((offsetof(struct tss_struct, x86_tss) ^
	117	offsetofend(struct tss_struct, x86_tss)) & PAGE_MASK);
	118	BUILD_BUG_ON(sizeof(struct tss_struct) % PAGE_SIZE != 0);
	119	cea_map_percpu_pages(&get_cpu_entry_area(cpu)->tss,
	120	&per_cpu(cpu_tss_rw, cpu),
	121	sizeof(struct tss_struct) / PAGE_SIZE, tss_prot);
	122
	123	#ifdef CONFIG_X86_32
	124	per_cpu(cpu_entry_area, cpu) = get_cpu_entry_area(cpu);
	125	#endif
	126
	127	#ifdef CONFIG_X86_64
	128	BUILD_BUG_ON(sizeof(exception_stacks) % PAGE_SIZE != 0);
	129	BUILD_BUG_ON(sizeof(exception_stacks) !=
	130	sizeof(((struct cpu_entry_area *)0)->exception_stacks));
	131	cea_map_percpu_pages(&get_cpu_entry_area(cpu)->exception_stacks,
	132	&per_cpu(exception_stacks, cpu),
	133	sizeof(exception_stacks) / PAGE_SIZE, PAGE_KERNEL);
	134
	135	cea_set_pte(&get_cpu_entry_area(cpu)->entry_trampoline,
	136	__pa_symbol(_entry_trampoline), PAGE_KERNEL_RX);
	137	#endif
	138	percpu_setup_debug_store(cpu);
	139	}
	140
	141	static __init void setup_cpu_entry_area_ptes(void)
	142	{
	143	#ifdef CONFIG_X86_32
	144	unsigned long start, end;
	145
	146	BUILD_BUG_ON(CPU_ENTRY_AREA_PAGES * PAGE_SIZE < CPU_ENTRY_AREA_MAP_SIZE);
	147	BUG_ON(CPU_ENTRY_AREA_BASE & ~PMD_MASK);
	148
	149	start = CPU_ENTRY_AREA_BASE;
	150	end = start + CPU_ENTRY_AREA_MAP_SIZE;
	151
	152	/* Careful here: start + PMD_SIZE might wrap around */
	153	for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE)
	154	populate_extra_pte(start);
	155	#endif
	156	}
	157
	158	void __init setup_cpu_entry_areas(void)
	159	{
	160	unsigned int cpu;
	161
	162	setup_cpu_entry_area_ptes();
	163
	164	for_each_possible_cpu(cpu)
	165	setup_cpu_entry_area(cpu);
	166	}

arch/x86/mm/debug_pagetables.c+74−6

@@ -5,7 +5,7 @@ · 4 unmodified lines
5		5
6	static int ptdump_show(struct seq_file m, void v)	6	static int ptdump_show(struct seq_file m, void v)
7	{	7	{
8	ptdump_walk_pgd_level(m, NULL);	8	ptdump_walk_pgd_level_debugfs(m, NULL, false);
9	return 0;	9	return 0;
10	}	10	}
11		11
@@ -22,21 +22,89 @@ static const struct file_operations ptdump_fops = { · 10 unmodified lines
22	.release = single_release,	22	.release = single_release,
23	};	23	};
24		24
25	static struct dentry *pe;	25	static int ptdump_show_curknl(struct seq_file m, void v)
		26	{
		27	if (current->mm->pgd) {
		28	down_read(&current->mm->mmap_sem);
		29	ptdump_walk_pgd_level_debugfs(m, current->mm->pgd, false);
		30	up_read(&current->mm->mmap_sem);
		31	}
		32	return 0;
		33	}
		34
		35	static int ptdump_open_curknl(struct inode inode, struct file filp)
		36	{
		37	return single_open(filp, ptdump_show_curknl, NULL);
		38	}
		39
		40	static const struct file_operations ptdump_curknl_fops = {
		41	.owner = THIS_MODULE,
		42	.open = ptdump_open_curknl,
		43	.read = seq_read,
		44	.llseek = seq_lseek,
		45	.release = single_release,
		46	};
		47
		48	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		49	static struct dentry *pe_curusr;
		50
		51	static int ptdump_show_curusr(struct seq_file m, void v)
		52	{
		53	if (current->mm->pgd) {
		54	down_read(&current->mm->mmap_sem);
		55	ptdump_walk_pgd_level_debugfs(m, current->mm->pgd, true);
		56	up_read(&current->mm->mmap_sem);
		57	}
		58	return 0;
		59	}
		60
		61	static int ptdump_open_curusr(struct inode inode, struct file filp)
		62	{
		63	return single_open(filp, ptdump_show_curusr, NULL);
		64	}
		65
		66	static const struct file_operations ptdump_curusr_fops = {
		67	.owner = THIS_MODULE,
		68	.open = ptdump_open_curusr,
		69	.read = seq_read,
		70	.llseek = seq_lseek,
		71	.release = single_release,
		72	};
		73	#endif
		74
		75	static struct dentry dir, pe_knl, *pe_curknl;
26		76
27	static int __init pt_dump_debug_init(void)	77	static int __init pt_dump_debug_init(void)
28	{	78	{
29	pe = debugfs_create_file("kernel_page_tables", S_IRUSR, NULL, NULL,	79	dir = debugfs_create_dir("page_tables", NULL);
30	&ptdump_fops);	80	if (!dir)
31	if (!pe)
32	return -ENOMEM;	81	return -ENOMEM;
33		82
		83	pe_knl = debugfs_create_file("kernel", 0400, dir, NULL,
		84	&ptdump_fops);
		85	if (!pe_knl)
		86	goto err;
		87
		88	pe_curknl = debugfs_create_file("current_kernel", 0400,
		89	dir, NULL, &ptdump_curknl_fops);
		90	if (!pe_curknl)
		91	goto err;
		92
		93	#ifdef CONFIG_PAGE_TABLE_ISOLATION
		94	pe_curusr = debugfs_create_file("current_user", 0400,
		95	dir, NULL, &ptdump_curusr_fops);
		96	if (!pe_curusr)
		97	goto err;
		98	#endif
34	return 0;	99	return 0;
		100	err:
		101	debugfs_remove_recursive(dir);
		102	return -ENOMEM;
35	}	103	}
36		104
37	static void __exit pt_dump_debug_exit(void)	105	static void __exit pt_dump_debug_exit(void)
38	{	106	{
39	debugfs_remove_recursive(pe);	107	debugfs_remove_recursive(dir);
40	}	108	}
41		109
42	module_init(pt_dump_debug_init);	110	module_init(pt_dump_debug_init);

arch/x86/mm/dump_pagetables.c+97−44

 	unsigned long max_lines;
 };
-/* indices for address_markers; keep sync'd w/ address_markers below */
+/* Address space markers hints */
+#ifdef CONFIG_X86_64
 enum address_markers_idx {
 	USER_SPACE_NR = 0,
-#ifdef CONFIG_X86_64
 	KERNEL_SPACE_NR,
 	LOW_KERNEL_NR,
+#if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL)
+	LDT_NR,
+#endif
 	VMALLOC_START_NR,
 	VMEMMAP_START_NR,
 #ifdef CONFIG_KASAN
 	KASAN_SHADOW_START_NR,
 	KASAN_SHADOW_END_NR,
 #endif
-# ifdef CONFIG_X86_ESPFIX64
+#if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL)
+	LDT_NR,
+#endif
+	CPU_ENTRY_AREA_NR,
+#ifdef CONFIG_X86_ESPFIX64
 	ESPFIX_START_NR,
-# endif
+#endif
+#ifdef CONFIG_EFI
+	EFI_END_NR,
+#endif
 	HIGH_KERNEL_NR,
 	MODULES_VADDR_NR,
 	MODULES_END_NR,
-#else
+	FIXADDR_START_NR,
+	END_OF_SPACE_NR,
+};
+static struct addr_marker address_markers[] = {
+	[USER_SPACE_NR]		= { 0,			"User Space" },
+	[KERNEL_SPACE_NR]	= { (1UL << 63),	"Kernel Space" },
+	[LOW_KERNEL_NR]		= { 0UL,		"Low Kernel Mapping" },
+	[VMALLOC_START_NR]	= { 0UL,		"vmalloc() Area" },
+	[VMEMMAP_START_NR]	= { 0UL,		"Vmemmap" },
+#ifdef CONFIG_KASAN
+	[KASAN_SHADOW_START_NR]	= { KASAN_SHADOW_START,	"KASAN shadow" },
+	[KASAN_SHADOW_END_NR]	= { KASAN_SHADOW_END,	"KASAN shadow end" },
+#endif
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+	[LDT_NR]		= { LDT_BASE_ADDR,	"LDT remap" },
+#endif
+	[CPU_ENTRY_AREA_NR]	= { CPU_ENTRY_AREA_BASE,"CPU entry Area" },
+#ifdef CONFIG_X86_ESPFIX64
+	[ESPFIX_START_NR]	= { ESPFIX_BASE_ADDR,	"ESPfix Area", 16 },
+#endif
+#ifdef CONFIG_EFI
+	[EFI_END_NR]		= { EFI_VA_END,		"EFI Runtime Services" },
+#endif
+	[HIGH_KERNEL_NR]	= { __START_KERNEL_map,	"High Kernel Mapping" },
+	[MODULES_VADDR_NR]	= { MODULES_VADDR,	"Modules" },
+	[MODULES_END_NR]	= { MODULES_END,	"End Modules" },
+	[FIXADDR_START_NR]	= { FIXADDR_START,	"Fixmap Area" },
+	[END_OF_SPACE_NR]	= { -1,			NULL }
+};
+#else /* CONFIG_X86_64 */
+enum address_markers_idx {
+	USER_SPACE_NR = 0,
 	KERNEL_SPACE_NR,
 	VMALLOC_START_NR,
 	VMALLOC_END_NR,
-# ifdef CONFIG_HIGHMEM
+#ifdef CONFIG_HIGHMEM
 	PKMAP_BASE_NR,
-# endif
-	FIXADDR_START_NR,
 #endif
+	CPU_ENTRY_AREA_NR,
+	FIXADDR_START_NR,
+	END_OF_SPACE_NR,
 };
-/* Address space markers hints */
 static struct addr_marker address_markers[] = {
-	{ 0, "User Space" },
+	[USER_SPACE_NR]		= { 0,			"User Space" },
-#ifdef CONFIG_X86_64
+	[KERNEL_SPACE_NR]	= { PAGE_OFFSET,	"Kernel Mapping" },
-	{ 0x8000000000000000UL, "Kernel Space" },
+	[VMALLOC_START_NR]	= { 0UL,		"vmalloc() Area" },
-	{ 0/* PAGE_OFFSET */,   "Low Kernel Mapping" },
+	[VMALLOC_END_NR]	= { 0UL,		"vmalloc() End" },
-	{ 0/* VMALLOC_START */, "vmalloc() Area" },
+#ifdef CONFIG_HIGHMEM
-	{ 0/* VMEMMAP_START */, "Vmemmap" },
+	[PKMAP_BASE_NR]		= { 0UL,		"Persistent kmap() Area" },
-#ifdef CONFIG_KASAN
-	{ KASAN_SHADOW_START,	"KASAN shadow" },
-	{ KASAN_SHADOW_END,	"KASAN shadow end" },
 #endif
-# ifdef CONFIG_X86_ESPFIX64
+	[CPU_ENTRY_AREA_NR]	= { 0UL,		"CPU entry area" },
-	{ ESPFIX_BASE_ADDR,	"ESPfix Area", 16 },
+	[FIXADDR_START_NR]	= { 0UL,		"Fixmap area" },
-# endif
+	[END_OF_SPACE_NR]	= { -1,			NULL }
-# ifdef CONFIG_EFI
-	{ EFI_VA_END,		"EFI Runtime Services" },
-# endif
-	{ __START_KERNEL_map,   "High Kernel Mapping" },
-	{ MODULES_VADDR,        "Modules" },
-	{ MODULES_END,          "End Modules" },
-#else
-	{ PAGE_OFFSET,          "Kernel Mapping" },
-	{ 0/* VMALLOC_START */, "vmalloc() Area" },
-	{ 0/*VMALLOC_END*/,     "vmalloc() End" },
-# ifdef CONFIG_HIGHMEM
-	{ 0/*PKMAP_BASE*/,      "Persistent kmap() Area" },
-# endif
-	{ 0/*FIXADDR_START*/,   "Fixmap Area" },
-#endif
-	{ -1, NULL }		/* End of list */
 };
+#endif /* !CONFIG_X86_64 */
 /* Multipliers for offsets within the PTEs */
 #define PTE_LEVEL_MULT (PAGE_SIZE)
 #define PMD_LEVEL_MULT (PTRS_PER_PTE * PTE_LEVEL_MULT)
 	static const char * const level_name[] =
 		{ "cr3", "pgd", "p4d", "pud", "pmd", "pte" };
-	if (!pgprot_val(prot)) {
+	if (!(pr & _PAGE_PRESENT)) {
 		/* Not present */
 		pt_dump_cont_printf(m, dmsg, "                              ");
 	} else {
 }
 static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
-				       bool checkwx)
+				       bool checkwx, bool dmesg)
 {
 #ifdef CONFIG_X86_64
 	pgd_t *start = (pgd_t *) &init_top_pgt;
 	if (pgd) {
 		start = pgd;
-		st.to_dmesg = true;
+		st.to_dmesg = dmesg;
 	}
 	st.check_wx = checkwx;
 void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd)
 {
-	ptdump_walk_pgd_level_core(m, pgd, false);
+	ptdump_walk_pgd_level_core(m, pgd, false, true);
+}
+void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user)
+{
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+	if (user && static_cpu_has(X86_FEATURE_PTI))
+		pgd = kernel_to_user_pgdp(pgd);
+#endif
+	ptdump_walk_pgd_level_core(m, pgd, false, false);
+}
+EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level_debugfs);
+static void ptdump_walk_user_pgd_level_checkwx(void)
+{
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+	pgd_t *pgd = (pgd_t *) &init_top_pgt;
+	if (!static_cpu_has(X86_FEATURE_PTI))
+		return;
+	pr_info("x86/mm: Checking user space page tables\n");
+	pgd = kernel_to_user_pgdp(pgd);
+	ptdump_walk_pgd_level_core(NULL, pgd, true, false);
+#endif
 }
-EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level);
 void ptdump_walk_pgd_level_checkwx(void)
 {
-	ptdump_walk_pgd_level_core(NULL, NULL, true);
+	ptdump_walk_pgd_level_core(NULL, NULL, true, false);
+	ptdump_walk_user_pgd_level_checkwx();
 }
 static int __init pt_dump_init(void)
 	address_markers[PKMAP_BASE_NR].start_address = PKMAP_BASE;
 # endif
 	address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
+	address_markers[CPU_ENTRY_AREA_NR].start_address = CPU_ENTRY_AREA_BASE;
 #endif
 	return 0;
 }
 __initcall(pt_dump_init);

arch/x86/mm/fault.c+1−1

@@ -860,7 +860,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code, · 859 unmodified lines
860	if (!printk_ratelimit())	860	if (!printk_ratelimit())
861	return;	861	return;
862		862
863	printk("%s%s[%d]: segfault at %lx ip %p sp %p error %lx",	863	printk("%s%s[%d]: segfault at %lx ip %px sp %px error %lx",
864	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,	864	task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
865	tsk->comm, task_pid_nr(tsk), address,	865	tsk->comm, task_pid_nr(tsk), address,
866	(void )regs->ip, (void )regs->sp, error_code);	866	(void )regs->ip, (void )regs->sp, error_code);

arch/x86/mm/init.c+49−31

@@ -20,6 +20,7 @@ · 19 unmodified lines
20	#include <asm/kaslr.h>	20	#include <asm/kaslr.h>
21	#include <asm/hypervisor.h>	21	#include <asm/hypervisor.h>
22	#include <asm/cpufeature.h>	22	#include <asm/cpufeature.h>
		23	#include <asm/pti.h>
23		24
24	/*	25	/*
25	* We need to define the tracepoints somewhere, and tlb.c	26	* We need to define the tracepoints somewhere, and tlb.c
@@ -160,6 +161,12 @@ struct map_range { · 134 unmodified lines
160		161
161	static int page_size_mask;	162	static int page_size_mask;
162		163
		164	static void enable_global_pages(void)
		165	{
		166	if (!static_cpu_has(X86_FEATURE_PTI))
		167	__supported_pte_mask \|= _PAGE_GLOBAL;
		168	}
		169
163	static void __init probe_page_size_mask(void)	170	static void __init probe_page_size_mask(void)
164	{	171	{
165	/*	172	/*
@@ -177,11 +184,11 @@ static void __init probe_page_size_mask(void) · 11 unmodified lines
177	cr4_set_bits_and_update_boot(X86_CR4_PSE);	184	cr4_set_bits_and_update_boot(X86_CR4_PSE);
178		185
179	/* Enable PGE if available */	186	/* Enable PGE if available */
		187	__supported_pte_mask &= ~_PAGE_GLOBAL;
180	if (boot_cpu_has(X86_FEATURE_PGE)) {	188	if (boot_cpu_has(X86_FEATURE_PGE)) {
181	cr4_set_bits_and_update_boot(X86_CR4_PGE);	189	cr4_set_bits_and_update_boot(X86_CR4_PGE);
182	__supported_pte_mask \|= _PAGE_GLOBAL;	190	enable_global_pages();
183	} else	191	}
184	__supported_pte_mask &= ~_PAGE_GLOBAL;
185		192
186	/* Enable 1 GB linear kernel mappings if available: */	193	/* Enable 1 GB linear kernel mappings if available: */
187	if (direct_gbpages && boot_cpu_has(X86_FEATURE_GBPAGES)) {	194	if (direct_gbpages && boot_cpu_has(X86_FEATURE_GBPAGES)) {
@@ -194,34 +201,44 @@ static void __init probe_page_size_mask(void) · 6 unmodified lines
194		201
195	static void setup_pcid(void)	202	static void setup_pcid(void)
196	{	203	{
197	#ifdef CONFIG_X86_64	204	if (!IS_ENABLED(CONFIG_X86_64))
198	if (boot_cpu_has(X86_FEATURE_PCID)) {	205	return;
199	if (boot_cpu_has(X86_FEATURE_PGE)) {	206
200	/*	207	if (!boot_cpu_has(X86_FEATURE_PCID))
201	* This can't be cr4_set_bits_and_update_boot() --	208	return;
202	* the trampoline code can't handle CR4.PCIDE and	209
203	* it wouldn't do any good anyway. Despite the name,	210	if (boot_cpu_has(X86_FEATURE_PGE)) {
204	* cr4_set_bits_and_update_boot() doesn't actually	211	/*
205	* cause the bits in question to remain set all the	212	* This can't be cr4_set_bits_and_update_boot() -- the
206	* way through the secondary boot asm.	213	* trampoline code can't handle CR4.PCIDE and it wouldn't
207	*	214	* do any good anyway. Despite the name,
208	* Instead, we brute-force it and set CR4.PCIDE	215	* cr4_set_bits_and_update_boot() doesn't actually cause
209	* manually in start_secondary().	216	* the bits in question to remain set all the way through
210	*/	217	* the secondary boot asm.
211	cr4_set_bits(X86_CR4_PCIDE);	218	*
212	} else {	219	* Instead, we brute-force it and set CR4.PCIDE manually in
213	/*	220	* start_secondary().
214	* flush_tlb_all(), as currently implemented, won't	221	*/
215	* work if PCID is on but PGE is not. Since that	222	cr4_set_bits(X86_CR4_PCIDE);
216	* combination doesn't exist on real hardware, there's	223
217	* no reason to try to fully support it, but it's	224	/*
218	* polite to avoid corrupting data if we're on	225	* INVPCID's single-context modes (2/3) only work if we set
219	* an improperly configured VM.	226	* X86_CR4_PCIDE, and we INVPCID support. It's unusable
220	*/	227	* on systems that have X86_CR4_PCIDE clear, or that have
221	setup_clear_cpu_cap(X86_FEATURE_PCID);	228	* no INVPCID support at all.
222	}	229	*/
		230	if (boot_cpu_has(X86_FEATURE_INVPCID))
		231	setup_force_cpu_cap(X86_FEATURE_INVPCID_SINGLE);
		232	} else {
		233	/*
		234	* flush_tlb_all(), as currently implemented, won't work if
		235	* PCID is on but PGE is not. Since that combination
		236	* doesn't exist on real hardware, there's no reason to try
		237	* to fully support it, but it's polite to avoid corrupting
		238	* data if we're on an improperly configured VM.
		239	*/
		240	setup_clear_cpu_cap(X86_FEATURE_PCID);
223	}	241	}
224	#endif
225	}	242	}
226		243
227	#ifdef CONFIG_X86_32	244	#ifdef CONFIG_X86_32
@@ -622,6 +639,7 @@ void __init init_mem_mapping(void) · 394 unmodified lines
622	{	639	{
623	unsigned long end;	640	unsigned long end;
624		641
		642	pti_check_boottime_disable();
625	probe_page_size_mask();	643	probe_page_size_mask();
626	setup_pcid();	644	setup_pcid();
627		645
@@ -845,7 +863,7 @@ void __init zone_sizes_init(void) · 217 unmodified lines
845	free_area_init_nodes(max_zone_pfns);	863	free_area_init_nodes(max_zone_pfns);
846	}	864	}
847		865
848	DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = {	866	__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = {
849	.loaded_mm = &init_mm,	867	.loaded_mm = &init_mm,
850	.next_asid = 1,	868	.next_asid = 1,
851	.cr4 = ~0UL, /* fail hard if we screw up cr4 shadow initialization */	869	.cr4 = ~0UL, /* fail hard if we screw up cr4 shadow initialization */

arch/x86/mm/init_32.c+6−0

 #include <asm/setup.h>
 #include <asm/set_memory.h>
 #include <asm/page_types.h>
+#include <asm/cpu_entry_area.h>
 #include <asm/init.h>
 #include "mm_internal.h"
 	mem_init_print_info(NULL);
 	printk(KERN_INFO "virtual kernel memory layout:\n"
 		"    fixmap  : 0x%08lx - 0x%08lx   (%4ld kB)\n"
+		"  cpu_entry : 0x%08lx - 0x%08lx   (%4ld kB)\n"
 #ifdef CONFIG_HIGHMEM
 		"    pkmap   : 0x%08lx - 0x%08lx   (%4ld kB)\n"
 #endif
 		FIXADDR_START, FIXADDR_TOP,
 		(FIXADDR_TOP - FIXADDR_START) >> 10,
+		CPU_ENTRY_AREA_BASE,
+		CPU_ENTRY_AREA_BASE + CPU_ENTRY_AREA_MAP_SIZE,
+		CPU_ENTRY_AREA_MAP_SIZE >> 10,
 #ifdef CONFIG_HIGHMEM
 		PKMAP_BASE, PKMAP_BASE+LAST_PKMAP*PAGE_SIZE,
 		(LAST_PKMAP*PAGE_SIZE) >> 10,

arch/x86/mm/ioremap.c+2−2

 		return;
 	}
+	mmiotrace_iounmap(addr);
 	addr = (volatile void __iomem *)
 		(PAGE_MASK & (unsigned long __force)addr);
-	mmiotrace_iounmap(addr);
 	/* Use the vm area unlocked, assuming the caller
 	   ensures there isn't another iounmap for the same address
 	   in parallel. Reuse of the virtual address is prevented by

arch/x86/mm/kasan_init_64.c+21−2

 #include <asm/tlbflush.h>
 #include <asm/sections.h>
 #include <asm/pgtable.h>
+#include <asm/cpu_entry_area.h>
 extern struct range pfn_mapped[E820_MAX_ENTRIES];
 void __init kasan_init(void)
 {
 	int i;
+	void *shadow_cpu_entry_begin, *shadow_cpu_entry_end;
 #ifdef CONFIG_KASAN_INLINE
 	register_die_notifier(&kasan_die_notifier);
 		map_range(&pfn_mapped[i]);
 	}
+	shadow_cpu_entry_begin = (void *)CPU_ENTRY_AREA_BASE;
+	shadow_cpu_entry_begin = kasan_mem_to_shadow(shadow_cpu_entry_begin);
+	shadow_cpu_entry_begin = (void *)round_down((unsigned long)shadow_cpu_entry_begin,
+						PAGE_SIZE);
+	shadow_cpu_entry_end = (void *)(CPU_ENTRY_AREA_BASE +
+					CPU_ENTRY_AREA_MAP_SIZE);
+	shadow_cpu_entry_end = kasan_mem_to_shadow(shadow_cpu_entry_end);
+	shadow_cpu_entry_end = (void *)round_up((unsigned long)shadow_cpu_entry_end,
+					PAGE_SIZE);
 	kasan_populate_zero_shadow(
 		kasan_mem_to_shadow((void *)PAGE_OFFSET + MAXMEM),
-		kasan_mem_to_shadow((void *)__START_KERNEL_map));
+		shadow_cpu_entry_begin);
+	kasan_populate_shadow((unsigned long)shadow_cpu_entry_begin,
+			      (unsigned long)shadow_cpu_entry_end, 0);
+	kasan_populate_zero_shadow(shadow_cpu_entry_end,
+				kasan_mem_to_shadow((void *)__START_KERNEL_map));
 	kasan_populate_shadow((unsigned long)kasan_mem_to_shadow(_stext),
 			      (unsigned long)kasan_mem_to_shadow(_end),
 			      early_pfn_to_nid(__pa(_stext)));
 	kasan_populate_zero_shadow(kasan_mem_to_shadow((void *)MODULES_END),
-			(void *)KASAN_SHADOW_END);
+				(void *)KASAN_SHADOW_END);
 	load_cr3(init_top_pgt);
 	__flush_tlb_all();

arch/x86/mm/kmmio.c+7−5

 	unsigned long flags;
 	int ret = 0;
 	unsigned long size = 0;
+	unsigned long addr = p->addr & PAGE_MASK;
 	const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
 	unsigned int l;
 	pte_t *pte;
 	spin_lock_irqsave(&kmmio_lock, flags);
-	if (get_kmmio_probe(p->addr)) {
+	if (get_kmmio_probe(addr)) {
 		ret = -EEXIST;
 		goto out;
 	}
-	pte = lookup_address(p->addr, &l);
+	pte = lookup_address(addr, &l);
 	if (!pte) {
 		ret = -EINVAL;
 		goto out;
 	kmmio_count++;
 	list_add_rcu(&p->list, &kmmio_probes);
 	while (size < size_lim) {
-		if (add_kmmio_fault_page(p->addr + size))
+		if (add_kmmio_fault_page(addr + size))
 			pr_err("Unable to set page fault.\n");
 		size += page_level_size(l);
 	}
 {
 	unsigned long flags;
 	unsigned long size = 0;
+	unsigned long addr = p->addr & PAGE_MASK;
 	const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
 	struct kmmio_fault_page *release_list = NULL;
 	struct kmmio_delayed_release *drelease;
 	unsigned int l;
 	pte_t *pte;
-	pte = lookup_address(p->addr, &l);
+	pte = lookup_address(addr, &l);
 	if (!pte)
 		return;
 	spin_lock_irqsave(&kmmio_lock, flags);
 	while (size < size_lim) {
-		release_kmmio_fault_page(p->addr + size, &release_list);
+		release_kmmio_fault_page(addr + size, &release_list);
 		size += page_level_size(l);
 	}
 	list_del_rcu(&p->list);

arch/x86/mm/mem_encrypt.c+2−2

@@ -405,13 +405,13 @@ bool sme_active(void) · 404 unmodified lines
405	{	405	{
406	return sme_me_mask && !sev_enabled;	406	return sme_me_mask && !sev_enabled;
407	}	407	}
408	EXPORT_SYMBOL_GPL(sme_active);	408	EXPORT_SYMBOL(sme_active);
409		409
410	bool sev_active(void)	410	bool sev_active(void)
411	{	411	{
412	return sme_me_mask && sev_enabled;	412	return sme_me_mask && sev_enabled;
413	}	413	}
414	EXPORT_SYMBOL_GPL(sev_active);	414	EXPORT_SYMBOL(sev_active);
415		415
416	static const struct dma_map_ops sev_dma_ops = {	416	static const struct dma_map_ops sev_dma_ops = {
417	.alloc = sev_alloc,	417	.alloc = sev_alloc,

arch/x86/mm/pgtable.c+3−2

@@ -355,14 +355,15 @@ static inline void _pgd_free(pgd_t *pgd) · 354 unmodified lines
355	kmem_cache_free(pgd_cache, pgd);	355	kmem_cache_free(pgd_cache, pgd);
356	}	356	}
357	#else	357	#else
		358
358	static inline pgd_t *_pgd_alloc(void)	359	static inline pgd_t *_pgd_alloc(void)
359	{	360	{
360	return (pgd_t *)__get_free_page(PGALLOC_GFP);	361	return (pgd_t *)__get_free_pages(PGALLOC_GFP, PGD_ALLOCATION_ORDER);
361	}	362	}
362		363
363	static inline void _pgd_free(pgd_t *pgd)	364	static inline void _pgd_free(pgd_t *pgd)
364	{	365	{
365	free_page((unsigned long)pgd);	366	free_pages((unsigned long)pgd, PGD_ALLOCATION_ORDER);
366	}	367	}
367	#endif /* CONFIG_X86_PAE */	368	#endif /* CONFIG_X86_PAE */
368		369

arch/x86/mm/pgtable_32.c+1−0

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	#include <linux/pagemap.h>	10	#include <linux/pagemap.h>
11	#include <linux/spinlock.h>	11	#include <linux/spinlock.h>
12		12
		13	#include <asm/cpu_entry_area.h>
13	#include <asm/pgtable.h>	14	#include <asm/pgtable.h>
14	#include <asm/pgalloc.h>	15	#include <asm/pgalloc.h>
15	#include <asm/fixmap.h>	16	#include <asm/fixmap.h>

arch/x86/mm/pti.c+387−0

@@ -0,0 +1,387 @@
	1	/*
	2	* Copyright(c) 2017 Intel Corporation. All rights reserved.
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of version 2 of the GNU General Public License as
	6	* published by the Free Software Foundation.
	7	*
	8	* This program is distributed in the hope that it will be useful, but
	9	* WITHOUT ANY WARRANTY; without even the implied warranty of
	10	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	11	* General Public License for more details.
	12	*
	13	* This code is based in part on work published here:
	14	*
	15	* https://github.com/IAIK/KAISER
	16	*
	17	* The original work was written by and and signed off by for the Linux
	18	* kernel by:
	19	*
	20	* Signed-off-by: Richard Fellner <richard.fellner@student.tugraz.at>
	21	* Signed-off-by: Moritz Lipp <moritz.lipp@iaik.tugraz.at>
	22	* Signed-off-by: Daniel Gruss <daniel.gruss@iaik.tugraz.at>
	23	* Signed-off-by: Michael Schwarz <michael.schwarz@iaik.tugraz.at>
	24	*
	25	* Major changes to the original code by: Dave Hansen <dave.hansen@intel.com>
	26	* Mostly rewritten by Thomas Gleixner <tglx@linutronix.de> and
	27	* Andy Lutomirsky <luto@amacapital.net>
	28	*/
	29	#include <linux/kernel.h>
	30	#include <linux/errno.h>
	31	#include <linux/string.h>
	32	#include <linux/types.h>
	33	#include <linux/bug.h>
	34	#include <linux/init.h>
	35	#include <linux/spinlock.h>
	36	#include <linux/mm.h>
	37	#include <linux/uaccess.h>
	38
	39	#include <asm/cpufeature.h>
	40	#include <asm/hypervisor.h>
	41	#include <asm/vsyscall.h>
	42	#include <asm/cmdline.h>
	43	#include <asm/pti.h>
	44	#include <asm/pgtable.h>
	45	#include <asm/pgalloc.h>
	46	#include <asm/tlbflush.h>
	47	#include <asm/desc.h>
	48
	49	#undef pr_fmt
	50	#define pr_fmt(fmt) "Kernel/User page tables isolation: " fmt
	51
	52	/* Backporting helper */
	53	#ifndef __GFP_NOTRACK
	54	#define __GFP_NOTRACK 0
	55	#endif
	56
	57	static void __init pti_print_if_insecure(const char *reason)
	58	{
	59	if (boot_cpu_has_bug(X86_BUG_CPU_INSECURE))
	60	pr_info("%s\n", reason);
	61	}
	62
	63	static void __init pti_print_if_secure(const char *reason)
	64	{
	65	if (!boot_cpu_has_bug(X86_BUG_CPU_INSECURE))
	66	pr_info("%s\n", reason);
	67	}
	68
	69	void __init pti_check_boottime_disable(void)
	70	{
	71	char arg[5];
	72	int ret;
	73
	74	if (hypervisor_is_type(X86_HYPER_XEN_PV)) {
	75	pti_print_if_insecure("disabled on XEN PV.");
	76	return;
	77	}
	78
	79	ret = cmdline_find_option(boot_command_line, "pti", arg, sizeof(arg));
	80	if (ret > 0) {
	81	if (ret == 3 && !strncmp(arg, "off", 3)) {
	82	pti_print_if_insecure("disabled on command line.");
	83	return;
	84	}
	85	if (ret == 2 && !strncmp(arg, "on", 2)) {
	86	pti_print_if_secure("force enabled on command line.");
	87	goto enable;
	88	}
	89	if (ret == 4 && !strncmp(arg, "auto", 4))
	90	goto autosel;
	91	}
	92
	93	if (cmdline_find_option_bool(boot_command_line, "nopti")) {
	94	pti_print_if_insecure("disabled on command line.");
	95	return;
	96	}
	97
	98	autosel:
	99	if (!boot_cpu_has_bug(X86_BUG_CPU_INSECURE))
	100	return;
	101	enable:
	102	setup_force_cpu_cap(X86_FEATURE_PTI);
	103	}
	104
	105	pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
	106	{
	107	/*
	108	* Changes to the high (kernel) portion of the kernelmode page
	109	* tables are not automatically propagated to the usermode tables.
	110	*
	111	* Users should keep in mind that, unlike the kernelmode tables,
	112	* there is no vmalloc_fault equivalent for the usermode tables.
	113	* Top-level entries added to init_mm's usermode pgd after boot
	114	* will not be automatically propagated to other mms.
	115	*/
	116	if (!pgdp_maps_userspace(pgdp))
	117	return pgd;
	118
	119	/*
	120	* The user page tables get the full PGD, accessible from
	121	* userspace:
	122	*/
	123	kernel_to_user_pgdp(pgdp)->pgd = pgd.pgd;
	124
	125	/*
	126	* If this is normal user memory, make it NX in the kernel
	127	* pagetables so that, if we somehow screw up and return to
	128	* usermode with the kernel CR3 loaded, we'll get a page fault
	129	* instead of allowing user code to execute with the wrong CR3.
	130	*
	131	* As exceptions, we don't set NX if:
	132	* - _PAGE_USER is not set. This could be an executable
	133	* EFI runtime mapping or something similar, and the kernel
	134	* may execute from it
	135	* - we don't have NX support
	136	* - we're clearing the PGD (i.e. the new pgd is not present).
	137	*/
	138	if ((pgd.pgd & (_PAGE_USER\|_PAGE_PRESENT)) == (_PAGE_USER\|_PAGE_PRESENT) &&
	139	(__supported_pte_mask & _PAGE_NX))
	140	pgd.pgd \|= _PAGE_NX;
	141
	142	/* return the copy of the PGD we want the kernel to use: */
	143	return pgd;
	144	}
	145
	146	/*
	147	* Walk the user copy of the page tables (optionally) trying to allocate
	148	* page table pages on the way down.
	149	*
	150	* Returns a pointer to a P4D on success, or NULL on failure.
	151	*/
	152	static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
	153	{
	154	pgd_t *pgd = kernel_to_user_pgdp(pgd_offset_k(address));
	155	gfp_t gfp = (GFP_KERNEL \| __GFP_NOTRACK \| __GFP_ZERO);
	156
	157	if (address < PAGE_OFFSET) {
	158	WARN_ONCE(1, "attempt to walk user address\n");
	159	return NULL;
	160	}
	161
	162	if (pgd_none(*pgd)) {
	163	unsigned long new_p4d_page = __get_free_page(gfp);
	164	if (!new_p4d_page)
	165	return NULL;
	166
	167	if (pgd_none(*pgd)) {
	168	set_pgd(pgd, __pgd(_KERNPG_TABLE \| __pa(new_p4d_page)));
	169	new_p4d_page = 0;
	170	}
	171	if (new_p4d_page)
	172	free_page(new_p4d_page);
	173	}
	174	BUILD_BUG_ON(pgd_large(*pgd) != 0);
	175
	176	return p4d_offset(pgd, address);
	177	}
	178
	179	/*
	180	* Walk the user copy of the page tables (optionally) trying to allocate
	181	* page table pages on the way down.
	182	*
	183	* Returns a pointer to a PMD on success, or NULL on failure.
	184	*/
	185	static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
	186	{
	187	gfp_t gfp = (GFP_KERNEL \| __GFP_NOTRACK \| __GFP_ZERO);
	188	p4d_t *p4d = pti_user_pagetable_walk_p4d(address);
	189	pud_t *pud;
	190
	191	BUILD_BUG_ON(p4d_large(*p4d) != 0);
	192	if (p4d_none(*p4d)) {
	193	unsigned long new_pud_page = __get_free_page(gfp);
	194	if (!new_pud_page)
	195	return NULL;
	196
	197	if (p4d_none(*p4d)) {
	198	set_p4d(p4d, __p4d(_KERNPG_TABLE \| __pa(new_pud_page)));
	199	new_pud_page = 0;
	200	}
	201	if (new_pud_page)
	202	free_page(new_pud_page);
	203	}
	204
	205	pud = pud_offset(p4d, address);
	206	/* The user page tables do not use large mappings: */
	207	if (pud_large(*pud)) {
	208	WARN_ON(1);
	209	return NULL;
	210	}
	211	if (pud_none(*pud)) {
	212	unsigned long new_pmd_page = __get_free_page(gfp);
	213	if (!new_pmd_page)
	214	return NULL;
	215
	216	if (pud_none(*pud)) {
	217	set_pud(pud, __pud(_KERNPG_TABLE \| __pa(new_pmd_page)));
	218	new_pmd_page = 0;
	219	}
	220	if (new_pmd_page)
	221	free_page(new_pmd_page);
	222	}
	223
	224	return pmd_offset(pud, address);
	225	}
	226
	227	#ifdef CONFIG_X86_VSYSCALL_EMULATION
	228	/*
	229	* Walk the shadow copy of the page tables (optionally) trying to allocate
	230	* page table pages on the way down. Does not support large pages.
	231	*
	232	* Note: this is only used when mapping new kernel data into the
	233	* user/shadow page tables. It is never used for userspace data.
	234	*
	235	* Returns a pointer to a PTE on success, or NULL on failure.
	236	*/
	237	static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
	238	{
	239	gfp_t gfp = (GFP_KERNEL \| __GFP_NOTRACK \| __GFP_ZERO);
	240	pmd_t *pmd = pti_user_pagetable_walk_pmd(address);
	241	pte_t *pte;
	242
	243	/* We can't do anything sensible if we hit a large mapping. */
	244	if (pmd_large(*pmd)) {
	245	WARN_ON(1);
	246	return NULL;
	247	}
	248
	249	if (pmd_none(*pmd)) {
	250	unsigned long new_pte_page = __get_free_page(gfp);
	251	if (!new_pte_page)
	252	return NULL;
	253
	254	if (pmd_none(*pmd)) {
	255	set_pmd(pmd, __pmd(_KERNPG_TABLE \| __pa(new_pte_page)));
	256	new_pte_page = 0;
	257	}
	258	if (new_pte_page)
	259	free_page(new_pte_page);
	260	}
	261
	262	pte = pte_offset_kernel(pmd, address);
	263	if (pte_flags(*pte) & _PAGE_USER) {
	264	WARN_ONCE(1, "attempt to walk to user pte\n");
	265	return NULL;
	266	}
	267	return pte;
	268	}
	269
	270	static void __init pti_setup_vsyscall(void)
	271	{
	272	pte_t pte, target_pte;
	273	unsigned int level;
	274
	275	pte = lookup_address(VSYSCALL_ADDR, &level);
	276	if (!pte \|\| WARN_ON(level != PG_LEVEL_4K) \|\| pte_none(*pte))
	277	return;
	278
	279	target_pte = pti_user_pagetable_walk_pte(VSYSCALL_ADDR);
	280	if (WARN_ON(!target_pte))
	281	return;
	282
	283	target_pte = pte;
	284	set_vsyscall_pgtable_user_bits(kernel_to_user_pgdp(swapper_pg_dir));
	285	}
	286	#else
	287	static void __init pti_setup_vsyscall(void) { }
	288	#endif
	289
	290	static void __init
	291	pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear)
	292	{
	293	unsigned long addr;
	294
	295	/*
	296	* Clone the populated PMDs which cover start to end. These PMD areas
	297	* can have holes.
	298	*/
	299	for (addr = start; addr < end; addr += PMD_SIZE) {
	300	pmd_t pmd, target_pmd;
	301	pgd_t *pgd;
	302	p4d_t *p4d;
	303	pud_t *pud;
	304
	305	pgd = pgd_offset_k(addr);
	306	if (WARN_ON(pgd_none(*pgd)))
	307	return;
	308	p4d = p4d_offset(pgd, addr);
	309	if (WARN_ON(p4d_none(*p4d)))
	310	return;
	311	pud = pud_offset(p4d, addr);
	312	if (pud_none(*pud))
	313	continue;
	314	pmd = pmd_offset(pud, addr);
	315	if (pmd_none(*pmd))
	316	continue;
	317
	318	target_pmd = pti_user_pagetable_walk_pmd(addr);
	319	if (WARN_ON(!target_pmd))
	320	return;
	321
	322	/*
	323	* Copy the PMD. That is, the kernelmode and usermode
	324	* tables will share the last-level page tables of this
	325	* address range
	326	*/
	327	target_pmd = pmd_clear_flags(pmd, clear);
	328	}
	329	}
	330
	331	/*
	332	* Clone a single p4d (i.e. a top-level entry on 4-level systems and a
	333	* next-level entry on 5-level systems.
	334	*/
	335	static void __init pti_clone_p4d(unsigned long addr)
	336	{
	337	p4d_t kernel_p4d, user_p4d;
	338	pgd_t *kernel_pgd;
	339
	340	user_p4d = pti_user_pagetable_walk_p4d(addr);
	341	kernel_pgd = pgd_offset_k(addr);
	342	kernel_p4d = p4d_offset(kernel_pgd, addr);
	343	user_p4d = kernel_p4d;
	344	}
	345
	346	/*
	347	* Clone the CPU_ENTRY_AREA into the user space visible page table.
	348	*/
	349	static void __init pti_clone_user_shared(void)
	350	{
	351	pti_clone_p4d(CPU_ENTRY_AREA_BASE);
	352	}
	353
	354	/*
	355	* Clone the ESPFIX P4D into the user space visinble page table
	356	*/
	357	static void __init pti_setup_espfix64(void)
	358	{
	359	#ifdef CONFIG_X86_ESPFIX64
	360	pti_clone_p4d(ESPFIX_BASE_ADDR);
	361	#endif
	362	}
	363
	364	/*
	365	* Clone the populated PMDs of the entry and irqentry text and force it RO.
	366	*/
	367	static void __init pti_clone_entry_text(void)
	368	{
	369	pti_clone_pmds((unsigned long) __entry_text_start,
	370	(unsigned long) __irqentry_text_end, _PAGE_RW);
	371	}
	372
	373	/*
	374	* Initialize kernel page table isolation
	375	*/
	376	void __init pti_init(void)
	377	{
	378	if (!static_cpu_has(X86_FEATURE_PTI))
	379	return;
	380
	381	pr_info("enabled\n");
	382
	383	pti_clone_user_shared();
	384	pti_clone_entry_text();
	385	pti_setup_espfix64();
	386	pti_setup_vsyscall();
	387	}

arch/x86/mm/tlb.c+59−5

@@ -28,6 +28,38 @@ · 27 unmodified lines
28	* Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi	28	* Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi
29	*/	29	*/
30		30
		31	/*
		32	* We get here when we do something requiring a TLB invalidation
		33	* but could not go invalidate all of the contexts. We do the
		34	* necessary invalidation by clearing out the 'ctx_id' which
		35	* forces a TLB flush when the context is loaded.
		36	*/
		37	void clear_asid_other(void)
		38	{
		39	u16 asid;
		40
		41	/*
		42	* This is only expected to be set if we have disabled
		43	* kernel _PAGE_GLOBAL pages.
		44	*/
		45	if (!static_cpu_has(X86_FEATURE_PTI)) {
		46	WARN_ON_ONCE(1);
		47	return;
		48	}
		49
		50	for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) {
		51	/* Do not need to flush the current asid */
		52	if (asid == this_cpu_read(cpu_tlbstate.loaded_mm_asid))
		53	continue;
		54	/*
		55	* Make sure the next time we go to switch to
		56	* this asid, we do a flush:
		57	*/
		58	this_cpu_write(cpu_tlbstate.ctxs[asid].ctx_id, 0);
		59	}
		60	this_cpu_write(cpu_tlbstate.invalidate_other, false);
		61	}
		62
31	atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1);	63	atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1);
32		64
33		65
@@ -42,6 +74,9 @@ static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen, · 8 unmodified lines
42	return;	74	return;
43	}	75	}
44		76
		77	if (this_cpu_read(cpu_tlbstate.invalidate_other))
		78	clear_asid_other();
		79
45	for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) {	80	for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) {
46	if (this_cpu_read(cpu_tlbstate.ctxs[asid].ctx_id) !=	81	if (this_cpu_read(cpu_tlbstate.ctxs[asid].ctx_id) !=
47	next->context.ctx_id)	82	next->context.ctx_id)
@@ -65,6 +100,25 @@ static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen, · 17 unmodified lines
65	*need_flush = true;	100	*need_flush = true;
66	}	101	}
67		102
		103	static void load_new_mm_cr3(pgd_t *pgdir, u16 new_asid, bool need_flush)
		104	{
		105	unsigned long new_mm_cr3;
		106
		107	if (need_flush) {
		108	invalidate_user_asid(new_asid);
		109	new_mm_cr3 = build_cr3(pgdir, new_asid);
		110	} else {
		111	new_mm_cr3 = build_cr3_noflush(pgdir, new_asid);
		112	}
		113
		114	/*
		115	* Caution: many callers of this function expect
		116	* that load_cr3() is serializing and orders TLB
		117	* fills with respect to the mm_cpumask writes.
		118	*/
		119	write_cr3(new_mm_cr3);
		120	}
		121
68	void leave_mm(int cpu)	122	void leave_mm(int cpu)
69	{	123	{
70	struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);	124	struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
@@ -128,7 +182,7 @@ void switch_mm_irqs_off(struct mm_struct prev, struct mm_struct next, · 57 unmodified lines
128	* isn't free.	182	* isn't free.
129	*/	183	*/
130	#ifdef CONFIG_DEBUG_VM	184	#ifdef CONFIG_DEBUG_VM
131	if (WARN_ON_ONCE(__read_cr3() != build_cr3(real_prev, prev_asid))) {	185	if (WARN_ON_ONCE(__read_cr3() != build_cr3(real_prev->pgd, prev_asid))) {
132	/*	186	/*
133	* If we were to BUG here, we'd be very likely to kill	187	* If we were to BUG here, we'd be very likely to kill
134	* the system so hard that we don't see the call trace.	188	* the system so hard that we don't see the call trace.
@@ -195,7 +249,7 @@ void switch_mm_irqs_off(struct mm_struct prev, struct mm_struct next, · 60 unmodified lines
195	if (need_flush) {	249	if (need_flush) {
196	this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);	250	this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
197	this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);	251	this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
198	write_cr3(build_cr3(next, new_asid));	252	load_new_mm_cr3(next->pgd, new_asid, true);
199		253
200	/*	254	/*
201	* NB: This gets called via leave_mm() in the idle path	255	* NB: This gets called via leave_mm() in the idle path
@@ -208,7 +262,7 @@ void switch_mm_irqs_off(struct mm_struct prev, struct mm_struct next, · 6 unmodified lines
208	trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);	262	trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
209	} else {	263	} else {
210	/* The new ASID is already up to date. */	264	/* The new ASID is already up to date. */
211	write_cr3(build_cr3_noflush(next, new_asid));	265	load_new_mm_cr3(next->pgd, new_asid, false);
212		266
213	/* See above wrt _rcuidle. */	267	/* See above wrt _rcuidle. */
214	trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);	268	trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
@@ -288,7 +342,7 @@ void initialize_tlbstate_and_flush(void) · 73 unmodified lines
288	!(cr4_read_shadow() & X86_CR4_PCIDE));	342	!(cr4_read_shadow() & X86_CR4_PCIDE));
289		343
290	/* Force ASID 0 and force a TLB flush. */	344	/* Force ASID 0 and force a TLB flush. */
291	write_cr3(build_cr3(mm, 0));	345	write_cr3(build_cr3(mm->pgd, 0));
292		346
293	/* Reinitialize tlbstate. */	347	/* Reinitialize tlbstate. */
294	this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);	348	this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
@@ -551,7 +605,7 @@ static void do_kernel_range_flush(void *info) · 256 unmodified lines
551		605
552	/* flush range by one by one 'invlpg' */	606	/* flush range by one by one 'invlpg' */
553	for (addr = f->start; addr < f->end; addr += PAGE_SIZE)	607	for (addr = f->start; addr < f->end; addr += PAGE_SIZE)
554	__flush_tlb_single(addr);	608	__flush_tlb_one(addr);
555	}	609	}
556		610
557	void flush_tlb_kernel_range(unsigned long start, unsigned long end)	611	void flush_tlb_kernel_range(unsigned long start, unsigned long end)

arch/x86/pci/fixup.c+21−6

 	unsigned i;
 	u32 base, limit, high;
 	struct resource *res, *conflict;
+	struct pci_dev *other;
+	/* Check that we are the only device of that type */
+	other = pci_get_device(dev->vendor, dev->device, NULL);
+	if (other != dev ||
+	    (other = pci_get_device(dev->vendor, dev->device, other))) {
+		/* This is a multi-socket system, don't touch it for now */
+		pci_dev_put(other);
+		return;
+	}
 	for (i = 0; i < 8; i++) {
 		pci_read_config_dword(dev, AMD_141b_MMIO_BASE(i), &base);
 	res->end = 0xfd00000000ull - 1;
 	/* Just grab the free area behind system memory for this */
-	while ((conflict = request_resource_conflict(&iomem_resource, res)))
+	while ((conflict = request_resource_conflict(&iomem_resource, res))) {
+		if (conflict->end >= res->end) {
+			kfree(res);
+			return;
+		}
 		res->start = conflict->end + 1;
+	}
 	dev_info(&dev->dev, "adding root bus resource %pR\n", res);
 	pci_bus_add_resource(dev->bus, res, 0);
 }
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
 #endif

arch/x86/platform/efi/efi_64.c+4−1

  * because we want to avoid inserting EFI region mappings (EFI_VA_END
  * to EFI_VA_START) into the standard kernel page tables. Everything
  * else can be shared, see efi_sync_low_kernel_mappings().
+ *
+ * We don't want the pgd on the pgd_list and cannot use pgd_alloc() for the
+ * allocation.
  */
 int __init efi_alloc_page_tables(void)
 {
 		return 0;
 	gfp_mask = GFP_KERNEL | __GFP_ZERO;
-	efi_pgd = (pgd_t *)__get_free_page(gfp_mask);
+	efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
 	if (!efi_pgd)
 		return -ENOMEM;

arch/x86/platform/uv/tlb_uv.c+1−1

@@ -299,7 +299,7 @@ static void bau_process_message(struct msg_desc mdp, struct bau_control bcp, · 298 unmodified lines
299	local_flush_tlb();	299	local_flush_tlb();
300	stat->d_alltlb++;	300	stat->d_alltlb++;
301	} else {	301	} else {
302	__flush_tlb_one(msg->address);	302	__flush_tlb_single(msg->address);
303	stat->d_onetlb++;	303	stat->d_onetlb++;
304	}	304	}
305	stat->d_requestee++;	305	stat->d_requestee++;

arch/x86/platform/uv/uv_irq.c+1−1

@@ -128,7 +128,7 @@ static void uv_domain_free(struct irq_domain *domain, unsigned int virq, · 127 unmodified lines
128	* on the specified blade to allow the sending of MSIs to the specified CPU.	128	* on the specified blade to allow the sending of MSIs to the specified CPU.
129	*/	129	*/
130	static int uv_domain_activate(struct irq_domain *domain,	130	static int uv_domain_activate(struct irq_domain *domain,
131	struct irq_data *irq_data, bool early)	131	struct irq_data *irq_data, bool reserve)
132	{	132	{
133	uv_program_mmr(irqd_cfg(irq_data), irq_data->chip_data);	133	uv_program_mmr(irqd_cfg(irq_data), irq_data->chip_data);
134	return 0;	134	return 0;

arch/x86/power/cpu.c+54−61

@@ -82,12 +82,8 @@ static void __save_processor_state(struct saved_context *ctxt) · 81 unmodified lines
82	/*	82	/*
83	* descriptor tables	83	* descriptor tables
84	*/	84	*/
85	#ifdef CONFIG_X86_32
86	store_idt(&ctxt->idt);	85	store_idt(&ctxt->idt);
87	#else	86
88	/* CONFIG_X86_64 */
89	store_idt((struct desc_ptr *)&ctxt->idt_limit);
90	#endif
91	/*	87	/*
92	* We save it here, but restore it only in the hibernate case.	88	* We save it here, but restore it only in the hibernate case.
93	* For ACPI S3 resume, this is loaded via 'early_gdt_desc' in 64-bit	89	* For ACPI S3 resume, this is loaded via 'early_gdt_desc' in 64-bit
@@ -103,22 +99,18 @@ static void __save_processor_state(struct saved_context *ctxt) · 9 unmodified lines
103	/*	99	/*
104	* segment registers	100	* segment registers
105	*/	101	*/
106	#ifdef CONFIG_X86_32	102	#ifdef CONFIG_X86_32_LAZY_GS
107	savesegment(es, ctxt->es);
108	savesegment(fs, ctxt->fs);
109	savesegment(gs, ctxt->gs);	103	savesegment(gs, ctxt->gs);
110	savesegment(ss, ctxt->ss);	104	#endif
111	#else	105	#ifdef CONFIG_X86_64
112	/* CONFIG_X86_64 */	106	savesegment(gs, ctxt->gs);
113	asm volatile ("movw %%ds, %0" : "=m" (ctxt->ds));	107	savesegment(fs, ctxt->fs);
114	asm volatile ("movw %%es, %0" : "=m" (ctxt->es));	108	savesegment(ds, ctxt->ds);
115	asm volatile ("movw %%fs, %0" : "=m" (ctxt->fs));	109	savesegment(es, ctxt->es);
116	asm volatile ("movw %%gs, %0" : "=m" (ctxt->gs));
117	asm volatile ("movw %%ss, %0" : "=m" (ctxt->ss));
118		110
119	rdmsrl(MSR_FS_BASE, ctxt->fs_base);	111	rdmsrl(MSR_FS_BASE, ctxt->fs_base);
120	rdmsrl(MSR_GS_BASE, ctxt->gs_base);	112	rdmsrl(MSR_GS_BASE, ctxt->kernelmode_gs_base);
121	rdmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base);	113	rdmsrl(MSR_KERNEL_GS_BASE, ctxt->usermode_gs_base);
122	mtrr_save_fixed_ranges(NULL);	114	mtrr_save_fixed_ranges(NULL);
123		115
124	rdmsrl(MSR_EFER, ctxt->efer);	116	rdmsrl(MSR_EFER, ctxt->efer);
@@ -160,17 +152,19 @@ static void do_fpu_end(void) · 35 unmodified lines
160	static void fix_processor_context(void)	152	static void fix_processor_context(void)
161	{	153	{
162	int cpu = smp_processor_id();	154	int cpu = smp_processor_id();
163	struct tss_struct *t = &per_cpu(cpu_tss, cpu);
164	#ifdef CONFIG_X86_64	155	#ifdef CONFIG_X86_64
165	struct desc_struct *desc = get_cpu_gdt_rw(cpu);	156	struct desc_struct *desc = get_cpu_gdt_rw(cpu);
166	tss_desc tss;	157	tss_desc tss;
167	#endif	158	#endif
168	set_tss_desc(cpu, t); /*	159
169	* This just modifies memory; should not be	160	/*
170	* necessary. But... This is necessary, because	161	* We need to reload TR, which requires that we change the
171	* 386 hardware has concept of busy TSS or some	162	* GDT entry to indicate "available" first.
172	* similar stupidity.	163	*
173	*/	164	* XXX: This could probably all be replaced by a call to
		165	* force_reload_TR().
		166	*/
		167	set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
174		168
175	#ifdef CONFIG_X86_64	169	#ifdef CONFIG_X86_64
176	memcpy(&tss, &desc[GDT_ENTRY_TSS], sizeof(tss_desc));	170	memcpy(&tss, &desc[GDT_ENTRY_TSS], sizeof(tss_desc));
@@ -178,6 +172,9 @@ static void fix_processor_context(void) · 1 unmodified line
178	write_gdt_entry(desc, GDT_ENTRY_TSS, &tss, DESC_TSS);	172	write_gdt_entry(desc, GDT_ENTRY_TSS, &tss, DESC_TSS);
179		173
180	syscall_init(); /* This sets MSR_STAR and related /	174	syscall_init(); /* This sets MSR_STAR and related /
		175	#else
		176	if (boot_cpu_has(X86_FEATURE_SEP))
		177	enable_sep_cpu();
181	#endif	178	#endif
182	load_TR_desc(); /* This does ltr */	179	load_TR_desc(); /* This does ltr */
183	load_mm_ldt(current->active_mm); /* This does lldt */	180	load_mm_ldt(current->active_mm); /* This does lldt */
@@ -190,9 +187,12 @@ static void fix_processor_context(void) · 6 unmodified lines
190	}	187	}
191		188
192	/**	189	/**
193	* __restore_processor_state - restore the contents of CPU registers saved	190	* __restore_processor_state - restore the contents of CPU registers saved
194	* by __save_processor_state()	191	* by __save_processor_state()
195	* @ctxt - structure to load the registers contents from	192	* @ctxt - structure to load the registers contents from
		193	*
		194	* The asm code that gets us here will have restored a usable GDT, although
		195	* it will be pointing to the wrong alias.
196	*/	196	*/
197	static void notrace __restore_processor_state(struct saved_context *ctxt)	197	static void notrace __restore_processor_state(struct saved_context *ctxt)
198	{	198	{
@@ -215,57 +215,50 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) · 16 unmodified lines
215	write_cr2(ctxt->cr2);	215	write_cr2(ctxt->cr2);
216	write_cr0(ctxt->cr0);	216	write_cr0(ctxt->cr0);
217		217
		218	/* Restore the IDT. */
		219	load_idt(&ctxt->idt);
		220
218	/*	221	/*
219	* now restore the descriptor tables to their proper values	222	* Just in case the asm code got us here with the SS, DS, or ES
220	* ltr is done i fix_processor_context().	223	* out of sync with the GDT, update them.
221	*/	224	*/
222	#ifdef CONFIG_X86_32	225	loadsegment(ss, __KERNEL_DS);
223	load_idt(&ctxt->idt);	226	loadsegment(ds, __USER_DS);
224	#else	227	loadsegment(es, __USER_DS);
225	/* CONFIG_X86_64 */
226	load_idt((const struct desc_ptr *)&ctxt->idt_limit);
227	#endif
228		228
229	#ifdef CONFIG_X86_64
230	/*	229	/*
231	* We need GSBASE restored before percpu access can work.	230	* Restore percpu access. Percpu access can happen in exception
232	* percpu access can happen in exception handlers or in complicated	231	* handlers or in complicated helpers like load_gs_index().
233	* helpers like load_gs_index().
234	*/	232	*/
235	wrmsrl(MSR_GS_BASE, ctxt->gs_base);	233	#ifdef CONFIG_X86_64
		234	wrmsrl(MSR_GS_BASE, ctxt->kernelmode_gs_base);
		235	#else
		236	loadsegment(fs, __KERNEL_PERCPU);
		237	loadsegment(gs, __KERNEL_STACK_CANARY);
236	#endif	238	#endif
237		239
		240	/* Restore the TSS, RO GDT, LDT, and usermode-relevant MSRs. */
238	fix_processor_context();	241	fix_processor_context();
239		242
240	/*	243	/*
241	* Restore segment registers. This happens after restoring the GDT	244	* Now that we have descriptor tables fully restored and working
242	* and LDT, which happen in fix_processor_context().	245	* exception handling, restore the usermode segments.
243	*/	246	*/
244	#ifdef CONFIG_X86_32	247	#ifdef CONFIG_X86_64
		248	loadsegment(ds, ctxt->es);
245	loadsegment(es, ctxt->es);	249	loadsegment(es, ctxt->es);
246	loadsegment(fs, ctxt->fs);	250	loadsegment(fs, ctxt->fs);
247	loadsegment(gs, ctxt->gs);
248	loadsegment(ss, ctxt->ss);
249
250	/*
251	* sysenter MSRs
252	*/
253	if (boot_cpu_has(X86_FEATURE_SEP))
254	enable_sep_cpu();
255	#else
256	/* CONFIG_X86_64 */
257	asm volatile ("movw %0, %%ds" :: "r" (ctxt->ds));
258	asm volatile ("movw %0, %%es" :: "r" (ctxt->es));
259	asm volatile ("movw %0, %%fs" :: "r" (ctxt->fs));
260	load_gs_index(ctxt->gs);	251	load_gs_index(ctxt->gs);
261	asm volatile ("movw %0, %%ss" :: "r" (ctxt->ss));
262		252
263	/*	253	/*
264	* Restore FSBASE and user GSBASE after reloading the respective	254	* Restore FSBASE and GSBASE after restoring the selectors, since
265	* segment selectors.	255	* restoring the selectors clobbers the bases. Keep in mind
		256	* that MSR_KERNEL_GS_BASE is horribly misnamed.
266	*/	257	*/
267	wrmsrl(MSR_FS_BASE, ctxt->fs_base);	258	wrmsrl(MSR_FS_BASE, ctxt->fs_base);
268	wrmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base);	259	wrmsrl(MSR_KERNEL_GS_BASE, ctxt->usermode_gs_base);
		260	#elif defined(CONFIG_X86_32_LAZY_GS)
		261	loadsegment(gs, ctxt->gs);
269	#endif	262	#endif
270		263
271	do_fpu_end();	264	do_fpu_end();

arch/x86/xen/apic.c+1−1

@@ -57,7 +57,7 @@ static u32 xen_apic_read(u32 reg) · 56 unmodified lines
57	return 0;	57	return 0;
58		58
59	if (reg == APIC_LVR)	59	if (reg == APIC_LVR)
60	return 0x10;	60	return 0x14;
61	#ifdef CONFIG_X86_32	61	#ifdef CONFIG_X86_32
62	if (reg == APIC_LDR)	62	if (reg == APIC_LDR)
63	return SET_APIC_LOGICAL_ID(1UL << smp_processor_id());	63	return SET_APIC_LOGICAL_ID(1UL << smp_processor_id());

arch/x86/xen/enlighten.c+81−0

@@ -1,8 +1,12 @@
		1	#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
		2	#include <linux/bootmem.h>
		3	#endif
1	#include <linux/cpu.h>	4	#include <linux/cpu.h>
2	#include <linux/kexec.h>	5	#include <linux/kexec.h>
3		6
4	#include <xen/features.h>	7	#include <xen/features.h>
5	#include <xen/page.h>	8	#include <xen/page.h>
		9	#include <xen/interface/memory.h>
6		10
7	#include <asm/xen/hypercall.h>	11	#include <asm/xen/hypercall.h>
8	#include <asm/xen/hypervisor.h>	12	#include <asm/xen/hypervisor.h>
@@ -331,3 +335,80 @@ void xen_arch_unregister_cpu(int num) · 322 unmodified lines
331	}	335	}
332	EXPORT_SYMBOL(xen_arch_unregister_cpu);	336	EXPORT_SYMBOL(xen_arch_unregister_cpu);
333	#endif	337	#endif
		338
		339	#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
		340	void __init arch_xen_balloon_init(struct resource *hostmem_resource)
		341	{
		342	struct xen_memory_map memmap;
		343	int rc;
		344	unsigned int i, last_guest_ram;
		345	phys_addr_t max_addr = PFN_PHYS(max_pfn);
		346	struct e820_table *xen_e820_table;
		347	const struct e820_entry *entry;
		348	struct resource *res;
		349
		350	if (!xen_initial_domain())
		351	return;
		352
		353	xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
		354	if (!xen_e820_table)
		355	return;
		356
		357	memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
		358	set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
		359	rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
		360	if (rc) {
		361	pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
		362	goto out;
		363	}
		364
		365	last_guest_ram = 0;
		366	for (i = 0; i < memmap.nr_entries; i++) {
		367	if (xen_e820_table->entries[i].addr >= max_addr)
		368	break;
		369	if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
		370	last_guest_ram = i;
		371	}
		372
		373	entry = &xen_e820_table->entries[last_guest_ram];
		374	if (max_addr >= entry->addr + entry->size)
		375	goto out; /* No unallocated host RAM. */
		376
		377	hostmem_resource->start = max_addr;
		378	hostmem_resource->end = entry->addr + entry->size;
		379
		380	/*
		381	* Mark non-RAM regions between the end of dom0 RAM and end of host RAM
		382	* as unavailable. The rest of that region can be used for hotplug-based
		383	* ballooning.
		384	*/
		385	for (; i < memmap.nr_entries; i++) {
		386	entry = &xen_e820_table->entries[i];
		387
		388	if (entry->type == E820_TYPE_RAM)
		389	continue;
		390
		391	if (entry->addr >= hostmem_resource->end)
		392	break;
		393
		394	res = kzalloc(sizeof(*res), GFP_KERNEL);
		395	if (!res)
		396	goto out;
		397
		398	res->name = "Unavailable host RAM";
		399	res->start = entry->addr;
		400	res->end = (entry->addr + entry->size < hostmem_resource->end) ?
		401	entry->addr + entry->size : hostmem_resource->end;
		402	rc = insert_resource(hostmem_resource, res);
		403	if (rc) {
		404	pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
		405	__func__, res->start, res->end, rc);
		406	kfree(res);
		407	goto out;
		408	}
		409	}
		410
		411	out:
		412	kfree(xen_e820_table);
		413	}
		414	#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */

arch/x86/xen/enlighten_pv.c+4−1

 #include "multicalls.h"
 #include "pmu.h"
+#include "../kernel/cpu/cpu.h" /* get_cpu_cap() */
 void *xen_initial_gdt;
 static int xen_cpu_up_prepare_pv(unsigned int cpu);
 	mcs = xen_mc_entry(0);
 	MULTI_stack_switch(mcs.mc, __KERNEL_DS, sp0);
 	xen_mc_issue(PARAVIRT_LAZY_CPU);
-	this_cpu_write(cpu_tss.x86_tss.sp0, sp0);
+	this_cpu_write(cpu_tss_rw.x86_tss.sp0, sp0);
 }
 void xen_set_iopl_mask(unsigned mask)
 	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
 	/* Work out if we support NX */
+	get_cpu_cap(&boot_cpu_data);
 	x86_configure_nx();
 	/* Get mfn list */

arch/x86/xen/mmu_pv.c+12−2

 	/* Graft it onto L4[511][510] */
 	copy_page(level2_kernel_pgt, l2);
+	/*
+	 * Zap execute permission from the ident map. Due to the sharing of
+	 * L1 entries we need to do this in the L2.
+	 */
+	if (__supported_pte_mask & _PAGE_NX) {
+		for (i = 0; i < PTRS_PER_PMD; ++i) {
+			if (pmd_none(level2_ident_pgt[i]))
+				continue;
+			level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i], _PAGE_NX);
+		}
+	}
 	/* Copy the initial P->M table mappings if necessary. */
 	i = pgd_index(xen_start_info->mfn_list);
 	if (i && i < pgd_index(__START_KERNEL_map))
 	switch (idx) {
 	case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
-	case FIX_RO_IDT:
 #ifdef CONFIG_X86_32
 	case FIX_WP_TEST:
 # ifdef CONFIG_HIGHMEM
 #endif
 	case FIX_TEXT_POKE0:
 	case FIX_TEXT_POKE1:
-	case FIX_GDT_REMAP_BEGIN ... FIX_GDT_REMAP_END:
 		/* All local page mappings */
 		pte = pfn_pte(phys, prot);
 		break;

arch/x86/xen/setup.c+2−4

 	addr = xen_e820_table.entries[0].addr;
 	size = xen_e820_table.entries[0].size;
 	while (i < xen_e820_table.nr_entries) {
-		bool discard = false;
 		chunk_size = size;
 		type = xen_e820_table.entries[i].type;
 				xen_add_extra_mem(pfn_s, n_pfns);
 				xen_max_p2m_pfn = pfn_s + n_pfns;
 			} else
-				discard = true;
+				type = E820_TYPE_UNUSABLE;
 		}
-		if (!discard)
+		xen_align_and_add_e820_region(addr, chunk_size, type);
-			xen_align_and_add_e820_region(addr, chunk_size, type);
 		addr += chunk_size;
 		size -= chunk_size;

block/bio.c+2−0

 	bio->bi_disk = bio_src->bi_disk;
 	bio->bi_partno = bio_src->bi_partno;
 	bio_set_flag(bio, BIO_CLONED);
+	if (bio_flagged(bio_src, BIO_THROTTLED))
+		bio_set_flag(bio, BIO_THROTTLED);
 	bio->bi_opf = bio_src->bi_opf;
 	bio->bi_write_hint = bio_src->bi_write_hint;
 	bio->bi_iter = bio_src->bi_iter;

block/blk-map.c+22−16

 #include "blk.h"
 /*
- * Append a bio to a passthrough request.  Only works can be merged into
+ * Append a bio to a passthrough request.  Only works if the bio can be merged
- * the request based on the driver constraints.
+ * into the request based on the driver constraints.
  */
-int blk_rq_append_bio(struct request *rq, struct bio *bio)
+int blk_rq_append_bio(struct request *rq, struct bio **bio)
 {
-	blk_queue_bounce(rq->q, &bio);
+	struct bio *orig_bio = *bio;
+	blk_queue_bounce(rq->q, bio);
 	if (!rq->bio) {
-		blk_rq_bio_prep(rq->q, rq, bio);
+		blk_rq_bio_prep(rq->q, rq, *bio);
 	} else {
-		if (!ll_back_merge_fn(rq->q, rq, bio))
+		if (!ll_back_merge_fn(rq->q, rq, *bio)) {
+			if (orig_bio != *bio) {
+				bio_put(*bio);
+				*bio = orig_bio;
+			}
 			return -EINVAL;
+		}
-		rq->biotail->bi_next = bio;
+		rq->biotail->bi_next = *bio;
-		rq->biotail = bio;
+		rq->biotail = *bio;
-		rq->__data_len += bio->bi_iter.bi_size;
+		rq->__data_len += (*bio)->bi_iter.bi_size;
 	}
 	return 0;
 	 * We link the bounce buffer in and could have to traverse it
 	 * later so we have to get a ref to prevent it from being freed
 	 */
-	ret = blk_rq_append_bio(rq, bio);
+	ret = blk_rq_append_bio(rq, &bio);
-	bio_get(bio);
 	if (ret) {
-		bio_endio(bio);
 		__blk_rq_unmap_user(orig_bio);
-		bio_put(bio);
 		return ret;
 	}
+	bio_get(bio);
 	return 0;
 }
 	int reading = rq_data_dir(rq) == READ;
 	unsigned long addr = (unsigned long) kbuf;
 	int do_copy = 0;
-	struct bio *bio;
+	struct bio *bio, *orig_bio;
 	int ret;
 	if (len > (queue_max_hw_sectors(q) << 9))
 	if (do_copy)
 		rq->rq_flags |= RQF_COPY_USER;
-	ret = blk_rq_append_bio(rq, bio);
+	orig_bio = bio;
+	ret = blk_rq_append_bio(rq, &bio);
 	if (unlikely(ret)) {
 		/* request is too big */
-		bio_put(bio);
+		bio_put(orig_bio);
 		return ret;
 	}

block/blk-throttle.c+1−7

 out_unlock:
 	spin_unlock_irq(q->queue_lock);
 out:
-	/*
+	bio_set_flag(bio, BIO_THROTTLED);
-	 * As multiple blk-throtls may stack in the same issue path, we
-	 * don't want bios to leave with the flag set.  Clear the flag if
-	 * being issued.
-	 */
-	if (!throttled)
-		bio_clear_flag(bio, BIO_THROTTLED);
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
 	if (throttled || !td->track_bio_latency)

block/bounce.c+4−2

 	unsigned i = 0;
 	bool bounce = false;
 	int sectors = 0;
+	bool passthrough = bio_is_passthrough(*bio_orig);
 	bio_for_each_segment(from, *bio_orig, iter) {
 		if (i++ < BIO_MAX_PAGES)
 	if (!bounce)
 		return;
-	if (sectors < bio_sectors(*bio_orig)) {
+	if (!passthrough && sectors < bio_sectors(*bio_orig)) {
 		bio = bio_split(*bio_orig, sectors, GFP_NOIO, bounce_bio_split);
 		bio_chain(bio, *bio_orig);
 		generic_make_request(*bio_orig);
 		*bio_orig = bio;
 	}
-	bio = bio_clone_bioset(*bio_orig, GFP_NOIO, bounce_bio_set);
+	bio = bio_clone_bioset(*bio_orig, GFP_NOIO, passthrough ? NULL :
+			bounce_bio_set);
 	bio_for_each_segment_all(to, bio, i) {
 		struct page *page = to->bv_page;

block/kyber-iosched.c+24−13

 	unsigned int cur_domain;
 	unsigned int batching;
 	wait_queue_entry_t domain_wait[KYBER_NUM_DOMAINS];
+	struct sbq_wait_state *domain_ws[KYBER_NUM_DOMAINS];
 	atomic_t wait_index[KYBER_NUM_DOMAINS];
 };
+static int kyber_domain_wake(wait_queue_entry_t *wait, unsigned mode, int flags,
+			     void *key);
 static int rq_sched_domain(const struct request *rq)
 {
 	unsigned int op = rq->cmd_flags;
 	for (i = 0; i < KYBER_NUM_DOMAINS; i++) {
 		INIT_LIST_HEAD(&khd->rqs[i]);
+		init_waitqueue_func_entry(&khd->domain_wait[i],
+					  kyber_domain_wake);
+		khd->domain_wait[i].private = hctx;
 		INIT_LIST_HEAD(&khd->domain_wait[i].entry);
 		atomic_set(&khd->wait_index[i], 0);
 	}
 	int nr;
 	nr = __sbitmap_queue_get(domain_tokens);
-	if (nr >= 0)
-		return nr;
 	/*
 	 * If we failed to get a domain token, make sure the hardware queue is
 	 * run when one becomes available. Note that this is serialized on
 	 * khd->lock, but we still need to be careful about the waker.
 	 */
-	if (list_empty_careful(&wait->entry)) {
+	if (nr < 0 && list_empty_careful(&wait->entry)) {
-		init_waitqueue_func_entry(wait, kyber_domain_wake);
-		wait->private = hctx;
 		ws = sbq_wait_ptr(domain_tokens,
 				  &khd->wait_index[sched_domain]);
+		khd->domain_ws[sched_domain] = ws;
 		add_wait_queue(&ws->wait, wait);
 		/*
 		 * Try again in case a token was freed before we got on the wait
-		 * queue. The waker may have already removed the entry from the
+		 * queue.
-		 * wait queue, but list_del_init() is okay with that.
 		 */
 		nr = __sbitmap_queue_get(domain_tokens);
-		if (nr >= 0) {
+	}
-			unsigned long flags;
-			spin_lock_irqsave(&ws->wait.lock, flags);
+	/*
-			list_del_init(&wait->entry);
+	 * If we got a token while we were on the wait queue, remove ourselves
-			spin_unlock_irqrestore(&ws->wait.lock, flags);
+	 * from the wait queue to ensure that all wake ups make forward
-		}
+	 * progress. It's possible that the waker already deleted the entry
+	 * between the !list_empty_careful() check and us grabbing the lock, but
+	 * list_del_init() is okay with that.
+	 */
+	if (nr >= 0 && !list_empty_careful(&wait->entry)) {
+		ws = khd->domain_ws[sched_domain];
+		spin_lock_irq(&ws->wait.lock);
+		list_del_init(&wait->entry);
+		spin_unlock_irq(&ws->wait.lock);
 	}
 	return nr;
 }

crypto/af_alg.c+7−12

 	}
 	tsgl = areq->tsgl;
-	for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
+	if (tsgl) {
-		if (!sg_page(sg))
+		for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
-			continue;
+			if (!sg_page(sg))
-		put_page(sg_page(sg));
+				continue;
-	}
+			put_page(sg_page(sg));
+		}
-	if (areq->tsgl && areq->tsgl_entries)
 		sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl));
+	}
 }
 EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls);
 		if (!af_alg_readable(sk))
 			break;
-		if (!ctx->used) {
-			err = af_alg_wait_for_data(sk, flags);
-			if (err)
-				return err;
-		}
 		seglen = min_t(size_t, (maxsize - len),
 			       msg_data_left(msg));

crypto/algif_aead.c+12−6

 	size_t usedpages = 0;		/* [in]  RX bufs to be used from user */
 	size_t processed = 0;		/* [in]  TX bufs to be consumed */
+	if (!ctx->used) {
+		err = af_alg_wait_for_data(sk, flags);
+		if (err)
+			return err;
+	}
 	/*
 	 * Data length provided by caller via sendmsg/sendpage that has not
 	 * yet been processed.
 		/* AIO operation */
 		sock_hold(sk);
 		areq->iocb = msg->msg_iocb;
+		/* Remember output size that will be generated. */
+		areq->outlen = outlen;
 		aead_request_set_callback(&areq->cra_u.aead_req,
 					  CRYPTO_TFM_REQ_MAY_BACKLOG,
 					  af_alg_async_cb, areq);
 				 crypto_aead_decrypt(&areq->cra_u.aead_req);
 		/* AIO operation in progress */
-		if (err == -EINPROGRESS || err == -EBUSY) {
+		if (err == -EINPROGRESS || err == -EBUSY)
-			/* Remember output size that will be generated. */
-			areq->outlen = outlen;
 			return -EIOCBQUEUED;
-		}
 		sock_put(sk);
 	} else {
 	struct aead_tfm *tfm = private;
 	crypto_free_aead(tfm->aead);
+	crypto_put_default_null_skcipher2();
 	kfree(tfm);
 }
 	unsigned int ivlen = crypto_aead_ivsize(tfm);
 	af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
-	crypto_put_default_null_skcipher2();
 	sock_kzfree_s(sk, ctx->iv, ivlen);
 	sock_kfree_s(sk, ctx, ctx->len);
 	af_alg_release_parent(sk);

crypto/algif_skcipher.c+11−5

 	int err = 0;
 	size_t len = 0;
+	if (!ctx->used) {
+		err = af_alg_wait_for_data(sk, flags);
+		if (err)
+			return err;
+	}
 	/* Allocate cipher request for current operation. */
 	areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) +
 				     crypto_skcipher_reqsize(tfm));
 		/* AIO operation */
 		sock_hold(sk);
 		areq->iocb = msg->msg_iocb;
+		/* Remember output size that will be generated. */
+		areq->outlen = len;
 		skcipher_request_set_callback(&areq->cra_u.skcipher_req,
 					      CRYPTO_TFM_REQ_MAY_SLEEP,
 					      af_alg_async_cb, areq);
 			crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
 		/* AIO operation in progress */
-		if (err == -EINPROGRESS || err == -EBUSY) {
+		if (err == -EINPROGRESS || err == -EBUSY)
-			/* Remember output size that will be generated. */
-			areq->outlen = len;
 			return -EIOCBQUEUED;
-		}
 		sock_put(sk);
 	} else {

crypto/hmac.c+5−1

 	salg = shash_attr_alg(tb[1], 0, 0);
 	if (IS_ERR(salg))
 		return PTR_ERR(salg);
+	alg = &salg->base;
+	/* The underlying hash algorithm must be unkeyed */
 	err = -EINVAL;
+	if (crypto_shash_alg_has_setkey(salg))
+		goto out_put_alg;
 	ds = salg->digestsize;
 	ss = salg->statesize;
-	alg = &salg->base;
 	if (ds > alg->cra_blocksize ||
 	    ss < alg->cra_blocksize)
 		goto out_put_alg;

crypto/mcryptd.c+10−13

@@ -81,6 +81,7 @@ static int mcryptd_init_queue(struct mcryptd_queue *queue, · 80 unmodified lines
81	pr_debug("cpu_queue #%d %p\n", cpu, queue->cpu_queue);	81	pr_debug("cpu_queue #%d %p\n", cpu, queue->cpu_queue);
82	crypto_init_queue(&cpu_queue->queue, max_cpu_qlen);	82	crypto_init_queue(&cpu_queue->queue, max_cpu_qlen);
83	INIT_WORK(&cpu_queue->work, mcryptd_queue_worker);	83	INIT_WORK(&cpu_queue->work, mcryptd_queue_worker);
		84	spin_lock_init(&cpu_queue->q_lock);
84	}	85	}
85	return 0;	86	return 0;
86	}	87	}
@@ -104,15 +105,16 @@ static int mcryptd_enqueue_request(struct mcryptd_queue *queue, · 17 unmodified lines
104	int cpu, err;	105	int cpu, err;
105	struct mcryptd_cpu_queue *cpu_queue;	106	struct mcryptd_cpu_queue *cpu_queue;
106		107
107	cpu = get_cpu();	108	cpu_queue = raw_cpu_ptr(queue->cpu_queue);
108	cpu_queue = this_cpu_ptr(queue->cpu_queue);	109	spin_lock(&cpu_queue->q_lock);
109	rctx->tag.cpu = cpu;	110	cpu = smp_processor_id();
		111	rctx->tag.cpu = smp_processor_id();
110		112
111	err = crypto_enqueue_request(&cpu_queue->queue, request);	113	err = crypto_enqueue_request(&cpu_queue->queue, request);
112	pr_debug("enqueue request: cpu %d cpu_queue %p request %p\n",	114	pr_debug("enqueue request: cpu %d cpu_queue %p request %p\n",
113	cpu, cpu_queue, request);	115	cpu, cpu_queue, request);
		116	spin_unlock(&cpu_queue->q_lock);
114	queue_work_on(cpu, kcrypto_wq, &cpu_queue->work);	117	queue_work_on(cpu, kcrypto_wq, &cpu_queue->work);
115	put_cpu();
116		118
117	return err;	119	return err;
118	}	120	}
@@ -161,16 +163,11 @@ static void mcryptd_queue_worker(struct work_struct *work) · 42 unmodified lines
161	cpu_queue = container_of(work, struct mcryptd_cpu_queue, work);	163	cpu_queue = container_of(work, struct mcryptd_cpu_queue, work);
162	i = 0;	164	i = 0;
163	while (i < MCRYPTD_BATCH \|\| single_task_running()) {	165	while (i < MCRYPTD_BATCH \|\| single_task_running()) {
164	/*	166
165	* preempt_disable/enable is used to prevent	167	spin_lock_bh(&cpu_queue->q_lock);
166	* being preempted by mcryptd_enqueue_request()
167	*/
168	local_bh_disable();
169	preempt_disable();
170	backlog = crypto_get_backlog(&cpu_queue->queue);	168	backlog = crypto_get_backlog(&cpu_queue->queue);
171	req = crypto_dequeue_request(&cpu_queue->queue);	169	req = crypto_dequeue_request(&cpu_queue->queue);
172	preempt_enable();	170	spin_unlock_bh(&cpu_queue->q_lock);
173	local_bh_enable();
174		171
175	if (!req) {	172	if (!req) {
176	mcryptd_opportunistic_flush();	173	mcryptd_opportunistic_flush();
@@ -185,7 +182,7 @@ static void mcryptd_queue_worker(struct work_struct *work) · 8 unmodified lines
185	++i;	182	++i;
186	}	183	}
187	if (cpu_queue->queue.qlen)	184	if (cpu_queue->queue.qlen)
188	queue_work(kcrypto_wq, &cpu_queue->work);	185	queue_work_on(smp_processor_id(), kcrypto_wq, &cpu_queue->work);
189	}	186	}
190		187
191	void mcryptd_flusher(struct work_struct *__work)	188	void mcryptd_flusher(struct work_struct *__work)

crypto/rsa_helper.c+1−1

@@ -30,7 +30,7 @@ int rsa_get_n(void *context, size_t hdrlen, unsigned char tag, · 29 unmodified lines
30	return -EINVAL;	30	return -EINVAL;
31		31
32	if (fips_enabled) {	32	if (fips_enabled) {
33	while (!*ptr && n_sz) {	33	while (n_sz && !*ptr) {
34	ptr++;	34	ptr++;
35	n_sz--;	35	n_sz--;
36	}	36	}

crypto/salsa20_generic.c+0−7

@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc, · 187 unmodified lines
188		188
189	salsa20_ivsetup(ctx, walk.iv);	189	salsa20_ivsetup(ctx, walk.iv);
190		190
191	if (likely(walk.nbytes == nbytes))
192	{
193	salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
194	walk.src.virt.addr, nbytes);
195	return blkcipher_walk_done(desc, &walk, 0);
196	}
197
198	while (walk.nbytes >= 64) {	191	while (walk.nbytes >= 64) {
199	salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,	192	salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
200	walk.src.virt.addr,	193	walk.src.virt.addr,

crypto/shash.c+3−2

 static const struct crypto_type crypto_shash_type;
-static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
-			   unsigned int keylen)
+		    unsigned int keylen)
 {
 	return -ENOSYS;
 }
+EXPORT_SYMBOL_GPL(shash_no_setkey);
 static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
 				  unsigned int keylen)

crypto/skcipher.c+4−6

 	walk->total = req->cryptlen;
 	walk->nbytes = 0;
+	walk->iv = req->iv;
+	walk->oiv = req->iv;
 	if (unlikely(!walk->total))
 		return 0;
 	scatterwalk_start(&walk->in, req->src);
 	scatterwalk_start(&walk->out, req->dst);
-	walk->iv = req->iv;
-	walk->oiv = req->iv;
 	walk->flags &= ~SKCIPHER_WALK_SLEEP;
 	walk->flags |= req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
 		       SKCIPHER_WALK_SLEEP : 0;
 	int err;
 	walk->nbytes = 0;
+	walk->iv = req->iv;
+	walk->oiv = req->iv;
 	if (unlikely(!walk->total))
 		return 0;
 	scatterwalk_done(&walk->in, 0, walk->total);
 	scatterwalk_done(&walk->out, 0, walk->total);
-	walk->iv = req->iv;
-	walk->oiv = req->iv;
 	if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP)
 		walk->flags |= SKCIPHER_WALK_SLEEP;
 	else

drivers/acpi/apei/erst.c+1−1

@@ -1007,7 +1007,7 @@ skip: · 1006 unmodified lines
1007	/* The record may be cleared by others, try read next record */	1007	/* The record may be cleared by others, try read next record */
1008	if (len == -ENOENT)	1008	if (len == -ENOENT)
1009	goto skip;	1009	goto skip;
1010	else if (len < sizeof(*rcd)) {	1010	else if (len < 0 \|\| len < sizeof(*rcd)) {
1011	rc = -EIO;	1011	rc = -EIO;
1012	goto out;	1012	goto out;
1013	}	1013	}

drivers/acpi/cppc_acpi.c+1−1

@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls) · 1170 unmodified lines
1171	struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);	1171	struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
1172	struct cpc_register_resource *desired_reg;	1172	struct cpc_register_resource *desired_reg;
1173	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);	1173	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
1174	struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];	1174	struct cppc_pcc_data *pcc_ss_data;
1175	int ret = 0;	1175	int ret = 0;
1176		1176
1177	if (!cpc_desc \|\| pcc_ss_id < 0) {	1177	if (!cpc_desc \|\| pcc_ss_id < 0) {

drivers/acpi/device_pm.c+1−1

@@ -1138,7 +1138,7 @@ int acpi_subsys_thaw_noirq(struct device *dev) · 1137 unmodified lines
1138	* skip all of the subsequent "thaw" callbacks for the device.	1138	* skip all of the subsequent "thaw" callbacks for the device.
1139	*/	1139	*/
1140	if (dev_pm_smart_suspend_and_suspended(dev)) {	1140	if (dev_pm_smart_suspend_and_suspended(dev)) {
1141	dev->power.direct_complete = true;	1141	dev_pm_skip_next_resume_phases(dev);
1142	return 0;	1142	return 0;
1143	}	1143	}
1144		1144

drivers/acpi/nfit/core.c+8−1

 				dev_name(&adev_dimm->dev));
 		return -ENXIO;
 	}
+	/*
+	 * Record nfit_mem for the notification path to track back to
+	 * the nfit sysfs attributes for this dimm device object.
+	 */
+	dev_set_drvdata(&adev_dimm->dev, nfit_mem);
 	/*
 	 * Until standardization materializes we need to consider 4
 			sysfs_put(nfit_mem->flags_attr);
 			nfit_mem->flags_attr = NULL;
 		}
-		if (adev_dimm)
+		if (adev_dimm) {
 			acpi_remove_notify_handler(adev_dimm->handle,
 					ACPI_DEVICE_NOTIFY, acpi_nvdimm_notify);
+			dev_set_drvdata(&adev_dimm->dev, NULL);
+		}
 	}
 	mutex_unlock(&acpi_desc->init_mutex);
 }

drivers/android/binder.c+31−13

@@ -482,7 +482,8 @@ enum binder_deferred_state { · 481 unmodified lines
482	* @tsk task_struct for group_leader of process	482	* @tsk task_struct for group_leader of process
483	* (invariant after initialized)	483	* (invariant after initialized)
484	* @files files_struct for process	484	* @files files_struct for process
485	* (invariant after initialized)	485	* (protected by @files_lock)
		486	* @files_lock mutex to protect @files
486	* @deferred_work_node: element for binder_deferred_list	487	* @deferred_work_node: element for binder_deferred_list
487	* (protected by binder_deferred_lock)	488	* (protected by binder_deferred_lock)
488	* @deferred_work: bitmap of deferred work to perform	489	* @deferred_work: bitmap of deferred work to perform
@@ -530,6 +531,7 @@ struct binder_proc { · 41 unmodified lines
530	int pid;	531	int pid;
531	struct task_struct *tsk;	532	struct task_struct *tsk;
532	struct files_struct *files;	533	struct files_struct *files;
		534	struct mutex files_lock;
533	struct hlist_node deferred_work_node;	535	struct hlist_node deferred_work_node;
534	int deferred_work;	536	int deferred_work;
535	bool is_dead;	537	bool is_dead;
@@ -924,20 +926,26 @@ static void binder_inc_node_tmpref_ilocked(struct binder_node *node); · 388 unmodified lines
924		926
925	static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)	927	static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
926	{	928	{
927	struct files_struct *files = proc->files;
928	unsigned long rlim_cur;	929	unsigned long rlim_cur;
929	unsigned long irqs;	930	unsigned long irqs;
		931	int ret;
930		932
931	if (files == NULL)	933	mutex_lock(&proc->files_lock);
932	return -ESRCH;	934	if (proc->files == NULL) {
933		935	ret = -ESRCH;
934	if (!lock_task_sighand(proc->tsk, &irqs))	936	goto err;
935	return -EMFILE;	937	}
936		938	if (!lock_task_sighand(proc->tsk, &irqs)) {
		939	ret = -EMFILE;
		940	goto err;
		941	}
937	rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);	942	rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
938	unlock_task_sighand(proc->tsk, &irqs);	943	unlock_task_sighand(proc->tsk, &irqs);
939		944
940	return __alloc_fd(files, 0, rlim_cur, flags);	945	ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
		946	err:
		947	mutex_unlock(&proc->files_lock);
		948	return ret;
941	}	949	}
942		950
943	/*	951	/*
@@ -946,8 +954,10 @@ static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) · 2 unmodified lines
946	static void task_fd_install(	954	static void task_fd_install(
947	struct binder_proc proc, unsigned int fd, struct file file)	955	struct binder_proc proc, unsigned int fd, struct file file)
948	{	956	{
		957	mutex_lock(&proc->files_lock);
949	if (proc->files)	958	if (proc->files)
950	__fd_install(proc->files, fd, file);	959	__fd_install(proc->files, fd, file);
		960	mutex_unlock(&proc->files_lock);
951	}	961	}
952		962
953	/*	963	/*
@@ -957,9 +967,11 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd) · 3 unmodified lines
957	{	967	{
958	int retval;	968	int retval;
959		969
960	if (proc->files == NULL)	970	mutex_lock(&proc->files_lock);
961	return -ESRCH;	971	if (proc->files == NULL) {
962		972	retval = -ESRCH;
		973	goto err;
		974	}
963	retval = __close_fd(proc->files, fd);	975	retval = __close_fd(proc->files, fd);
964	/* can't restart close syscall because file table entry was cleared */	976	/* can't restart close syscall because file table entry was cleared */
965	if (unlikely(retval == -ERESTARTSYS \|\|	977	if (unlikely(retval == -ERESTARTSYS \|\|
@@ -967,7 +979,8 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd) · 1 unmodified line
967	retval == -ERESTARTNOHAND \|\|	979	retval == -ERESTARTNOHAND \|\|
968	retval == -ERESTART_RESTARTBLOCK))	980	retval == -ERESTART_RESTARTBLOCK))
969	retval = -EINTR;	981	retval = -EINTR;
970		982	err:
		983	mutex_unlock(&proc->files_lock);
971	return retval;	984	return retval;
972	}	985	}
973		986
@@ -4690,7 +4703,9 @@ static int binder_mmap(struct file filp, struct vm_area_struct vma) · 3716 unmodified lines
4690	ret = binder_alloc_mmap_handler(&proc->alloc, vma);	4703	ret = binder_alloc_mmap_handler(&proc->alloc, vma);
4691	if (ret)	4704	if (ret)
4692	return ret;	4705	return ret;
		4706	mutex_lock(&proc->files_lock);
4693	proc->files = get_files_struct(current);	4707	proc->files = get_files_struct(current);
		4708	mutex_unlock(&proc->files_lock);
4694	return 0;	4709	return 0;
4695		4710
4696	err_bad_arg:	4711	err_bad_arg:
@@ -4714,6 +4729,7 @@ static int binder_open(struct inode nodp, struct file filp) · 17 unmodified lines
4714	spin_lock_init(&proc->outer_lock);	4729	spin_lock_init(&proc->outer_lock);
4715	get_task_struct(current->group_leader);	4730	get_task_struct(current->group_leader);
4716	proc->tsk = current->group_leader;	4731	proc->tsk = current->group_leader;
		4732	mutex_init(&proc->files_lock);
4717	INIT_LIST_HEAD(&proc->todo);	4733	INIT_LIST_HEAD(&proc->todo);
4718	proc->default_priority = task_nice(current);	4734	proc->default_priority = task_nice(current);
4719	binder_dev = container_of(filp->private_data, struct binder_device,	4735	binder_dev = container_of(filp->private_data, struct binder_device,
@@ -4966,9 +4982,11 @@ static void binder_deferred_func(struct work_struct *work) · 246 unmodified lines
4966		4982
4967	files = NULL;	4983	files = NULL;
4968	if (defer & BINDER_DEFERRED_PUT_FILES) {	4984	if (defer & BINDER_DEFERRED_PUT_FILES) {
		4985	mutex_lock(&proc->files_lock);
4969	files = proc->files;	4986	files = proc->files;
4970	if (files)	4987	if (files)
4971	proc->files = NULL;	4988	proc->files = NULL;
		4989	mutex_unlock(&proc->files_lock);
4972	}	4990	}
4973		4991
4974	if (defer & BINDER_DEFERRED_FLUSH)	4992	if (defer & BINDER_DEFERRED_FLUSH)

drivers/ata/ahci_mtk.c+3−3

@@ -1,5 +1,5 @@
1	/*	1	/*
2	* MeidaTek AHCI SATA driver	2	* MediaTek AHCI SATA driver
3	*	3	*
4	* Copyright (c) 2017 MediaTek Inc.	4	* Copyright (c) 2017 MediaTek Inc.
5	* Author: Ryder Lee <ryder.lee@mediatek.com>	5	* Author: Ryder Lee <ryder.lee@mediatek.com>
@@ -25,7 +25,7 @@ · 19 unmodified lines
25	#include <linux/reset.h>	25	#include <linux/reset.h>
26	#include "ahci.h"	26	#include "ahci.h"
27		27
28	#define DRV_NAME "ahci"	28	#define DRV_NAME "ahci-mtk"
29		29
30	#define SYS_CFG 0x14	30	#define SYS_CFG 0x14
31	#define SYS_CFG_SATA_MSK GENMASK(31, 30)	31	#define SYS_CFG_SATA_MSK GENMASK(31, 30)
@@ -192,5 +192,5 @@ static struct platform_driver mtk_ahci_driver = { · 160 unmodified lines
192	};	192	};
193	module_platform_driver(mtk_ahci_driver);	193	module_platform_driver(mtk_ahci_driver);
194		194
195	MODULE_DESCRIPTION("MeidaTek SATA AHCI Driver");	195	MODULE_DESCRIPTION("MediaTek SATA AHCI Driver");
196	MODULE_LICENSE("GPL v2");	196	MODULE_LICENSE("GPL v2");

drivers/ata/ahci_qoriq.c+12−0

 /* port register default value */
 #define AHCI_PORT_PHY_1_CFG	0xa003fffe
+#define AHCI_PORT_PHY2_CFG	0x28184d1f
+#define AHCI_PORT_PHY3_CFG	0x0e081509
 #define AHCI_PORT_TRANS_CFG	0x08000029
 #define AHCI_PORT_AXICC_CFG	0x3fffffff
 		writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
 				qpriv->ecc_addr);
 		writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+		writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+		writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
 		writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
 		if (qpriv->is_dmacoherent)
 			writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
 	case AHCI_LS2080A:
 		writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+		writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+		writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
 		writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
 		if (qpriv->is_dmacoherent)
 			writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
 		writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
 				qpriv->ecc_addr);
 		writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+		writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+		writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
 		writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
 		if (qpriv->is_dmacoherent)
 			writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
 		writel(readl(qpriv->ecc_addr) | ECC_DIS_LS1088A,
 		       qpriv->ecc_addr);
 		writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+		writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+		writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
 		writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
 		if (qpriv->is_dmacoherent)
 			writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
 	case AHCI_LS2088A:
 		writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+		writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+		writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
 		writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
 		if (qpriv->is_dmacoherent)
 			writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);

drivers/ata/libata-core.c+9−3

 	bit = fls(mask) - 1;
 	mask &= ~(1 << bit);
-	/* Mask off all speeds higher than or equal to the current
+	/*
-	 * one.  Force 1.5Gbps if current SPD is not available.
+	 * Mask off all speeds higher than or equal to the current one.  At
+	 * this point, if current SPD is not available and we previously
+	 * recorded the link speed from SStatus, the driver has already
+	 * masked off the highest bit so mask should already be 1 or 0.
+	 * Otherwise, we should not force 1.5Gbps on a link where we have
+	 * not previously recorded speed from SStatus.  Just return in this
+	 * case.
 	 */
 	if (spd > 1)
 		mask &= (1 << (spd - 1)) - 1;
 	else
-		mask &= 1;
+		return -EINVAL;
 	/* were we already at the bottom? */
 	if (!mask)

drivers/ata/pata_pdc2027x.c+6−10

  * is issued to the device. However, if the controller clock is 133MHz,
  * the following tables must be used.
  */
-static struct pdc2027x_pio_timing {
+static const struct pdc2027x_pio_timing {
 	u8 value0, value1, value2;
 } pdc2027x_pio_timing_tbl[] = {
 	{ 0xfb, 0x2b, 0xac }, /* PIO mode 0 */
 	{ 0x23, 0x09, 0x25 }, /* PIO mode 4, IORDY on, Prefetch off */
 };
-static struct pdc2027x_mdma_timing {
+static const struct pdc2027x_mdma_timing {
 	u8 value0, value1;
 } pdc2027x_mdma_timing_tbl[] = {
 	{ 0xdf, 0x5f }, /* MDMA mode 0 */
 	{ 0x69, 0x25 }, /* MDMA mode 2 */
 };
-static struct pdc2027x_udma_timing {
+static const struct pdc2027x_udma_timing {
 	u8 value0, value1, value2;
 } pdc2027x_udma_timing_tbl[] = {
 	{ 0x4a, 0x0f, 0xd5 }, /* UDMA mode 0 */
  * @host: target ATA host
  * @board_idx: board identifier
  */
-static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
+static void pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
 {
 	long pll_clock;
 	/* Adjust PLL control register */
 	pdc_adjust_pll(host, pll_clock, board_idx);
-	return 0;
 }
 /**
 	//pci_enable_intx(pdev);
 	/* initialize adapter */
-	if (pdc_hardware_init(host, board_idx) != 0)
+	pdc_hardware_init(host, board_idx);
-		return -EIO;
 	pci_set_master(pdev);
 	return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt,
 	else
 		board_idx = PDC_UDMA_133;
-	if (pdc_hardware_init(host, board_idx))
+	pdc_hardware_init(host, board_idx);
-		return -EIO;
 	ata_host_resume(host);
 	return 0;

drivers/base/cacheinfo.c+13−0

@@ -186,6 +186,11 @@ static void cache_associativity(struct cacheinfo *this_leaf) · 185 unmodified lines
186	this_leaf->ways_of_associativity = (size / nr_sets) / line_size;	186	this_leaf->ways_of_associativity = (size / nr_sets) / line_size;
187	}	187	}
188		188
		189	static bool cache_node_is_unified(struct cacheinfo *this_leaf)
		190	{
		191	return of_property_read_bool(this_leaf->of_node, "cache-unified");
		192	}
		193
189	static void cache_of_override_properties(unsigned int cpu)	194	static void cache_of_override_properties(unsigned int cpu)
190	{	195	{
191	int index;	196	int index;
@@ -194,6 +199,14 @@ static void cache_of_override_properties(unsigned int cpu) · 2 unmodified lines
194		199
195	for (index = 0; index < cache_leaves(cpu); index++) {	200	for (index = 0; index < cache_leaves(cpu); index++) {
196	this_leaf = this_cpu_ci->info_list + index;	201	this_leaf = this_cpu_ci->info_list + index;
		202	/*
		203	* init_cache_level must setup the cache level correctly
		204	* overriding the architecturally specified levels, so
		205	* if type is NONE at this stage, it should be unified
		206	*/
		207	if (this_leaf->type == CACHE_TYPE_NOCACHE &&
		208	cache_node_is_unified(this_leaf))
		209	this_leaf->type = CACHE_TYPE_UNIFIED;
197	cache_size(this_leaf);	210	cache_size(this_leaf);
198	cache_get_line_size(this_leaf);	211	cache_get_line_size(this_leaf);
199	cache_nr_sets(this_leaf);	212	cache_nr_sets(this_leaf);

drivers/base/power/main.c+15−0

@@ -525,6 +525,21 @@ static void dpm_watchdog_clear(struct dpm_watchdog *wd) · 524 unmodified lines
525		525
526	/------------------------- Resume routines -------------------------/	526	/------------------------- Resume routines -------------------------/
527		527
		528	/**
		529	* dev_pm_skip_next_resume_phases - Skip next system resume phases for device.
		530	* @dev: Target device.
		531	*
		532	* Make the core skip the "early resume" and "resume" phases for @dev.
		533	*
		534	* This function can be called by middle-layer code during the "noirq" phase of
		535	* system resume if necessary, but not by device drivers.
		536	*/
		537	void dev_pm_skip_next_resume_phases(struct device *dev)
		538	{
		539	dev->power.is_late_suspended = false;
		540	dev->power.is_suspended = false;
		541	}
		542
528	/**	543	/**
529	* device_resume_noirq - Execute a "noirq resume" callback for given device.	544	* device_resume_noirq - Execute a "noirq resume" callback for given device.
530	* @dev: Device to handle.	545	* @dev: Device to handle.

drivers/block/null_blk.c+2−2

 struct nullb_cmd {
 	struct list_head list;
 	struct llist_node ll_list;
-	call_single_data_t csd;
+	struct __call_single_data csd;
 	struct request *rq;
 	struct bio *bio;
 	unsigned int tag;
+	blk_status_t error;
 	struct nullb_queue *nq;
 	struct hrtimer timer;
-	blk_status_t error;
 };
 struct nullb_queue {

drivers/char/ipmi/ipmi_si_intf.c+23−21

 	/* The timer for this si. */
 	struct timer_list   si_timer;
+	/* This flag is set, if the timer can be set */
+	bool		    timer_can_start;
 	/* This flag is set, if the timer is running (timer_pending() isn't enough) */
 	bool		    timer_running;
 static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 {
+	if (!smi_info->timer_can_start)
+		return;
 	smi_info->last_timeout_jiffies = jiffies;
 	mod_timer(&smi_info->si_timer, new_val);
 	smi_info->timer_running = true;
 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
 }
-static void start_check_enables(struct smi_info *smi_info, bool start_timer)
+static void start_check_enables(struct smi_info *smi_info)
 {
 	unsigned char msg[2];
 	msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
 	msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
-	if (start_timer)
+	start_new_msg(smi_info, msg, 2);
-		start_new_msg(smi_info, msg, 2);
-	else
-		smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
 	smi_info->si_state = SI_CHECKING_ENABLES;
 }
-static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
+static void start_clear_flags(struct smi_info *smi_info)
 {
 	unsigned char msg[3];
 	msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
 	msg[2] = WDT_PRE_TIMEOUT_INT;
-	if (start_timer)
+	start_new_msg(smi_info, msg, 3);
-		start_new_msg(smi_info, msg, 3);
-	else
-		smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
 	smi_info->si_state = SI_CLEARING_FLAGS;
 }
  * Note that we cannot just use disable_irq(), since the interrupt may
  * be shared.
  */
-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
+static inline bool disable_si_irq(struct smi_info *smi_info)
 {
 	if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
 		smi_info->interrupt_disabled = true;
-		start_check_enables(smi_info, start_timer);
+		start_check_enables(smi_info);
 		return true;
 	}
 	return false;
 {
 	if ((smi_info->io.irq) && (smi_info->interrupt_disabled)) {
 		smi_info->interrupt_disabled = false;
-		start_check_enables(smi_info, true);
+		start_check_enables(smi_info);
 		return true;
 	}
 	return false;
 	msg = ipmi_alloc_smi_msg();
 	if (!msg) {
-		if (!disable_si_irq(smi_info, true))
+		if (!disable_si_irq(smi_info))
 			smi_info->si_state = SI_NORMAL;
 	} else if (enable_si_irq(smi_info)) {
 		ipmi_free_smi_msg(msg);
 		/* Watchdog pre-timeout */
 		smi_inc_stat(smi_info, watchdog_pretimeouts);
-		start_clear_flags(smi_info, true);
+		start_clear_flags(smi_info);
 		smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
 		if (smi_info->intf)
 			ipmi_smi_watchdog_pretimeout(smi_info->intf);
 		 * disable and messages disabled.
 		 */
 		if (smi_info->supports_event_msg_buff || smi_info->io.irq) {
-			start_check_enables(smi_info, true);
+			start_check_enables(smi_info);
 		} else {
 			smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
 			if (!smi_info->curr_msg)
 	/* Set up the timer that drives the interface. */
 	timer_setup(&new_smi->si_timer, smi_timeout, 0);
+	new_smi->timer_can_start = true;
 	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
 	/* Try to claim any interrupts. */
 	check_set_rcv_irq(smi_info);
 }
-static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
+static inline void stop_timer_and_thread(struct smi_info *smi_info)
 {
 	if (smi_info->thread != NULL)
 		kthread_stop(smi_info->thread);
+	smi_info->timer_can_start = false;
 	if (smi_info->timer_running)
 		del_timer_sync(&smi_info->si_timer);
 }
 	 * Start clearing the flags before we enable interrupts or the
 	 * timer to avoid racing with the timer.
 	 */
-	start_clear_flags(new_smi, false);
+	start_clear_flags(new_smi);
 	/*
 	 * IRQ is defined to be set when non-zero.  req_events will
 	dev_set_drvdata(new_smi->io.dev, NULL);
 out_err_stop_timer:
-	wait_for_timer_and_thread(new_smi);
+	stop_timer_and_thread(new_smi);
 out_err:
 	new_smi->interrupt_disabled = true;
 	 */
 	if (to_clean->io.irq_cleanup)
 		to_clean->io.irq_cleanup(&to_clean->io);
-	wait_for_timer_and_thread(to_clean);
+	stop_timer_and_thread(to_clean);
 	/*
 	 * Timeouts are stopped, now make sure the interrupts are off
 		schedule_timeout_uninterruptible(1);
 	}
 	if (to_clean->handlers)
-		disable_si_irq(to_clean, false);
+		disable_si_irq(to_clean);
 	while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
 		poll(to_clean);
 		schedule_timeout_uninterruptible(1);

drivers/char/ipmi/ipmi_si_parisc.c+2−0

@@ -10,6 +10,8 @@ static int __init ipmi_parisc_probe(struct parisc_device *dev) · 9 unmodified lines
10	{	10	{
11	struct si_sm_io io;	11	struct si_sm_io io;
12		12
		13	memset(&io, 0, sizeof(io));
		14
13	io.si_type = SI_KCS;	15	io.si_type = SI_KCS;
14	io.addr_source = SI_DEVICETREE;	16	io.addr_source = SI_DEVICETREE;
15	io.addr_type = IPMI_MEM_ADDR_SPACE;	17	io.addr_type = IPMI_MEM_ADDR_SPACE;

drivers/char/ipmi/ipmi_si_pci.c+5−2

 	io.addr_source_cleanup = ipmi_pci_cleanup;
 	io.addr_source_data = pdev;
-	if (pci_resource_flags(pdev, 0) & IORESOURCE_IO)
+	if (pci_resource_flags(pdev, 0) & IORESOURCE_IO) {
 		io.addr_type = IPMI_IO_ADDR_SPACE;
-	else
+		io.io_setup = ipmi_si_port_setup;
+	} else {
 		io.addr_type = IPMI_MEM_ADDR_SPACE;
+		io.io_setup = ipmi_si_mem_setup;
+	}
 	io.addr_data = pci_resource_start(pdev, 0);
 	io.regspacing = ipmi_pci_probe_regspacing(&io);

drivers/clk/clk.c+7−1

 	ret = core->ops->is_enabled(core->hw);
 done:
-	clk_pm_runtime_put(core);
+	if (core->dev)
+		pm_runtime_put(core->dev);
 	return ret;
 }
 		best_parent_rate = core->parent->rate;
 	}
+	if (clk_pm_runtime_get(core))
+		return;
 	if (core->flags & CLK_SET_RATE_UNGATE) {
 		unsigned long flags;
 	/* handle the new child who might not be in core->children yet */
 	if (core->new_child)
 		clk_change_rate(core->new_child);
+	clk_pm_runtime_put(core);
 }
 static int clk_core_set_rate_nolock(struct clk_core *core,

drivers/clk/sunxi/clk-sun9i-mmc.c+12−0

 #include <linux/clk.h>
 #include <linux/clk-provider.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
 	return 0;
 }
+static int sun9i_mmc_reset_reset(struct reset_controller_dev *rcdev,
+				 unsigned long id)
+{
+	sun9i_mmc_reset_assert(rcdev, id);
+	udelay(10);
+	sun9i_mmc_reset_deassert(rcdev, id);
+	return 0;
+}
 static const struct reset_control_ops sun9i_mmc_reset_ops = {
 	.assert		= sun9i_mmc_reset_assert,
 	.deassert	= sun9i_mmc_reset_deassert,
+	.reset		= sun9i_mmc_reset_reset,
 };
 static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev)

drivers/cpufreq/cpufreq_governor.c+16−3

@@ -22,6 +22,8 @@ · 21 unmodified lines
22		22
23	#include "cpufreq_governor.h"	23	#include "cpufreq_governor.h"
24		24
		25	#define CPUFREQ_DBS_MIN_SAMPLING_INTERVAL (2 * TICK_NSEC / NSEC_PER_USEC)
		26
25	static DEFINE_PER_CPU(struct cpu_dbs_info, cpu_dbs);	27	static DEFINE_PER_CPU(struct cpu_dbs_info, cpu_dbs);
26		28
27	static DEFINE_MUTEX(gov_dbs_data_mutex);	29	static DEFINE_MUTEX(gov_dbs_data_mutex);
@@ -47,11 +49,15 @@ ssize_t store_sampling_rate(struct gov_attr_set attr_set, const char buf, · 19 unmodified lines
47	{	49	{
48	struct dbs_data *dbs_data = to_dbs_data(attr_set);	50	struct dbs_data *dbs_data = to_dbs_data(attr_set);
49	struct policy_dbs_info *policy_dbs;	51	struct policy_dbs_info *policy_dbs;
		52	unsigned int sampling_interval;
50	int ret;	53	int ret;
51	ret = sscanf(buf, "%u", &dbs_data->sampling_rate);	54
52	if (ret != 1)	55	ret = sscanf(buf, "%u", &sampling_interval);
		56	if (ret != 1 \|\| sampling_interval < CPUFREQ_DBS_MIN_SAMPLING_INTERVAL)
53	return -EINVAL;	57	return -EINVAL;
54		58
		59	dbs_data->sampling_rate = sampling_interval;
		60
55	/*	61	/*
56	* We are operating under dbs_data->mutex and so the list and its	62	* We are operating under dbs_data->mutex and so the list and its
57	* entries can't be freed concurrently.	63	* entries can't be freed concurrently.
@@ -430,7 +436,14 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) · 372 unmodified lines
430	if (ret)	436	if (ret)
431	goto free_policy_dbs_info;	437	goto free_policy_dbs_info;
432		438
433	dbs_data->sampling_rate = cpufreq_policy_transition_delay_us(policy);	439	/*
		440	* The sampling interval should not be less than the transition latency
		441	* of the CPU and it also cannot be too small for dbs_update() to work
		442	* correctly.
		443	*/
		444	dbs_data->sampling_rate = max_t(unsigned int,
		445	CPUFREQ_DBS_MIN_SAMPLING_INTERVAL,
		446	cpufreq_policy_transition_delay_us(policy));
434		447
435	if (!have_governor_per_policy())	448	if (!have_governor_per_policy())
436	gov->gdbs_data = dbs_data;	449	gov->gdbs_data = dbs_data;

drivers/cpufreq/imx6q-cpufreq.c+6−5

@@ -226,17 +226,18 @@ static void imx6q_opp_check_speed_grading(struct device *dev) · 225 unmodified lines
226	val >>= OCOTP_CFG3_SPEED_SHIFT;	226	val >>= OCOTP_CFG3_SPEED_SHIFT;
227	val &= 0x3;	227	val &= 0x3;
228		228
229	if ((val != OCOTP_CFG3_SPEED_1P2GHZ) &&
230	of_machine_is_compatible("fsl,imx6q"))
231	if (dev_pm_opp_disable(dev, 1200000000))
232	dev_warn(dev, "failed to disable 1.2GHz OPP\n");
233	if (val < OCOTP_CFG3_SPEED_996MHZ)	229	if (val < OCOTP_CFG3_SPEED_996MHZ)
234	if (dev_pm_opp_disable(dev, 996000000))	230	if (dev_pm_opp_disable(dev, 996000000))
235	dev_warn(dev, "failed to disable 996MHz OPP\n");	231	dev_warn(dev, "failed to disable 996MHz OPP\n");
236	if (of_machine_is_compatible("fsl,imx6q")) {	232
		233	if (of_machine_is_compatible("fsl,imx6q") \|\|
		234	of_machine_is_compatible("fsl,imx6qp")) {
237	if (val != OCOTP_CFG3_SPEED_852MHZ)	235	if (val != OCOTP_CFG3_SPEED_852MHZ)
238	if (dev_pm_opp_disable(dev, 852000000))	236	if (dev_pm_opp_disable(dev, 852000000))
239	dev_warn(dev, "failed to disable 852MHz OPP\n");	237	dev_warn(dev, "failed to disable 852MHz OPP\n");
		238	if (val != OCOTP_CFG3_SPEED_1P2GHZ)
		239	if (dev_pm_opp_disable(dev, 1200000000))
		240	dev_warn(dev, "failed to disable 1.2GHz OPP\n");
240	}	241	}
241	iounmap(base);	242	iounmap(base);
242	put_node:	243	put_node:

drivers/dma/at_hdmac.c+3−1

 			 unsigned long flags)
 {
 	struct at_dma_chan	*atchan = to_at_dma_chan(chan);
-	struct data_chunk	*first = xt->sgl;
+	struct data_chunk	*first;
 	struct at_desc		*desc = NULL;
 	size_t			xfer_count;
 	unsigned int		dwidth;
 	if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
 		return NULL;
+	first = xt->sgl;
 	dev_info(chan2dev(chan),
 		 "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
 		__func__, &xt->src_start, &xt->dst_start, xt->numf,

drivers/dma/dma-jz4740.c+3−1

 	ret = dma_async_device_register(dd);
 	if (ret)
-		return ret;
+		goto err_clk;
 	irq = platform_get_irq(pdev, 0);
 	ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
 err_unregister:
 	dma_async_device_unregister(dd);
+err_clk:
+	clk_disable_unprepare(dmadev->clk);
 	return ret;
 }

drivers/dma/dmatest.c+31−24

@@ -155,6 +155,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)"); · 154 unmodified lines
155	#define PATTERN_COUNT_MASK 0x1f	155	#define PATTERN_COUNT_MASK 0x1f
156	#define PATTERN_MEMSET_IDX 0x01	156	#define PATTERN_MEMSET_IDX 0x01
157		157
		158	/* poor man's completion - we want to use wait_event_freezable() on it */
		159	struct dmatest_done {
		160	bool done;
		161	wait_queue_head_t *wait;
		162	};
		163
158	struct dmatest_thread {	164	struct dmatest_thread {
159	struct list_head node;	165	struct list_head node;
160	struct dmatest_info *info;	166	struct dmatest_info *info;
@@ -165,6 +171,8 @@ struct dmatest_thread { · 4 unmodified lines
165	u8 **dsts;	171	u8 **dsts;
166	u8 **udsts;	172	u8 **udsts;
167	enum dma_transaction_type type;	173	enum dma_transaction_type type;
		174	wait_queue_head_t done_wait;
		175	struct dmatest_done test_done;
168	bool done;	176	bool done;
169	};	177	};
170		178
@@ -342,18 +350,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start, · 171 unmodified lines
342	return error_count;	350	return error_count;
343	}	351	}
344		352
345	/* poor man's completion - we want to use wait_event_freezable() on it */
346	struct dmatest_done {
347	bool done;
348	wait_queue_head_t *wait;
349	};
350		353
351	static void dmatest_callback(void *arg)	354	static void dmatest_callback(void *arg)
352	{	355	{
353	struct dmatest_done *done = arg;	356	struct dmatest_done *done = arg;
354		357	struct dmatest_thread *thread =
355	done->done = true;	358	container_of(arg, struct dmatest_thread, done_wait);
356	wake_up_all(done->wait);	359	if (!thread->done) {
		360	done->done = true;
		361	wake_up_all(done->wait);
		362	} else {
		363	/*
		364	* If thread->done, it means that this callback occurred
		365	* after the parent thread has cleaned up. This can
		366	* happen in the case that driver doesn't implement
		367	* the terminate_all() functionality and a dma operation
		368	* did not occur within the timeout period
		369	*/
		370	WARN(1, "dmatest: Kernel memory may be corrupted!!\n");
		371	}
357	}	372	}
358		373
359	static unsigned int min_odd(unsigned int x, unsigned int y)	374	static unsigned int min_odd(unsigned int x, unsigned int y)
@@ -424,9 +439,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len) · 64 unmodified lines
424	*/	439	*/
425	static int dmatest_func(void *data)	440	static int dmatest_func(void *data)
426	{	441	{
427	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait);
428	struct dmatest_thread *thread = data;	442	struct dmatest_thread *thread = data;
429	struct dmatest_done done = { .wait = &done_wait };	443	struct dmatest_done *done = &thread->test_done;
430	struct dmatest_info *info;	444	struct dmatest_info *info;
431	struct dmatest_params *params;	445	struct dmatest_params *params;
432	struct dma_chan *chan;	446	struct dma_chan *chan;
@@ -673,9 +687,9 @@ static int dmatest_func(void *data) · 240 unmodified lines
673	continue;	687	continue;
674	}	688	}
675		689
676	done.done = false;	690	done->done = false;
677	tx->callback = dmatest_callback;	691	tx->callback = dmatest_callback;
678	tx->callback_param = &done;	692	tx->callback_param = done;
679	cookie = tx->tx_submit(tx);	693	cookie = tx->tx_submit(tx);
680		694
681	if (dma_submit_error(cookie)) {	695	if (dma_submit_error(cookie)) {
@@ -688,21 +702,12 @@ static int dmatest_func(void *data) · 6 unmodified lines
688	}	702	}
689	dma_async_issue_pending(chan);	703	dma_async_issue_pending(chan);
690		704
691	wait_event_freezable_timeout(done_wait, done.done,	705	wait_event_freezable_timeout(thread->done_wait, done->done,
692	msecs_to_jiffies(params->timeout));	706	msecs_to_jiffies(params->timeout));
693		707
694	status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);	708	status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
695		709
696	if (!done.done) {	710	if (!done->done) {
697	/*
698	* We're leaving the timed out dma operation with
699	* dangling pointer to done_wait. To make this
700	* correct, we'll need to allocate wait_done for
701	* each test iteration and perform "who's gonna
702	* free it this time?" dancing. For now, just
703	* leave it dangling.
704	*/
705	WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
706	dmaengine_unmap_put(um);	711	dmaengine_unmap_put(um);
707	result("test timed out", total_tests, src_off, dst_off,	712	result("test timed out", total_tests, src_off, dst_off,
708	len, 0);	713	len, 0);
@@ -789,7 +794,7 @@ err_thread_type: · 80 unmodified lines
789	dmatest_KBs(runtime, total_len), ret);	794	dmatest_KBs(runtime, total_len), ret);
790		795
791	/* terminate all transfers on specified channels */	796	/* terminate all transfers on specified channels */
792	if (ret)	797	if (ret \|\| failed_tests)
793	dmaengine_terminate_all(chan);	798	dmaengine_terminate_all(chan);
794		799
795	thread->done = true;	800	thread->done = true;
@@ -849,6 +854,8 @@ static int dmatest_add_threads(struct dmatest_info *info, · 53 unmodified lines
849	thread->info = info;	854	thread->info = info;
850	thread->chan = dtc->chan;	855	thread->chan = dtc->chan;
851	thread->type = type;	856	thread->type = type;
		857	thread->test_done.wait = &thread->done_wait;
		858	init_waitqueue_head(&thread->done_wait);
852	smp_wmb();	859	smp_wmb();
853	thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",	860	thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
854	dma_chan_name(chan), op, i);	861	dma_chan_name(chan), op, i);

drivers/dma/fsl-edma.c+14−14

 	}
 }
-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
+static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
 {
 	int i;
-	for (i = 0; i < DMAMUX_NR; i++)
+	for (i = 0; i < nr_clocks; i++)
 		clk_disable_unprepare(fsl_edma->muxclk[i]);
 }
 		res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
 		fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
-		if (IS_ERR(fsl_edma->muxbase[i]))
+		if (IS_ERR(fsl_edma->muxbase[i])) {
+			/* on error: disable all previously enabled clks */
+			fsl_disable_clocks(fsl_edma, i);
 			return PTR_ERR(fsl_edma->muxbase[i]);
+		}
 		sprintf(clkname, "dmamux%d", i);
 		fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
 		if (IS_ERR(fsl_edma->muxclk[i])) {
 			dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
+			/* on error: disable all previously enabled clks */
+			fsl_disable_clocks(fsl_edma, i);
 			return PTR_ERR(fsl_edma->muxclk[i]);
 		}
 		ret = clk_prepare_enable(fsl_edma->muxclk[i]);
-		if (ret) {
+		if (ret)
-			/* disable only clks which were enabled on error */
+			/* on error: disable all previously enabled clks */
-			for (; i >= 0; i--)
+			fsl_disable_clocks(fsl_edma, i);
-				clk_disable_unprepare(fsl_edma->muxclk[i]);
-			dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
-			return ret;
-		}
 	}
 	if (ret) {
 		dev_err(&pdev->dev,
 			"Can't register Freescale eDMA engine. (%d)\n", ret);
-		fsl_disable_clocks(fsl_edma);
+		fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 		return ret;
 	}
 		dev_err(&pdev->dev,
 			"Can't register Freescale eDMA of_dma. (%d)\n", ret);
 		dma_async_device_unregister(&fsl_edma->dma_dev);
-		fsl_disable_clocks(fsl_edma);
+		fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 		return ret;
 	}
 	fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
 	of_dma_controller_free(np);
 	dma_async_device_unregister(&fsl_edma->dma_dev);
-	fsl_disable_clocks(fsl_edma);
+	fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 	return 0;
 }

drivers/dma/ioat/init.c+1−1

@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma) · 389 unmodified lines
390	if (memcmp(src, dest, IOAT_TEST_SIZE)) {	390	if (memcmp(src, dest, IOAT_TEST_SIZE)) {
391	dev_err(dev, "Self-test copy failed compare, disabling\n");	391	dev_err(dev, "Self-test copy failed compare, disabling\n");
392	err = -ENODEV;	392	err = -ENODEV;
393	goto free_resources;	393	goto unmap_dma;
394	}	394	}
395		395
396	unmap_dma:	396	unmap_dma:

drivers/gpio/gpio-bcm-kona.c+2−1

  * category than their parents, so it won't report false recursion.
  */
 static struct lock_class_key gpio_lock_class;
+static struct lock_class_key gpio_request_class;
 static int bcm_kona_gpio_irq_map(struct irq_domain *d, unsigned int irq,
 				 irq_hw_number_t hwirq)
 	ret = irq_set_chip_data(irq, d->host_data);
 	if (ret < 0)
 		return ret;
-	irq_set_lockdep_class(irq, &gpio_lock_class);
+	irq_set_lockdep_class(irq, &gpio_lock_class, &gpio_request_class);
 	irq_set_chip_and_handler(irq, &bcm_gpio_irq_chip, handle_simple_irq);
 	irq_set_noprobe(irq);

drivers/gpio/gpio-brcmstb.c+3−1

  * category than their parents, so it won't report false recursion.
  */
 static struct lock_class_key brcmstb_gpio_irq_lock_class;
+static struct lock_class_key brcmstb_gpio_irq_request_class;
 static int brcmstb_gpio_irq_map(struct irq_domain *d, unsigned int irq,
 	ret = irq_set_chip_data(irq, &bank->gc);
 	if (ret < 0)
 		return ret;
-	irq_set_lockdep_class(irq, &brcmstb_gpio_irq_lock_class);
+	irq_set_lockdep_class(irq, &brcmstb_gpio_irq_lock_class,
+			      &brcmstb_gpio_irq_request_class);
 	irq_set_chip_and_handler(irq, &priv->irq_chip, handle_level_irq);
 	irq_set_noprobe(irq);
 	return 0;

drivers/gpio/gpio-reg.c+2−2

@@ -103,8 +103,8 @@ static int gpio_reg_to_irq(struct gpio_chip *gc, unsigned offset) · 102 unmodified lines
103	struct gpio_reg *r = to_gpio_reg(gc);	103	struct gpio_reg *r = to_gpio_reg(gc);
104	int irq = r->irqs[offset];	104	int irq = r->irqs[offset];
105		105
106	if (irq >= 0 && r->irq.domain)	106	if (irq >= 0 && r->irqdomain)
107	irq = irq_find_mapping(r->irq.domain, irq);	107	irq = irq_find_mapping(r->irqdomain, irq);
108		108
109	return irq;	109	return irq;
110	}	110	}

drivers/gpio/gpio-tegra.c+3−1

  * than their parents, so it won't report false recursion.
  */
 static struct lock_class_key gpio_lock_class;
+static struct lock_class_key gpio_request_class;
 static int tegra_gpio_probe(struct platform_device *pdev)
 {
 		bank = &tgi->bank_info[GPIO_BANK(gpio)];
-		irq_set_lockdep_class(irq, &gpio_lock_class);
+		irq_set_lockdep_class(irq, &gpio_lock_class,
+				      &gpio_request_class);
 		irq_set_chip_data(irq, bank);
 		irq_set_chip_and_handler(irq, &tgi->ic, handle_simple_irq);
 	}

drivers/gpio/gpio-xgene-sb.c+1−1

@@ -139,7 +139,7 @@ static int xgene_gpio_sb_to_irq(struct gpio_chip *gc, u32 gpio) · 138 unmodified lines
139		139
140	static int xgene_gpio_sb_domain_activate(struct irq_domain *d,	140	static int xgene_gpio_sb_domain_activate(struct irq_domain *d,
141	struct irq_data *irq_data,	141	struct irq_data *irq_data,
142	bool early)	142	bool reserve)
143	{	143	{
144	struct xgene_gpio_sb *priv = d->host_data;	144	struct xgene_gpio_sb *priv = d->host_data;
145	u32 gpio = HWIRQ_TO_GPIO(priv, irq_data->hwirq);	145	u32 gpio = HWIRQ_TO_GPIO(priv, irq_data->hwirq);

drivers/gpio/gpiolib-acpi.c+1−1

@@ -1074,7 +1074,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip) · 1073 unmodified lines
1074	}	1074	}
1075		1075
1076	if (!chip->names)	1076	if (!chip->names)
1077	devprop_gpiochip_set_names(chip);	1077	devprop_gpiochip_set_names(chip, dev_fwnode(chip->parent));
1078		1078
1079	acpi_gpiochip_request_regions(acpi_gpio);	1079	acpi_gpiochip_request_regions(acpi_gpio);
1080	acpi_gpiochip_scan_gpios(acpi_gpio);	1080	acpi_gpiochip_scan_gpios(acpi_gpio);

drivers/gpio/gpiolib-devprop.c+7−10

 /**
  * devprop_gpiochip_set_names - Set GPIO line names using device properties
  * @chip: GPIO chip whose lines should be named, if possible
+ * @fwnode: Property Node containing the gpio-line-names property
  *
  * Looks for device property "gpio-line-names" and if it exists assigns
  * GPIO line names for the chip. The memory allocated for the assigned
  * names belong to the underlying firmware node and should not be released
  * by the caller.
  */
-void devprop_gpiochip_set_names(struct gpio_chip *chip)
+void devprop_gpiochip_set_names(struct gpio_chip *chip,
+				const struct fwnode_handle *fwnode)
 {
 	struct gpio_device *gdev = chip->gpiodev;
 	const char **names;
 	int ret, i;
-	if (!chip->parent) {
+	ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
-		dev_warn(&gdev->dev, "GPIO chip parent is NULL\n");
-		return;
-	}
-	ret = device_property_read_string_array(chip->parent, "gpio-line-names",
 						NULL, 0);
 	if (ret < 0)
 		return;
 	if (ret != gdev->ngpio) {
-		dev_warn(chip->parent,
+		dev_warn(&gdev->dev,
 			 "names %d do not match number of GPIOs %d\n", ret,
 			 gdev->ngpio);
 		return;
 	if (!names)
 		return;
-	ret = device_property_read_string_array(chip->parent, "gpio-line-names",
+	ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
 						names, gdev->ngpio);
 	if (ret < 0) {
-		dev_warn(chip->parent, "failed to read GPIO line names\n");
+		dev_warn(&gdev->dev, "failed to read GPIO line names\n");
 		kfree(names);
 		return;
 	}

drivers/gpio/gpiolib-of.c+2−1

@@ -493,7 +493,8 @@ int of_gpiochip_add(struct gpio_chip *chip) · 492 unmodified lines
493		493
494	/* If the chip defines names itself, these take precedence */	494	/* If the chip defines names itself, these take precedence */
495	if (!chip->names)	495	if (!chip->names)
496	devprop_gpiochip_set_names(chip);	496	devprop_gpiochip_set_names(chip,
		497	of_fwnode_handle(chip->of_node));
497		498
498	of_node_get(chip->of_node);	499	of_node_get(chip->of_node);
499		500

drivers/gpio/gpiolib.c+18−9

 static void gpiochip_free_hogs(struct gpio_chip *chip);
 static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-				struct lock_class_key *key);
+				struct lock_class_key *lock_key,
+				struct lock_class_key *request_key);
 static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip);
 static int gpiochip_irqchip_init_valid_mask(struct gpio_chip *gpiochip);
 static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gpiochip);
 }
 int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
-			       struct lock_class_key *key)
+			       struct lock_class_key *lock_key,
+			       struct lock_class_key *request_key)
 {
 	unsigned long	flags;
 	int		status = 0;
 	if (status)
 		goto err_remove_from_list;
-	status = gpiochip_add_irqchip(chip, key);
+	status = gpiochip_add_irqchip(chip, lock_key, request_key);
 	if (status)
 		goto err_remove_chip;
 	 * This lock class tells lockdep that GPIO irqs are in a different
 	 * category than their parents, so it won't report false recursion.
 	 */
-	irq_set_lockdep_class(irq, chip->irq.lock_key);
+	irq_set_lockdep_class(irq, chip->irq.lock_key, chip->irq.request_key);
 	irq_set_chip_and_handler(irq, chip->irq.chip, chip->irq.handler);
 	/* Chips that use nested thread handlers have them marked */
 	if (chip->irq.threaded)
 /**
  * gpiochip_add_irqchip() - adds an IRQ chip to a GPIO chip
  * @gpiochip: the GPIO chip to add the IRQ chip to
- * @lock_key: lockdep class
+ * @lock_key: lockdep class for IRQ lock
+ * @request_key: lockdep class for IRQ request
  */
 static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-				struct lock_class_key *lock_key)
+				struct lock_class_key *lock_key,
+				struct lock_class_key *request_key)
 {
 	struct irq_chip *irqchip = gpiochip->irq.chip;
 	const struct irq_domain_ops *ops;
 	gpiochip->to_irq = gpiochip_to_irq;
 	gpiochip->irq.default_type = type;
 	gpiochip->irq.lock_key = lock_key;
+	gpiochip->irq.request_key = request_key;
 	if (gpiochip->irq.domain_ops)
 		ops = gpiochip->irq.domain_ops;
  * @type: the default type for IRQs on this irqchip, pass IRQ_TYPE_NONE
  * to have the core avoid setting up any default type in the hardware.
  * @threaded: whether this irqchip uses a nested thread handler
- * @lock_key: lockdep class
+ * @lock_key: lockdep class for IRQ lock
+ * @request_key: lockdep class for IRQ request
  *
  * This function closely associates a certain irqchip with a certain
  * gpiochip, providing an irq domain to translate the local IRQs to
 			     irq_flow_handler_t handler,
 			     unsigned int type,
 			     bool threaded,
-			     struct lock_class_key *lock_key)
+			     struct lock_class_key *lock_key,
+			     struct lock_class_key *request_key)
 {
 	struct device_node *of_node;
 	gpiochip->irq.default_type = type;
 	gpiochip->to_irq = gpiochip_to_irq;
 	gpiochip->irq.lock_key = lock_key;
+	gpiochip->irq.request_key = request_key;
 	gpiochip->irq.domain = irq_domain_add_simple(of_node,
 					gpiochip->ngpio, first_irq,
 					&gpiochip_domain_ops, gpiochip);
 #else /* CONFIG_GPIOLIB_IRQCHIP */
 static inline int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-				       struct lock_class_key *key)
+				       struct lock_class_key *lock_key,
+				       struct lock_class_key *request_key)
 {
 	return 0;
 }

drivers/gpio/gpiolib.h+2−1

@@ -228,7 +228,8 @@ static inline int gpio_chip_hwgpio(const struct gpio_desc *desc) · 227 unmodified lines
228	return desc - &desc->gdev->descs[0];	228	return desc - &desc->gdev->descs[0];
229	}	229	}
230		230
231	void devprop_gpiochip_set_names(struct gpio_chip *chip);	231	void devprop_gpiochip_set_names(struct gpio_chip *chip,
		232	const struct fwnode_handle *fwnode);
232		233
233	/* With descriptor prefix */	234	/* With descriptor prefix */
234		235

drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c+1−1

@@ -2467,7 +2467,7 @@ static int gfx_v9_0_kiq_kcq_enable(struct amdgpu_device *adev) · 2466 unmodified lines
2467	PACKET3_MAP_QUEUES_PIPE(ring->pipe) \|	2467	PACKET3_MAP_QUEUES_PIPE(ring->pipe) \|
2468	PACKET3_MAP_QUEUES_ME((ring->me == 1 ? 0 : 1)) \|	2468	PACKET3_MAP_QUEUES_ME((ring->me == 1 ? 0 : 1)) \|
2469	PACKET3_MAP_QUEUES_QUEUE_TYPE(0) \| /queue_type: normal compute queue /	2469	PACKET3_MAP_QUEUES_QUEUE_TYPE(0) \| /queue_type: normal compute queue /
2470	PACKET3_MAP_QUEUES_ALLOC_FORMAT(1) \| /* alloc format: all_on_one_pipe */	2470	PACKET3_MAP_QUEUES_ALLOC_FORMAT(0) \| /* alloc format: all_on_one_pipe */
2471	PACKET3_MAP_QUEUES_ENGINE_SEL(0) \| /* engine_sel: compute */	2471	PACKET3_MAP_QUEUES_ENGINE_SEL(0) \| /* engine_sel: compute */
2472	PACKET3_MAP_QUEUES_NUM_QUEUES(1)); /* num_queues: must be 1 */	2472	PACKET3_MAP_QUEUES_NUM_QUEUES(1)); /* num_queues: must be 1 */
2473	amdgpu_ring_write(kiq_ring, PACKET3_MAP_QUEUES_DOORBELL_OFFSET(ring->doorbell_index));	2473	amdgpu_ring_write(kiq_ring, PACKET3_MAP_QUEUES_DOORBELL_OFFSET(ring->doorbell_index));

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+8−5

 		       const struct dm_connector_state *dm_state)
 {
 	struct drm_display_mode *preferred_mode = NULL;
-	const struct drm_connector *drm_connector;
+	struct drm_connector *drm_connector;
 	struct dc_stream_state *stream = NULL;
 	struct drm_display_mode mode = *drm_mode;
 	bool native_mode_found = false;
 	if (!aconnector->dc_sink) {
 		/*
-		 * Exclude MST from creating fake_sink
+		 * Create dc_sink when necessary to MST
-		 * TODO: need to enable MST into fake_sink feature
+		 * Don't apply fake_sink to MST
 		 */
-		if (aconnector->mst_port)
+		if (aconnector->mst_port) {
-			goto stream_create_fail;
+			dm_dp_mst_dc_sink_create(drm_connector);
+			goto mst_dc_sink_create_done;
+		}
 		if (create_fake_sink(aconnector))
 			goto stream_create_fail;
 stream_create_fail:
 dm_state_null:
 drm_connector_null:
+mst_dc_sink_create_done:
 	return stream;
 }

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h+2−0

@@ -189,6 +189,8 @@ struct amdgpu_dm_connector { · 188 unmodified lines
189	struct mutex hpd_lock;	189	struct mutex hpd_lock;
190		190
191	bool fake_enable;	191	bool fake_enable;
		192
		193	bool mst_connected;
192	};	194	};
193		195
194	#define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)	196	#define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c+51−0

@@ -185,6 +185,42 @@ static int dm_connector_update_modes(struct drm_connector *connector, · 184 unmodified lines
185	return ret;	185	return ret;
186	}	186	}
187		187
		188	void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
		189	{
		190	struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
		191	struct edid *edid;
		192	struct dc_sink *dc_sink;
		193	struct dc_sink_init_data init_params = {
		194	.link = aconnector->dc_link,
		195	.sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
		196
		197	edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
		198
		199	if (!edid) {
		200	drm_mode_connector_update_edid_property(
		201	&aconnector->base,
		202	NULL);
		203	return;
		204	}
		205
		206	aconnector->edid = edid;
		207
		208	dc_sink = dc_link_add_remote_sink(
		209	aconnector->dc_link,
		210	(uint8_t *)aconnector->edid,
		211	(aconnector->edid->extensions + 1) * EDID_LENGTH,
		212	&init_params);
		213
		214	dc_sink->priv = aconnector;
		215	aconnector->dc_sink = dc_sink;
		216
		217	amdgpu_dm_add_sink_to_freesync_module(
		218	connector, aconnector->edid);
		219
		220	drm_mode_connector_update_edid_property(
		221	&aconnector->base, aconnector->edid);
		222	}
		223
188	static int dm_dp_mst_get_modes(struct drm_connector *connector)	224	static int dm_dp_mst_get_modes(struct drm_connector *connector)
189	{	225	{
190	struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);	226	struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
@@ -311,6 +347,7 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, · 120 unmodified lines
311	drm_mode_connector_set_path_property(connector, pathprop);	347	drm_mode_connector_set_path_property(connector, pathprop);
312		348
313	drm_connector_list_iter_end(&conn_iter);	349	drm_connector_list_iter_end(&conn_iter);
		350	aconnector->mst_connected = true;
314	return &aconnector->base;	351	return &aconnector->base;
315	}	352	}
316	}	353	}
@@ -363,6 +400,8 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, · 46 unmodified lines
363	*/	400	*/
364	amdgpu_dm_connector_funcs_reset(connector);	401	amdgpu_dm_connector_funcs_reset(connector);
365		402
		403	aconnector->mst_connected = true;
		404
366	DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",	405	DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
367	aconnector, connector->base.id, aconnector->mst_port);	406	aconnector, connector->base.id, aconnector->mst_port);
368		407
@@ -394,6 +433,8 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, · 25 unmodified lines
394	drm_mode_connector_update_edid_property(	433	drm_mode_connector_update_edid_property(
395	&aconnector->base,	434	&aconnector->base,
396	NULL);	435	NULL);
		436
		437	aconnector->mst_connected = false;
397	}	438	}
398		439
399	static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)	440	static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
@@ -404,10 +445,18 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr) · 4 unmodified lines
404	drm_kms_helper_hotplug_event(dev);	445	drm_kms_helper_hotplug_event(dev);
405	}	446	}
406		447
		448	static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
		449	{
		450	mutex_lock(&connector->dev->mode_config.mutex);
		451	drm_mode_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
		452	mutex_unlock(&connector->dev->mode_config.mutex);
		453	}
		454
407	static void dm_dp_mst_register_connector(struct drm_connector *connector)	455	static void dm_dp_mst_register_connector(struct drm_connector *connector)
408	{	456	{
409	struct drm_device *dev = connector->dev;	457	struct drm_device *dev = connector->dev;
410	struct amdgpu_device *adev = dev->dev_private;	458	struct amdgpu_device *adev = dev->dev_private;
		459	struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
411		460
412	if (adev->mode_info.rfbdev)	461	if (adev->mode_info.rfbdev)
413	drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);	462	drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
@@ -416,6 +465,8 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector) · 2 unmodified lines
416		465
417	drm_connector_register(connector);	466	drm_connector_register(connector);
418		467
		468	if (aconnector->mst_connected)
		469	dm_dp_mst_link_status_reset(connector);
419	}	470	}
420		471
421	static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {	472	static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h+1−0

@@ -31,5 +31,6 @@ struct amdgpu_dm_connector; · 30 unmodified lines
31		31
32	void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,	32	void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
33	struct amdgpu_dm_connector *aconnector);	33	struct amdgpu_dm_connector *aconnector);
		34	void dm_dp_mst_dc_sink_create(struct drm_connector *connector);
34		35
35	#endif	36	#endif

drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c+9−0

@@ -900,6 +900,15 @@ bool dcn_validate_bandwidth( · 899 unmodified lines
900	v->override_vta_ps[input_idx] = pipe->plane_res.scl_data.taps.v_taps;	900	v->override_vta_ps[input_idx] = pipe->plane_res.scl_data.taps.v_taps;
901	v->override_hta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.h_taps_c;	901	v->override_hta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.h_taps_c;
902	v->override_vta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.v_taps_c;	902	v->override_vta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.v_taps_c;
		903	/*
		904	* Spreadsheet doesn't handle taps_c is one properly,
		905	* need to force Chroma to always be scaled to pass
		906	* bandwidth validation.
		907	*/
		908	if (v->override_hta_pschroma[input_idx] == 1)
		909	v->override_hta_pschroma[input_idx] = 2;
		910	if (v->override_vta_pschroma[input_idx] == 1)
		911	v->override_vta_pschroma[input_idx] = 2;
903	v->source_scan[input_idx] = (pipe->plane_state->rotation % 2) ? dcn_bw_vert : dcn_bw_hor;	912	v->source_scan[input_idx] = (pipe->plane_state->rotation % 2) ? dcn_bw_vert : dcn_bw_hor;
904	}	913	}
905	if (v->is_line_buffer_bpp_fixed == dcn_bw_yes)	914	if (v->is_line_buffer_bpp_fixed == dcn_bw_yes)

drivers/gpu/drm/amd/display/dc/core/dc_link.c+3−1

 		link->link_enc->funcs->disable_output(link->link_enc, signal, link);
 }
-bool dp_active_dongle_validate_timing(
+static bool dp_active_dongle_validate_timing(
 		const struct dc_crtc_timing *timing,
 		const struct dc_dongle_caps *dongle_caps)
 {
 	/* Check Color Depth and Pixel Clock */
 	if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR420)
 		required_pix_clk /= 2;
+	else if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR422)
+		required_pix_clk = required_pix_clk * 2 / 3;
 	switch (timing->display_color_depth) {
 	case COLOR_DEPTH_666:

drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c+21−5

@@ -2866,16 +2866,19 @@ static void dce110_apply_ctx_for_surface( · 2865 unmodified lines
2866	int num_planes,	2866	int num_planes,
2867	struct dc_state *context)	2867	struct dc_state *context)
2868	{	2868	{
2869	int i, be_idx;	2869	int i;
2870		2870
2871	if (num_planes == 0)	2871	if (num_planes == 0)
2872	return;	2872	return;
2873		2873
2874	be_idx = -1;
2875	for (i = 0; i < dc->res_pool->pipe_count; i++) {	2874	for (i = 0; i < dc->res_pool->pipe_count; i++) {
2876	if (stream == context->res_ctx.pipe_ctx[i].stream) {	2875	struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
2877	be_idx = context->res_ctx.pipe_ctx[i].stream_res.tg->inst;	2876	struct pipe_ctx *old_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
2878	break;	2877
		2878	if (stream == pipe_ctx->stream) {
		2879	if (!pipe_ctx->top_pipe &&
		2880	(pipe_ctx->plane_state \|\| old_pipe_ctx->plane_state))
		2881	dc->hwss.pipe_control_lock(dc, pipe_ctx, true);
2879	}	2882	}
2880	}	2883	}
2881		2884
@@ -2895,9 +2898,22 @@ static void dce110_apply_ctx_for_surface( · 13 unmodified lines
2895	context->stream_count);	2898	context->stream_count);
2896		2899
2897	dce110_program_front_end_for_pipe(dc, pipe_ctx);	2900	dce110_program_front_end_for_pipe(dc, pipe_ctx);
		2901
		2902	dc->hwss.update_plane_addr(dc, pipe_ctx);
		2903
2898	program_surface_visibility(dc, pipe_ctx);	2904	program_surface_visibility(dc, pipe_ctx);
2899		2905
2900	}	2906	}
		2907
		2908	for (i = 0; i < dc->res_pool->pipe_count; i++) {
		2909	struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
		2910	struct pipe_ctx *old_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
		2911
		2912	if ((stream == pipe_ctx->stream) &&
		2913	(!pipe_ctx->top_pipe) &&
		2914	(pipe_ctx->plane_state \|\| old_pipe_ctx->plane_state))
		2915	dc->hwss.pipe_control_lock(dc, pipe_ctx, false);
		2916	}
2901	}	2917	}
2902		2918
2903	static void dce110_power_down_fe(struct dc *dc, int fe_idx)	2919	static void dce110_power_down_fe(struct dc *dc, int fe_idx)

drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c+4−5

 			scl_data->taps.h_taps = 1;
 		if (IDENTITY_RATIO(scl_data->ratios.vert))
 			scl_data->taps.v_taps = 1;
-		/*
+		if (IDENTITY_RATIO(scl_data->ratios.horz_c))
-		 * Spreadsheet doesn't handle taps_c is one properly,
+			scl_data->taps.h_taps_c = 1;
-		 * need to force Chroma to always be scaled to pass
+		if (IDENTITY_RATIO(scl_data->ratios.vert_c))
-		 * bandwidth validation.
+			scl_data->taps.v_taps_c = 1;
-		 */
 	}
 	return true;

drivers/gpu/drm/drm_connector.c+48−15

@@ -152,14 +152,23 @@ static void drm_connector_free(struct kref *kref) · 151 unmodified lines
152	connector->funcs->destroy(connector);	152	connector->funcs->destroy(connector);
153	}	153	}
154		154
155	static void drm_connector_free_work_fn(struct work_struct *work)	155	void drm_connector_free_work_fn(struct work_struct *work)
156	{	156	{
157	struct drm_connector *connector =	157	struct drm_connector connector, n;
158	container_of(work, struct drm_connector, free_work);	158	struct drm_device *dev =
159	struct drm_device *dev = connector->dev;	159	container_of(work, struct drm_device, mode_config.connector_free_work);
		160	struct drm_mode_config *config = &dev->mode_config;
		161	unsigned long flags;
		162	struct llist_node *freed;
160		163
161	drm_mode_object_unregister(dev, &connector->base);	164	spin_lock_irqsave(&config->connector_list_lock, flags);
162	connector->funcs->destroy(connector);	165	freed = llist_del_all(&config->connector_free_list);
		166	spin_unlock_irqrestore(&config->connector_list_lock, flags);
		167
		168	llist_for_each_entry_safe(connector, n, freed, free_node) {
		169	drm_mode_object_unregister(dev, &connector->base);
		170	connector->funcs->destroy(connector);
		171	}
163	}	172	}
164		173
165	/**	174	/**
@@ -191,8 +200,6 @@ int drm_connector_init(struct drm_device *dev, · 25 unmodified lines
191	if (ret)	200	if (ret)
192	return ret;	201	return ret;
193		202
194	INIT_WORK(&connector->free_work, drm_connector_free_work_fn);
195
196	connector->base.properties = &connector->properties;	203	connector->base.properties = &connector->properties;
197	connector->dev = dev;	204	connector->dev = dev;
198	connector->funcs = funcs;	205	connector->funcs = funcs;
@@ -547,10 +554,17 @@ EXPORT_SYMBOL(drm_connector_list_iter_begin); · 348 unmodified lines
547	* actually release the connector when dropping our final reference.	554	* actually release the connector when dropping our final reference.
548	*/	555	*/
549	static void	556	static void
550	drm_connector_put_safe(struct drm_connector *conn)	557	__drm_connector_put_safe(struct drm_connector *conn)
551	{	558	{
552	if (refcount_dec_and_test(&conn->base.refcount.refcount))	559	struct drm_mode_config *config = &conn->dev->mode_config;
553	schedule_work(&conn->free_work);	560
		561	lockdep_assert_held(&config->connector_list_lock);
		562
		563	if (!refcount_dec_and_test(&conn->base.refcount.refcount))
		564	return;
		565
		566	llist_add(&conn->free_node, &config->connector_free_list);
		567	schedule_work(&config->connector_free_work);
554	}	568	}
555		569
556	/**	570	/**
@@ -582,10 +596,10 @@ drm_connector_list_iter_next(struct drm_connector_list_iter *iter) · 25 unmodified lines
582		596
583	/* loop until it's not a zombie connector */	597	/* loop until it's not a zombie connector */
584	} while (!kref_get_unless_zero(&iter->conn->base.refcount));	598	} while (!kref_get_unless_zero(&iter->conn->base.refcount));
585	spin_unlock_irqrestore(&config->connector_list_lock, flags);
586		599
587	if (old_conn)	600	if (old_conn)
588	drm_connector_put_safe(old_conn);	601	__drm_connector_put_safe(old_conn);
		602	spin_unlock_irqrestore(&config->connector_list_lock, flags);
589		603
590	return iter->conn;	604	return iter->conn;
591	}	605	}
@@ -602,9 +616,15 @@ EXPORT_SYMBOL(drm_connector_list_iter_next); · 10 unmodified lines
602	*/	616	*/
603	void drm_connector_list_iter_end(struct drm_connector_list_iter *iter)	617	void drm_connector_list_iter_end(struct drm_connector_list_iter *iter)
604	{	618	{
		619	struct drm_mode_config *config = &iter->dev->mode_config;
		620	unsigned long flags;
		621
605	iter->dev = NULL;	622	iter->dev = NULL;
606	if (iter->conn)	623	if (iter->conn) {
607	drm_connector_put_safe(iter->conn);	624	spin_lock_irqsave(&config->connector_list_lock, flags);
		625	__drm_connector_put_safe(iter->conn);
		626	spin_unlock_irqrestore(&config->connector_list_lock, flags);
		627	}
608	lock_release(&connector_list_iter_dep_map, 0, _RET_IP_);	628	lock_release(&connector_list_iter_dep_map, 0, _RET_IP_);
609	}	629	}
610	EXPORT_SYMBOL(drm_connector_list_iter_end);	630	EXPORT_SYMBOL(drm_connector_list_iter_end);
@@ -1231,6 +1251,19 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector, · 620 unmodified lines
1231	if (edid)	1251	if (edid)
1232	size = EDID_LENGTH * (1 + edid->extensions);	1252	size = EDID_LENGTH * (1 + edid->extensions);
1233		1253
		1254	/* Set the display info, using edid if available, otherwise
		1255	* reseting the values to defaults. This duplicates the work
		1256	* done in drm_add_edid_modes, but that function is not
		1257	* consistently called before this one in all drivers and the
		1258	* computation is cheap enough that it seems better to
		1259	* duplicate it rather than attempt to ensure some arbitrary
		1260	* ordering of calls.
		1261	*/
		1262	if (edid)
		1263	drm_add_display_info(connector, edid);
		1264	else
		1265	drm_reset_display_info(connector);
		1266
1234	drm_object_property_set_value(&connector->base,	1267	drm_object_property_set_value(&connector->base,
1235	dev->mode_config.non_desktop_property,	1268	dev->mode_config.non_desktop_property,
1236	connector->display_info.non_desktop);	1269	connector->display_info.non_desktop);

drivers/gpu/drm/drm_crtc_internal.h+1−0

@@ -142,6 +142,7 @@ int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj, · 141 unmodified lines
142	uint64_t value);	142	uint64_t value);
143	int drm_connector_create_standard_properties(struct drm_device *dev);	143	int drm_connector_create_standard_properties(struct drm_device *dev);
144	const char *drm_get_connector_force_name(enum drm_connector_force force);	144	const char *drm_get_connector_force_name(enum drm_connector_force force);
		145	void drm_connector_free_work_fn(struct work_struct *work);
145		146
146	/* IOCTL */	147	/* IOCTL */
147	int drm_mode_connector_property_set_ioctl(struct drm_device *dev,	148	int drm_mode_connector_property_set_ioctl(struct drm_device *dev,

drivers/gpu/drm/drm_edid.c+38−14

  *
  * Returns true if @vendor is in @edid, false otherwise
  */
-static bool edid_vendor(struct edid *edid, const char *vendor)
+static bool edid_vendor(const struct edid *edid, const char *vendor)
 {
 	char edid_vendor[3];
  *
  * This tells subsequent routines what fixes they need to apply.
  */
-static u32 edid_get_quirks(struct edid *edid)
+static u32 edid_get_quirks(const struct edid *edid)
 {
 	const struct edid_quirk *quirk;
 	int i;
 /*
  * Search EDID for CEA extension block.
  */
-static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
+static u8 *drm_find_edid_extension(const struct edid *edid, int ext_id)
 {
 	u8 *edid_ext = NULL;
 	int i;
 	return edid_ext;
 }
-static u8 *drm_find_cea_extension(struct edid *edid)
+static u8 *drm_find_cea_extension(const struct edid *edid)
 {
 	return drm_find_edid_extension(edid, CEA_EXT);
 }
-static u8 *drm_find_displayid_extension(struct edid *edid)
+static u8 *drm_find_displayid_extension(const struct edid *edid)
 {
 	return drm_find_edid_extension(edid, DISPLAYID_EXT);
 }
 }
 static void drm_parse_cea_ext(struct drm_connector *connector,
-			      struct edid *edid)
+			      const struct edid *edid)
 {
 	struct drm_display_info *info = &connector->display_info;
 	const u8 *edid_ext;
 	}
 }
-static void drm_add_display_info(struct drm_connector *connector,
+/* A connector has no EDID information, so we've got no EDID to compute quirks from. Reset
-				 struct edid *edid, u32 quirks)
+ * all of the values which would have been set from EDID
+ */
+void
+drm_reset_display_info(struct drm_connector *connector)
 {
 	struct drm_display_info *info = &connector->display_info;
+	info->width_mm = 0;
+	info->height_mm = 0;
+	info->bpc = 0;
+	info->color_formats = 0;
+	info->cea_rev = 0;
+	info->max_tmds_clock = 0;
+	info->dvi_dual = false;
+	info->non_desktop = 0;
+}
+EXPORT_SYMBOL_GPL(drm_reset_display_info);
+u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edid)
+{
+	struct drm_display_info *info = &connector->display_info;
+	u32 quirks = edid_get_quirks(edid);
 	info->width_mm = edid->width_cm * 10;
 	info->height_mm = edid->height_cm * 10;
 	info->non_desktop = !!(quirks & EDID_QUIRK_NON_DESKTOP);
+	DRM_DEBUG_KMS("non_desktop set to %d\n", info->non_desktop);
 	if (edid->revision < 3)
-		return;
+		return quirks;
 	if (!(edid->input & DRM_EDID_INPUT_DIGITAL))
-		return;
+		return quirks;
 	drm_parse_cea_ext(connector, edid);
 	/* Only defined for 1.4 with digital displays */
 	if (edid->revision < 4)
-		return;
+		return quirks;
 	switch (edid->input & DRM_EDID_DIGITAL_DEPTH_MASK) {
 	case DRM_EDID_DIGITAL_DEPTH_6:
 		info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
 	if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422)
 		info->color_formats |= DRM_COLOR_FORMAT_YCRCB422;
+	return quirks;
 }
+EXPORT_SYMBOL_GPL(drm_add_display_info);
 static int validate_displayid(u8 *displayid, int length, int idx)
 {
 		return 0;
 	}
-	quirks = edid_get_quirks(edid);
 	/*
 	 * CEA-861-F adds ycbcr capability map block, for HDMI 2.0 sinks.
 	 * To avoid multiple parsing of same block, lets parse that map
 	 * from sink info, before parsing CEA modes.
 	 */
-	drm_add_display_info(connector, edid, quirks);
+	quirks = drm_add_display_info(connector, edid);
 	/*
 	 * EDID spec says modes should be preferred in this order:

drivers/gpu/drm/drm_lease.c+13−13

 	mutex_lock(&dev->mode_config.idr_mutex);
-	/* Insert the new lessee into the tree */
-	id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
-	if (id < 0) {
-		error = id;
-		goto out_lessee;
-	}
-	lessee->lessee_id = id;
-	lessee->lessor = drm_master_get(lessor);
-	list_add_tail(&lessee->lessee_list, &lessor->lessees);
 	idr_for_each_entry(leases, entry, object) {
 		error = 0;
 		if (!idr_find(&dev->mode_config.crtc_idr, object))
 		}
 	}
+	/* Insert the new lessee into the tree */
+	id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
+	if (id < 0) {
+		error = id;
+		goto out_lessee;
+	}
+	lessee->lessee_id = id;
+	lessee->lessor = drm_master_get(lessor);
+	list_add_tail(&lessee->lessee_list, &lessor->lessees);
 	/* Move the leases over */
 	lessee->leases = *leases;
 	DRM_DEBUG_LEASE("new lessee %d %p, lessor %d %p\n", lessee->lessee_id, lessee, lessor->lessee_id, lessor);
 	return lessee;
 out_lessee:
-	drm_master_put(&lessee);
 	mutex_unlock(&dev->mode_config.idr_mutex);
+	drm_master_put(&lessee);
 	return ERR_PTR(error);
 }

drivers/gpu/drm/drm_mm.c+5−3

  */
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
+	struct drm_mm *mm = old->mm;
 	DRM_MM_BUG_ON(!old->allocated);
 	*new = *old;
 	list_replace(&old->node_list, &new->node_list);
-	rb_replace_node(&old->rb, &new->rb, &old->mm->interval_tree.rb_root);
+	rb_replace_node_cached(&old->rb, &new->rb, &mm->interval_tree);
 	if (drm_mm_hole_follows(old)) {
 		list_replace(&old->hole_stack, &new->hole_stack);
 		rb_replace_node(&old->rb_hole_size,
 				&new->rb_hole_size,
-				&old->mm->holes_size);
+				&mm->holes_size);
 		rb_replace_node(&old->rb_hole_addr,
 				&new->rb_hole_addr,
-				&old->mm->holes_addr);
+				&mm->holes_addr);
 	}
 	old->allocated = false;

drivers/gpu/drm/drm_mode_config.c+4−1

 	ida_init(&dev->mode_config.connector_ida);
 	spin_lock_init(&dev->mode_config.connector_list_lock);
+	init_llist_head(&dev->mode_config.connector_free_list);
+	INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
 	drm_mode_create_standard_properties(dev);
 	/* Just to be sure */
 	}
 	drm_connector_list_iter_end(&conn_iter);
 	/* connector_iter drops references in a work item. */
-	flush_scheduled_work();
+	flush_work(&dev->mode_config.connector_free_work);
 	if (WARN_ON(!list_empty(&dev->mode_config.connector_list))) {
 		drm_connector_list_iter_begin(dev, &conn_iter);
 		drm_for_each_connector_iter(connector, &conn_iter)

drivers/gpu/drm/drm_plane.c+20−22

@@ -558,11 +558,10 @@ int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format) · 557 unmodified lines
558	}	558	}
559		559
560	/*	560	/*
561	* setplane_internal - setplane handler for internal callers	561	* __setplane_internal - setplane handler for internal callers
562	*	562	*
563	* Note that we assume an extra reference has already been taken on fb. If the	563	* This function will take a reference on the new fb for the plane
564	* update fails, this reference will be dropped before return; if it succeeds,	564	* on success.
565	* the previous framebuffer (if any) will be unreferenced instead.
566	*	565	*
567	* src_{x,y,w,h} are provided in 16.16 fixed point format	566	* src_{x,y,w,h} are provided in 16.16 fixed point format
568	*/	567	*/
@@ -630,14 +629,12 @@ static int __setplane_internal(struct drm_plane *plane, · 61 unmodified lines
630	if (!ret) {	629	if (!ret) {
631	plane->crtc = crtc;	630	plane->crtc = crtc;
632	plane->fb = fb;	631	plane->fb = fb;
633	fb = NULL;	632	drm_framebuffer_get(plane->fb);
634	} else {	633	} else {
635	plane->old_fb = NULL;	634	plane->old_fb = NULL;
636	}	635	}
637		636
638	out:	637	out:
639	if (fb)
640	drm_framebuffer_put(fb);
641	if (plane->old_fb)	638	if (plane->old_fb)
642	drm_framebuffer_put(plane->old_fb);	639	drm_framebuffer_put(plane->old_fb);
643	plane->old_fb = NULL;	640	plane->old_fb = NULL;
@@ -685,6 +682,7 @@ int drm_mode_setplane(struct drm_device dev, void data, · 41 unmodified lines
685	struct drm_plane *plane;	682	struct drm_plane *plane;
686	struct drm_crtc *crtc = NULL;	683	struct drm_crtc *crtc = NULL;
687	struct drm_framebuffer *fb = NULL;	684	struct drm_framebuffer *fb = NULL;
		685	int ret;
688		686
689	if (!drm_core_check_feature(dev, DRIVER_MODESET))	687	if (!drm_core_check_feature(dev, DRIVER_MODESET))
690	return -EINVAL;	688	return -EINVAL;
@@ -717,15 +715,16 @@ int drm_mode_setplane(struct drm_device dev, void data, · 26 unmodified lines
717	}	715	}
718	}	716	}
719		717
720	/*	718	ret = setplane_internal(plane, crtc, fb,
721	* setplane_internal will take care of deref'ing either the old or new	719	plane_req->crtc_x, plane_req->crtc_y,
722	* framebuffer depending on success.	720	plane_req->crtc_w, plane_req->crtc_h,
723	*/	721	plane_req->src_x, plane_req->src_y,
724	return setplane_internal(plane, crtc, fb,	722	plane_req->src_w, plane_req->src_h);
725	plane_req->crtc_x, plane_req->crtc_y,	723
726	plane_req->crtc_w, plane_req->crtc_h,	724	if (fb)
727	plane_req->src_x, plane_req->src_y,	725	drm_framebuffer_put(fb);
728	plane_req->src_w, plane_req->src_h);	726
		727	return ret;
729	}	728	}
730		729
731	static int drm_mode_cursor_universal(struct drm_crtc *crtc,	730	static int drm_mode_cursor_universal(struct drm_crtc *crtc,
@@ -788,13 +787,12 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc, · 56 unmodified lines
788	src_h = fb->height << 16;	787	src_h = fb->height << 16;
789	}	788	}
790		789
791	/*
792	* setplane_internal will take care of deref'ing either the old or new
793	* framebuffer depending on success.
794	*/
795	ret = __setplane_internal(crtc->cursor, crtc, fb,	790	ret = __setplane_internal(crtc->cursor, crtc, fb,
796	crtc_x, crtc_y, crtc_w, crtc_h,	791	crtc_x, crtc_y, crtc_w, crtc_h,
797	0, 0, src_w, src_h, ctx);	792	0, 0, src_w, src_h, ctx);
		793
		794	if (fb)
		795	drm_framebuffer_put(fb);
798		796
799	/* Update successful; save new cursor position, if necessary */	797	/* Update successful; save new cursor position, if necessary */
800	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {	798	if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {

drivers/gpu/drm/drm_syncobj.c+29−48

@@ -369,40 +369,26 @@ static const struct file_operations drm_syncobj_file_fops = { · 368 unmodified lines
369	.release = drm_syncobj_file_release,	369	.release = drm_syncobj_file_release,
370	};	370	};
371		371
372	static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
373	{
374	struct file *file = anon_inode_getfile("syncobj_file",
375	&drm_syncobj_file_fops,
376	syncobj, 0);
377	if (IS_ERR(file))
378	return PTR_ERR(file);
379
380	drm_syncobj_get(syncobj);
381	if (cmpxchg(&syncobj->file, NULL, file)) {
382	/* lost the race */
383	fput(file);
384	}
385
386	return 0;
387	}
388
389	int drm_syncobj_get_fd(struct drm_syncobj syncobj, int p_fd)	372	int drm_syncobj_get_fd(struct drm_syncobj syncobj, int p_fd)
390	{	373	{
391	int ret;	374	struct file *file;
392	int fd;	375	int fd;
393		376
394	fd = get_unused_fd_flags(O_CLOEXEC);	377	fd = get_unused_fd_flags(O_CLOEXEC);
395	if (fd < 0)	378	if (fd < 0)
396	return fd;	379	return fd;
397		380
398	if (!syncobj->file) {	381	file = anon_inode_getfile("syncobj_file",
399	ret = drm_syncobj_alloc_file(syncobj);	382	&drm_syncobj_file_fops,
400	if (ret) {	383	syncobj, 0);
401	put_unused_fd(fd);	384	if (IS_ERR(file)) {
402	return ret;	385	put_unused_fd(fd);
403	}	386	return PTR_ERR(file);
404	}	387	}
405	fd_install(fd, syncobj->file);	388
		389	drm_syncobj_get(syncobj);
		390	fd_install(fd, file);
		391
406	*p_fd = fd;	392	*p_fd = fd;
407	return 0;	393	return 0;
408	}	394	}
@@ -422,31 +408,24 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private, · 13 unmodified lines
422	return ret;	408	return ret;
423	}	409	}
424		410
425	static struct drm_syncobj *drm_syncobj_fdget(int fd)
426	{
427	struct file *file = fget(fd);
428
429	if (!file)
430	return NULL;
431	if (file->f_op != &drm_syncobj_file_fops)
432	goto err;
433
434	return file->private_data;
435	err:
436	fput(file);
437	return NULL;
438	};
439
440	static int drm_syncobj_fd_to_handle(struct drm_file *file_private,	411	static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
441	int fd, u32 *handle)	412	int fd, u32 *handle)
442	{	413	{
443	struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);	414	struct drm_syncobj *syncobj;
		415	struct file *file;
444	int ret;	416	int ret;
445		417
446	if (!syncobj)	418	file = fget(fd);
		419	if (!file)
447	return -EINVAL;	420	return -EINVAL;
448		421
		422	if (file->f_op != &drm_syncobj_file_fops) {
		423	fput(file);
		424	return -EINVAL;
		425	}
		426
449	/* take a reference to put in the idr */	427	/* take a reference to put in the idr */
		428	syncobj = file->private_data;
450	drm_syncobj_get(syncobj);	429	drm_syncobj_get(syncobj);
451		430
452	idr_preload(GFP_KERNEL);	431	idr_preload(GFP_KERNEL);
@@ -455,12 +434,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private, · 2 unmodified lines
455	spin_unlock(&file_private->syncobj_table_lock);	434	spin_unlock(&file_private->syncobj_table_lock);
456	idr_preload_end();	435	idr_preload_end();
457		436
458	if (ret < 0) {	437	if (ret > 0) {
459	fput(syncobj->file);	438	*handle = ret;
460	return ret;	439	ret = 0;
461	}	440	} else
462	*handle = ret;	441	drm_syncobj_put(syncobj);
463	return 0;	442
		443	fput(file);
		444	return ret;
464	}	445	}
465		446
466	static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,	447	static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,

drivers/gpu/drm/i915/gvt/display.c+3−2

@@ -266,6 +266,8 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu) · 265 unmodified lines
266	/* Clear host CRT status, so guest couldn't detect this host CRT. */	266	/* Clear host CRT status, so guest couldn't detect this host CRT. */
267	if (IS_BROADWELL(dev_priv))	267	if (IS_BROADWELL(dev_priv))
268	vgpu_vreg(vgpu, PCH_ADPA) &= ~ADPA_CRT_HOTPLUG_MONITOR_MASK;	268	vgpu_vreg(vgpu, PCH_ADPA) &= ~ADPA_CRT_HOTPLUG_MONITOR_MASK;
		269
		270	vgpu_vreg(vgpu, PIPECONF(PIPE_A)) \|= PIPECONF_ENABLE;
269	}	271	}
270		272
271	static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)	273	static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
@@ -282,7 +284,6 @@ static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num) · 10 unmodified lines
282	static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,	284	static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
283	int type, unsigned int resolution)	285	int type, unsigned int resolution)
284	{	286	{
285	struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
286	struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);	287	struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);
287		288
288	if (WARN_ON(resolution >= GVT_EDID_NUM))	289	if (WARN_ON(resolution >= GVT_EDID_NUM))
@@ -308,7 +309,7 @@ static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num, · 19 unmodified lines
308	port->type = type;	309	port->type = type;
309		310
310	emulate_monitor_status_change(vgpu);	311	emulate_monitor_status_change(vgpu);
311	vgpu_vreg(vgpu, PIPECONF(PIPE_A)) \|= PIPECONF_ENABLE;	312
312	return 0;	313	return 0;
313	}	314	}
314		315

drivers/gpu/drm/i915/i915_gem.c+1−8

 	 * must wait for all rendering to complete to the object (as unbinding
 	 * must anyway), and retire the requests.
 	 */
-	ret = i915_gem_object_wait(obj,
+	ret = i915_gem_object_set_to_cpu_domain(obj, false);
-				   I915_WAIT_INTERRUPTIBLE |
-				   I915_WAIT_LOCKED |
-				   I915_WAIT_ALL,
-				   MAX_SCHEDULE_TIMEOUT,
-				   NULL);
 	if (ret)
 		return ret;
-	i915_gem_retire_requests(to_i915(obj->base.dev));
 	while ((vma = list_first_entry_or_null(&obj->vma_list,
 					       struct i915_vma,
 					       obj_link))) {

drivers/gpu/drm/i915/i915_sw_fence.c+2−1

 	struct dma_fence *dma;
 	struct timer_list timer;
 	struct irq_work work;
+	struct rcu_head rcu;
 };
 static void timer_i915_sw_fence_wake(struct timer_list *t)
 	del_timer_sync(&cb->timer);
 	dma_fence_put(cb->dma);
-	kfree(cb);
+	kfree_rcu(cb, rcu);
 }
 int i915_sw_fence_await_dma_fence(struct i915_sw_fence *fence,

drivers/gpu/drm/i915/intel_breadcrumbs.c+11−11

 	struct intel_wait *wait, *n, *first;
 	if (!b->irq_armed)
-		return;
+		goto wakeup_signaler;
 	/* We only disarm the irq when we are idle (all requests completed),
 	 * so if the bottom-half remains asleep, it missed the request
 	b->waiters = RB_ROOT;
 	spin_unlock_irq(&b->rb_lock);
+	/*
+	 * The signaling thread may be asleep holding a reference to a request,
+	 * that had its signaling cancelled prior to being preempted. We need
+	 * to kick the signaler, just in case, to release any such reference.
+	 */
+wakeup_signaler:
+	wake_up_process(b->signaler);
 }
 static bool use_fake_irq(const struct intel_breadcrumbs *b)
 		}
 		if (unlikely(do_schedule)) {
-			DEFINE_WAIT(exec);
 			if (kthread_should_park())
 				kthread_parkme();
-			if (kthread_should_stop()) {
+			if (unlikely(kthread_should_stop())) {
-				GEM_BUG_ON(request);
+				i915_gem_request_put(request);
 				break;
 			}
-			if (request)
-				add_wait_queue(&request->execute, &exec);
 			schedule();
-			if (request)
-				remove_wait_queue(&request->execute, &exec);
 		}
 		i915_gem_request_put(request);
 	} while (1);

drivers/gpu/drm/i915/intel_ddi.c+4−0

 	if (WARN_ON(!pll))
 		return;
+	 mutex_lock(&dev_priv->dpll_lock);
 	if (IS_CANNONLAKE(dev_priv)) {
 		/* Configure DPCLKA_CFGCR0 to map the DPLL to the DDI. */
 		val = I915_READ(DPCLKA_CFGCR0);
 	} else if (INTEL_INFO(dev_priv)->gen < 9) {
 		I915_WRITE(PORT_CLK_SEL(port), hsw_pll_to_ddi_pll_sel(pll));
 	}
+	mutex_unlock(&dev_priv->dpll_lock);
 }
 static void intel_ddi_clk_disable(struct intel_encoder *encoder)

drivers/gpu/drm/i915/intel_display.c+2−3

 	}
 	ret = intel_modeset_setup_plane_state(state, crtc, mode, fb, 0, 0);
+	drm_framebuffer_put(fb);
 	if (ret)
 		goto fail;
-	drm_framebuffer_put(fb);
 	ret = drm_atomic_set_mode_for_crtc(&crtc_state->base, mode);
 	if (ret)
 		goto fail;
 	primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe);
 	primary->check_plane = intel_check_primary_plane;
-	if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) {
+	if (INTEL_GEN(dev_priv) >= 10) {
 		intel_primary_formats = skl_primary_formats;
 		num_formats = ARRAY_SIZE(skl_primary_formats);
 		modifiers = skl_format_modifiers_ccs;

drivers/gpu/drm/i915/intel_lpe_audio.c+1−1

@@ -193,7 +193,7 @@ static bool lpe_audio_detect(struct drm_i915_private *dev_priv) · 192 unmodified lines
193	};	193	};
194		194
195	if (!pci_dev_present(atom_hdaudio_ids)) {	195	if (!pci_dev_present(atom_hdaudio_ids)) {
196	DRM_INFO("%s\n", "HDaudio controller not detected, using LPE audio instead\n");	196	DRM_INFO("HDaudio controller not detected, using LPE audio instead\n");
197	lpe_present = true;	197	lpe_present = true;
198	}	198	}
199	}	199	}

drivers/gpu/drm/nouveau/nouveau_bo.c+3−2

 		/* Determine if we can get a cache-coherent map, forcing
 		 * uncached mapping if we can't.
 		 */
-		if (mmu->type[drm->ttm.type_host].type & NVIF_MEM_UNCACHED)
+		if (!nouveau_drm_use_coherent_gpu_mapping(drm))
 			nvbo->force_coherent = true;
 	}
 		if (cli->device.info.family > NV_DEVICE_INFO_V0_CURIE &&
 		    (flags & TTM_PL_FLAG_VRAM) && !vmm->page[i].vram)
 			continue;
-		if ((flags & TTM_PL_FLAG_TT  ) && !vmm->page[i].host)
+		if ((flags & TTM_PL_FLAG_TT) &&
+		    (!vmm->page[i].host || vmm->page[i].shift > PAGE_SHIFT))
 			continue;
 		/* Select this page size if it's the first that supports

drivers/gpu/drm/nouveau/nouveau_drm.c+1−1

 	work->cli = cli;
 	mutex_lock(&cli->lock);
 	list_add_tail(&work->head, &cli->worker);
-	mutex_unlock(&cli->lock);
 	if (dma_fence_add_callback(fence, &work->cb, nouveau_cli_work_fence))
 		nouveau_cli_work_fence(fence, &work->cb);
+	mutex_unlock(&cli->lock);
 }
 static void

drivers/gpu/drm/nouveau/nouveau_drv.h+9−2

 		struct nvif_object copy;
 		int mtrr;
 		int type_vram;
-		int type_host;
+		int type_host[2];
-		int type_ncoh;
+		int type_ncoh[2];
 	} ttm;
 	/* GEM interface support */
 	return dev->dev_private;
 }
+static inline bool
+nouveau_drm_use_coherent_gpu_mapping(struct nouveau_drm *drm)
+{
+	struct nvif_mmu *mmu = &drm->client.mmu;
+	return !(mmu->type[drm->ttm.type_host[0]].type & NVIF_MEM_UNCACHED);
+}
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
 bool nouveau_pmops_runtime(void);

drivers/gpu/drm/nouveau/nouveau_fbcon.c+1−1

@@ -429,7 +429,7 @@ nouveau_fbcon_destroy(struct drm_device dev, struct nouveau_fbdev fbcon) · 428 unmodified lines
429	drm_fb_helper_unregister_fbi(&fbcon->helper);	429	drm_fb_helper_unregister_fbi(&fbcon->helper);
430	drm_fb_helper_fini(&fbcon->helper);	430	drm_fb_helper_fini(&fbcon->helper);
431		431
432	if (nouveau_fb->nvbo) {	432	if (nouveau_fb && nouveau_fb->nvbo) {
433	nouveau_vma_del(&nouveau_fb->vma);	433	nouveau_vma_del(&nouveau_fb->vma);
434	nouveau_bo_unmap(nouveau_fb->nvbo);	434	nouveau_bo_unmap(nouveau_fb->nvbo);
435	nouveau_bo_unpin(nouveau_fb->nvbo);	435	nouveau_bo_unpin(nouveau_fb->nvbo);

drivers/gpu/drm/nouveau/nouveau_mem.c+3−3

@@ -103,10 +103,10 @@ nouveau_mem_host(struct ttm_mem_reg reg, struct ttm_dma_tt tt) · 102 unmodified lines
103	u8 type;	103	u8 type;
104	int ret;	104	int ret;
105		105
106	if (mmu->type[drm->ttm.type_host].type & NVIF_MEM_UNCACHED)	106	if (!nouveau_drm_use_coherent_gpu_mapping(drm))
107	type = drm->ttm.type_ncoh;	107	type = drm->ttm.type_ncoh[!!mem->kind];
108	else	108	else
109	type = drm->ttm.type_host;	109	type = drm->ttm.type_host[0];
110		110
111	if (mem->kind && !(mmu->type[type].type & NVIF_MEM_KIND))	111	if (mem->kind && !(mmu->type[type].type & NVIF_MEM_KIND))
112	mem->comp = mem->kind = 0;	112	mem->comp = mem->kind = 0;

drivers/gpu/drm/nouveau/nouveau_ttm.c+29−10

 	drm->ttm.mem_global_ref.release = NULL;
 }
-int
+static int
-nouveau_ttm_init(struct nouveau_drm *drm)
+nouveau_ttm_init_host(struct nouveau_drm *drm, u8 kind)
 {
-	struct nvkm_device *device = nvxx_device(&drm->client.device);
-	struct nvkm_pci *pci = device->pci;
 	struct nvif_mmu *mmu = &drm->client.mmu;
-	struct drm_device *dev = drm->dev;
+	int typei;
-	int typei, ret;
 	typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE |
-						   NVIF_MEM_COHERENT);
+					    kind | NVIF_MEM_COHERENT);
 	if (typei < 0)
 		return -ENOSYS;
-	drm->ttm.type_host = typei;
+	drm->ttm.type_host[!!kind] = typei;
-	typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE);
+	typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE | kind);
 	if (typei < 0)
 		return -ENOSYS;
-	drm->ttm.type_ncoh = typei;
+	drm->ttm.type_ncoh[!!kind] = typei;
+	return 0;
+}
+int
+nouveau_ttm_init(struct nouveau_drm *drm)
+{
+	struct nvkm_device *device = nvxx_device(&drm->client.device);
+	struct nvkm_pci *pci = device->pci;
+	struct nvif_mmu *mmu = &drm->client.mmu;
+	struct drm_device *dev = drm->dev;
+	int typei, ret;
+	ret = nouveau_ttm_init_host(drm, 0);
+	if (ret)
+		return ret;
+	if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA &&
+	    drm->client.device.info.chipset != 0x50) {
+		ret = nouveau_ttm_init_host(drm, NVIF_MEM_KIND);
+		if (ret)
+			return ret;
+	}
 	if (drm->client.device.info.platform != NV_DEVICE_INFO_V0_SOC &&
 	    drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA) {

drivers/gpu/drm/nouveau/nouveau_vmm.c+1−1

 			nvif_vmm_put(&vma->vmm->vmm, &tmp);
 		}
 		list_del(&vma->head);
-		*pvma = NULL;
 		kfree(*pvma);
+		*pvma = NULL;
 	}
 }

drivers/gpu/drm/nouveau/nvkm/engine/device/base.c+1−1

@@ -2369,7 +2369,7 @@ nv13b_chipset = { · 2368 unmodified lines
2369	.imem = gk20a_instmem_new,	2369	.imem = gk20a_instmem_new,
2370	.ltc = gp100_ltc_new,	2370	.ltc = gp100_ltc_new,
2371	.mc = gp10b_mc_new,	2371	.mc = gp10b_mc_new,
2372	.mmu = gf100_mmu_new,	2372	.mmu = gp10b_mmu_new,
2373	.secboot = gp10b_secboot_new,	2373	.secboot = gp10b_secboot_new,
2374	.pmu = gm20b_pmu_new,	2374	.pmu = gm20b_pmu_new,
2375	.timer = gk20a_timer_new,	2375	.timer = gk20a_timer_new,

drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c+8−1

 			if (data) {
 				*ver = nvbios_rd08(bios, data + 0x00);
 				switch (*ver) {
+				case 0x20:
 				case 0x21:
 				case 0x30:
 				case 0x40:
 	if (data && idx < *cnt) {
 		u16 outp = nvbios_rd16(bios, data + *hdr + idx * *len);
 		switch (*ver * !!outp) {
+		case 0x20:
 		case 0x21:
 		case 0x30:
 			*hdr = nvbios_rd08(bios, data + 0x04);
 		info->type = nvbios_rd16(bios, data + 0x00);
 		info->mask = nvbios_rd16(bios, data + 0x02);
 		switch (*ver) {
+		case 0x20:
+			info->mask |= 0x00c0; /* match any link */
+			/* fall-through */
 		case 0x21:
 		case 0x30:
 			info->flags     = nvbios_rd08(bios, data + 0x05);
 			info->script[0] = nvbios_rd16(bios, data + 0x06);
 			info->script[1] = nvbios_rd16(bios, data + 0x08);
-			info->lnkcmp    = nvbios_rd16(bios, data + 0x0a);
+			if (*len >= 0x0c)
+				info->lnkcmp    = nvbios_rd16(bios, data + 0x0a);
 			if (*len >= 0x0f) {
 				info->script[2] = nvbios_rd16(bios, data + 0x0c);
 				info->script[3] = nvbios_rd16(bios, data + 0x0e);
 	memset(info, 0x00, sizeof(*info));
 	if (data) {
 		switch (*ver) {
+		case 0x20:
 		case 0x21:
 			info->dc    = nvbios_rd08(bios, data + 0x02);
 			info->pe    = nvbios_rd08(bios, data + 0x03);

drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c+1−1

@@ -249,7 +249,7 @@ nv50_instobj_acquire(struct nvkm_memory *memory) · 248 unmodified lines
249	iobj->base.memory.ptrs = &nv50_instobj_fast;	249	iobj->base.memory.ptrs = &nv50_instobj_fast;
250	else	250	else
251	iobj->base.memory.ptrs = &nv50_instobj_slow;	251	iobj->base.memory.ptrs = &nv50_instobj_slow;
252	refcount_inc(&iobj->maps);	252	refcount_set(&iobj->maps, 1);
253	}	253	}
254		254
255	mutex_unlock(&imem->subdev.mutex);	255	mutex_unlock(&imem->subdev.mutex);

drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c+7−0

@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev) · 135 unmodified lines
136	return ret;	136	return ret;
137		137
138	pci->irq = pdev->irq;	138	pci->irq = pdev->irq;
		139
		140	/* Ensure MSI interrupts are armed, for the case where there are
		141	* already interrupts pending (for whatever reason) at load time.
		142	*/
		143	if (pci->msi)
		144	pci->func->msi_rearm(pci);
		145
139	return ret;	146	return ret;
140	}	147	}
141		148

drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c+20−0

@@ -175,11 +175,31 @@ static void sun4i_hdmi_mode_set(struct drm_encoder *encoder, · 174 unmodified lines
175	writel(val, hdmi->base + SUN4I_HDMI_VID_TIMING_POL_REG);	175	writel(val, hdmi->base + SUN4I_HDMI_VID_TIMING_POL_REG);
176	}	176	}
177		177
		178	static enum drm_mode_status sun4i_hdmi_mode_valid(struct drm_encoder *encoder,
		179	const struct drm_display_mode *mode)
		180	{
		181	struct sun4i_hdmi *hdmi = drm_encoder_to_sun4i_hdmi(encoder);
		182	unsigned long rate = mode->clock * 1000;
		183	unsigned long diff = rate / 200; /* +-0.5% allowed by HDMI spec */
		184	long rounded_rate;
		185
		186	/* 165 MHz is the typical max pixelclock frequency for HDMI <= 1.2 */
		187	if (rate > 165000000)
		188	return MODE_CLOCK_HIGH;
		189	rounded_rate = clk_round_rate(hdmi->tmds_clk, rate);
		190	if (rounded_rate > 0 &&
		191	max_t(unsigned long, rounded_rate, rate) -
		192	min_t(unsigned long, rounded_rate, rate) < diff)
		193	return MODE_OK;
		194	return MODE_NOCLOCK;
		195	}
		196
178	static const struct drm_encoder_helper_funcs sun4i_hdmi_helper_funcs = {	197	static const struct drm_encoder_helper_funcs sun4i_hdmi_helper_funcs = {
179	.atomic_check = sun4i_hdmi_atomic_check,	198	.atomic_check = sun4i_hdmi_atomic_check,
180	.disable = sun4i_hdmi_disable,	199	.disable = sun4i_hdmi_disable,
181	.enable = sun4i_hdmi_enable,	200	.enable = sun4i_hdmi_enable,
182	.mode_set = sun4i_hdmi_mode_set,	201	.mode_set = sun4i_hdmi_mode_set,
		202	.mode_valid = sun4i_hdmi_mode_valid,
183	};	203	};
184		204
185	static const struct drm_encoder_funcs sun4i_hdmi_funcs = {	205	static const struct drm_encoder_funcs sun4i_hdmi_funcs = {

drivers/gpu/drm/sun4i/sun4i_tcon.c+2−2

@@ -724,12 +724,12 @@ static int sun4i_tcon_bind(struct device dev, struct device master, · 723 unmodified lines
724	if (IS_ERR(tcon->crtc)) {	724	if (IS_ERR(tcon->crtc)) {
725	dev_err(dev, "Couldn't create our CRTC\n");	725	dev_err(dev, "Couldn't create our CRTC\n");
726	ret = PTR_ERR(tcon->crtc);	726	ret = PTR_ERR(tcon->crtc);
727	goto err_free_clocks;	727	goto err_free_dotclock;
728	}	728	}
729		729
730	ret = sun4i_rgb_init(drm, tcon);	730	ret = sun4i_rgb_init(drm, tcon);
731	if (ret < 0)	731	if (ret < 0)
732	goto err_free_clocks;	732	goto err_free_dotclock;
733		733
734	if (tcon->quirks->needs_de_be_mux) {	734	if (tcon->quirks->needs_de_be_mux) {
735	/*	735	/*

drivers/gpu/drm/ttm/ttm_page_alloc.c+2−1

 		freed += (nr_free_pool - shrink_pages) << pool->order;
 		if (freed >= sc->nr_to_scan)
 			break;
+		shrink_pages <<= pool->order;
 	}
 	mutex_unlock(&lock);
 	return freed;
 	int r = 0;
 	unsigned i, j, cpages;
 	unsigned npages = 1 << order;
-	unsigned max_cpages = min(count, (unsigned)NUM_PAGES_TO_ALLOC);
+	unsigned max_cpages = min(count << order, (unsigned)NUM_PAGES_TO_ALLOC);
 	/* allocate array for page caching change */
 	caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL);

drivers/gpu/drm/vc4/vc4_gem.c+3−1

 	/* If we got force-completed because of GPU reset rather than
 	 * through our IRQ handler, signal the fence now.
 	 */
-	if (exec->fence)
+	if (exec->fence) {
 		dma_fence_signal(exec->fence);
+		dma_fence_put(exec->fence);
+	}
 	if (exec->bo) {
 		for (i = 0; i < exec->bo_count; i++) {

drivers/gpu/drm/vc4/vc4_irq.c+1−0

@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_device *dev) · 138 unmodified lines
139	list_move_tail(&exec->head, &vc4->job_done_list);	139	list_move_tail(&exec->head, &vc4->job_done_list);
140	if (exec->fence) {	140	if (exec->fence) {
141	dma_fence_signal_locked(exec->fence);	141	dma_fence_signal_locked(exec->fence);
		142	dma_fence_put(exec->fence);
142	exec->fence = NULL;	143	exec->fence = NULL;
143	}	144	}
144	vc4_submit_next_render_job(dev);	145	vc4_submit_next_render_job(dev);

drivers/hid/hid-core.c+1−1

@@ -551,7 +551,7 @@ static int hid_parser_main(struct hid_parser parser, struct hid_item item) · 550 unmodified lines
551	ret = hid_add_field(parser, HID_FEATURE_REPORT, data);	551	ret = hid_add_field(parser, HID_FEATURE_REPORT, data);
552	break;	552	break;
553	default:	553	default:
554	hid_err(parser->device, "unknown main item tag 0x%x\n", item->tag);	554	hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
555	ret = 0;	555	ret = 0;
556	}	556	}
557		557

drivers/hid/hid-cp2112.c+13−2

 					      (u8 *)&word, 2);
 		break;
 	case I2C_SMBUS_I2C_BLOCK_DATA:
-		size = I2C_SMBUS_BLOCK_DATA;
+		if (read_write == I2C_SMBUS_READ) {
-		/* fallthrough */
+			read_length = data->block[0];
+			count = cp2112_write_read_req(buf, addr, read_length,
+						      command, NULL, 0);
+		} else {
+			count = cp2112_write_req(buf, addr, command,
+						 data->block + 1,
+						 data->block[0]);
+		}
+		break;
 	case I2C_SMBUS_BLOCK_DATA:
 		if (I2C_SMBUS_READ == read_write) {
 			count = cp2112_write_read_req(buf, addr,
 	case I2C_SMBUS_WORD_DATA:
 		data->word = le16_to_cpup((__le16 *)buf);
 		break;
+	case I2C_SMBUS_I2C_BLOCK_DATA:
+		memcpy(data->block + 1, buf, read_length);
+		break;
 	case I2C_SMBUS_BLOCK_DATA:
 		if (read_length > I2C_SMBUS_BLOCK_MAX) {
 			ret = -EPROTO;

drivers/hid/hid-holtekff.c+4−4

 #ifdef CONFIG_HOLTEK_FF
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Anssi Hannula <anssi.hannula@iki.fi>");
-MODULE_DESCRIPTION("Force feedback support for Holtek On Line Grip based devices");
 /*
  * These commands and parameters are currently known:
  *
 	.probe = holtek_probe,
 };
 module_hid_driver(holtek_driver);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anssi Hannula <anssi.hannula@iki.fi>");
+MODULE_DESCRIPTION("Force feedback support for Holtek On Line Grip based devices");

drivers/hv/vmbus_drv.c+2−0

@@ -1378,6 +1378,8 @@ void vmbus_device_unregister(struct hv_device *device_obj) · 1377 unmodified lines
1378	pr_debug("child device %s unregistered\n",	1378	pr_debug("child device %s unregistered\n",
1379	dev_name(&device_obj->device));	1379	dev_name(&device_obj->device));
1380		1380
		1381	kset_unregister(device_obj->channels_kset);
		1382
1381	/*	1383	/*
1382	* Kick off the process of unregistering the device.	1384	* Kick off the process of unregistering the device.
1383	* This will call vmbus_remove() and eventually vmbus_device_release()	1385	* This will call vmbus_remove() and eventually vmbus_device_release()

drivers/hwmon/hwmon.c+17−4

 				    struct hwmon_device *hwdev, int index)
 {
 	struct hwmon_thermal_data *tdata;
+	struct thermal_zone_device *tzd;
 	tdata = devm_kzalloc(dev, sizeof(*tdata), GFP_KERNEL);
 	if (!tdata)
 	tdata->hwdev = hwdev;
 	tdata->index = index;
-	devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
+	tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
-					     &hwmon_thermal_ops);
+						   &hwmon_thermal_ops);
+	/*
+	 * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+	 * so ignore that error but forward any other error.
+	 */
+	if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV))
+		return PTR_ERR(tzd);
 	return 0;
 }
 				if (!chip->ops->is_visible(drvdata, hwmon_temp,
 							   hwmon_temp_input, j))
 					continue;
-				if (info[i]->config[j] & HWMON_T_INPUT)
+				if (info[i]->config[j] & HWMON_T_INPUT) {
-					hwmon_thermal_add_sensor(dev, hwdev, j);
+					err = hwmon_thermal_add_sensor(dev,
+								hwdev, j);
+					if (err)
+						goto free_device;
+				}
 			}
 		}
 	}
 	return hdev;
+free_device:
+	device_unregister(hdev);
 free_hwmon:
 	kfree(hwdev);
 ida_remove:

drivers/hwtracing/stm/ftrace.c+4−2

  * @len:	length of the data packet
  */
 static void notrace
-stm_ftrace_write(const void *buf, unsigned int len)
+stm_ftrace_write(struct trace_export *export, const void *buf, unsigned int len)
 {
-	stm_source_write(&stm_ftrace.data, STM_FTRACE_CHAN, buf, len);
+	struct stm_ftrace *stm = container_of(export, struct stm_ftrace, ftrace);
+	stm_source_write(&stm->data, STM_FTRACE_CHAN, buf, len);
 }
 static int stm_ftrace_link(struct stm_source_data *data)

drivers/i2c/busses/i2c-cht-wc.c+1−1

@@ -379,7 +379,7 @@ static int cht_wc_i2c_adap_i2c_remove(struct platform_device *pdev) · 378 unmodified lines
379	return 0;	379	return 0;
380	}	380	}
381		381
382	static struct platform_device_id cht_wc_i2c_adap_id_table[] = {	382	static const struct platform_device_id cht_wc_i2c_adap_id_table[] = {
383	{ .name = "cht_wcove_ext_chgr" },	383	{ .name = "cht_wcove_ext_chgr" },
384	{},	384	{},
385	};	385	};

drivers/i2c/busses/i2c-piix4.c+1−1

@@ -983,7 +983,7 @@ static void piix4_adap_remove(struct i2c_adapter *adap) · 982 unmodified lines
983		983
984	if (adapdata->smba) {	984	if (adapdata->smba) {
985	i2c_del_adapter(adap);	985	i2c_del_adapter(adap);
986	if (adapdata->port == (0 << 1)) {	986	if (adapdata->port == (0 << piix4_port_shift_sb800)) {
987	release_region(adapdata->smba, SMBIOSIZE);	987	release_region(adapdata->smba, SMBIOSIZE);
988	if (adapdata->sb800_main)	988	if (adapdata->sb800_main)
989	release_region(SB800_PIIX4_SMB_IDX, 2);	989	release_region(SB800_PIIX4_SMB_IDX, 2);

drivers/i2c/busses/i2c-stm32.h+2−1

+// SPDX-License-Identifier: GPL-2.0
 /*
  * i2c-stm32.h
  *
  * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 #ifndef _I2C_STM32_H

drivers/i2c/busses/i2c-stm32f4.c+2−1

+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for STMicroelectronics STM32 I2C controller
  *
  * http://www.st.com/resource/en/reference_manual/DM00031020.pdf
  *
  * Copyright (C) M'boumba Cedric Madianga 2016
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
  * This driver is based on i2c-st.c
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 #include <linux/clk.h>

drivers/i2c/busses/i2c-stm32f7.c+2−1

+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for STMicroelectronics STM32F7 I2C controller
  *
  * http://www.st.com/resource/en/reference_manual/dm00124865.pdf
  *
  * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
  * This driver is based on i2c-stm32f4.c
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 #include <linux/clk.h>
 #include <linux/delay.h>

drivers/infiniband/core/cma.c+1−1

@@ -4458,7 +4458,7 @@ out: · 4457 unmodified lines
4458	return skb->len;	4458	return skb->len;
4459	}	4459	}
4460		4460
4461	static const struct rdma_nl_cbs cma_cb_table[] = {	4461	static const struct rdma_nl_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = {
4462	[RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats},	4462	[RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats},
4463	};	4463	};
4464		4464

drivers/infiniband/core/device.c+1−1

@@ -1146,7 +1146,7 @@ struct net_device ib_get_net_dev_by_params(struct ib_device dev, · 1145 unmodified lines
1146	}	1146	}
1147	EXPORT_SYMBOL(ib_get_net_dev_by_params);	1147	EXPORT_SYMBOL(ib_get_net_dev_by_params);
1148		1148
1149	static const struct rdma_nl_cbs ibnl_ls_cb_table[] = {	1149	static const struct rdma_nl_cbs ibnl_ls_cb_table[RDMA_NL_LS_NUM_OPS] = {
1150	[RDMA_NL_LS_OP_RESOLVE] = {	1150	[RDMA_NL_LS_OP_RESOLVE] = {
1151	.doit = ib_nl_handle_resolve_resp,	1151	.doit = ib_nl_handle_resolve_resp,
1152	.flags = RDMA_NL_ADMIN_PERM,	1152	.flags = RDMA_NL_ADMIN_PERM,

drivers/infiniband/core/iwcm.c+1−1

@@ -80,7 +80,7 @@ const char *__attribute_const__ iwcm_reject_msg(int reason) · 79 unmodified lines
80	}	80	}
81	EXPORT_SYMBOL(iwcm_reject_msg);	81	EXPORT_SYMBOL(iwcm_reject_msg);
82		82
83	static struct rdma_nl_cbs iwcm_nl_cb_table[] = {	83	static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
84	[RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb},	84	[RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb},
85	[RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb},	85	[RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb},
86	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},	86	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},

drivers/infiniband/core/nldev.c+1−1

@@ -303,7 +303,7 @@ out: cb->args[0] = idx; · 302 unmodified lines
303	return skb->len;	303	return skb->len;
304	}	304	}
305		305
306	static const struct rdma_nl_cbs nldev_cb_table[] = {	306	static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
307	[RDMA_NLDEV_CMD_GET] = {	307	[RDMA_NLDEV_CMD_GET] = {
308	.doit = nldev_get_doit,	308	.doit = nldev_get_doit,
309	.dump = nldev_get_dumpit,	309	.dump = nldev_get_dumpit,

drivers/infiniband/core/security.c+8−2

 	if (ret)
 		return ret;
+	if (!qp->qp_sec)
+		return 0;
 	mutex_lock(&real_qp->qp_sec->mutex);
 	ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
 					  qp->qp_sec);
 	if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
 		return 0;
-	if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed)
+	if (map->agent.qp->qp_type == IB_QPT_SMI) {
-		return -EACCES;
+		if (!map->agent.smp_allowed)
+			return -EACCES;
+		return 0;
+	}
 	return ib_security_pkey_access(map->agent.device,
 				       map->agent.port_num,

drivers/infiniband/core/uverbs_cmd.c+8−2

 		goto release_qp;
 	}
+	if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
+	    !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+		ret = -EINVAL;
+		goto release_qp;
+	}
 	attr->qp_state		  = cmd->base.qp_state;
 	attr->cur_qp_state	  = cmd->base.cur_qp_state;
 	attr->path_mtu		  = cmd->base.path_mtu;
 		return -EOPNOTSUPP;
 	if (ucore->inlen > sizeof(cmd)) {
-		if (ib_is_udata_cleared(ucore, sizeof(cmd),
+		if (!ib_is_udata_cleared(ucore, sizeof(cmd),
-					ucore->inlen - sizeof(cmd)))
+					 ucore->inlen - sizeof(cmd)))
 			return -EOPNOTSUPP;
 	}

drivers/infiniband/core/verbs.c+2−1

@@ -1438,7 +1438,8 @@ int ib_close_qp(struct ib_qp *qp) · 1437 unmodified lines
1438	spin_unlock_irqrestore(&real_qp->device->event_handler_lock, flags);	1438	spin_unlock_irqrestore(&real_qp->device->event_handler_lock, flags);
1439		1439
1440	atomic_dec(&real_qp->usecnt);	1440	atomic_dec(&real_qp->usecnt);
1441	ib_close_shared_qp_security(qp->qp_sec);	1441	if (qp->qp_sec)
		1442	ib_close_shared_qp_security(qp->qp_sec);
1442	kfree(qp);	1443	kfree(qp);
1443		1444
1444	return 0;	1445	return 0;

drivers/infiniband/hw/cxgb4/cq.c+9−7

 static int cqe_completes_wr(struct t4_cqe *cqe, struct t4_wq *wq)
 {
+	if (DRAIN_CQE(cqe)) {
+		WARN_ONCE(1, "Unexpected DRAIN CQE qp id %u!\n", wq->sq.qid);
+		return 0;
+	}
 	if (CQE_OPCODE(cqe) == FW_RI_TERMINATE)
 		return 0;
 	/*
 	 * Special cqe for drain WR completions...
 	 */
-	if (CQE_OPCODE(hw_cqe) == C4IW_DRAIN_OPCODE) {
+	if (DRAIN_CQE(hw_cqe)) {
 		*cookie = CQE_DRAIN_COOKIE(hw_cqe);
 		*cqe = *hw_cqe;
 		goto skip_cqe;
 			ret = -EAGAIN;
 			goto skip_cqe;
 		}
-		if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) {
+		if (unlikely(!CQE_STATUS(hw_cqe) &&
+			     CQE_WRID_MSN(hw_cqe) != wq->rq.msn)) {
 			t4_set_wq_in_error(wq);
-			hw_cqe->header |= htonl(CQE_STATUS_V(T4_ERR_MSN));
+			hw_cqe->header |= cpu_to_be32(CQE_STATUS_V(T4_ERR_MSN));
-			goto proc_cqe;
 		}
 		goto proc_cqe;
 	}
 				c4iw_invalidate_mr(qhp->rhp,
 						   CQE_WRID_FR_STAG(&cqe));
 			break;
-		case C4IW_DRAIN_OPCODE:
-			wc->opcode = IB_WC_SEND;
-			break;
 		default:
 			pr_err("Unexpected opcode %d in the CQE received for QPID=0x%0x\n",
 			       CQE_OPCODE(&cqe), CQE_QPID(&cqe));

drivers/infiniband/hw/cxgb4/iw_cxgb4.h+0−2

@@ -693,8 +693,6 @@ static inline int to_ib_qp_state(int c4iw_qp_state) · 692 unmodified lines
693	return IB_QPS_ERR;	693	return IB_QPS_ERR;
694	}	694	}
695		695
696	#define C4IW_DRAIN_OPCODE FW_RI_SGE_EC_CR_RETURN
697
698	static inline u32 c4iw_ib_to_tpt_access(int a)	696	static inline u32 c4iw_ib_to_tpt_access(int a)
699	{	697	{
700	return (a & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) \|	698	return (a & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) \|

drivers/infiniband/hw/cxgb4/qp.c+83−11

@@ -790,21 +790,57 @@ static int ring_kernel_rq_db(struct c4iw_qp *qhp, u16 inc) · 789 unmodified lines
790	return 0;	790	return 0;
791	}	791	}
792		792
793	static void complete_sq_drain_wr(struct c4iw_qp qhp, struct ib_send_wr wr)	793	static int ib_to_fw_opcode(int ib_opcode)
		794	{
		795	int opcode;
		796
		797	switch (ib_opcode) {
		798	case IB_WR_SEND_WITH_INV:
		799	opcode = FW_RI_SEND_WITH_INV;
		800	break;
		801	case IB_WR_SEND:
		802	opcode = FW_RI_SEND;
		803	break;
		804	case IB_WR_RDMA_WRITE:
		805	opcode = FW_RI_RDMA_WRITE;
		806	break;
		807	case IB_WR_RDMA_READ:
		808	case IB_WR_RDMA_READ_WITH_INV:
		809	opcode = FW_RI_READ_REQ;
		810	break;
		811	case IB_WR_REG_MR:
		812	opcode = FW_RI_FAST_REGISTER;
		813	break;
		814	case IB_WR_LOCAL_INV:
		815	opcode = FW_RI_LOCAL_INV;
		816	break;
		817	default:
		818	opcode = -EINVAL;
		819	}
		820	return opcode;
		821	}
		822
		823	static int complete_sq_drain_wr(struct c4iw_qp qhp, struct ib_send_wr wr)
794	{	824	{
795	struct t4_cqe cqe = {};	825	struct t4_cqe cqe = {};
796	struct c4iw_cq *schp;	826	struct c4iw_cq *schp;
797	unsigned long flag;	827	unsigned long flag;
798	struct t4_cq *cq;	828	struct t4_cq *cq;
		829	int opcode;
799		830
800	schp = to_c4iw_cq(qhp->ibqp.send_cq);	831	schp = to_c4iw_cq(qhp->ibqp.send_cq);
801	cq = &schp->cq;	832	cq = &schp->cq;
802		833
		834	opcode = ib_to_fw_opcode(wr->opcode);
		835	if (opcode < 0)
		836	return opcode;
		837
803	cqe.u.drain_cookie = wr->wr_id;	838	cqe.u.drain_cookie = wr->wr_id;
804	cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) \|	839	cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) \|
805	CQE_OPCODE_V(C4IW_DRAIN_OPCODE) \|	840	CQE_OPCODE_V(opcode) \|
806	CQE_TYPE_V(1) \|	841	CQE_TYPE_V(1) \|
807	CQE_SWCQE_V(1) \|	842	CQE_SWCQE_V(1) \|
		843	CQE_DRAIN_V(1) \|
808	CQE_QPID_V(qhp->wq.sq.qid));	844	CQE_QPID_V(qhp->wq.sq.qid));
809		845
810	spin_lock_irqsave(&schp->lock, flag);	846	spin_lock_irqsave(&schp->lock, flag);
@@ -819,6 +855,23 @@ static void complete_sq_drain_wr(struct c4iw_qp qhp, struct ib_send_wr wr) · 8 unmodified lines
819	schp->ibcq.cq_context);	855	schp->ibcq.cq_context);
820	spin_unlock_irqrestore(&schp->comp_handler_lock, flag);	856	spin_unlock_irqrestore(&schp->comp_handler_lock, flag);
821	}	857	}
		858	return 0;
		859	}
		860
		861	static int complete_sq_drain_wrs(struct c4iw_qp qhp, struct ib_send_wr wr,
		862	struct ib_send_wr **bad_wr)
		863	{
		864	int ret = 0;
		865
		866	while (wr) {
		867	ret = complete_sq_drain_wr(qhp, wr);
		868	if (ret) {
		869	*bad_wr = wr;
		870	break;
		871	}
		872	wr = wr->next;
		873	}
		874	return ret;
822	}	875	}
823		876
824	static void complete_rq_drain_wr(struct c4iw_qp qhp, struct ib_recv_wr wr)	877	static void complete_rq_drain_wr(struct c4iw_qp qhp, struct ib_recv_wr wr)
@@ -833,9 +886,10 @@ static void complete_rq_drain_wr(struct c4iw_qp qhp, struct ib_recv_wr wr) · 8 unmodified lines
833		886
834	cqe.u.drain_cookie = wr->wr_id;	887	cqe.u.drain_cookie = wr->wr_id;
835	cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) \|	888	cqe.header = cpu_to_be32(CQE_STATUS_V(T4_ERR_SWFLUSH) \|
836	CQE_OPCODE_V(C4IW_DRAIN_OPCODE) \|	889	CQE_OPCODE_V(FW_RI_SEND) \|
837	CQE_TYPE_V(0) \|	890	CQE_TYPE_V(0) \|
838	CQE_SWCQE_V(1) \|	891	CQE_SWCQE_V(1) \|
		892	CQE_DRAIN_V(1) \|
839	CQE_QPID_V(qhp->wq.sq.qid));	893	CQE_QPID_V(qhp->wq.sq.qid));
840		894
841	spin_lock_irqsave(&rchp->lock, flag);	895	spin_lock_irqsave(&rchp->lock, flag);
@@ -852,6 +906,14 @@ static void complete_rq_drain_wr(struct c4iw_qp qhp, struct ib_recv_wr wr) · 10 unmodified lines
852	}	906	}
853	}	907	}
854		908
		909	static void complete_rq_drain_wrs(struct c4iw_qp qhp, struct ib_recv_wr wr)
		910	{
		911	while (wr) {
		912	complete_rq_drain_wr(qhp, wr);
		913	wr = wr->next;
		914	}
		915	}
		916
855	int c4iw_post_send(struct ib_qp ibqp, struct ib_send_wr wr,	917	int c4iw_post_send(struct ib_qp ibqp, struct ib_send_wr wr,
856	struct ib_send_wr **bad_wr)	918	struct ib_send_wr **bad_wr)
857	{	919	{
@@ -868,9 +930,14 @@ int c4iw_post_send(struct ib_qp ibqp, struct ib_send_wr wr, · 10 unmodified lines
868		930
869	qhp = to_c4iw_qp(ibqp);	931	qhp = to_c4iw_qp(ibqp);
870	spin_lock_irqsave(&qhp->lock, flag);	932	spin_lock_irqsave(&qhp->lock, flag);
871	if (t4_wq_in_error(&qhp->wq)) {	933
		934	/*
		935	* If the qp has been flushed, then just insert a special
		936	* drain cqe.
		937	*/
		938	if (qhp->wq.flushed) {
872	spin_unlock_irqrestore(&qhp->lock, flag);	939	spin_unlock_irqrestore(&qhp->lock, flag);
873	complete_sq_drain_wr(qhp, wr);	940	err = complete_sq_drain_wrs(qhp, wr, bad_wr);
874	return err;	941	return err;
875	}	942	}
876	num_wrs = t4_sq_avail(&qhp->wq);	943	num_wrs = t4_sq_avail(&qhp->wq);
@@ -1011,9 +1078,14 @@ int c4iw_post_receive(struct ib_qp ibqp, struct ib_recv_wr wr, · 134 unmodified lines
1011		1078
1012	qhp = to_c4iw_qp(ibqp);	1079	qhp = to_c4iw_qp(ibqp);
1013	spin_lock_irqsave(&qhp->lock, flag);	1080	spin_lock_irqsave(&qhp->lock, flag);
1014	if (t4_wq_in_error(&qhp->wq)) {	1081
		1082	/*
		1083	* If the qp has been flushed, then just insert a special
		1084	* drain cqe.
		1085	*/
		1086	if (qhp->wq.flushed) {
1015	spin_unlock_irqrestore(&qhp->lock, flag);	1087	spin_unlock_irqrestore(&qhp->lock, flag);
1016	complete_rq_drain_wr(qhp, wr);	1088	complete_rq_drain_wrs(qhp, wr);
1017	return err;	1089	return err;
1018	}	1090	}
1019	num_wrs = t4_rq_avail(&qhp->wq);	1091	num_wrs = t4_rq_avail(&qhp->wq);
@@ -1285,21 +1357,21 @@ static void __flush_qp(struct c4iw_qp qhp, struct c4iw_cq rchp, · 265 unmodified lines
1285	spin_unlock_irqrestore(&rchp->lock, flag);	1357	spin_unlock_irqrestore(&rchp->lock, flag);
1286		1358
1287	if (schp == rchp) {	1359	if (schp == rchp) {
1288	if (t4_clear_cq_armed(&rchp->cq) &&	1360	if ((rq_flushed \|\| sq_flushed) &&
1289	(rq_flushed \|\| sq_flushed)) {	1361	t4_clear_cq_armed(&rchp->cq)) {
1290	spin_lock_irqsave(&rchp->comp_handler_lock, flag);	1362	spin_lock_irqsave(&rchp->comp_handler_lock, flag);
1291	(*rchp->ibcq.comp_handler)(&rchp->ibcq,	1363	(*rchp->ibcq.comp_handler)(&rchp->ibcq,
1292	rchp->ibcq.cq_context);	1364	rchp->ibcq.cq_context);
1293	spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);	1365	spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
1294	}	1366	}
1295	} else {	1367	} else {
1296	if (t4_clear_cq_armed(&rchp->cq) && rq_flushed) {	1368	if (rq_flushed && t4_clear_cq_armed(&rchp->cq)) {
1297	spin_lock_irqsave(&rchp->comp_handler_lock, flag);	1369	spin_lock_irqsave(&rchp->comp_handler_lock, flag);
1298	(*rchp->ibcq.comp_handler)(&rchp->ibcq,	1370	(*rchp->ibcq.comp_handler)(&rchp->ibcq,
1299	rchp->ibcq.cq_context);	1371	rchp->ibcq.cq_context);
1300	spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);	1372	spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
1301	}	1373	}
1302	if (t4_clear_cq_armed(&schp->cq) && sq_flushed) {	1374	if (sq_flushed && t4_clear_cq_armed(&schp->cq)) {
1303	spin_lock_irqsave(&schp->comp_handler_lock, flag);	1375	spin_lock_irqsave(&schp->comp_handler_lock, flag);
1304	(*schp->ibcq.comp_handler)(&schp->ibcq,	1376	(*schp->ibcq.comp_handler)(&schp->ibcq,
1305	schp->ibcq.cq_context);	1377	schp->ibcq.cq_context);

drivers/infiniband/hw/cxgb4/t4.h+6−0

 #define CQE_SWCQE_G(x)    ((((x) >> CQE_SWCQE_S)) & CQE_SWCQE_M)
 #define CQE_SWCQE_V(x)	  ((x)<<CQE_SWCQE_S)
+#define CQE_DRAIN_S       10
+#define CQE_DRAIN_M       0x1
+#define CQE_DRAIN_G(x)    ((((x) >> CQE_DRAIN_S)) & CQE_DRAIN_M)
+#define CQE_DRAIN_V(x)	  ((x)<<CQE_DRAIN_S)
 #define CQE_STATUS_S      5
 #define CQE_STATUS_M      0x1F
 #define CQE_STATUS_G(x)   ((((x) >> CQE_STATUS_S)) & CQE_STATUS_M)
 #define CQE_OPCODE_V(x)   ((x)<<CQE_OPCODE_S)
 #define SW_CQE(x)         (CQE_SWCQE_G(be32_to_cpu((x)->header)))
+#define DRAIN_CQE(x)      (CQE_DRAIN_G(be32_to_cpu((x)->header)))
 #define CQE_QPID(x)       (CQE_QPID_G(be32_to_cpu((x)->header)))
 #define CQE_TYPE(x)       (CQE_TYPE_G(be32_to_cpu((x)->header)))
 #define SQ_TYPE(x)	  (CQE_TYPE((x)))

drivers/infiniband/hw/hfi1/hfi.h+0−1

@@ -1131,7 +1131,6 @@ struct hfi1_devdata { · 1130 unmodified lines
1131	u16 pcie_lnkctl;	1131	u16 pcie_lnkctl;
1132	u16 pcie_devctl2;	1132	u16 pcie_devctl2;
1133	u32 pci_msix0;	1133	u32 pci_msix0;
1134	u32 pci_lnkctl3;
1135	u32 pci_tph2;	1134	u32 pci_tph2;
1136		1135
1137	/*	1136	/*

drivers/infiniband/hw/hfi1/pcie.c+12−18

@@ -411,15 +411,12 @@ int restore_pci_variables(struct hfi1_devdata *dd) · 410 unmodified lines
411	if (ret)	411	if (ret)
412	goto error;	412	goto error;
413		413
414	ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_SPCIE1,	414	if (pci_find_ext_capability(dd->pcidev, PCI_EXT_CAP_ID_TPH)) {
415	dd->pci_lnkctl3);	415	ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_TPH2,
416	if (ret)	416	dd->pci_tph2);
417	goto error;	417	if (ret)
418		418	goto error;
419	ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_TPH2, dd->pci_tph2);	419	}
420	if (ret)
421	goto error;
422
423	return 0;	420	return 0;
424		421
425	error:	422	error:
@@ -469,15 +466,12 @@ int save_pci_variables(struct hfi1_devdata *dd) · 43 unmodified lines
469	if (ret)	466	if (ret)
470	goto error;	467	goto error;
471		468
472	ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_SPCIE1,	469	if (pci_find_ext_capability(dd->pcidev, PCI_EXT_CAP_ID_TPH)) {
473	&dd->pci_lnkctl3);	470	ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_TPH2,
474	if (ret)	471	&dd->pci_tph2);
475	goto error;	472	if (ret)
476		473	goto error;
477	ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_TPH2, &dd->pci_tph2);	474	}
478	if (ret)
479	goto error;
480
481	return 0;	475	return 0;
482		476
483	error:	477	error:

drivers/infiniband/hw/mlx4/qp.c+19−7

 		return (-EOPNOTSUPP);
 	}
+	if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4	|
+					  MLX4_IB_RX_HASH_DST_IPV4	|
+					  MLX4_IB_RX_HASH_SRC_IPV6	|
+					  MLX4_IB_RX_HASH_DST_IPV6	|
+					  MLX4_IB_RX_HASH_SRC_PORT_TCP	|
+					  MLX4_IB_RX_HASH_DST_PORT_TCP	|
+					  MLX4_IB_RX_HASH_SRC_PORT_UDP	|
+					  MLX4_IB_RX_HASH_DST_PORT_UDP)) {
+		pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
+			 ucmd->rx_hash_fields_mask);
+		return (-EOPNOTSUPP);
+	}
 	if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) &&
 	    (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) {
 		rss_ctx->flags = MLX4_RSS_IPV4;
 			return (-EOPNOTSUPP);
 		}
-		if (rss_ctx->flags & MLX4_RSS_IPV4) {
+		if (rss_ctx->flags & MLX4_RSS_IPV4)
 			rss_ctx->flags |= MLX4_RSS_UDP_IPV4;
-		} else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+		if (rss_ctx->flags & MLX4_RSS_IPV6)
 			rss_ctx->flags |= MLX4_RSS_UDP_IPV6;
-		} else {
+		if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
 			pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n");
 			return (-EOPNOTSUPP);
 		}
 	if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) &&
 	    (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
-		if (rss_ctx->flags & MLX4_RSS_IPV4) {
+		if (rss_ctx->flags & MLX4_RSS_IPV4)
 			rss_ctx->flags |= MLX4_RSS_TCP_IPV4;
-		} else if (rss_ctx->flags & MLX4_RSS_IPV6) {
+		if (rss_ctx->flags & MLX4_RSS_IPV6)
 			rss_ctx->flags |= MLX4_RSS_TCP_IPV6;
-		} else {
+		if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
 			pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n");
 			return (-EOPNOTSUPP);
 		}
 	} else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) ||
 		   (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
 		pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n");

drivers/infiniband/hw/mlx5/cmd.c+0−11

@@ -47,17 +47,6 @@ int mlx5_cmd_null_mkey(struct mlx5_core_dev dev, u32 null_mkey) · 46 unmodified lines
47	return err;	47	return err;
48	}	48	}
49		49
50	int mlx5_cmd_query_cong_counter(struct mlx5_core_dev *dev,
51	bool reset, void *out, int out_size)
52	{
53	u32 in[MLX5_ST_SZ_DW(query_cong_statistics_in)] = { };
54
55	MLX5_SET(query_cong_statistics_in, in, opcode,
56	MLX5_CMD_OP_QUERY_CONG_STATISTICS);
57	MLX5_SET(query_cong_statistics_in, in, clear, reset);
58	return mlx5_cmd_exec(dev, in, sizeof(in), out, out_size);
59	}
60
61	int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,	50	int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,
62	void *out, int out_size)	51	void *out, int out_size)
63	{	52	{

drivers/infiniband/hw/mlx5/cmd.h+0−2

@@ -37,8 +37,6 @@ · 36 unmodified lines
37	#include <linux/mlx5/driver.h>	37	#include <linux/mlx5/driver.h>
38		38
39	int mlx5_cmd_null_mkey(struct mlx5_core_dev dev, u32 null_mkey);	39	int mlx5_cmd_null_mkey(struct mlx5_core_dev dev, u32 null_mkey);
40	int mlx5_cmd_query_cong_counter(struct mlx5_core_dev *dev,
41	bool reset, void *out, int out_size);
42	int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,	40	int mlx5_cmd_query_cong_params(struct mlx5_core_dev *dev, int cong_point,
43	void *out, int out_size);	41	void *out, int out_size);
44	int mlx5_cmd_modify_cong_params(struct mlx5_core_dev *mdev,	42	int mlx5_cmd_modify_cong_params(struct mlx5_core_dev *mdev,

drivers/infiniband/hw/mlx5/main.c+14−29

 	}
 	INIT_LIST_HEAD(&context->vma_private_list);
+	mutex_init(&context->vma_private_list_mutex);
 	INIT_LIST_HEAD(&context->db_page_list);
 	mutex_init(&context->db_page_mutex);
 	 * mlx5_ib_disassociate_ucontext().
 	 */
 	mlx5_ib_vma_priv_data->vma = NULL;
+	mutex_lock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
 	list_del(&mlx5_ib_vma_priv_data->list);
+	mutex_unlock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
 	kfree(mlx5_ib_vma_priv_data);
 }
 		return -ENOMEM;
 	vma_prv->vma = vma;
+	vma_prv->vma_private_list_mutex = &ctx->vma_private_list_mutex;
 	vma->vm_private_data = vma_prv;
 	vma->vm_ops =  &mlx5_ib_vm_ops;
+	mutex_lock(&ctx->vma_private_list_mutex);
 	list_add(&vma_prv->list, vma_head);
+	mutex_unlock(&ctx->vma_private_list_mutex);
 	return 0;
 }
 	 * mlx5_ib_vma_close.
 	 */
 	down_write(&owning_mm->mmap_sem);
+	mutex_lock(&context->vma_private_list_mutex);
 	list_for_each_entry_safe(vma_private, n, &context->vma_private_list,
 				 list) {
 		vma = vma_private->vma;
 		list_del(&vma_private->list);
 		kfree(vma_private);
 	}
+	mutex_unlock(&context->vma_private_list_mutex);
 	up_write(&owning_mm->mmap_sem);
 	mmput(owning_mm);
 	put_task_struct(owning_process);
 	return ret;
 }
-static int mlx5_ib_query_cong_counters(struct mlx5_ib_dev *dev,
-				       struct mlx5_ib_port *port,
-				       struct rdma_hw_stats *stats)
-{
-	int outlen = MLX5_ST_SZ_BYTES(query_cong_statistics_out);
-	void *out;
-	int ret, i;
-	int offset = port->cnts.num_q_counters;
-	out = kvzalloc(outlen, GFP_KERNEL);
-	if (!out)
-		return -ENOMEM;
-	ret = mlx5_cmd_query_cong_counter(dev->mdev, false, out, outlen);
-	if (ret)
-		goto free;
-	for (i = 0; i < port->cnts.num_cong_counters; i++) {
-		stats->value[i + offset] =
-			be64_to_cpup((__be64 *)(out +
-				     port->cnts.offsets[i + offset]));
-	}
-free:
-	kvfree(out);
-	return ret;
-}
 static int mlx5_ib_get_hw_stats(struct ib_device *ibdev,
 				struct rdma_hw_stats *stats,
 				u8 port_num, int index)
 	num_counters = port->cnts.num_q_counters;
 	if (MLX5_CAP_GEN(dev->mdev, cc_query_allowed)) {
-		ret = mlx5_ib_query_cong_counters(dev, port, stats);
+		ret = mlx5_lag_query_cong_counters(dev->mdev,
+						   stats->value +
+						   port->cnts.num_q_counters,
+						   port->cnts.num_cong_counters,
+						   port->cnts.offsets +
+						   port->cnts.num_q_counters);
 		if (ret)
 			return ret;
 		num_counters += port->cnts.num_cong_counters;

drivers/infiniband/hw/mlx5/mlx5_ib.h+4−0

 struct mlx5_ib_vma_private_data {
 	struct list_head list;
 	struct vm_area_struct *vma;
+	/* protect vma_private_list add/del */
+	struct mutex *vma_private_list_mutex;
 };
 struct mlx5_ib_ucontext {
 	/* Transport Domain number */
 	u32			tdn;
 	struct list_head	vma_private_list;
+	/* protect vma_private_list add/del */
+	struct mutex		vma_private_list_mutex;
 	unsigned long		upd_xlt_page;
 	/* protect ODP/KSM */

drivers/infiniband/hw/mlx5/mr.c+1−0

@@ -1637,6 +1637,7 @@ struct ib_mr mlx5_ib_alloc_mr(struct ib_pd pd, · 1636 unmodified lines
1637	MLX5_SET(mkc, mkc, access_mode, mr->access_mode);	1637	MLX5_SET(mkc, mkc, access_mode, mr->access_mode);
1638	MLX5_SET(mkc, mkc, umr_en, 1);	1638	MLX5_SET(mkc, mkc, umr_en, 1);
1639		1639
		1640	mr->ibmr.device = pd->device;
1640	err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);	1641	err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);
1641	if (err)	1642	if (err)
1642	goto err_destroy_psv;	1643	goto err_destroy_psv;

drivers/infiniband/hw/vmw_pvrdma/pvrdma.h+3−3

@@ -94,7 +94,7 @@ struct pvrdma_cq { · 93 unmodified lines
94	u32 cq_handle;	94	u32 cq_handle;
95	bool is_kernel;	95	bool is_kernel;
96	atomic_t refcnt;	96	atomic_t refcnt;
97	wait_queue_head_t wait;	97	struct completion free;
98	};	98	};
99		99
100	struct pvrdma_id_table {	100	struct pvrdma_id_table {
@@ -175,7 +175,7 @@ struct pvrdma_srq { · 74 unmodified lines
175	u32 srq_handle;	175	u32 srq_handle;
176	int npages;	176	int npages;
177	refcount_t refcnt;	177	refcount_t refcnt;
178	wait_queue_head_t wait;	178	struct completion free;
179	};	179	};
180		180
181	struct pvrdma_qp {	181	struct pvrdma_qp {
@@ -197,7 +197,7 @@ struct pvrdma_qp { · 15 unmodified lines
197	bool is_kernel;	197	bool is_kernel;
198	struct mutex mutex; /* QP state mutex. */	198	struct mutex mutex; /* QP state mutex. */
199	atomic_t refcnt;	199	atomic_t refcnt;
200	wait_queue_head_t wait;	200	struct completion free;
201	};	201	};
202		202
203	struct pvrdma_dev {	203	struct pvrdma_dev {

drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c+4−3

 		pvrdma_page_dir_insert_umem(&cq->pdir, cq->umem, 0);
 	atomic_set(&cq->refcnt, 1);
-	init_waitqueue_head(&cq->wait);
+	init_completion(&cq->free);
 	spin_lock_init(&cq->cq_lock);
 	memset(cmd, 0, sizeof(*cmd));
 static void pvrdma_free_cq(struct pvrdma_dev *dev, struct pvrdma_cq *cq)
 {
-	atomic_dec(&cq->refcnt);
+	if (atomic_dec_and_test(&cq->refcnt))
-	wait_event(cq->wait, !atomic_read(&cq->refcnt));
+		complete(&cq->free);
+	wait_for_completion(&cq->free);
 	if (!cq->is_kernel)
 		ib_umem_release(cq->umem);

drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c+7−10

 		ibqp->event_handler(&e, ibqp->qp_context);
 	}
 	if (qp) {
-		atomic_dec(&qp->refcnt);
+		if (atomic_dec_and_test(&qp->refcnt))
-		if (atomic_read(&qp->refcnt) == 0)
+			complete(&qp->free);
-			wake_up(&qp->wait);
 	}
 }
 		ibcq->event_handler(&e, ibcq->cq_context);
 	}
 	if (cq) {
-		atomic_dec(&cq->refcnt);
+		if (atomic_dec_and_test(&cq->refcnt))
-		if (atomic_read(&cq->refcnt) == 0)
+			complete(&cq->free);
-			wake_up(&cq->wait);
 	}
 }
 	}
 	if (srq) {
 		if (refcount_dec_and_test(&srq->refcnt))
-			wake_up(&srq->wait);
+			complete(&srq->free);
 	}
 }
 		if (cq && cq->ibcq.comp_handler)
 			cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
 		if (cq) {
-			atomic_dec(&cq->refcnt);
+			if (atomic_dec_and_test(&cq->refcnt))
-			if (atomic_read(&cq->refcnt))
+				complete(&cq->free);
-				wake_up(&cq->wait);
 		}
 		pvrdma_idx_ring_inc(&ring->cons_head, ring_slots);
 	}

drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c+11−3

 		spin_lock_init(&qp->rq.lock);
 		mutex_init(&qp->mutex);
 		atomic_set(&qp->refcnt, 1);
-		init_waitqueue_head(&qp->wait);
+		init_completion(&qp->free);
 		qp->state = IB_QPS_RESET;
 	pvrdma_unlock_cqs(scq, rcq, &scq_flags, &rcq_flags);
-	atomic_dec(&qp->refcnt);
+	if (atomic_dec_and_test(&qp->refcnt))
-	wait_event(qp->wait, !atomic_read(&qp->refcnt));
+		complete(&qp->free);
+	wait_for_completion(&qp->free);
+	if (!qp->is_kernel) {
+		if (qp->rumem)
+			ib_umem_release(qp->rumem);
+		if (qp->sumem)
+			ib_umem_release(qp->sumem);
+	}
 	pvrdma_page_dir_cleanup(dev, &qp->pdir);

drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c+4−3

 	spin_lock_init(&srq->lock);
 	refcount_set(&srq->refcnt, 1);
-	init_waitqueue_head(&srq->wait);
+	init_completion(&srq->free);
 	dev_dbg(&dev->pdev->dev,
 		"create shared receive queue from user space\n");
 	dev->srq_tbl[srq->srq_handle] = NULL;
 	spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);
-	refcount_dec(&srq->refcnt);
+	if (refcount_dec_and_test(&srq->refcnt))
-	wait_event(srq->wait, !refcount_read(&srq->refcnt));
+		complete(&srq->free);
+	wait_for_completion(&srq->free);
 	/* There is no support for kernel clients, so this is safe. */
 	ib_umem_release(srq->umem);

drivers/infiniband/ulp/ipoib/ipoib_cm.c+1−0

@@ -1145,6 +1145,7 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn, · 1144 unmodified lines
1145	noio_flag = memalloc_noio_save();	1145	noio_flag = memalloc_noio_save();
1146	p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));	1146	p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
1147	if (!p->tx_ring) {	1147	if (!p->tx_ring) {
		1148	memalloc_noio_restore(noio_flag);
1148	ret = -ENOMEM;	1149	ret = -ENOMEM;
1149	goto err_tx;	1150	goto err_tx;
1150	}	1151	}

drivers/infiniband/ulp/ipoib/ipoib_ib.c+3−4

 		ipoib_ib_dev_down(dev);
 	if (level == IPOIB_FLUSH_HEAVY) {
-		rtnl_lock();
 		if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))
 			ipoib_ib_dev_stop(dev);
-		result = ipoib_ib_dev_open(dev);
+		if (ipoib_ib_dev_open(dev))
-		rtnl_unlock();
-		if (result)
 			return;
 		if (netif_queue_stopped(dev))
 	struct ipoib_dev_priv *priv =
 		container_of(work, struct ipoib_dev_priv, flush_heavy);
+	rtnl_lock();
 	__ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY, 0);
+	rtnl_unlock();
 }
 void ipoib_ib_dev_cleanup(struct net_device *dev)

drivers/iommu/amd_iommu.c+1−1

@@ -4184,7 +4184,7 @@ static void amd_ir_update_irte(struct irq_data irqd, struct amd_iommu iommu, · 4183 unmodified lines
4184	struct irq_cfg *cfg);	4184	struct irq_cfg *cfg);
4185		4185
4186	static int irq_remapping_activate(struct irq_domain *domain,	4186	static int irq_remapping_activate(struct irq_domain *domain,
4187	struct irq_data *irq_data, bool early)	4187	struct irq_data *irq_data, bool reserve)
4188	{	4188	{
4189	struct amd_ir_data *data = irq_data->chip_data;	4189	struct amd_ir_data *data = irq_data->chip_data;
4190	struct irq_2_irte *irte_info = &data->irq_2_irte;	4190	struct irq_2_irte *irte_info = &data->irq_2_irte;

drivers/iommu/intel_irq_remapping.c+1−1

@@ -1397,7 +1397,7 @@ static void intel_irq_remapping_free(struct irq_domain *domain, · 1396 unmodified lines
1397	}	1397	}
1398		1398
1399	static int intel_irq_remapping_activate(struct irq_domain *domain,	1399	static int intel_irq_remapping_activate(struct irq_domain *domain,
1400	struct irq_data *irq_data, bool early)	1400	struct irq_data *irq_data, bool reserve)
1401	{	1401	{
1402	intel_ir_reconfigure_irte(irq_data, true);	1402	intel_ir_reconfigure_irte(irq_data, true);
1403	return 0;	1403	return 0;

drivers/irqchip/irq-gic-v3-its.c+2−2

@@ -2303,7 +2303,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, · 2302 unmodified lines
2303	}	2303	}
2304		2304
2305	static int its_irq_domain_activate(struct irq_domain *domain,	2305	static int its_irq_domain_activate(struct irq_domain *domain,
2306	struct irq_data *d, bool early)	2306	struct irq_data *d, bool reserve)
2307	{	2307	{
2308	struct its_device *its_dev = irq_data_get_irq_chip_data(d);	2308	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
2309	u32 event = its_get_event_id(d);	2309	u32 event = its_get_event_id(d);
@@ -2818,7 +2818,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq · 508 unmodified lines
2818	}	2818	}
2819		2819
2820	static int its_vpe_irq_domain_activate(struct irq_domain *domain,	2820	static int its_vpe_irq_domain_activate(struct irq_domain *domain,
2821	struct irq_data *d, bool early)	2821	struct irq_data *d, bool reserve)
2822	{	2822	{
2823	struct its_vpe *vpe = irq_data_get_irq_chip_data(d);	2823	struct its_vpe *vpe = irq_data_get_irq_chip_data(d);
2824	struct its_node *its;	2824	struct its_node *its;

drivers/irqchip/irq-renesas-intc-irqpin.c+5−1

  */
 static struct lock_class_key intc_irqpin_irq_lock_class;
+/* And this is for the request mutex */
+static struct lock_class_key intc_irqpin_irq_request_class;
 static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
 				      irq_hw_number_t hw)
 {
 	intc_irqpin_dbg(&p->irq[hw], "map");
 	irq_set_chip_data(virq, h->host_data);
-	irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class);
+	irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class,
+			      &intc_irqpin_irq_request_class);
 	irq_set_chip_and_handler(virq, &p->irq_chip, handle_level_irq);
 	return 0;
 }

drivers/leds/led-core.c+1−1

@@ -186,7 +186,7 @@ void led_blink_set(struct led_classdev *led_cdev, · 185 unmodified lines
186	unsigned long *delay_on,	186	unsigned long *delay_on,
187	unsigned long *delay_off)	187	unsigned long *delay_off)
188	{	188	{
189	del_timer_sync(&led_cdev->blink_timer);	189	led_stop_software_blink(led_cdev);
190		190
191	clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);	191	clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
192	clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);	192	clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);

drivers/md/dm-bufio.c+6−2

 	int l;
 	struct dm_buffer *b, *tmp;
 	unsigned long freed = 0;
-	unsigned long count = nr_to_scan;
+	unsigned long count = c->n_buffers[LIST_CLEAN] +
+			      c->n_buffers[LIST_DIRTY];
 	unsigned long retain_target = get_retain_buffers(c);
 	for (l = 0; l < LIST_SIZE; l++) {
 dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 {
 	struct dm_bufio_client *c = container_of(shrink, struct dm_bufio_client, shrinker);
+	unsigned long count = READ_ONCE(c->n_buffers[LIST_CLEAN]) +
+			      READ_ONCE(c->n_buffers[LIST_DIRTY]);
+	unsigned long retain_target = get_retain_buffers(c);
-	return READ_ONCE(c->n_buffers[LIST_CLEAN]) + READ_ONCE(c->n_buffers[LIST_DIRTY]);
+	return (count < retain_target) ? 0 : (count - retain_target);
 }
 /*

drivers/md/dm-cache-target.c+6−6

 {
 	int r;
-	r = dm_register_target(&cache_target);
-	if (r) {
-		DMERR("cache target registration failed: %d", r);
-		return r;
-	}
 	migration_cache = KMEM_CACHE(dm_cache_migration, 0);
 	if (!migration_cache) {
 		dm_unregister_target(&cache_target);
 		return -ENOMEM;
 	}
+	r = dm_register_target(&cache_target);
+	if (r) {
+		DMERR("cache target registration failed: %d", r);
+		return r;
+	}
 	return 0;
 }

drivers/md/dm-mpath.c+51−16

 		 dm_noflush_suspending((m)->ti));			\
 } while (0)
+/*
+ * Check whether bios must be queued in the device-mapper core rather
+ * than here in the target.
+ *
+ * If MPATHF_QUEUE_IF_NO_PATH and MPATHF_SAVED_QUEUE_IF_NO_PATH hold
+ * the same value then we are not between multipath_presuspend()
+ * and multipath_resume() calls and we have no need to check
+ * for the DMF_NOFLUSH_SUSPENDING flag.
+ */
+static bool __must_push_back(struct multipath *m, unsigned long flags)
+{
+	return ((test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) !=
+		 test_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &flags)) &&
+		dm_noflush_suspending(m->ti));
+}
+/*
+ * Following functions use READ_ONCE to get atomic access to
+ * all m->flags to avoid taking spinlock
+ */
+static bool must_push_back_rq(struct multipath *m)
+{
+	unsigned long flags = READ_ONCE(m->flags);
+	return test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) || __must_push_back(m, flags);
+}
+static bool must_push_back_bio(struct multipath *m)
+{
+	unsigned long flags = READ_ONCE(m->flags);
+	return __must_push_back(m, flags);
+}
 /*
  * Map cloned requests (request-based multipath)
  */
 		pgpath = choose_pgpath(m, nr_bytes);
 	if (!pgpath) {
-		if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+		if (must_push_back_rq(m))
 			return DM_MAPIO_DELAY_REQUEUE;
 		dm_report_EIO(m);	/* Failed */
 		return DM_MAPIO_KILL;
 	}
 	if (!pgpath) {
-		if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+		if (must_push_back_bio(m))
 			return DM_MAPIO_REQUEUE;
 		dm_report_EIO(m);
 		return DM_MAPIO_KILL;
 	assign_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &m->flags,
 		   (save_old_value && test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) ||
 		   (!save_old_value && queue_if_no_path));
-	assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags,
+	assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags, queue_if_no_path);
-		   queue_if_no_path || dm_noflush_suspending(m->ti));
 	spin_unlock_irqrestore(&m->lock, flags);
 	if (!queue_if_no_path) {
 			fail_path(pgpath);
 		if (atomic_read(&m->nr_valid_paths) == 0 &&
-		    !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+		    !must_push_back_rq(m)) {
 			if (error == BLK_STS_IOERR)
 				dm_report_EIO(m);
 			/* complete with the original error */
 	if (atomic_read(&m->nr_valid_paths) == 0 &&
 	    !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
-		dm_report_EIO(m);
+		if (must_push_back_bio(m)) {
-		*error = BLK_STS_IOERR;
+			r = DM_ENDIO_REQUEUE;
+		} else {
+			dm_report_EIO(m);
+			*error = BLK_STS_IOERR;
+		}
 		goto done;
 	}
 {
 	int r;
-	r = dm_register_target(&multipath_target);
-	if (r < 0) {
-		DMERR("request-based register failed %d", r);
-		r = -EINVAL;
-		goto bad_register_target;
-	}
 	kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM, 0);
 	if (!kmultipathd) {
 		DMERR("failed to create workqueue kmpathd");
 		goto bad_alloc_kmpath_handlerd;
 	}
+	r = dm_register_target(&multipath_target);
+	if (r < 0) {
+		DMERR("request-based register failed %d", r);
+		r = -EINVAL;
+		goto bad_register_target;
+	}
 	return 0;
+bad_register_target:
+	destroy_workqueue(kmpath_handlerd);
 bad_alloc_kmpath_handlerd:
 	destroy_workqueue(kmultipathd);
 bad_alloc_kmultipathd:
-	dm_unregister_target(&multipath_target);
-bad_register_target:
 	return r;
 }

drivers/md/dm-snap.c+24−24

 		return r;
 	}
-	r = dm_register_target(&snapshot_target);
-	if (r < 0) {
-		DMERR("snapshot target register failed %d", r);
-		goto bad_register_snapshot_target;
-	}
-	r = dm_register_target(&origin_target);
-	if (r < 0) {
-		DMERR("Origin target register failed %d", r);
-		goto bad_register_origin_target;
-	}
-	r = dm_register_target(&merge_target);
-	if (r < 0) {
-		DMERR("Merge target register failed %d", r);
-		goto bad_register_merge_target;
-	}
 	r = init_origin_hash();
 	if (r) {
 		DMERR("init_origin_hash failed.");
 		goto bad_pending_cache;
 	}
+	r = dm_register_target(&snapshot_target);
+	if (r < 0) {
+		DMERR("snapshot target register failed %d", r);
+		goto bad_register_snapshot_target;
+	}
+	r = dm_register_target(&origin_target);
+	if (r < 0) {
+		DMERR("Origin target register failed %d", r);
+		goto bad_register_origin_target;
+	}
+	r = dm_register_target(&merge_target);
+	if (r < 0) {
+		DMERR("Merge target register failed %d", r);
+		goto bad_register_merge_target;
+	}
 	return 0;
-bad_pending_cache:
-	kmem_cache_destroy(exception_cache);
-bad_exception_cache:
-	exit_origin_hash();
-bad_origin_hash:
-	dm_unregister_target(&merge_target);
 bad_register_merge_target:
 	dm_unregister_target(&origin_target);
 bad_register_origin_target:
 	dm_unregister_target(&snapshot_target);
 bad_register_snapshot_target:
+	kmem_cache_destroy(pending_cache);
+bad_pending_cache:
+	kmem_cache_destroy(exception_cache);
+bad_exception_cache:
+	exit_origin_hash();
+bad_origin_hash:
 	dm_exception_store_exit();
 	return r;

drivers/md/dm-table.c+3−2

@@ -453,14 +453,15 @@ int dm_get_device(struct dm_target ti, const char path, fmode_t mode, · 452 unmodified lines
453		453
454	refcount_set(&dd->count, 1);	454	refcount_set(&dd->count, 1);
455	list_add(&dd->list, &t->devices);	455	list_add(&dd->list, &t->devices);
		456	goto out;
456		457
457	} else if (dd->dm_dev->mode != (mode \| dd->dm_dev->mode)) {	458	} else if (dd->dm_dev->mode != (mode \| dd->dm_dev->mode)) {
458	r = upgrade_mode(dd, mode, t->md);	459	r = upgrade_mode(dd, mode, t->md);
459	if (r)	460	if (r)
460	return r;	461	return r;
461	refcount_inc(&dd->count);
462	}	462	}
463		463	refcount_inc(&dd->count);
		464	out:
464	*result = dd->dm_dev;	465	*result = dd->dm_dev;
465	return 0;	466	return 0;
466	}	467	}

drivers/md/dm-thin.c+10−12

 static int __init dm_thin_init(void)
 {
-	int r;
+	int r = -ENOMEM;
 	pool_table_init();
+	_new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
+	if (!_new_mapping_cache)
+		return r;
 	r = dm_register_target(&thin_target);
 	if (r)
-		return r;
+		goto bad_new_mapping_cache;
 	r = dm_register_target(&pool_target);
 	if (r)
-		goto bad_pool_target;
+		goto bad_thin_target;
-	r = -ENOMEM;
-	_new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
-	if (!_new_mapping_cache)
-		goto bad_new_mapping_cache;
 	return 0;
-bad_new_mapping_cache:
+bad_thin_target:
-	dm_unregister_target(&pool_target);
-bad_pool_target:
 	dm_unregister_target(&thin_target);
+bad_new_mapping_cache:
+	kmem_cache_destroy(_new_mapping_cache);
 	return r;
 }

drivers/mfd/arizona-irq.c+3−1

 };
 static struct lock_class_key arizona_irq_lock_class;
+static struct lock_class_key arizona_irq_request_class;
 static int arizona_irq_map(struct irq_domain *h, unsigned int virq,
 			      irq_hw_number_t hw)
 	struct arizona *data = h->host_data;
 	irq_set_chip_data(virq, data);
-	irq_set_lockdep_class(virq, &arizona_irq_lock_class);
+	irq_set_lockdep_class(virq, &arizona_irq_lock_class,
+		&arizona_irq_request_class);
 	irq_set_chip_and_handler(virq, &arizona_irq_chip, handle_simple_irq);
 	irq_set_nested_thread(virq, 1);
 	irq_set_noprobe(virq);

drivers/mfd/cros_ec_spi.c+25−28

 	u8 *ptr;
 	u8 *rx_buf;
 	u8 sum;
+	u8 rx_byte;
 	int ret = 0, final_ret;
 	len = cros_ec_prepare_tx(ec_dev, ec_msg);
 	if (!ret) {
 		/* Verify that EC can process command */
 		for (i = 0; i < len; i++) {
-			switch (rx_buf[i]) {
+			rx_byte = rx_buf[i];
-			case EC_SPI_PAST_END:
+			if (rx_byte == EC_SPI_PAST_END  ||
-			case EC_SPI_RX_BAD_DATA:
+			    rx_byte == EC_SPI_RX_BAD_DATA ||
-			case EC_SPI_NOT_READY:
+			    rx_byte == EC_SPI_NOT_READY) {
-				ret = -EAGAIN;
+				ret = -EREMOTEIO;
-				ec_msg->result = EC_RES_IN_PROGRESS;
-			default:
 				break;
 			}
-			if (ret)
-				break;
 		}
-		if (!ret)
-			ret = cros_ec_spi_receive_packet(ec_dev,
-					ec_msg->insize + sizeof(*response));
-	} else {
-		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 	}
+	if (!ret)
+		ret = cros_ec_spi_receive_packet(ec_dev,
+				ec_msg->insize + sizeof(*response));
+	else
+		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 	final_ret = terminate_request(ec_dev);
 	spi_bus_unlock(ec_spi->spi->master);
 	int i, len;
 	u8 *ptr;
 	u8 *rx_buf;
+	u8 rx_byte;
 	int sum;
 	int ret = 0, final_ret;
 	if (!ret) {
 		/* Verify that EC can process command */
 		for (i = 0; i < len; i++) {
-			switch (rx_buf[i]) {
+			rx_byte = rx_buf[i];
-			case EC_SPI_PAST_END:
+			if (rx_byte == EC_SPI_PAST_END  ||
-			case EC_SPI_RX_BAD_DATA:
+			    rx_byte == EC_SPI_RX_BAD_DATA ||
-			case EC_SPI_NOT_READY:
+			    rx_byte == EC_SPI_NOT_READY) {
-				ret = -EAGAIN;
+				ret = -EREMOTEIO;
-				ec_msg->result = EC_RES_IN_PROGRESS;
-			default:
 				break;
 			}
-			if (ret)
-				break;
 		}
-		if (!ret)
-			ret = cros_ec_spi_receive_response(ec_dev,
-					ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
-	} else {
-		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 	}
+	if (!ret)
+		ret = cros_ec_spi_receive_response(ec_dev,
+				ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
+	else
+		dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 	final_ret = terminate_request(ec_dev);
 	spi_bus_unlock(ec_spi->spi->master);
 			   sizeof(struct ec_response_get_protocol_info);
 	ec_dev->dout_size = sizeof(struct ec_host_request);
+	ec_spi->last_transfer_ns = ktime_get_ns();
 	err = cros_ec_register(ec_dev);
 	if (err) {

drivers/mfd/twl4030-audio.c+7−2

 EXPORT_SYMBOL_GPL(twl4030_audio_get_mclk);
 static bool twl4030_audio_has_codec(struct twl4030_audio_data *pdata,
-			      struct device_node *node)
+			      struct device_node *parent)
 {
+	struct device_node *node;
 	if (pdata && pdata->codec)
 		return true;
-	if (of_find_node_by_name(node, "codec"))
+	node = of_get_child_by_name(parent, "codec");
+	if (node) {
+		of_node_put(node);
 		return true;
+	}
 	return false;
 }

drivers/mfd/twl6040.c+8−4

@@ -97,12 +97,16 @@ static struct reg_sequence twl6040_patch[] = { · 96 unmodified lines
97	};	97	};
98		98
99		99
100	static bool twl6040_has_vibra(struct device_node *node)	100	static bool twl6040_has_vibra(struct device_node *parent)
101	{	101	{
102	#ifdef CONFIG_OF	102	struct device_node *node;
103	if (of_find_node_by_name(node, "vibra"))	103
		104	node = of_get_child_by_name(parent, "vibra");
		105	if (node) {
		106	of_node_put(node);
104	return true;	107	return true;
105	#endif	108	}
		109
106	return false;	110	return false;
107	}	111	}
108		112

drivers/misc/eeprom/at24.c+11−15

 static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 {
 	struct at24_data *at24 = priv;
-	struct i2c_client *client;
+	struct device *dev = &at24->client[0]->dev;
 	char *buf = val;
 	int ret;
 	if (off + count > at24->chip.byte_len)
 		return -EINVAL;
-	client = at24_translate_offset(at24, &off);
+	ret = pm_runtime_get_sync(dev);
-	ret = pm_runtime_get_sync(&client->dev);
 	if (ret < 0) {
-		pm_runtime_put_noidle(&client->dev);
+		pm_runtime_put_noidle(dev);
 		return ret;
 	}
 		status = at24->read_func(at24, buf, off, count);
 		if (status < 0) {
 			mutex_unlock(&at24->lock);
-			pm_runtime_put(&client->dev);
+			pm_runtime_put(dev);
 			return status;
 		}
 		buf += status;
 	mutex_unlock(&at24->lock);
-	pm_runtime_put(&client->dev);
+	pm_runtime_put(dev);
 	return 0;
 }
 static int at24_write(void *priv, unsigned int off, void *val, size_t count)
 {
 	struct at24_data *at24 = priv;
-	struct i2c_client *client;
+	struct device *dev = &at24->client[0]->dev;
 	char *buf = val;
 	int ret;
 	if (off + count > at24->chip.byte_len)
 		return -EINVAL;
-	client = at24_translate_offset(at24, &off);
+	ret = pm_runtime_get_sync(dev);
-	ret = pm_runtime_get_sync(&client->dev);
 	if (ret < 0) {
-		pm_runtime_put_noidle(&client->dev);
+		pm_runtime_put_noidle(dev);
 		return ret;
 	}
 		status = at24->write_func(at24, buf, off, count);
 		if (status < 0) {
 			mutex_unlock(&at24->lock);
-			pm_runtime_put(&client->dev);
+			pm_runtime_put(dev);
 			return status;
 		}
 		buf += status;
 	mutex_unlock(&at24->lock);
-	pm_runtime_put(&client->dev);
+	pm_runtime_put(dev);
 	return 0;
 }
 	at24->nvmem_config.reg_read = at24_read;
 	at24->nvmem_config.reg_write = at24_write;
 	at24->nvmem_config.priv = at24;
-	at24->nvmem_config.stride = 4;
+	at24->nvmem_config.stride = 1;
 	at24->nvmem_config.word_size = 1;
 	at24->nvmem_config.size = chip.byte_len;

drivers/misc/pti.c+1−1

@@ -32,7 +32,7 @@ · 31 unmodified lines
32	#include <linux/pci.h>	32	#include <linux/pci.h>
33	#include <linux/mutex.h>	33	#include <linux/mutex.h>
34	#include <linux/miscdevice.h>	34	#include <linux/miscdevice.h>
35	#include <linux/pti.h>	35	#include <linux/intel-pti.h>
36	#include <linux/slab.h>	36	#include <linux/slab.h>
37	#include <linux/uaccess.h>	37	#include <linux/uaccess.h>
38		38

drivers/mmc/core/card.h+2−0

 #define EXT_CSD_REV_ANY (-1u)
 #define CID_MANFID_SANDISK      0x2
+#define CID_MANFID_ATP          0x9
 #define CID_MANFID_TOSHIBA      0x11
 #define CID_MANFID_MICRON       0x13
 #define CID_MANFID_SAMSUNG      0x15
+#define CID_MANFID_APACER       0x27
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX	0x90

drivers/mmc/core/mmc.c+1−1

@@ -1290,7 +1290,7 @@ out_err: · 1289 unmodified lines
1290		1290
1291	static void mmc_select_driver_type(struct mmc_card *card)	1291	static void mmc_select_driver_type(struct mmc_card *card)
1292	{	1292	{
1293	int card_drv_type, drive_strength, drv_type;	1293	int card_drv_type, drive_strength, drv_type = 0;
1294	int fixed_drv_type = card->host->fixed_drv_type;	1294	int fixed_drv_type = card->host->fixed_drv_type;
1295		1295
1296	card_drv_type = card->ext_csd.raw_driver_strength \|	1296	card_drv_type = card->ext_csd.raw_driver_strength \|

drivers/mmc/core/quirks.h+8−0

@@ -52,6 +52,14 @@ static const struct mmc_fixup mmc_blk_fixups[] = { · 51 unmodified lines
52	MMC_FIXUP("MMC32G", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc,	52	MMC_FIXUP("MMC32G", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc,
53	MMC_QUIRK_BLK_NO_CMD23),	53	MMC_QUIRK_BLK_NO_CMD23),
54		54
		55	/*
		56	* Some SD cards lockup while using CMD23 multiblock transfers.
		57	*/
		58	MMC_FIXUP("AF SD", CID_MANFID_ATP, CID_OEMID_ANY, add_quirk_sd,
		59	MMC_QUIRK_BLK_NO_CMD23),
		60	MMC_FIXUP("APUSD", CID_MANFID_APACER, 0x5048, add_quirk_sd,
		61	MMC_QUIRK_BLK_NO_CMD23),
		62
55	/*	63	/*
56	* Some MMC cards need longer data read timeout than indicated in CSD.	64	* Some MMC cards need longer data read timeout than indicated in CSD.
57	*/	65	*/

drivers/mtd/mtdcore.c+1−1

@@ -1114,7 +1114,7 @@ static int mtd_check_oob_ops(struct mtd_info *mtd, loff_t offs, · 1113 unmodified lines
1114	if (!ops->oobbuf)	1114	if (!ops->oobbuf)
1115	ops->ooblen = 0;	1115	ops->ooblen = 0;
1116		1116
1117	if (offs < 0 \|\| offs + ops->len >= mtd->size)	1117	if (offs < 0 \|\| offs + ops->len > mtd->size)
1118	return -EINVAL;	1118	return -EINVAL;
1119		1119
1120	if (ops->ooblen) {	1120	if (ops->ooblen) {

drivers/mtd/nand/brcmnand/brcmnand.c+1−1

@@ -1763,7 +1763,7 @@ try_dmaread: · 1762 unmodified lines
1763	err = brcmstb_nand_verify_erased_page(mtd, chip, buf,	1763	err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
1764	addr);	1764	addr);
1765	/* erased page bitflips corrected */	1765	/* erased page bitflips corrected */
1766	if (err > 0)	1766	if (err >= 0)
1767	return err;	1767	return err;
1768	}	1768	}
1769		1769

drivers/mtd/nand/gpio.c+3−3

@@ -253,9 +253,9 @@ static int gpio_nand_probe(struct platform_device *pdev) · 252 unmodified lines
253	goto out_ce;	253	goto out_ce;
254	}	254	}
255		255
256	gpiomtd->nwp = devm_gpiod_get(dev, "ale", GPIOD_OUT_LOW);	256	gpiomtd->ale = devm_gpiod_get(dev, "ale", GPIOD_OUT_LOW);
257	if (IS_ERR(gpiomtd->nwp)) {	257	if (IS_ERR(gpiomtd->ale)) {
258	ret = PTR_ERR(gpiomtd->nwp);	258	ret = PTR_ERR(gpiomtd->ale);
259	goto out_ce;	259	goto out_ce;
260	}	260	}
261		261

drivers/mtd/nand/gpmi-nand/gpmi-nand.c+3−3

 		return ret;
 	}
-	/* handle the block mark swapping */
-	block_mark_swapping(this, payload_virt, auxiliary_virt);
 	/* Loop over status bytes, accumulating ECC status. */
 	status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
 		max_bitflips = max_t(unsigned int, max_bitflips, *status);
 	}
+	/* handle the block mark swapping */
+	block_mark_swapping(this, buf, auxiliary_virt);
 	if (oob_required) {
 		/*
 		 * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()

drivers/net/dsa/mv88e6xxx/port.c+1−0

@@ -338,6 +338,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port, · 337 unmodified lines
338	cmode = MV88E6XXX_PORT_STS_CMODE_2500BASEX;	338	cmode = MV88E6XXX_PORT_STS_CMODE_2500BASEX;
339	break;	339	break;
340	case PHY_INTERFACE_MODE_XGMII:	340	case PHY_INTERFACE_MODE_XGMII:
		341	case PHY_INTERFACE_MODE_XAUI:
341	cmode = MV88E6XXX_PORT_STS_CMODE_XAUI;	342	cmode = MV88E6XXX_PORT_STS_CMODE_XAUI;
342	break;	343	break;
343	case PHY_INTERFACE_MODE_RXAUI:	344	case PHY_INTERFACE_MODE_RXAUI:

drivers/net/ethernet/aquantia/atlantic/aq_cfg.h+3−2

 #define AQ_CFG_PCI_FUNC_MSIX_IRQS   9U
 #define AQ_CFG_PCI_FUNC_PORTS       2U
-#define AQ_CFG_SERVICE_TIMER_INTERVAL    (2 * HZ)
+#define AQ_CFG_SERVICE_TIMER_INTERVAL    (1 * HZ)
 #define AQ_CFG_POLLING_TIMER_INTERVAL   ((unsigned int)(2 * HZ))
 #define AQ_CFG_SKB_FRAGS_MAX   32U
 #define AQ_CFG_DRV_VERSION	__stringify(NIC_MAJOR_DRIVER_VERSION)"."\
 				__stringify(NIC_MINOR_DRIVER_VERSION)"."\
 				__stringify(NIC_BUILD_DRIVER_VERSION)"."\
-				__stringify(NIC_REVISION_DRIVER_VERSION)
+				__stringify(NIC_REVISION_DRIVER_VERSION) \
+				AQ_CFG_DRV_VERSION_SUFFIX
 #endif /* AQ_CFG_H */

drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c+8−8

@@ -66,14 +66,14 @@ static const char aq_ethtool_stat_names[][ETH_GSTRING_LEN] = { · 65 unmodified lines
66	"OutUCast",	66	"OutUCast",
67	"OutMCast",	67	"OutMCast",
68	"OutBCast",	68	"OutBCast",
69	"InUCastOctects",	69	"InUCastOctets",
70	"OutUCastOctects",	70	"OutUCastOctets",
71	"InMCastOctects",	71	"InMCastOctets",
72	"OutMCastOctects",	72	"OutMCastOctets",
73	"InBCastOctects",	73	"InBCastOctets",
74	"OutBCastOctects",	74	"OutBCastOctets",
75	"InOctects",	75	"InOctets",
76	"OutOctects",	76	"OutOctets",
77	"InPacketsDma",	77	"InPacketsDma",
78	"OutPacketsDma",	78	"OutPacketsDma",
79	"InOctetsDma",	79	"InOctetsDma",

drivers/net/ethernet/aquantia/atlantic/aq_hw.h+26−3

@@ -46,6 +46,28 @@ struct aq_hw_link_status_s { · 45 unmodified lines
46	unsigned int mbps;	46	unsigned int mbps;
47	};	47	};
48		48
		49	struct aq_stats_s {
		50	u64 uprc;
		51	u64 mprc;
		52	u64 bprc;
		53	u64 erpt;
		54	u64 uptc;
		55	u64 mptc;
		56	u64 bptc;
		57	u64 erpr;
		58	u64 mbtc;
		59	u64 bbtc;
		60	u64 mbrc;
		61	u64 bbrc;
		62	u64 ubrc;
		63	u64 ubtc;
		64	u64 dpc;
		65	u64 dma_pkt_rc;
		66	u64 dma_pkt_tc;
		67	u64 dma_oct_rc;
		68	u64 dma_oct_tc;
		69	};
		70
49	#define AQ_HW_IRQ_INVALID 0U	71	#define AQ_HW_IRQ_INVALID 0U
50	#define AQ_HW_IRQ_LEGACY 1U	72	#define AQ_HW_IRQ_LEGACY 1U
51	#define AQ_HW_IRQ_MSI 2U	73	#define AQ_HW_IRQ_MSI 2U
@@ -85,7 +107,9 @@ struct aq_hw_ops { · 33 unmodified lines
85	void (destroy)(struct aq_hw_s self);	107	void (destroy)(struct aq_hw_s self);
86		108
87	int (get_hw_caps)(struct aq_hw_s self,	109	int (get_hw_caps)(struct aq_hw_s self,
88	struct aq_hw_caps_s *aq_hw_caps);	110	struct aq_hw_caps_s *aq_hw_caps,
		111	unsigned short device,
		112	unsigned short subsystem_device);
89		113
90	int (hw_ring_tx_xmit)(struct aq_hw_s self, struct aq_ring_s *aq_ring,	114	int (hw_ring_tx_xmit)(struct aq_hw_s self, struct aq_ring_s *aq_ring,
91	unsigned int frags);	115	unsigned int frags);
@@ -164,8 +188,7 @@ struct aq_hw_ops { · 72 unmodified lines
164		188
165	int (hw_update_stats)(struct aq_hw_s self);	189	int (hw_update_stats)(struct aq_hw_s self);
166		190
167	int (hw_get_hw_stats)(struct aq_hw_s self, u64 *data,	191	struct aq_stats_s (hw_get_hw_stats)(struct aq_hw_s *self);
168	unsigned int *p_count);
169		192
170	int (hw_get_fw_version)(struct aq_hw_s self, u32 *fw_version);	193	int (hw_get_fw_version)(struct aq_hw_s self, u32 *fw_version);
171		194

drivers/net/ethernet/aquantia/atlantic/aq_nic.c+55−27

 module_param_named(aq_itr_rx, aq_itr_rx, uint, 0644);
 MODULE_PARM_DESC(aq_itr_rx, "RX interrupt throttle rate");
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self);
 static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
 {
 	struct aq_nic_cfg_s *cfg = &self->aq_nic_cfg;
 static void aq_nic_service_timer_cb(struct timer_list *t)
 {
 	struct aq_nic_s *self = from_timer(self, t, service_timer);
-	struct net_device *ndev = aq_nic_get_ndev(self);
+	int ctimer = AQ_CFG_SERVICE_TIMER_INTERVAL;
 	int err = 0;
-	unsigned int i = 0U;
-	struct aq_ring_stats_rx_s stats_rx;
-	struct aq_ring_stats_tx_s stats_tx;
 	if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
 		goto err_exit;
 	if (self->aq_hw_ops.hw_update_stats)
 		self->aq_hw_ops.hw_update_stats(self->aq_hw);
-	memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
+	aq_nic_update_ndev_stats(self);
-	memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
-	for (i = AQ_DIMOF(self->aq_vec); i--;) {
-		if (self->aq_vec[i])
-			aq_vec_add_stats(self->aq_vec[i], &stats_rx, &stats_tx);
-	}
-	ndev->stats.rx_packets = stats_rx.packets;
+	/* If no link - use faster timer rate to detect link up asap */
-	ndev->stats.rx_bytes = stats_rx.bytes;
+	if (!netif_carrier_ok(self->ndev))
-	ndev->stats.rx_errors = stats_rx.errors;
+		ctimer = max(ctimer / 2, 1);
-	ndev->stats.tx_packets = stats_tx.packets;
-	ndev->stats.tx_bytes = stats_tx.bytes;
-	ndev->stats.tx_errors = stats_tx.errors;
 err_exit:
-	mod_timer(&self->service_timer,
+	mod_timer(&self->service_timer, jiffies + ctimer);
-		  jiffies + AQ_CFG_SERVICE_TIMER_INTERVAL);
 }
 static void aq_nic_polling_timer_cb(struct timer_list *t)
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
 				   const struct ethtool_ops *et_ops,
-				   struct device *dev,
+				   struct pci_dev *pdev,
 				   struct aq_pci_func_s *aq_pci_func,
 				   unsigned int port,
 				   const struct aq_hw_ops *aq_hw_ops)
 	ndev->netdev_ops = ndev_ops;
 	ndev->ethtool_ops = et_ops;
-	SET_NETDEV_DEV(ndev, dev);
+	SET_NETDEV_DEV(ndev, &pdev->dev);
 	ndev->if_port = port;
 	self->ndev = ndev;
 	self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port,
 						&self->aq_hw_ops);
-	err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps);
+	err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps,
+					  pdev->device, pdev->subsystem_device);
 	if (err < 0)
 		goto err_exit;
 void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
 {
-	struct aq_vec_s *aq_vec = NULL;
 	unsigned int i = 0U;
 	unsigned int count = 0U;
-	int err = 0;
+	struct aq_vec_s *aq_vec = NULL;
+	struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
-	err = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw, data, &count);
+	if (!stats)
-	if (err < 0)
 		goto err_exit;
-	data += count;
+	data[i] = stats->uprc + stats->mprc + stats->bprc;
+	data[++i] = stats->uprc;
+	data[++i] = stats->mprc;
+	data[++i] = stats->bprc;
+	data[++i] = stats->erpt;
+	data[++i] = stats->uptc + stats->mptc + stats->bptc;
+	data[++i] = stats->uptc;
+	data[++i] = stats->mptc;
+	data[++i] = stats->bptc;
+	data[++i] = stats->ubrc;
+	data[++i] = stats->ubtc;
+	data[++i] = stats->mbrc;
+	data[++i] = stats->mbtc;
+	data[++i] = stats->bbrc;
+	data[++i] = stats->bbtc;
+	data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
+	data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
+	data[++i] = stats->dma_pkt_rc;
+	data[++i] = stats->dma_pkt_tc;
+	data[++i] = stats->dma_oct_rc;
+	data[++i] = stats->dma_oct_tc;
+	data[++i] = stats->dpc;
+	i++;
+	data += i;
 	count = 0U;
 	for (i = 0U, aq_vec = self->aq_vec[0];
 	}
 err_exit:;
-	(void)err;
+}
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self)
+{
+	struct net_device *ndev = self->ndev;
+	struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
+	ndev->stats.rx_packets = stats->uprc + stats->mprc + stats->bprc;
+	ndev->stats.rx_bytes = stats->ubrc + stats->mbrc + stats->bbrc;
+	ndev->stats.rx_errors = stats->erpr;
+	ndev->stats.tx_packets = stats->uptc + stats->mptc + stats->bptc;
+	ndev->stats.tx_bytes = stats->ubtc + stats->mbtc + stats->bbtc;
+	ndev->stats.tx_errors = stats->erpt;
+	ndev->stats.multicast = stats->mprc;
 }
 void aq_nic_get_link_ksettings(struct aq_nic_s *self,

drivers/net/ethernet/aquantia/atlantic/aq_nic.h+1−1

@@ -71,7 +71,7 @@ struct aq_nic_cfg_s { · 70 unmodified lines
71		71
72	struct aq_nic_s aq_nic_alloc_cold(const struct net_device_ops ndev_ops,	72	struct aq_nic_s aq_nic_alloc_cold(const struct net_device_ops ndev_ops,
73	const struct ethtool_ops *et_ops,	73	const struct ethtool_ops *et_ops,
74	struct device *dev,	74	struct pci_dev *pdev,
75	struct aq_pci_func_s *aq_pci_func,	75	struct aq_pci_func_s *aq_pci_func,
76	unsigned int port,	76	unsigned int port,
77	const struct aq_hw_ops *aq_hw_ops);	77	const struct aq_hw_ops *aq_hw_ops);

drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c+3−2

 	pci_set_drvdata(pdev, self);
 	self->pdev = pdev;
-	err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps);
+	err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device,
+				     pdev->subsystem_device);
 	if (err < 0)
 		goto err_exit;
 	for (port = 0; port < self->ports; ++port) {
 		struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops,
-							    &pdev->dev, self,
+							    pdev, self,
 							    port, aq_hw_ops);
 		if (!aq_nic) {

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c+16−1

 #include "hw_atl_a0_internal.h"
 static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self,
-				 struct aq_hw_caps_s *aq_hw_caps)
+				 struct aq_hw_caps_s *aq_hw_caps,
+				 unsigned short device,
+				 unsigned short subsystem_device)
 {
 	memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps));
+	if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+	if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+		aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G;
+	}
 	return 0;
 }
 	hw_atl_a0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
 	hw_atl_a0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
+	/* Reset link status and read out initial hardware counters */
+	self->aq_link_status.mbps = 0;
+	hw_atl_utils_update_stats(self);
 	err = aq_hw_err_from_flags(self);
 	if (err < 0)
 		goto err_exit;

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c+28−1

@@ -16,11 +16,23 @@ · 15 unmodified lines
16	#include "hw_atl_utils.h"	16	#include "hw_atl_utils.h"
17	#include "hw_atl_llh.h"	17	#include "hw_atl_llh.h"
18	#include "hw_atl_b0_internal.h"	18	#include "hw_atl_b0_internal.h"
		19	#include "hw_atl_llh_internal.h"
19		20
20	static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,	21	static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
21	struct aq_hw_caps_s *aq_hw_caps)	22	struct aq_hw_caps_s *aq_hw_caps,
		23	unsigned short device,
		24	unsigned short subsystem_device)
22	{	25	{
23	memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));	26	memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));
		27
		28	if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
		29	aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
		30
		31	if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
		32	aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
		33	aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G;
		34	}
		35
24	return 0;	36	return 0;
25	}	37	}
26		38
@@ -357,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self, · 330 unmodified lines
357	};	369	};
358		370
359	int err = 0;	371	int err = 0;
		372	u32 val;
360		373
361	self->aq_nic_cfg = aq_nic_cfg;	374	self->aq_nic_cfg = aq_nic_cfg;
362		375
@@ -374,6 +387,20 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self, · 11 unmodified lines
374	hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);	387	hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
375	hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);	388	hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
376		389
		390	/* Force limit MRRS on RDM/TDM to 2K */
		391	val = aq_hw_read_reg(self, pci_reg_control6_adr);
		392	aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) \| 0x404);
		393
		394	/* TX DMA total request limit. B0 hardware is not capable to
		395	* handle more than (8K-MRRS) incoming DMA data.
		396	* Value 24 in 256byte units
		397	*/
		398	aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24);
		399
		400	/* Reset link status and read out initial hardware counters */
		401	self->aq_link_status.mbps = 0;
		402	hw_atl_utils_update_stats(self);
		403
377	err = aq_hw_err_from_flags(self);	404	err = aq_hw_err_from_flags(self);
378	if (err < 0)	405	if (err < 0)
379	goto err_exit;	406	goto err_exit;

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h+6−0

 #define tx_dma_desc_base_addrmsw_adr(descriptor) \
 			(0x00007c04u + (descriptor) * 0x40)
+/* tx dma total request limit */
+#define tx_dma_total_req_limit_adr 0x00007b20u
 /* tx interrupt moderation control register definitions
  * Preprocessor definitions for TX Interrupt Moderation Control Register
  * Base Address: 0x00008980
 /* default value of bitfield reg_res_dsbl */
 #define pci_reg_res_dsbl_default 0x1
+/* PCI core control register */
+#define pci_reg_control6_adr 0x1014u
 /* global microprocessor scratch pad definitions */
 #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4)

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c+25−55

@@ -503,73 +503,43 @@ int hw_atl_utils_update_stats(struct aq_hw_s *self) · 502 unmodified lines
503	struct hw_atl_s *hw_self = PHAL_ATLANTIC;	503	struct hw_atl_s *hw_self = PHAL_ATLANTIC;
504	struct hw_aq_atl_utils_mbox mbox;	504	struct hw_aq_atl_utils_mbox mbox;
505		505
506	if (!self->aq_link_status.mbps)
507	return 0;
508
509	hw_atl_utils_mpi_read_stats(self, &mbox);	506	hw_atl_utils_mpi_read_stats(self, &mbox);
510		507
511	#define AQ_SDELTA(_N_) (hw_self->curr_stats._N_ += \	508	#define AQ_SDELTA(_N_) (hw_self->curr_stats._N_ += \
512	mbox.stats._N_ - hw_self->last_stats._N_)	509	mbox.stats._N_ - hw_self->last_stats._N_)
513		510	if (self->aq_link_status.mbps) {
514	AQ_SDELTA(uprc);	511	AQ_SDELTA(uprc);
515	AQ_SDELTA(mprc);	512	AQ_SDELTA(mprc);
516	AQ_SDELTA(bprc);	513	AQ_SDELTA(bprc);
517	AQ_SDELTA(erpt);	514	AQ_SDELTA(erpt);
518		515
519	AQ_SDELTA(uptc);	516	AQ_SDELTA(uptc);
520	AQ_SDELTA(mptc);	517	AQ_SDELTA(mptc);
521	AQ_SDELTA(bptc);	518	AQ_SDELTA(bptc);
522	AQ_SDELTA(erpr);	519	AQ_SDELTA(erpr);
523		520
524	AQ_SDELTA(ubrc);	521	AQ_SDELTA(ubrc);
525	AQ_SDELTA(ubtc);	522	AQ_SDELTA(ubtc);
526	AQ_SDELTA(mbrc);	523	AQ_SDELTA(mbrc);
527	AQ_SDELTA(mbtc);	524	AQ_SDELTA(mbtc);
528	AQ_SDELTA(bbrc);	525	AQ_SDELTA(bbrc);
529	AQ_SDELTA(bbtc);	526	AQ_SDELTA(bbtc);
530	AQ_SDELTA(dpc);	527	AQ_SDELTA(dpc);
531		528	}
532	#undef AQ_SDELTA	529	#undef AQ_SDELTA
		530	hw_self->curr_stats.dma_pkt_rc = stats_rx_dma_good_pkt_counterlsw_get(self);
		531	hw_self->curr_stats.dma_pkt_tc = stats_tx_dma_good_pkt_counterlsw_get(self);
		532	hw_self->curr_stats.dma_oct_rc = stats_rx_dma_good_octet_counterlsw_get(self);
		533	hw_self->curr_stats.dma_oct_tc = stats_tx_dma_good_octet_counterlsw_get(self);
533		534
534	memcpy(&hw_self->last_stats, &mbox.stats, sizeof(mbox.stats));	535	memcpy(&hw_self->last_stats, &mbox.stats, sizeof(mbox.stats));
535		536
536	return 0;	537	return 0;
537	}	538	}
538		539
539	int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,	540	struct aq_stats_s hw_atl_utils_get_hw_stats(struct aq_hw_s self)
540	u64 data, unsigned int p_count)
541	{	541	{
542	struct hw_atl_s *hw_self = PHAL_ATLANTIC;	542	return &PHAL_ATLANTIC->curr_stats;
543	struct hw_atl_stats_s *stats = &hw_self->curr_stats;
544	int i = 0;
545
546	data[i] = stats->uprc + stats->mprc + stats->bprc;
547	data[++i] = stats->uprc;
548	data[++i] = stats->mprc;
549	data[++i] = stats->bprc;
550	data[++i] = stats->erpt;
551	data[++i] = stats->uptc + stats->mptc + stats->bptc;
552	data[++i] = stats->uptc;
553	data[++i] = stats->mptc;
554	data[++i] = stats->bptc;
555	data[++i] = stats->ubrc;
556	data[++i] = stats->ubtc;
557	data[++i] = stats->mbrc;
558	data[++i] = stats->mbtc;
559	data[++i] = stats->bbrc;
560	data[++i] = stats->bbtc;
561	data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
562	data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
563	data[++i] = stats_rx_dma_good_pkt_counterlsw_get(self);
564	data[++i] = stats_tx_dma_good_pkt_counterlsw_get(self);
565	data[++i] = stats_rx_dma_good_octet_counterlsw_get(self);
566	data[++i] = stats_tx_dma_good_octet_counterlsw_get(self);
567	data[++i] = stats->dpc;
568
569	if (p_count)
570	*p_count = ++i;
571
572	return 0;
573	}	543	}
574		544
575	static const u32 hw_atl_utils_hw_mac_regs[] = {	545	static const u32 hw_atl_utils_hw_mac_regs[] = {

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h+2−4

 struct __packed hw_atl_s {
 	struct aq_hw_s base;
 	struct hw_atl_stats_s last_stats;
-	struct hw_atl_stats_s curr_stats;
+	struct aq_stats_s curr_stats;
 	u64 speed;
 	unsigned int chip_features;
 	u32 fw_ver_actual;
 int hw_atl_utils_update_stats(struct aq_hw_s *self);
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self);
-			      u64 *data,
-			      unsigned int *p_count);
 #endif /* HW_ATL_UTILS_H */

drivers/net/ethernet/aquantia/atlantic/ver.h+4−2

@@ -11,8 +11,10 @@ · 10 unmodified lines
11	#define VER_H	11	#define VER_H
12		12
13	#define NIC_MAJOR_DRIVER_VERSION 1	13	#define NIC_MAJOR_DRIVER_VERSION 1
14	#define NIC_MINOR_DRIVER_VERSION 5	14	#define NIC_MINOR_DRIVER_VERSION 6
15	#define NIC_BUILD_DRIVER_VERSION 345	15	#define NIC_BUILD_DRIVER_VERSION 13
16	#define NIC_REVISION_DRIVER_VERSION 0	16	#define NIC_REVISION_DRIVER_VERSION 0
17		17
		18	#define AQ_CFG_DRV_VERSION_SUFFIX "-kern"
		19
18	#endif /* VER_H */	20	#endif /* VER_H */

drivers/net/ethernet/arc/emac.h+2−0

@@ -159,6 +159,8 @@ struct arc_emac_priv { · 158 unmodified lines
159	unsigned int link;	159	unsigned int link;
160	unsigned int duplex;	160	unsigned int duplex;
161	unsigned int speed;	161	unsigned int speed;
		162
		163	unsigned int rx_missed_errors;
162	};	164	};
163		165
164	/**	166	/**

drivers/net/ethernet/arc/emac_main.c+142−22

@@ -26,6 +26,8 @@ · 25 unmodified lines
26		26
27	#include "emac.h"	27	#include "emac.h"
28		28
		29	static void arc_emac_restart(struct net_device *ndev);
		30
29	/**	31	/**
30	* arc_emac_tx_avail - Return the number of available slots in the tx ring.	32	* arc_emac_tx_avail - Return the number of available slots in the tx ring.
31	* @priv: Pointer to ARC EMAC private data structure.	33	* @priv: Pointer to ARC EMAC private data structure.
@@ -210,39 +212,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget) · 178 unmodified lines
210	continue;	212	continue;
211	}	213	}
212		214
213	pktlen = info & LEN_MASK;	215	/* Prepare the BD for next cycle. netif_receive_skb()
214	stats->rx_packets++;	216	* only if new skb was allocated and mapped to avoid holes
215	stats->rx_bytes += pktlen;	217	* in the RX fifo.
216	skb = rx_buff->skb;	218	*/
217	skb_put(skb, pktlen);	219	skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
218	skb->dev = ndev;	220	if (unlikely(!skb)) {
219	skb->protocol = eth_type_trans(skb, ndev);	221	if (net_ratelimit())
220		222	netdev_err(ndev, "cannot allocate skb\n");
221	dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),	223	/* Return ownership to EMAC */
222	dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);	224	rxbd->info = cpu_to_le32(FOR_EMAC \| EMAC_BUFFER_SIZE);
223
224	/* Prepare the BD for next cycle */
225	rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
226	EMAC_BUFFER_SIZE);
227	if (unlikely(!rx_buff->skb)) {
228	stats->rx_errors++;	225	stats->rx_errors++;
229	/* Because receive_skb is below, increment rx_dropped */
230	stats->rx_dropped++;	226	stats->rx_dropped++;
231	continue;	227	continue;
232	}	228	}
233		229
234	/* receive_skb only if new skb was allocated to avoid holes */	230	addr = dma_map_single(&ndev->dev, (void *)skb->data,
235	netif_receive_skb(skb);
236
237	addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
238	EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);	231	EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
239	if (dma_mapping_error(&ndev->dev, addr)) {	232	if (dma_mapping_error(&ndev->dev, addr)) {
240	if (net_ratelimit())	233	if (net_ratelimit())
241	netdev_err(ndev, "cannot dma map\n");	234	netdev_err(ndev, "cannot map dma buffer\n");
242	dev_kfree_skb(rx_buff->skb);	235	dev_kfree_skb(skb);
		236	/* Return ownership to EMAC */
		237	rxbd->info = cpu_to_le32(FOR_EMAC \| EMAC_BUFFER_SIZE);
243	stats->rx_errors++;	238	stats->rx_errors++;
		239	stats->rx_dropped++;
244	continue;	240	continue;
245	}	241	}
		242
		243	/* unmap previosly mapped skb */
		244	dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
		245	dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
		246
		247	pktlen = info & LEN_MASK;
		248	stats->rx_packets++;
		249	stats->rx_bytes += pktlen;
		250	skb_put(rx_buff->skb, pktlen);
		251	rx_buff->skb->dev = ndev;
		252	rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
		253
		254	netif_receive_skb(rx_buff->skb);
		255
		256	rx_buff->skb = skb;
246	dma_unmap_addr_set(rx_buff, addr, addr);	257	dma_unmap_addr_set(rx_buff, addr, addr);
247	dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);	258	dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
248		259
@@ -258,6 +269,53 @@ static int arc_emac_rx(struct net_device *ndev, int budget) · 9 unmodified lines
258	return work_done;	269	return work_done;
259	}	270	}
260		271
		272	/**
		273	* arc_emac_rx_miss_handle - handle R_MISS register
		274	* @ndev: Pointer to the net_device structure.
		275	*/
		276	static void arc_emac_rx_miss_handle(struct net_device *ndev)
		277	{
		278	struct arc_emac_priv *priv = netdev_priv(ndev);
		279	struct net_device_stats *stats = &ndev->stats;
		280	unsigned int miss;
		281
		282	miss = arc_reg_get(priv, R_MISS);
		283	if (miss) {
		284	stats->rx_errors += miss;
		285	stats->rx_missed_errors += miss;
		286	priv->rx_missed_errors += miss;
		287	}
		288	}
		289
		290	/**
		291	* arc_emac_rx_stall_check - check RX stall
		292	* @ndev: Pointer to the net_device structure.
		293	* @budget: How many BDs requested to process on 1 call.
		294	* @work_done: How many BDs processed
		295	*
		296	* Under certain conditions EMAC stop reception of incoming packets and
		297	* continuously increment R_MISS register instead of saving data into
		298	* provided buffer. This function detect that condition and restart
		299	* EMAC.
		300	*/
		301	static void arc_emac_rx_stall_check(struct net_device *ndev,
		302	int budget, unsigned int work_done)
		303	{
		304	struct arc_emac_priv *priv = netdev_priv(ndev);
		305	struct arc_emac_bd *rxbd;
		306
		307	if (work_done)
		308	priv->rx_missed_errors = 0;
		309
		310	if (priv->rx_missed_errors && budget) {
		311	rxbd = &priv->rxbd[priv->last_rx_bd];
		312	if (le32_to_cpu(rxbd->info) & FOR_EMAC) {
		313	arc_emac_restart(ndev);
		314	priv->rx_missed_errors = 0;
		315	}
		316	}
		317	}
		318
261	/**	319	/**
262	* arc_emac_poll - NAPI poll handler.	320	* arc_emac_poll - NAPI poll handler.
263	* @napi: Pointer to napi_struct structure.	321	* @napi: Pointer to napi_struct structure.
@@ -272,6 +330,7 @@ static int arc_emac_poll(struct napi_struct *napi, int budget) · 8 unmodified lines
272	unsigned int work_done;	330	unsigned int work_done;
273		331
274	arc_emac_tx_clean(ndev);	332	arc_emac_tx_clean(ndev);
		333	arc_emac_rx_miss_handle(ndev);
275		334
276	work_done = arc_emac_rx(ndev, budget);	335	work_done = arc_emac_rx(ndev, budget);
277	if (work_done < budget) {	336	if (work_done < budget) {
@@ -279,6 +338,8 @@ static int arc_emac_poll(struct napi_struct *napi, int budget) · 1 unmodified line
279	arc_reg_or(priv, R_ENABLE, RXINT_MASK \| TXINT_MASK);	338	arc_reg_or(priv, R_ENABLE, RXINT_MASK \| TXINT_MASK);
280	}	339	}
281		340
		341	arc_emac_rx_stall_check(ndev, budget, work_done);
		342
282	return work_done;	343	return work_done;
283	}	344	}
284		345
@@ -320,6 +381,8 @@ static irqreturn_t arc_emac_intr(int irq, void *dev_instance) · 35 unmodified lines
320	if (status & MSER_MASK) {	381	if (status & MSER_MASK) {
321	stats->rx_missed_errors += 0x100;	382	stats->rx_missed_errors += 0x100;
322	stats->rx_errors += 0x100;	383	stats->rx_errors += 0x100;
		384	priv->rx_missed_errors += 0x100;
		385	napi_schedule(&priv->napi);
323	}	386	}
324		387
325	if (status & RXCR_MASK) {	388	if (status & RXCR_MASK) {
@@ -732,6 +795,63 @@ static int arc_emac_ioctl(struct net_device dev, struct ifreq rq, int cmd) · 406 unmodified lines
732	}	795	}
733		796
734		797
		798	/**
		799	* arc_emac_restart - Restart EMAC
		800	* @ndev: Pointer to net_device structure.
		801	*
		802	* This function do hardware reset of EMAC in order to restore
		803	* network packets reception.
		804	*/
		805	static void arc_emac_restart(struct net_device *ndev)
		806	{
		807	struct arc_emac_priv *priv = netdev_priv(ndev);
		808	struct net_device_stats *stats = &ndev->stats;
		809	int i;
		810
		811	if (net_ratelimit())
		812	netdev_warn(ndev, "restarting stalled EMAC\n");
		813
		814	netif_stop_queue(ndev);
		815
		816	/* Disable interrupts */
		817	arc_reg_clr(priv, R_ENABLE, RXINT_MASK \| TXINT_MASK \| ERR_MASK);
		818
		819	/* Disable EMAC */
		820	arc_reg_clr(priv, R_CTRL, EN_MASK);
		821
		822	/* Return the sk_buff to system */
		823	arc_free_tx_queue(ndev);
		824
		825	/* Clean Tx BD's */
		826	priv->txbd_curr = 0;
		827	priv->txbd_dirty = 0;
		828	memset(priv->txbd, 0, TX_RING_SZ);
		829
		830	for (i = 0; i < RX_BD_NUM; i++) {
		831	struct arc_emac_bd *rxbd = &priv->rxbd[i];
		832	unsigned int info = le32_to_cpu(rxbd->info);
		833
		834	if (!(info & FOR_EMAC)) {
		835	stats->rx_errors++;
		836	stats->rx_dropped++;
		837	}
		838	/* Return ownership to EMAC */
		839	rxbd->info = cpu_to_le32(FOR_EMAC \| EMAC_BUFFER_SIZE);
		840	}
		841	priv->last_rx_bd = 0;
		842
		843	/* Make sure info is visible to EMAC before enable */
		844	wmb();
		845
		846	/* Enable interrupts */
		847	arc_reg_set(priv, R_ENABLE, RXINT_MASK \| TXINT_MASK \| ERR_MASK);
		848
		849	/* Enable EMAC */
		850	arc_reg_or(priv, R_CTRL, EN_MASK);
		851
		852	netif_start_queue(ndev);
		853	}
		854
735	static const struct net_device_ops arc_emac_netdev_ops = {	855	static const struct net_device_ops arc_emac_netdev_ops = {
736	.ndo_open = arc_emac_open,	856	.ndo_open = arc_emac_open,
737	.ndo_stop = arc_emac_stop,	857	.ndo_stop = arc_emac_stop,

drivers/net/ethernet/arc/emac_rockchip.c+7−3

 	/* RMII interface needs always a rate of 50MHz */
 	err = clk_set_rate(priv->refclk, 50000000);
-	if (err)
+	if (err) {
 		dev_err(dev,
 			"failed to change reference clock rate (%d)\n", err);
+		goto out_regulator_disable;
+	}
 	if (priv->soc_data->need_div_macclk) {
 		priv->macclk = devm_clk_get(dev, "macclk");
 	err = arc_emac_probe(ndev, interface);
 	if (err) {
 		dev_err(dev, "failed to probe arc emac (%d)\n", err);
-		goto out_regulator_disable;
+		goto out_clk_disable_macclk;
 	}
 	return 0;
 out_clk_disable_macclk:
-	clk_disable_unprepare(priv->macclk);
+	if (priv->soc_data->need_div_macclk)
+		clk_disable_unprepare(priv->macclk);
 out_regulator_disable:
 	if (priv->regulator)
 		regulator_disable(priv->regulator);

drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c+2−2

@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) · 3029 unmodified lines
3030		3030
3031	del_timer_sync(&bp->timer);	3031	del_timer_sync(&bp->timer);
3032		3032
3033	if (IS_PF(bp)) {	3033	if (IS_PF(bp) && !BP_NOMCP(bp)) {
3034	/* Set ALWAYS_ALIVE bit in shmem */	3034	/* Set ALWAYS_ALIVE bit in shmem */
3035	bp->fw_drv_pulse_wr_seq \|= DRV_PULSE_ALWAYS_ALIVE;	3035	bp->fw_drv_pulse_wr_seq \|= DRV_PULSE_ALWAYS_ALIVE;
3036	bnx2x_drv_pulse(bp);	3036	bnx2x_drv_pulse(bp);
@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) · 79 unmodified lines
3116	bp->cnic_loaded = false;	3116	bp->cnic_loaded = false;
3117		3117
3118	/* Clear driver version indication in shmem */	3118	/* Clear driver version indication in shmem */
3119	if (IS_PF(bp))	3119	if (IS_PF(bp) && !BP_NOMCP(bp))
3120	bnx2x_update_mng_version(bp);	3120	bnx2x_update_mng_version(bp);
3121		3121
3122	/* Check if there are pending parity attentions. If there are - set	3122	/* Check if there are pending parity attentions. If there are - set

drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c+13−1

 	do {
 		bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
+		/* If we read all 0xFFs, means we are in PCI error state and
+		 * should bail out to avoid crashes on adapter's FW reads.
+		 */
+		if (bp->common.shmem_base == 0xFFFFFFFF) {
+			bp->flags |= NO_MCP_FLAG;
+			return -ENODEV;
+		}
 		if (bp->common.shmem_base) {
 			val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
 			if (val & SHR_MEM_VALIDITY_MB)
 		BNX2X_ERR("IO slot reset --> driver unload\n");
 		/* MCP should have been reset; Need to wait for validity */
-		bnx2x_init_shmem(bp);
+		if (bnx2x_init_shmem(bp)) {
+			rtnl_unlock();
+			return PCI_ERS_RESULT_DISCONNECT;
+		}
 		if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
 			u32 v;

drivers/net/ethernet/broadcom/tg3.c+18−3

  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005-2014 Broadcom Corporation.
+ * Copyright (C) 2005-2016 Broadcom Corporation.
+ * Copyright (C) 2016-2017 Broadcom Limited.
  *
  * Firmware is:
  *	Derived from proprietary unpublished source code,
- *	Copyright (C) 2000-2003 Broadcom Corporation.
+ *	Copyright (C) 2000-2016 Broadcom Corporation.
+ *	Copyright (C) 2016-2017 Broadcom Ltd.
  *
  *	Permission is hereby granted for the distribution of this firmware
  *	data in hexadecimal or equivalent format, provided this copyright
 	tw32(GRC_MODE, tp->grc_mode | val);
+	/* On one of the AMD platform, MRRS is restricted to 4000 because of
+	 * south bridge limitation. As a workaround, Driver is setting MRRS
+	 * to 2048 instead of default 4096.
+	 */
+	if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+	    tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
+		val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
+		tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
+	}
 	/* Setup the timer prescalar register.  Clock is always 66Mhz. */
 	val = tr32(GRC_MISC_CFG);
 	val &= ~0xff;
 	/* Reset PHY, otherwise the read DMA engine will be in a mode that
 	 * breaks all requests to 256 bytes.
 	 */
-	if (tg3_asic_rev(tp) == ASIC_REV_57766)
+	if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
+	    tg3_asic_rev(tp) == ASIC_REV_5717 ||
+	    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+	    tg3_asic_rev(tp) == ASIC_REV_5720)
 		reset_phy = true;
 	err = tg3_restart_hw(tp, reset_phy);

drivers/net/ethernet/broadcom/tg3.h+6−1

  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2007-2014 Broadcom Corporation.
+ * Copyright (C) 2007-2016 Broadcom Corporation.
+ * Copyright (C) 2016-2017 Broadcom Limited.
  */
 #ifndef _T3_H
 #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR		0x0106
 #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT		0x0109
 #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT	0x010a
+#define TG3PCI_SUBDEVICE_ID_DELL_5762		0x07f0
 #define TG3PCI_SUBVENDOR_ID_COMPAQ		PCI_VENDOR_ID_COMPAQ
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE	0x007c
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2	0x009a
 #define TG3PCI_STD_RING_PROD_IDX	0x00000098 /* 64-bit */
 #define TG3PCI_RCV_RET_RING_CON_IDX	0x000000a0 /* 64-bit */
 /* 0xa8 --> 0xb8 unused */
+#define TG3PCI_DEV_STATUS_CTRL		0x000000b4
+#define  MAX_READ_REQ_SIZE_2048		 0x00004000
+#define  MAX_READ_REQ_MASK		 0x00007000
 #define TG3PCI_DUAL_MAC_CTRL		0x000000b8
 #define  DUAL_MAC_CTRL_CH_MASK		 0x00000003
 #define  DUAL_MAC_CTRL_ID		 0x00000004

drivers/net/ethernet/freescale/fec_main.c+6−0

 		for (i = 0; i < txq->bd.ring_size; i++) {
 			/* Initialize the BD for every fragment in the page. */
 			bdp->cbd_sc = cpu_to_fec16(0);
+			if (bdp->cbd_bufaddr &&
+			    !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
+				dma_unmap_single(&fep->pdev->dev,
+						 fec32_to_cpu(bdp->cbd_bufaddr),
+						 fec16_to_cpu(bdp->cbd_datlen),
+						 DMA_TO_DEVICE);
 			if (txq->tx_skbuff[i]) {
 				dev_kfree_skb_any(txq->tx_skbuff[i]);
 				txq->tx_skbuff[i] = NULL;

drivers/net/ethernet/marvell/mvneta.c+6−2

 	val &= ~MVNETA_GMAC0_PORT_ENABLE;
 	mvreg_write(pp, MVNETA_GMAC_CTRL_0, val);
+	pp->link = 0;
+	pp->duplex = -1;
+	pp->speed = 0;
 	udelay(200);
 }
 		if (!mvneta_rxq_desc_is_first_last(rx_status) ||
 		    (rx_status & MVNETA_RXD_ERR_SUMMARY)) {
+			mvneta_rx_error(pp, rx_desc);
 err_drop_frame:
 			dev->stats.rx_errors++;
-			mvneta_rx_error(pp, rx_desc);
 			/* leave the descriptor untouched */
 			continue;
 		}
 {
 	int queue;
-	for (queue = 0; queue < txq_number; queue++)
+	for (queue = 0; queue < rxq_number; queue++)
 		mvneta_rxq_deinit(pp, &pp->rxqs[queue]);
 }

drivers/net/ethernet/marvell/skge.c+0−1

@@ -4081,7 +4081,6 @@ static void skge_remove(struct pci_dev *pdev) · 4080 unmodified lines
4081	if (hw->ports > 1) {	4081	if (hw->ports > 1) {
4082	skge_write32(hw, B0_IMSK, 0);	4082	skge_write32(hw, B0_IMSK, 0);
4083	skge_read32(hw, B0_IMSK);	4083	skge_read32(hw, B0_IMSK);
4084	free_irq(pdev->irq, hw);
4085	}	4084	}
4086	spin_unlock_irq(&hw->hw_lock);	4085	spin_unlock_irq(&hw->hw_lock);
4087		4086

drivers/net/ethernet/mediatek/mtk_eth_soc.c+6−5

@@ -1961,11 +1961,12 @@ static int mtk_hw_init(struct mtk_eth *eth) · 1960 unmodified lines
1961	/* set GE2 TUNE */	1961	/* set GE2 TUNE */
1962	regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);	1962	regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
1963		1963
1964	/* GE1, Force 1000M/FD, FC ON */	1964	/* Set linkdown as the default for each GMAC. Its own MCR would be set
1965	mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));	1965	* up with the more appropriate value when mtk_phy_link_adjust call is
1966		1966	* being invoked.
1967	/* GE2, Force 1000M/FD, FC ON */	1967	*/
1968	mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));	1968	for (i = 0; i < MTK_MAC_COUNT; i++)
		1969	mtk_w32(eth, 0, MTK_MAC_MCR(i));
1969		1970
1970	/* Indicates CDM to parse the MTK special tag from CPU	1971	/* Indicates CDM to parse the MTK special tag from CPU
1971	* which also is working out for untag packets.	1972	* which also is working out for untag packets.

drivers/net/ethernet/mellanox/mlx4/en_port.c+31−26

 	struct net_device *dev = mdev->pndev[port];
 	struct mlx4_en_priv *priv = netdev_priv(dev);
 	struct net_device_stats *stats = &dev->stats;
-	struct mlx4_cmd_mailbox *mailbox;
+	struct mlx4_cmd_mailbox *mailbox, *mailbox_priority;
 	u64 in_mod = reset << 8 | port;
 	int err;
 	int i, counter_index;
 	mailbox = mlx4_alloc_cmd_mailbox(mdev->dev);
 	if (IS_ERR(mailbox))
 		return PTR_ERR(mailbox);
+	mailbox_priority = mlx4_alloc_cmd_mailbox(mdev->dev);
+	if (IS_ERR(mailbox_priority)) {
+		mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+		return PTR_ERR(mailbox_priority);
+	}
 	err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, in_mod, 0,
 			   MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
 			   MLX4_CMD_NATIVE);
 	mlx4_en_stats = mailbox->buf;
+	memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
+	counter_index = mlx4_get_default_counter_index(mdev->dev, port);
+	err = mlx4_get_counter_stats(mdev->dev, counter_index,
+				     &tmp_counter_stats, reset);
+	/* 0xffs indicates invalid value */
+	memset(mailbox_priority->buf, 0xff,
+	       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+	if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
+		memset(mailbox_priority->buf, 0,
+		       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+		err = mlx4_cmd_box(mdev->dev, 0, mailbox_priority->dma,
+				   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
+				   0, MLX4_CMD_DUMP_ETH_STATS,
+				   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
+		if (err)
+			goto out;
+	}
+	flowstats = mailbox_priority->buf;
 	spin_lock_bh(&priv->stats_lock);
 	mlx4_en_fold_software_stats(dev);
 	priv->pkstats.tx_prio[8][0] = be64_to_cpu(mlx4_en_stats->TTOT_novlan);
 	priv->pkstats.tx_prio[8][1] = be64_to_cpu(mlx4_en_stats->TOCT_novlan);
-	spin_unlock_bh(&priv->stats_lock);
-	memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
-	counter_index = mlx4_get_default_counter_index(mdev->dev, port);
-	err = mlx4_get_counter_stats(mdev->dev, counter_index,
-				     &tmp_counter_stats, reset);
-	/* 0xffs indicates invalid value */
-	memset(mailbox->buf, 0xff, sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-	if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
-		memset(mailbox->buf, 0,
-		       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-		err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma,
-				   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
-				   0, MLX4_CMD_DUMP_ETH_STATS,
-				   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
-		if (err)
-			goto out;
-	}
-	flowstats = mailbox->buf;
-	spin_lock_bh(&priv->stats_lock);
 	if (tmp_counter_stats.counter_mode == 0) {
 		priv->pf_stats.rx_bytes   = be64_to_cpu(tmp_counter_stats.rx_bytes);
 		priv->pf_stats.tx_bytes   = be64_to_cpu(tmp_counter_stats.tx_bytes);
 out:
 	mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+	mlx4_free_cmd_mailbox(mdev->dev, mailbox_priority);
 	return err;
 }

drivers/net/ethernet/mellanox/mlx4/en_selftest.c+1−1

@@ -185,7 +185,7 @@ void mlx4_en_ex_selftest(struct net_device dev, u32 flags, u64 *buf) · 184 unmodified lines
185	if (priv->mdev->dev->caps.flags &	185	if (priv->mdev->dev->caps.flags &
186	MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {	186	MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
187	buf[3] = mlx4_en_test_registers(priv);	187	buf[3] = mlx4_en_test_registers(priv);
188	if (priv->port_up)	188	if (priv->port_up && dev->mtu >= MLX4_SELFTEST_LB_MIN_MTU)
189	buf[4] = mlx4_en_test_loopback(priv);	189	buf[4] = mlx4_en_test_loopback(priv);
190	}	190	}
191		191

drivers/net/ethernet/mellanox/mlx4/mlx4_en.h+3−0

 #define SMALL_PACKET_SIZE      (256 - NET_IP_ALIGN)
 #define HEADER_COPY_SIZE       (128 - NET_IP_ALIGN)
 #define MLX4_LOOPBACK_TEST_PAYLOAD (HEADER_COPY_SIZE - ETH_HLEN)
+#define PREAMBLE_LEN           8
+#define MLX4_SELFTEST_LB_MIN_MTU (MLX4_LOOPBACK_TEST_PAYLOAD + NET_IP_ALIGN + \
+				  ETH_HLEN + PREAMBLE_LEN)
 #define MLX4_EN_MIN_MTU		46
 /* VLAN_HLEN is added twice,to support skb vlan tagged with multiple

drivers/net/ethernet/mellanox/mlx4/resource_tracker.c+0−1

@@ -611,7 +611,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev) · 610 unmodified lines
611	MLX4_MAX_PORTS;	611	MLX4_MAX_PORTS;
612	else	612	else
613	res_alloc->guaranteed[t] = 0;	613	res_alloc->guaranteed[t] = 0;
614	res_alloc->res_free -= res_alloc->guaranteed[t];
615	break;	614	break;
616	default:	615	default:
617	break;	616	break;

drivers/net/ethernet/mellanox/mlx5/core/cmd.c+2−2

drivers/net/ethernet/mellanox/mlx5/core/en.h+7−2

 	max_t(u32, MLX5_MPWRQ_MIN_LOG_STRIDE_SZ(mdev), req)
 #define MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev)       MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, 6)
 #define MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, 8)
+#define MLX5E_MPWQE_STRIDE_SZ(mdev, cqe_cmprs) \
+	(cqe_cmprs ? MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) : \
+	MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev))
 #define MLX5_MPWRQ_LOG_WQE_SZ			18
 #define MLX5_MPWRQ_WQE_PAGE_ORDER  (MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT > 0 ? \
 	struct mlx5_core_dev      *mdev;
 	struct hwtstamp_config    *tstamp;
 	int                        ix;
+	int                        cpu;
 };
 struct mlx5e_channels {
 				 u8 cq_period_mode);
 void mlx5e_set_rx_cq_mode_params(struct mlx5e_params *params,
 				 u8 cq_period_mode);
-void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
+void mlx5e_init_rq_type_params(struct mlx5_core_dev *mdev,
-			      struct mlx5e_params *params, u8 rq_type);
+			       struct mlx5e_params *params,
+			       u8 rq_type);
 static inline bool mlx5e_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev)
 {

drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c+7−3

 static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
 				    struct ieee_ets *ets)
 {
+	bool have_ets_tc = false;
 	int bw_sum = 0;
 	int i;
 	}
 	/* Validate Bandwidth Sum */
-	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
+	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-		if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
+		if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
+			have_ets_tc = true;
 			bw_sum += ets->tc_tx_bw[i];
+		}
+	}
-	if (bw_sum != 0 && bw_sum != 100) {
+	if (have_ets_tc && bw_sum != 100) {
 		netdev_err(netdev,
 			   "Failed to validate ETS: BW sum is illegal\n");
 		return -EINVAL;

drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c+8−2

 	new_channels.params = priv->channels.params;
 	MLX5E_SET_PFLAG(&new_channels.params, MLX5E_PFLAG_RX_CQE_COMPRESS, new_val);
-	mlx5e_set_rq_type_params(priv->mdev, &new_channels.params,
+	new_channels.params.mpwqe_log_stride_sz =
-				 new_channels.params.rq_wq_type);
+		MLX5E_MPWQE_STRIDE_SZ(priv->mdev, new_val);
+	new_channels.params.mpwqe_log_num_strides =
+		MLX5_MPWRQ_LOG_WQE_SZ - new_channels.params.mpwqe_log_stride_sz;
 	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
 		priv->channels.params = new_channels.params;
 		return err;
 	mlx5e_switch_priv_channels(priv, &new_channels, NULL);
+	mlx5e_dbg(DRV, priv, "MLX5E: RxCqeCmprss was turned %s\n",
+		  MLX5E_GET_PFLAG(&priv->channels.params,
+				  MLX5E_PFLAG_RX_CQE_COMPRESS) ? "ON" : "OFF");
 	return 0;
 }

drivers/net/ethernet/mellanox/mlx5/core/en_main.c+31−32

 	struct mlx5e_cq_param      icosq_cq;
 };
-static int mlx5e_get_node(struct mlx5e_priv *priv, int ix)
-{
-	return pci_irq_get_node(priv->mdev->pdev, MLX5_EQ_VEC_COMP_BASE + ix);
-}
 static bool mlx5e_check_fragmented_striding_rq_cap(struct mlx5_core_dev *mdev)
 {
 	return MLX5_CAP_GEN(mdev, striding_rq) &&
 		MLX5_CAP_ETH(mdev, reg_umr_sq);
 }
-void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
+void mlx5e_init_rq_type_params(struct mlx5_core_dev *mdev,
-			      struct mlx5e_params *params, u8 rq_type)
+			       struct mlx5e_params *params, u8 rq_type)
 {
 	params->rq_wq_type = rq_type;
 	params->lro_wqe_sz = MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ;
 		params->log_rq_size = is_kdump_kernel() ?
 			MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW :
 			MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE_MPW;
-		params->mpwqe_log_stride_sz =
+		params->mpwqe_log_stride_sz = MLX5E_MPWQE_STRIDE_SZ(mdev,
-			MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS) ?
+			MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS));
-			MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) :
-			MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev);
 		params->mpwqe_log_num_strides = MLX5_MPWRQ_LOG_WQE_SZ -
 			params->mpwqe_log_stride_sz;
 		break;
 		       MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS));
 }
-static void mlx5e_set_rq_params(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
+static void mlx5e_set_rq_params(struct mlx5_core_dev *mdev,
+				struct mlx5e_params *params)
 {
 	u8 rq_type = mlx5e_check_fragmented_striding_rq_cap(mdev) &&
 		    !params->xdp_prog && !MLX5_IPSEC_DEV(mdev) ?
 		    MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ :
 		    MLX5_WQ_TYPE_LINKED_LIST;
-	mlx5e_set_rq_type_params(mdev, params, rq_type);
+	mlx5e_init_rq_type_params(mdev, params, rq_type);
 }
 static void mlx5e_update_carrier(struct mlx5e_priv *priv)
 	int wq_sz = mlx5_wq_ll_get_size(&rq->wq);
 	int mtt_sz = mlx5e_get_wqe_mtt_sz();
 	int mtt_alloc = mtt_sz + MLX5_UMR_ALIGN - 1;
-	int node = mlx5e_get_node(c->priv, c->ix);
 	int i;
 	rq->mpwqe.info = kzalloc_node(wq_sz * sizeof(*rq->mpwqe.info),
-					GFP_KERNEL, node);
+				      GFP_KERNEL, cpu_to_node(c->cpu));
 	if (!rq->mpwqe.info)
 		goto err_out;
 	/* We allocate more than mtt_sz as we will align the pointer */
-	rq->mpwqe.mtt_no_align = kzalloc_node(mtt_alloc * wq_sz,
+	rq->mpwqe.mtt_no_align = kzalloc_node(mtt_alloc * wq_sz, GFP_KERNEL,
-					GFP_KERNEL, node);
+					cpu_to_node(c->cpu));
 	if (unlikely(!rq->mpwqe.mtt_no_align))
 		goto err_free_wqe_info;
 	int err;
 	int i;
-	rqp->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+	rqp->wq.db_numa_node = cpu_to_node(c->cpu);
 	err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->wq,
 				&rq->wq_ctrl);
 	default: /* MLX5_WQ_TYPE_LINKED_LIST */
 		rq->wqe.frag_info =
 			kzalloc_node(wq_sz * sizeof(*rq->wqe.frag_info),
-				     GFP_KERNEL,
+				     GFP_KERNEL, cpu_to_node(c->cpu));
-				     mlx5e_get_node(c->priv, c->ix));
 		if (!rq->wqe.frag_info) {
 			err = -ENOMEM;
 			goto err_rq_wq_destroy;
 	sq->uar_map   = mdev->mlx5e_res.bfreg.map;
 	sq->min_inline_mode = params->tx_min_inline_mode;
-	param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+	param->wq.db_numa_node = cpu_to_node(c->cpu);
 	err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
 	if (err)
 		return err;
 	sq->wq.db = &sq->wq.db[MLX5_SND_DBR];
-	err = mlx5e_alloc_xdpsq_db(sq, mlx5e_get_node(c->priv, c->ix));
+	err = mlx5e_alloc_xdpsq_db(sq, cpu_to_node(c->cpu));
 	if (err)
 		goto err_sq_wq_destroy;
 	sq->channel   = c;
 	sq->uar_map   = mdev->mlx5e_res.bfreg.map;
-	param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+	param->wq.db_numa_node = cpu_to_node(c->cpu);
 	err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
 	if (err)
 		return err;
 	sq->wq.db = &sq->wq.db[MLX5_SND_DBR];
-	err = mlx5e_alloc_icosq_db(sq, mlx5e_get_node(c->priv, c->ix));
+	err = mlx5e_alloc_icosq_db(sq, cpu_to_node(c->cpu));
 	if (err)
 		goto err_sq_wq_destroy;
 	if (MLX5_IPSEC_DEV(c->priv->mdev))
 		set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state);
-	param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+	param->wq.db_numa_node = cpu_to_node(c->cpu);
 	err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
 	if (err)
 		return err;
 	sq->wq.db    = &sq->wq.db[MLX5_SND_DBR];
-	err = mlx5e_alloc_txqsq_db(sq, mlx5e_get_node(c->priv, c->ix));
+	err = mlx5e_alloc_txqsq_db(sq, cpu_to_node(c->cpu));
 	if (err)
 		goto err_sq_wq_destroy;
 	struct mlx5_core_dev *mdev = c->priv->mdev;
 	int err;
-	param->wq.buf_numa_node = mlx5e_get_node(c->priv, c->ix);
+	param->wq.buf_numa_node = cpu_to_node(c->cpu);
-	param->wq.db_numa_node  = mlx5e_get_node(c->priv, c->ix);
+	param->wq.db_numa_node  = cpu_to_node(c->cpu);
 	param->eq_ix   = c->ix;
 	err = mlx5e_alloc_cq_common(mdev, param, cq);
 	mlx5e_free_cq(cq);
 }
+static int mlx5e_get_cpu(struct mlx5e_priv *priv, int ix)
+{
+	return cpumask_first(priv->mdev->priv.irq_info[ix].mask);
+}
 static int mlx5e_open_tx_cqs(struct mlx5e_channel *c,
 			     struct mlx5e_params *params,
 			     struct mlx5e_channel_param *cparam)
 {
 	struct mlx5e_cq_moder icocq_moder = {0, 0};
 	struct net_device *netdev = priv->netdev;
+	int cpu = mlx5e_get_cpu(priv, ix);
 	struct mlx5e_channel *c;
 	unsigned int irq;
 	int err;
 	int eqn;
-	c = kzalloc_node(sizeof(*c), GFP_KERNEL, mlx5e_get_node(priv, ix));
+	c = kzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
 	if (!c)
 		return -ENOMEM;
 	c->mdev     = priv->mdev;
 	c->tstamp   = &priv->tstamp;
 	c->ix       = ix;
+	c->cpu      = cpu;
 	c->pdev     = &priv->mdev->pdev->dev;
 	c->netdev   = priv->netdev;
 	c->mkey_be  = cpu_to_be32(priv->mdev->mlx5e_res.mkey.key);
 	for (tc = 0; tc < c->num_tc; tc++)
 		mlx5e_activate_txqsq(&c->sq[tc]);
 	mlx5e_activate_rq(&c->rq);
-	netif_set_xps_queue(c->netdev,
+	netif_set_xps_queue(c->netdev, get_cpu_mask(c->cpu), c->ix);
-		mlx5_get_vector_affinity(c->priv->mdev, c->ix), c->ix);
 }
 static void mlx5e_deactivate_channel(struct mlx5e_channel *c)
 						     struct sk_buff *skb,
 						     netdev_features_t features)
 {
+	unsigned int offset = 0;
 	struct udphdr *udph;
 	u8 proto;
 	u16 port;
 		proto = ip_hdr(skb)->protocol;
 		break;
 	case htons(ETH_P_IPV6):
-		proto = ipv6_hdr(skb)->nexthdr;
+		proto = ipv6_find_hdr(skb, &offset, -1, NULL, NULL);
 		break;
 	default:
 		goto out;

drivers/net/ethernet/mellanox/mlx5/core/eq.c+12−8

@@ -466,7 +466,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr) · 465 unmodified lines
466	break;	466	break;
467	case MLX5_EVENT_TYPE_CQ_ERROR:	467	case MLX5_EVENT_TYPE_CQ_ERROR:
468	cqn = be32_to_cpu(eqe->data.cq_err.cqn) & 0xffffff;	468	cqn = be32_to_cpu(eqe->data.cq_err.cqn) & 0xffffff;
469	mlx5_core_warn(dev, "CQ error on CQN 0x%x, syndrom 0x%x\n",	469	mlx5_core_warn(dev, "CQ error on CQN 0x%x, syndrome 0x%x\n",
470	cqn, eqe->data.cq_err.syndrome);	470	cqn, eqe->data.cq_err.syndrome);
471	mlx5_cq_event(dev, cqn, eqe->type);	471	mlx5_cq_event(dev, cqn, eqe->type);
472	break;	472	break;
@@ -775,7 +775,7 @@ err1: · 302 unmodified lines
775	return err;	775	return err;
776	}	776	}
777		777
778	int mlx5_stop_eqs(struct mlx5_core_dev *dev)	778	void mlx5_stop_eqs(struct mlx5_core_dev *dev)
779	{	779	{
780	struct mlx5_eq_table *table = &dev->priv.eq_table;	780	struct mlx5_eq_table *table = &dev->priv.eq_table;
781	int err;	781	int err;
@@ -784,22 +784,26 @@ int mlx5_stop_eqs(struct mlx5_core_dev *dev) · 2 unmodified lines
784	if (MLX5_CAP_GEN(dev, pg)) {	784	if (MLX5_CAP_GEN(dev, pg)) {
785	err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq);	785	err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq);
786	if (err)	786	if (err)
787	return err;	787	mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n",
		788	err);
788	}	789	}
789	#endif	790	#endif
790		791
791	err = mlx5_destroy_unmap_eq(dev, &table->pages_eq);	792	err = mlx5_destroy_unmap_eq(dev, &table->pages_eq);
792	if (err)	793	if (err)
793	return err;	794	mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n",
		795	err);
794		796
795	mlx5_destroy_unmap_eq(dev, &table->async_eq);	797	err = mlx5_destroy_unmap_eq(dev, &table->async_eq);
		798	if (err)
		799	mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n",
		800	err);
796	mlx5_cmd_use_polling(dev);	801	mlx5_cmd_use_polling(dev);
797		802
798	err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);	803	err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
799	if (err)	804	if (err)
800	mlx5_cmd_use_events(dev);	805	mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
801		806	err);
802	return err;
803	}	807	}
804		808
805	int mlx5_core_eq_query(struct mlx5_core_dev dev, struct mlx5_eq eq,	809	int mlx5_core_eq_query(struct mlx5_core_dev dev, struct mlx5_eq eq,

drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c+6−0

 	u8 actual_size;
 	int err;
+	if (!size)
+		return -EINVAL;
 	if (!fdev->mdev)
 		return -ENOTCONN;
 	u8 actual_size;
 	int err;
+	if (!size)
+		return -EINVAL;
 	if (!fdev->mdev)
 		return -ENOTCONN;

drivers/net/ethernet/mellanox/mlx5/core/fs_core.c+14−2

 static void del_sw_flow_table(struct fs_node *node);
 static void del_sw_flow_group(struct fs_node *node);
 static void del_sw_fte(struct fs_node *node);
+static void del_sw_prio(struct fs_node *node);
+static void del_sw_ns(struct fs_node *node);
 /* Delete rule (destination) is special case that
  * requires to lock the FTE for all the deletion process.
  */
 	return NULL;
 }
+static void del_sw_ns(struct fs_node *node)
+{
+	kfree(node);
+}
+static void del_sw_prio(struct fs_node *node)
+{
+	kfree(node);
+}
 static void del_hw_flow_table(struct fs_node *node)
 {
 	struct mlx5_flow_table *ft;
 		return ERR_PTR(-ENOMEM);
 	fs_prio->node.type = FS_TYPE_PRIO;
-	tree_init_node(&fs_prio->node, NULL, NULL);
+	tree_init_node(&fs_prio->node, NULL, del_sw_prio);
 	tree_add_node(&fs_prio->node, &ns->node);
 	fs_prio->num_levels = num_levels;
 	fs_prio->prio = prio;
 		return ERR_PTR(-ENOMEM);
 	fs_init_namespace(ns);
-	tree_init_node(&ns->node, NULL, NULL);
+	tree_init_node(&ns->node, NULL, del_sw_ns);
 	tree_add_node(&ns->node, &prio->node);
 	list_add_tail(&ns->node.list, &prio->node.children);

drivers/net/ethernet/mellanox/mlx5/core/health.c+1−1

@@ -241,7 +241,7 @@ static void print_health_info(struct mlx5_core_dev *dev) · 240 unmodified lines
241	u32 fw;	241	u32 fw;
242	int i;	242	int i;
243		243
244	/* If the syndrom is 0, the device is OK and no need to print buffer */	244	/* If the syndrome is 0, the device is OK and no need to print buffer */
245	if (!ioread8(&h->synd))	245	if (!ioread8(&h->synd))
246	return;	246	return;
247		247

drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c+1−1

@@ -57,7 +57,7 @@ static void mlx5i_build_nic_params(struct mlx5_core_dev *mdev, · 56 unmodified lines
57	struct mlx5e_params *params)	57	struct mlx5e_params *params)
58	{	58	{
59	/* Override RQ params as IPoIB supports only LINKED LIST RQ for now */	59	/* Override RQ params as IPoIB supports only LINKED LIST RQ for now */
60	mlx5e_set_rq_type_params(mdev, params, MLX5_WQ_TYPE_LINKED_LIST);	60	mlx5e_init_rq_type_params(mdev, params, MLX5_WQ_TYPE_LINKED_LIST);
61		61
62	/* RQ size in ipoib by default is 512 */	62	/* RQ size in ipoib by default is 512 */
63	params->log_rq_size = is_kdump_kernel() ?	63	params->log_rq_size = is_kdump_kernel() ?

drivers/net/ethernet/mellanox/mlx5/core/lag.c+56−0

@@ -137,6 +137,17 @@ int mlx5_cmd_destroy_vport_lag(struct mlx5_core_dev *dev) · 136 unmodified lines
137	}	137	}
138	EXPORT_SYMBOL(mlx5_cmd_destroy_vport_lag);	138	EXPORT_SYMBOL(mlx5_cmd_destroy_vport_lag);
139		139
		140	static int mlx5_cmd_query_cong_counter(struct mlx5_core_dev *dev,
		141	bool reset, void *out, int out_size)
		142	{
		143	u32 in[MLX5_ST_SZ_DW(query_cong_statistics_in)] = { };
		144
		145	MLX5_SET(query_cong_statistics_in, in, opcode,
		146	MLX5_CMD_OP_QUERY_CONG_STATISTICS);
		147	MLX5_SET(query_cong_statistics_in, in, clear, reset);
		148	return mlx5_cmd_exec(dev, in, sizeof(in), out, out_size);
		149	}
		150
140	static struct mlx5_lag mlx5_lag_dev_get(struct mlx5_core_dev dev)	151	static struct mlx5_lag mlx5_lag_dev_get(struct mlx5_core_dev dev)
141	{	152	{
142	return dev->priv.lag;	153	return dev->priv.lag;
@@ -633,3 +644,48 @@ bool mlx5_lag_intf_add(struct mlx5_interface intf, struct mlx5_priv priv) · 490 unmodified lines
633	/* If bonded, we do not add an IB device for PF1. */	644	/* If bonded, we do not add an IB device for PF1. */
634	return false;	645	return false;
635	}	646	}
		647
		648	int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev,
		649	u64 *values,
		650	int num_counters,
		651	size_t *offsets)
		652	{
		653	int outlen = MLX5_ST_SZ_BYTES(query_cong_statistics_out);
		654	struct mlx5_core_dev *mdev[MLX5_MAX_PORTS];
		655	struct mlx5_lag *ldev;
		656	int num_ports;
		657	int ret, i, j;
		658	void *out;
		659
		660	out = kvzalloc(outlen, GFP_KERNEL);
		661	if (!out)
		662	return -ENOMEM;
		663
		664	memset(values, 0, sizeof(values) num_counters);
		665
		666	mutex_lock(&lag_mutex);
		667	ldev = mlx5_lag_dev_get(dev);
		668	if (ldev && mlx5_lag_is_bonded(ldev)) {
		669	num_ports = MLX5_MAX_PORTS;
		670	mdev[0] = ldev->pf[0].dev;
		671	mdev[1] = ldev->pf[1].dev;
		672	} else {
		673	num_ports = 1;
		674	mdev[0] = dev;
		675	}
		676
		677	for (i = 0; i < num_ports; ++i) {
		678	ret = mlx5_cmd_query_cong_counter(mdev[i], false, out, outlen);
		679	if (ret)
		680	goto unlock;
		681
		682	for (j = 0; j < num_counters; ++j)
		683	values[j] += be64_to_cpup((__be64 *)(out + offsets[j]));
		684	}
		685
		686	unlock:
		687	mutex_unlock(&lag_mutex);
		688	kvfree(out);
		689	return ret;
		690	}
		691	EXPORT_SYMBOL(mlx5_lag_query_cong_counters);

drivers/net/ethernet/mellanox/mlx5/core/main.c+69−6

@@ -317,9 +317,6 @@ static int mlx5_alloc_irq_vectors(struct mlx5_core_dev *dev) · 316 unmodified lines
317	{	317	{
318	struct mlx5_priv *priv = &dev->priv;	318	struct mlx5_priv *priv = &dev->priv;
319	struct mlx5_eq_table *table = &priv->eq_table;	319	struct mlx5_eq_table *table = &priv->eq_table;
320	struct irq_affinity irqdesc = {
321	.pre_vectors = MLX5_EQ_VEC_COMP_BASE,
322	};
323	int num_eqs = 1 << MLX5_CAP_GEN(dev, log_max_eq);	320	int num_eqs = 1 << MLX5_CAP_GEN(dev, log_max_eq);
324	int nvec;	321	int nvec;
325		322
@@ -333,10 +330,9 @@ static int mlx5_alloc_irq_vectors(struct mlx5_core_dev *dev) · 7 unmodified lines
333	if (!priv->irq_info)	330	if (!priv->irq_info)
334	goto err_free_msix;	331	goto err_free_msix;
335		332
336	nvec = pci_alloc_irq_vectors_affinity(dev->pdev,	333	nvec = pci_alloc_irq_vectors(dev->pdev,
337	MLX5_EQ_VEC_COMP_BASE + 1, nvec,	334	MLX5_EQ_VEC_COMP_BASE + 1, nvec,
338	PCI_IRQ_MSIX \| PCI_IRQ_AFFINITY,	335	PCI_IRQ_MSIX);
339	&irqdesc);
340	if (nvec < 0)	336	if (nvec < 0)
341	return nvec;	337	return nvec;
342		338
@@ -622,6 +618,63 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev) · 279 unmodified lines
622	return (u64)timer_l \| (u64)timer_h1 << 32;	618	return (u64)timer_l \| (u64)timer_h1 << 32;
623	}	619	}
624		620
		621	static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
		622	{
		623	struct mlx5_priv *priv = &mdev->priv;
		624	int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
		625
		626	if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
		627	mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
		628	return -ENOMEM;
		629	}
		630
		631	cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
		632	priv->irq_info[i].mask);
		633
		634	if (IS_ENABLED(CONFIG_SMP) &&
		635	irq_set_affinity_hint(irq, priv->irq_info[i].mask))
		636	mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
		637
		638	return 0;
		639	}
		640
		641	static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
		642	{
		643	struct mlx5_priv *priv = &mdev->priv;
		644	int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
		645
		646	irq_set_affinity_hint(irq, NULL);
		647	free_cpumask_var(priv->irq_info[i].mask);
		648	}
		649
		650	static int mlx5_irq_set_affinity_hints(struct mlx5_core_dev *mdev)
		651	{
		652	int err;
		653	int i;
		654
		655	for (i = 0; i < mdev->priv.eq_table.num_comp_vectors; i++) {
		656	err = mlx5_irq_set_affinity_hint(mdev, i);
		657	if (err)
		658	goto err_out;
		659	}
		660
		661	return 0;
		662
		663	err_out:
		664	for (i--; i >= 0; i--)
		665	mlx5_irq_clear_affinity_hint(mdev, i);
		666
		667	return err;
		668	}
		669
		670	static void mlx5_irq_clear_affinity_hints(struct mlx5_core_dev *mdev)
		671	{
		672	int i;
		673
		674	for (i = 0; i < mdev->priv.eq_table.num_comp_vectors; i++)
		675	mlx5_irq_clear_affinity_hint(mdev, i);
		676	}
		677
625	int mlx5_vector2eqn(struct mlx5_core_dev dev, int vector, int eqn,	678	int mlx5_vector2eqn(struct mlx5_core_dev dev, int vector, int eqn,
626	unsigned int *irqn)	679	unsigned int *irqn)
627	{	680	{
@@ -1097,6 +1150,12 @@ static int mlx5_load_one(struct mlx5_core_dev dev, struct mlx5_priv priv, · 469 unmodified lines
1097	goto err_stop_eqs;	1150	goto err_stop_eqs;
1098	}	1151	}
1099		1152
		1153	err = mlx5_irq_set_affinity_hints(dev);
		1154	if (err) {
		1155	dev_err(&pdev->dev, "Failed to alloc affinity hint cpumask\n");
		1156	goto err_affinity_hints;
		1157	}
		1158
1100	err = mlx5_init_fs(dev);	1159	err = mlx5_init_fs(dev);
1101	if (err) {	1160	if (err) {
1102	dev_err(&pdev->dev, "Failed to init flow steering\n");	1161	dev_err(&pdev->dev, "Failed to init flow steering\n");
@@ -1154,6 +1213,9 @@ err_sriov: · 51 unmodified lines
1154	mlx5_cleanup_fs(dev);	1213	mlx5_cleanup_fs(dev);
1155		1214
1156	err_fs:	1215	err_fs:
		1216	mlx5_irq_clear_affinity_hints(dev);
		1217
		1218	err_affinity_hints:
1157	free_comp_eqs(dev);	1219	free_comp_eqs(dev);
1158		1220
1159	err_stop_eqs:	1221	err_stop_eqs:
@@ -1222,6 +1284,7 @@ static int mlx5_unload_one(struct mlx5_core_dev dev, struct mlx5_priv priv, · 62 unmodified lines
1222		1284
1223	mlx5_sriov_detach(dev);	1285	mlx5_sriov_detach(dev);
1224	mlx5_cleanup_fs(dev);	1286	mlx5_cleanup_fs(dev);
		1287	mlx5_irq_clear_affinity_hints(dev);
1225	free_comp_eqs(dev);	1288	free_comp_eqs(dev);
1226	mlx5_stop_eqs(dev);	1289	mlx5_stop_eqs(dev);
1227	mlx5_put_uars_page(dev, priv->uar);	1290	mlx5_put_uars_page(dev, priv->uar);

drivers/net/ethernet/mellanox/mlx5/core/qp.c+2−2

@@ -213,8 +213,8 @@ int mlx5_core_create_qp(struct mlx5_core_dev *dev, · 212 unmodified lines
213	err_cmd:	213	err_cmd:
214	memset(din, 0, sizeof(din));	214	memset(din, 0, sizeof(din));
215	memset(dout, 0, sizeof(dout));	215	memset(dout, 0, sizeof(dout));
216	MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP);	216	MLX5_SET(destroy_qp_in, din, opcode, MLX5_CMD_OP_DESTROY_QP);
217	MLX5_SET(destroy_qp_in, in, qpn, qp->qpn);	217	MLX5_SET(destroy_qp_in, din, qpn, qp->qpn);
218	mlx5_cmd_exec(dev, din, sizeof(din), dout, sizeof(dout));	218	mlx5_cmd_exec(dev, din, sizeof(din), dout, sizeof(dout));
219	return err;	219	return err;
220	}	220	}

drivers/net/ethernet/mellanox/mlx5/core/rl.c+11−11

@@ -125,16 +125,16 @@ static struct mlx5_rl_entry find_rl_entry(struct mlx5_rl_table table, · 124 unmodified lines
125	return ret_entry;	125	return ret_entry;
126	}	126	}
127		127
128	static int mlx5_set_rate_limit_cmd(struct mlx5_core_dev *dev,	128	static int mlx5_set_pp_rate_limit_cmd(struct mlx5_core_dev *dev,
129	u32 rate, u16 index)	129	u32 rate, u16 index)
130	{	130	{
131	u32 in[MLX5_ST_SZ_DW(set_rate_limit_in)] = {0};	131	u32 in[MLX5_ST_SZ_DW(set_pp_rate_limit_in)] = {0};
132	u32 out[MLX5_ST_SZ_DW(set_rate_limit_out)] = {0};	132	u32 out[MLX5_ST_SZ_DW(set_pp_rate_limit_out)] = {0};
133		133
134	MLX5_SET(set_rate_limit_in, in, opcode,	134	MLX5_SET(set_pp_rate_limit_in, in, opcode,
135	MLX5_CMD_OP_SET_RATE_LIMIT);	135	MLX5_CMD_OP_SET_PP_RATE_LIMIT);
136	MLX5_SET(set_rate_limit_in, in, rate_limit_index, index);	136	MLX5_SET(set_pp_rate_limit_in, in, rate_limit_index, index);
137	MLX5_SET(set_rate_limit_in, in, rate_limit, rate);	137	MLX5_SET(set_pp_rate_limit_in, in, rate_limit, rate);
138	return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));	138	return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
139	}	139	}
140		140
@@ -173,7 +173,7 @@ int mlx5_rl_add_rate(struct mlx5_core_dev dev, u32 rate, u16 index) · 32 unmodified lines
173	entry->refcount++;	173	entry->refcount++;
174	} else {	174	} else {
175	/* new rate limit */	175	/* new rate limit */
176	err = mlx5_set_rate_limit_cmd(dev, rate, entry->index);	176	err = mlx5_set_pp_rate_limit_cmd(dev, rate, entry->index);
177	if (err) {	177	if (err) {
178	mlx5_core_err(dev, "Failed configuring rate: %u (%d)\n",	178	mlx5_core_err(dev, "Failed configuring rate: %u (%d)\n",
179	rate, err);	179	rate, err);
@@ -209,7 +209,7 @@ void mlx5_rl_remove_rate(struct mlx5_core_dev *dev, u32 rate) · 29 unmodified lines
209	entry->refcount--;	209	entry->refcount--;
210	if (!entry->refcount) {	210	if (!entry->refcount) {
211	/* need to remove rate */	211	/* need to remove rate */
212	mlx5_set_rate_limit_cmd(dev, 0, entry->index);	212	mlx5_set_pp_rate_limit_cmd(dev, 0, entry->index);
213	entry->rate = 0;	213	entry->rate = 0;
214	}	214	}
215		215
@@ -262,8 +262,8 @@ void mlx5_cleanup_rl_table(struct mlx5_core_dev *dev) · 46 unmodified lines
262	/* Clear all configured rates */	262	/* Clear all configured rates */
263	for (i = 0; i < table->max_size; i++)	263	for (i = 0; i < table->max_size; i++)
264	if (table->rl_entry[i].rate)	264	if (table->rl_entry[i].rate)
265	mlx5_set_rate_limit_cmd(dev, 0,	265	mlx5_set_pp_rate_limit_cmd(dev, 0,
266	table->rl_entry[i].index);	266	table->rl_entry[i].index);
267		267
268	kfree(dev->priv.rl_table.rl_entry);	268	kfree(dev->priv.rl_table.rl_entry);
269	}	269	}

drivers/net/ethernet/mellanox/mlx5/core/vxlan.c+36−28

 	struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan;
 	struct mlx5e_vxlan *vxlan;
-	spin_lock(&vxlan_db->lock);
+	spin_lock_bh(&vxlan_db->lock);
 	vxlan = radix_tree_lookup(&vxlan_db->tree, port);
-	spin_unlock(&vxlan_db->lock);
+	spin_unlock_bh(&vxlan_db->lock);
 	return vxlan;
 }
 	struct mlx5e_vxlan *vxlan;
 	int err;
-	if (mlx5e_vxlan_lookup_port(priv, port))
+	mutex_lock(&priv->state_lock);
+	vxlan = mlx5e_vxlan_lookup_port(priv, port);
+	if (vxlan) {
+		atomic_inc(&vxlan->refcount);
 		goto free_work;
+	}
 	if (mlx5e_vxlan_core_add_port_cmd(priv->mdev, port))
 		goto free_work;
 		goto err_delete_port;
 	vxlan->udp_port = port;
+	atomic_set(&vxlan->refcount, 1);
-	spin_lock_irq(&vxlan_db->lock);
+	spin_lock_bh(&vxlan_db->lock);
 	err = radix_tree_insert(&vxlan_db->tree, vxlan->udp_port, vxlan);
-	spin_unlock_irq(&vxlan_db->lock);
+	spin_unlock_bh(&vxlan_db->lock);
 	if (err)
 		goto err_free;
 err_delete_port:
 	mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
 free_work:
+	mutex_unlock(&priv->state_lock);
 	kfree(vxlan_work);
 }
-static void __mlx5e_vxlan_core_del_port(struct mlx5e_priv *priv, u16 port)
+static void mlx5e_vxlan_del_port(struct work_struct *work)
 {
+	struct mlx5e_vxlan_work *vxlan_work =
+		container_of(work, struct mlx5e_vxlan_work, work);
+	struct mlx5e_priv *priv         = vxlan_work->priv;
 	struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan;
+	u16 port = vxlan_work->port;
 	struct mlx5e_vxlan *vxlan;
+	bool remove = false;
-	spin_lock_irq(&vxlan_db->lock);
+	mutex_lock(&priv->state_lock);
-	vxlan = radix_tree_delete(&vxlan_db->tree, port);
+	spin_lock_bh(&vxlan_db->lock);
-	spin_unlock_irq(&vxlan_db->lock);
+	vxlan = radix_tree_lookup(&vxlan_db->tree, port);
 	if (!vxlan)
-		return;
+		goto out_unlock;
-	mlx5e_vxlan_core_del_port_cmd(priv->mdev, vxlan->udp_port);
-	kfree(vxlan);
-}
-static void mlx5e_vxlan_del_port(struct work_struct *work)
+	if (atomic_dec_and_test(&vxlan->refcount)) {
-{
+		radix_tree_delete(&vxlan_db->tree, port);
-	struct mlx5e_vxlan_work *vxlan_work =
+		remove = true;
-		container_of(work, struct mlx5e_vxlan_work, work);
+	}
-	struct mlx5e_priv *priv = vxlan_work->priv;
-	u16 port = vxlan_work->port;
-	__mlx5e_vxlan_core_del_port(priv, port);
+out_unlock:
+	spin_unlock_bh(&vxlan_db->lock);
+	if (remove) {
+		mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
+		kfree(vxlan);
+	}
+	mutex_unlock(&priv->state_lock);
 	kfree(vxlan_work);
 }
 	struct mlx5e_vxlan *vxlan;
 	unsigned int port = 0;
-	spin_lock_irq(&vxlan_db->lock);
+	/* Lockless since we are the only radix-tree consumers, wq is disabled */
 	while (radix_tree_gang_lookup(&vxlan_db->tree, (void **)&vxlan, port, 1)) {
 		port = vxlan->udp_port;
-		spin_unlock_irq(&vxlan_db->lock);
+		radix_tree_delete(&vxlan_db->tree, port);
-		__mlx5e_vxlan_core_del_port(priv, (u16)port);
+		mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
-		spin_lock_irq(&vxlan_db->lock);
+		kfree(vxlan);
 	}
-	spin_unlock_irq(&vxlan_db->lock);
 }

drivers/net/ethernet/mellanox/mlx5/core/vxlan.h+1−0

@@ -36,6 +36,7 @@ · 35 unmodified lines
36	#include "en.h"	36	#include "en.h"
37		37
38	struct mlx5e_vxlan {	38	struct mlx5e_vxlan {
		39	atomic_t refcount;
39	u16 udp_port;	40	u16 udp_port;
40	};	41	};
41		42

drivers/net/ethernet/mellanox/mlxsw/spectrum.c+18−0

 static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+	u16 vid = 1;
 	int err;
 	err = mlxsw_sp_port_vp_mode_set(mlxsw_sp_port, true);
 				     true, false);
 	if (err)
 		goto err_port_vlan_set;
+	for (; vid <= VLAN_N_VID - 1; vid++) {
+		err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+						     vid, false);
+		if (err)
+			goto err_vid_learning_set;
+	}
 	return 0;
+err_vid_learning_set:
+	for (vid--; vid >= 1; vid--)
+		mlxsw_sp_port_vid_learning_set(mlxsw_sp_port, vid, true);
 err_port_vlan_set:
 	mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
 err_port_stp_set:
 static void mlxsw_sp_port_ovs_leave(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+	u16 vid;
+	for (vid = VLAN_N_VID - 1; vid >= 1; vid--)
+		mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+					       vid, true);
 	mlxsw_sp_port_vlan_set(mlxsw_sp_port, 2, VLAN_N_VID - 1,
 			       false, false);
 	mlxsw_sp_port_stp_set(mlxsw_sp_port, false);

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c+3−12

 	rhashtable_destroy(&mlxsw_sp->router->neigh_ht);
 }
-static int mlxsw_sp_neigh_rif_flush(struct mlxsw_sp *mlxsw_sp,
-				    const struct mlxsw_sp_rif *rif)
-{
-	char rauht_pl[MLXSW_REG_RAUHT_LEN];
-	mlxsw_reg_rauht_pack(rauht_pl, MLXSW_REG_RAUHT_OP_WRITE_DELETE_ALL,
-			     rif->rif_index, rif->addr);
-	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(rauht), rauht_pl);
-}
 static void mlxsw_sp_neigh_rif_gone_sync(struct mlxsw_sp *mlxsw_sp,
 					 struct mlxsw_sp_rif *rif)
 {
 	struct mlxsw_sp_neigh_entry *neigh_entry, *tmp;
-	mlxsw_sp_neigh_rif_flush(mlxsw_sp, rif);
 	list_for_each_entry_safe(neigh_entry, tmp, &rif->neigh_list,
-				 rif_list_node)
+				 rif_list_node) {
+		mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, false);
 		mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry);
+	}
 }
 enum mlxsw_sp_nexthop_type {

drivers/net/ethernet/netronome/nfp/bpf/main.c+44−11

 	return nfp_net_ebpf_capable(nn) ? "BPF" : "";
 }
+static int
+nfp_bpf_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id)
+{
+	int err;
+	nn->app_priv = kzalloc(sizeof(struct nfp_bpf_vnic), GFP_KERNEL);
+	if (!nn->app_priv)
+		return -ENOMEM;
+	err = nfp_app_nic_vnic_alloc(app, nn, id);
+	if (err)
+		goto err_free_priv;
+	return 0;
+err_free_priv:
+	kfree(nn->app_priv);
+	return err;
+}
 static void nfp_bpf_vnic_free(struct nfp_app *app, struct nfp_net *nn)
 {
+	struct nfp_bpf_vnic *bv = nn->app_priv;
 	if (nn->dp.bpf_offload_xdp)
 		nfp_bpf_xdp_offload(app, nn, NULL);
+	WARN_ON(bv->tc_prog);
+	kfree(bv);
 }
 static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
 {
 	struct tc_cls_bpf_offload *cls_bpf = type_data;
 	struct nfp_net *nn = cb_priv;
+	struct bpf_prog *oldprog;
+	struct nfp_bpf_vnic *bv;
+	int err;
 	if (type != TC_SETUP_CLSBPF ||
 	    !tc_can_offload(nn->dp.netdev) ||
 	    cls_bpf->common.protocol != htons(ETH_P_ALL) ||
 	    cls_bpf->common.chain_index)
 		return -EOPNOTSUPP;
-	if (nn->dp.bpf_offload_xdp)
-		return -EBUSY;
 	/* Only support TC direct action */
 	if (!cls_bpf->exts_integrated ||
 		return -EOPNOTSUPP;
 	}
-	switch (cls_bpf->command) {
+	if (cls_bpf->command != TC_CLSBPF_OFFLOAD)
-	case TC_CLSBPF_REPLACE:
-		return nfp_net_bpf_offload(nn, cls_bpf->prog, true);
-	case TC_CLSBPF_ADD:
-		return nfp_net_bpf_offload(nn, cls_bpf->prog, false);
-	case TC_CLSBPF_DESTROY:
-		return nfp_net_bpf_offload(nn, NULL, true);
-	default:
 		return -EOPNOTSUPP;
+	bv = nn->app_priv;
+	oldprog = cls_bpf->oldprog;
+	/* Don't remove if oldprog doesn't match driver's state */
+	if (bv->tc_prog != oldprog) {
+		oldprog = NULL;
+		if (!cls_bpf->prog)
+			return 0;
 	}
+	err = nfp_net_bpf_offload(nn, cls_bpf->prog, oldprog);
+	if (err)
+		return err;
+	bv->tc_prog = cls_bpf->prog;
+	return 0;
 }
 static int nfp_bpf_setup_tc_block(struct net_device *netdev,
 	.extra_cap	= nfp_bpf_extra_cap,
-	.vnic_alloc	= nfp_app_nic_vnic_alloc,
+	.vnic_alloc	= nfp_bpf_vnic_alloc,
 	.vnic_free	= nfp_bpf_vnic_free,
 	.setup_tc	= nfp_bpf_setup_tc,

drivers/net/ethernet/netronome/nfp/bpf/main.h+8−0

@@ -172,6 +172,14 @@ struct nfp_prog { · 171 unmodified lines
172	struct list_head insns;	172	struct list_head insns;
173	};	173	};
174		174
		175	/**
		176	* struct nfp_bpf_vnic - per-vNIC BPF priv structure
		177	* @tc_prog: currently loaded cls_bpf program
		178	*/
		179	struct nfp_bpf_vnic {
		180	struct bpf_prog *tc_prog;
		181	};
		182
175	int nfp_bpf_jit(struct nfp_prog *prog);	183	int nfp_bpf_jit(struct nfp_prog *prog);
176		184
177	extern const struct bpf_ext_analyzer_ops nfp_bpf_analyzer_ops;	185	extern const struct bpf_ext_analyzer_ops nfp_bpf_analyzer_ops;

drivers/net/ethernet/qualcomm/emac/emac-phy.c+4−3

 #define MDIO_CLK_25_28                                               7
 #define MDIO_WAIT_TIMES                                           1000
+#define MDIO_STATUS_DELAY_TIME                                       1
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
 	if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
 			       !(reg & (MDIO_START | MDIO_BUSY)),
-			       100, MDIO_WAIT_TIMES * 100))
+			       MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
 		return -EIO;
 	return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
 	writel(reg, adpt->base + EMAC_MDIO_CTRL);
 	if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
-			       !(reg & (MDIO_START | MDIO_BUSY)), 100,
+			       !(reg & (MDIO_START | MDIO_BUSY)),
-			       MDIO_WAIT_TIMES * 100))
+			       MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
 		return -EIO;
 	return 0;

drivers/net/ethernet/qualcomm/emac/emac.c+3−3

 		return ret;
 	}
-	ret = emac_mac_up(adpt);
+	ret = adpt->phy.open(adpt);
 	if (ret) {
 		emac_mac_rx_tx_rings_free_all(adpt);
 		free_irq(irq->irq, irq);
 		return ret;
 	}
-	ret = adpt->phy.open(adpt);
+	ret = emac_mac_up(adpt);
 	if (ret) {
-		emac_mac_down(adpt);
 		emac_mac_rx_tx_rings_free_all(adpt);
 		free_irq(irq->irq, irq);
+		adpt->phy.close(adpt);
 		return ret;
 	}

drivers/net/ethernet/renesas/ravb_main.c+2−25

@@ -2308,32 +2308,9 @@ static int __maybe_unused ravb_resume(struct device *dev) · 2307 unmodified lines
2308	struct ravb_private *priv = netdev_priv(ndev);	2308	struct ravb_private *priv = netdev_priv(ndev);
2309	int ret = 0;	2309	int ret = 0;
2310		2310
2311	if (priv->wol_enabled) {	2311	/* If WoL is enabled set reset mode to rearm the WoL logic */
2312	/* Reduce the usecount of the clock to zero and then	2312	if (priv->wol_enabled)
2313	* restore it to its original value. This is done to force
2314	* the clock to be re-enabled which is a workaround
2315	* for renesas-cpg-mssr driver which do not enable clocks
2316	* when resuming from PSCI suspend/resume.
2317	*
2318	* Without this workaround the driver fails to communicate
2319	* with the hardware if WoL was enabled when the system
2320	* entered PSCI suspend. This is due to that if WoL is enabled
2321	* we explicitly keep the clock from being turned off when
2322	* suspending, but in PSCI sleep power is cut so the clock
2323	* is disabled anyhow, the clock driver is not aware of this
2324	* so the clock is not turned back on when resuming.
2325	*
2326	* TODO: once the renesas-cpg-mssr suspend/resume is working
2327	* this clock dance should be removed.
2328	*/
2329	clk_disable(priv->clk);
2330	clk_disable(priv->clk);
2331	clk_enable(priv->clk);
2332	clk_enable(priv->clk);
2333
2334	/* Set reset mode to rearm the WoL logic */
2335	ravb_write(ndev, CCC_OPC_RESET, CCC);	2313	ravb_write(ndev, CCC_OPC_RESET, CCC);
2336	}
2337		2314
2338	/* All register have been reset to default values.	2315	/* All register have been reset to default values.
2339	* Restore all registers which where setup at probe time and	2316	* Restore all registers which where setup at probe time and

drivers/net/ethernet/renesas/sh_eth.c+10−0

@@ -1892,6 +1892,16 @@ static int sh_eth_phy_init(struct net_device *ndev) · 1891 unmodified lines
1892	return PTR_ERR(phydev);	1892	return PTR_ERR(phydev);
1893	}	1893	}
1894		1894
		1895	/* mask with MAC supported features */
		1896	if (mdp->cd->register_type != SH_ETH_REG_GIGABIT) {
		1897	int err = phy_set_max_speed(phydev, SPEED_100);
		1898	if (err) {
		1899	netdev_err(ndev, "failed to limit PHY to 100 Mbit/s\n");
		1900	phy_disconnect(phydev);
		1901	return err;
		1902	}
		1903	}
		1904
1895	phy_attached_info(phydev);	1905	phy_attached_info(phydev);
1896		1906
1897	return 0;	1907	return 0;

drivers/net/ethernet/stmicro/stmmac/common.h+1−1

@@ -409,7 +409,7 @@ struct stmmac_desc_ops { · 408 unmodified lines
409	/* get timestamp value */	409	/* get timestamp value */
410	u64(get_timestamp) (void desc, u32 ats);	410	u64(get_timestamp) (void desc, u32 ats);
411	/* get rx timestamp status */	411	/* get rx timestamp status */
412	int (get_rx_timestamp_status) (void desc, u32 ats);	412	int (get_rx_timestamp_status)(void desc, void *next_desc, u32 ats);
413	/* Display ring */	413	/* Display ring */
414	void (display_ring)(void head, unsigned int size, bool rx);	414	void (display_ring)(void head, unsigned int size, bool rx);
415	/* set MSS via context descriptor */	415	/* set MSS via context descriptor */

drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c+3−2

 	return ret;
 }
-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
+static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc,
+						 u32 ats)
 {
 	struct dma_desc *p = (struct dma_desc *)desc;
 	int ret = -EINVAL;
 			/* Check if timestamp is OK from context descriptor */
 			do {
-				ret = dwmac4_rx_check_timestamp(desc);
+				ret = dwmac4_rx_check_timestamp(next_desc);
 				if (ret < 0)
 					goto exit;
 				i++;

drivers/net/ethernet/stmicro/stmmac/enh_desc.c+2−1

@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void *desc, u32 ats) · 399 unmodified lines
400	return ns;	400	return ns;
401	}	401	}
402		402
403	static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats)	403	static int enh_desc_get_rx_timestamp_status(void desc, void next_desc,
		404	u32 ats)
404	{	405	{
405	if (ats) {	406	if (ats) {
406	struct dma_extended_desc p = (struct dma_extended_desc )desc;	407	struct dma_extended_desc p = (struct dma_extended_desc )desc;

drivers/net/ethernet/stmicro/stmmac/norm_desc.c+1−1

@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *desc, u32 ats) · 264 unmodified lines
265	return ns;	265	return ns;
266	}	266	}
267		267
268	static int ndesc_get_rx_timestamp_status(void *desc, u32 ats)	268	static int ndesc_get_rx_timestamp_status(void desc, void next_desc, u32 ats)
269	{	269	{
270	struct dma_desc p = (struct dma_desc )desc;	270	struct dma_desc p = (struct dma_desc )desc;
271		271

drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c+4−2

 {
 	u32 value = readl(ioaddr + PTP_TCR);
 	unsigned long data;
+	u32 reg_value;
 	/* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
 	 *	formula = (1/ptp_clock) * 1000000000
 	data &= PTP_SSIR_SSINC_MASK;
+	reg_value = data;
 	if (gmac4)
-		data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
+		reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT;
-	writel(data, ioaddr + PTP_SSIR);
+	writel(reg_value, ioaddr + PTP_SSIR);
 	return data;
 }

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c+1−1

@@ -482,7 +482,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv priv, struct dma_desc p, · 481 unmodified lines
482	desc = np;	482	desc = np;
483		483
484	/* Check if timestamp is available */	484	/* Check if timestamp is available */
485	if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {	485	if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) {
486	ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);	486	ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
487	netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);	487	netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
488	shhwtstamp = skb_hwtstamps(skb);	488	shhwtstamp = skb_hwtstamps(skb);

drivers/net/hippi/rrunner.c+1−1

@@ -1379,8 +1379,8 @@ static int rr_close(struct net_device *dev) · 1378 unmodified lines
1379	rrpriv->info_dma);	1379	rrpriv->info_dma);
1380	rrpriv->info = NULL;	1380	rrpriv->info = NULL;
1381		1381
1382	free_irq(pdev->irq, dev);
1383	spin_unlock_irqrestore(&rrpriv->lock, flags);	1382	spin_unlock_irqrestore(&rrpriv->lock, flags);
		1383	free_irq(pdev->irq, dev);
1384		1384
1385	return 0;	1385	return 0;
1386	}	1386	}

drivers/net/phy/at803x.c+0−4

 {
 	int value;
-	mutex_lock(&phydev->lock);
 	value = phy_read(phydev, MII_BMCR);
 	value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
 	phy_write(phydev, MII_BMCR, value);
-	mutex_unlock(&phydev->lock);
 	return 0;
 }

drivers/net/phy/marvell.c+17−1

 	if (err < 0)
 		goto error;
+	/* Do not touch the fiber page if we're in copper->sgmii mode */
+	if (phydev->interface == PHY_INTERFACE_MODE_SGMII)
+		return 0;
 	/* Then the fiber link */
 	err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE);
 	if (err < 0)
 	/* SGMII-to-Copper mode initialization */
 	if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+		u32 pause;
 		/* Select page 18 */
 		err = marvell_set_page(phydev, 18);
 		if (err < 0)
 		err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
 		if (err < 0)
 			return err;
+		/* There appears to be a bug in the 88e1512 when used in
+		 * SGMII to copper mode, where the AN advertisment register
+		 * clears the pause bits each time a negotiation occurs.
+		 * This means we can never be truely sure what was advertised,
+		 * so disable Pause support.
+		 */
+		pause = SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+		phydev->supported &= ~pause;
+		phydev->advertising &= ~pause;
 	}
 	return m88e1121_config_init(phydev);
 		.flags = PHY_HAS_INTERRUPT,
 		.probe = marvell_probe,
 		.config_init = &m88e1145_config_init,
-		.config_aneg = &marvell_config_aneg,
+		.config_aneg = &m88e1101_config_aneg,
 		.read_status = &genphy_read_status,
 		.ack_interrupt = &marvell_ack_interrupt,
 		.config_intr = &marvell_config_intr,

drivers/net/phy/mdio-xgene.c+15−6

 	}
 	ret = xgene_enet_ecc_init(pdata);
-	if (ret)
+	if (ret) {
+		if (pdata->dev->of_node)
+			clk_disable_unprepare(pdata->clk);
 		return ret;
+	}
 	xgene_gmac_reset(pdata);
 	return 0;
 		return ret;
 	mdio_bus = mdiobus_alloc();
-	if (!mdio_bus)
+	if (!mdio_bus) {
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto out_clk;
+	}
 	mdio_bus->name = "APM X-Gene MDIO bus";
 		mdio_bus->phy_mask = ~0;
 		ret = mdiobus_register(mdio_bus);
 		if (ret)
-			goto out;
+			goto out_mdiobus;
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1,
 				    acpi_register_phy, NULL, mdio_bus, NULL);
 	}
 	if (ret)
-		goto out;
+		goto out_mdiobus;
 	pdata->mdio_bus = mdio_bus;
 	xgene_mdio_status = true;
 	return 0;
-out:
+out_mdiobus:
 	mdiobus_free(mdio_bus);
+out_clk:
+	if (dev->of_node)
+		clk_disable_unprepare(pdata->clk);
 	return ret;
 }

drivers/net/phy/mdio_bus.c+1−0

@@ -270,6 +270,7 @@ static void of_mdiobus_link_mdiodev(struct mii_bus *bus, · 269 unmodified lines
270		270
271	if (addr == mdiodev->addr) {	271	if (addr == mdiodev->addr) {
272	dev->of_node = child;	272	dev->of_node = child;
		273	dev->fwnode = of_fwnode_handle(child);
273	return;	274	return;
274	}	275	}
275	}	276	}

drivers/net/phy/meson-gxl.c+73−1

@@ -22,6 +22,7 @@ · 21 unmodified lines
22	#include <linux/ethtool.h>	22	#include <linux/ethtool.h>
23	#include <linux/phy.h>	23	#include <linux/phy.h>
24	#include <linux/netdevice.h>	24	#include <linux/netdevice.h>
		25	#include <linux/bitfield.h>
25		26
26	static int meson_gxl_config_init(struct phy_device *phydev)	27	static int meson_gxl_config_init(struct phy_device *phydev)
27	{	28	{
@@ -50,6 +51,77 @@ static int meson_gxl_config_init(struct phy_device *phydev) · 22 unmodified lines
50	return 0;	51	return 0;
51	}	52	}
52		53
		54	/* This function is provided to cope with the possible failures of this phy
		55	* during aneg process. When aneg fails, the PHY reports that aneg is done
		56	* but the value found in MII_LPA is wrong:
		57	* - Early failures: MII_LPA is just 0x0001. if MII_EXPANSION reports that
		58	* the link partner (LP) supports aneg but the LP never acked our base
		59	* code word, it is likely that we never sent it to begin with.
		60	* - Late failures: MII_LPA is filled with a value which seems to make sense
		61	* but it actually is not what the LP is advertising. It seems that we
		62	* can detect this using a magic bit in the WOL bank (reg 12 - bit 12).
		63	* If this particular bit is not set when aneg is reported being done,
		64	* it means MII_LPA is likely to be wrong.
		65	*
		66	* In both case, forcing a restart of the aneg process solve the problem.
		67	* When this failure happens, the first retry is usually successful but,
		68	* in some cases, it may take up to 6 retries to get a decent result
		69	*/
		70	static int meson_gxl_read_status(struct phy_device *phydev)
		71	{
		72	int ret, wol, lpa, exp;
		73
		74	if (phydev->autoneg == AUTONEG_ENABLE) {
		75	ret = genphy_aneg_done(phydev);
		76	if (ret < 0)
		77	return ret;
		78	else if (!ret)
		79	goto read_status_continue;
		80
		81	/* Need to access WOL bank, make sure the access is open */
		82	ret = phy_write(phydev, 0x14, 0x0000);
		83	if (ret)
		84	return ret;
		85	ret = phy_write(phydev, 0x14, 0x0400);
		86	if (ret)
		87	return ret;
		88	ret = phy_write(phydev, 0x14, 0x0000);
		89	if (ret)
		90	return ret;
		91	ret = phy_write(phydev, 0x14, 0x0400);
		92	if (ret)
		93	return ret;
		94
		95	/* Request LPI_STATUS WOL register */
		96	ret = phy_write(phydev, 0x14, 0x8D80);
		97	if (ret)
		98	return ret;
		99
		100	/* Read LPI_STATUS value */
		101	wol = phy_read(phydev, 0x15);
		102	if (wol < 0)
		103	return wol;
		104
		105	lpa = phy_read(phydev, MII_LPA);
		106	if (lpa < 0)
		107	return lpa;
		108
		109	exp = phy_read(phydev, MII_EXPANSION);
		110	if (exp < 0)
		111	return exp;
		112
		113	if (!(wol & BIT(12)) \|\|
		114	((exp & EXPANSION_NWAY) && !(lpa & LPA_LPACK))) {
		115	/* Looks like aneg failed after all */
		116	phydev_dbg(phydev, "LPA corruption - aneg restart\n");
		117	return genphy_restart_aneg(phydev);
		118	}
		119	}
		120
		121	read_status_continue:
		122	return genphy_read_status(phydev);
		123	}
		124
53	static struct phy_driver meson_gxl_phy[] = {	125	static struct phy_driver meson_gxl_phy[] = {
54	{	126	{
55	.phy_id = 0x01814400,	127	.phy_id = 0x01814400,
@@ -60,7 +132,7 @@ static struct phy_driver meson_gxl_phy[] = { · 4 unmodified lines
60	.config_init = meson_gxl_config_init,	132	.config_init = meson_gxl_config_init,
61	.config_aneg = genphy_config_aneg,	133	.config_aneg = genphy_config_aneg,
62	.aneg_done = genphy_aneg_done,	134	.aneg_done = genphy_aneg_done,
63	.read_status = genphy_read_status,	135	.read_status = meson_gxl_read_status,
64	.suspend = genphy_suspend,	136	.suspend = genphy_suspend,
65	.resume = genphy_resume,	137	.resume = genphy_resume,
66	},	138	},

drivers/net/phy/micrel.c+1−0

@@ -624,6 +624,7 @@ static int ksz9031_read_status(struct phy_device *phydev) · 623 unmodified lines
624	phydev->link = 0;	624	phydev->link = 0;
625	if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))	625	if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))
626	phydev->drv->config_intr(phydev);	626	phydev->drv->config_intr(phydev);
		627	return genphy_config_aneg(phydev);
627	}	628	}
628		629
629	return 0;	630	return 0;

drivers/net/phy/phy.c+3−6

  */
 void phy_start(struct phy_device *phydev)
 {
-	bool do_resume = false;
 	int err = 0;
 	mutex_lock(&phydev->lock);
 		phydev->state = PHY_UP;
 		break;
 	case PHY_HALTED:
+		/* if phy was suspended, bring the physical link up again */
+		phy_resume(phydev);
 		/* make sure interrupts are re-enabled for the PHY */
 		if (phydev->irq != PHY_POLL) {
 			err = phy_enable_interrupts(phydev);
 		}
 		phydev->state = PHY_RESUMING;
-		do_resume = true;
 		break;
 	default:
 		break;
 	}
 	mutex_unlock(&phydev->lock);
-	/* if phy was suspended, bring the physical link up again */
-	if (do_resume)
-		phy_resume(phydev);
 	phy_trigger_machine(phydev, true);
 }
 EXPORT_SYMBOL(phy_start);

drivers/net/phy/phy_device.c+6−4

 	if (!mdio_bus_phy_may_suspend(phydev))
 		goto no_resume;
+	mutex_lock(&phydev->lock);
 	ret = phy_resume(phydev);
+	mutex_unlock(&phydev->lock);
 	if (ret < 0)
 		return ret;
 	if (err)
 		goto error;
+	mutex_lock(&phydev->lock);
 	phy_resume(phydev);
+	mutex_unlock(&phydev->lock);
 	phy_led_triggers_register(phydev);
 	return err;
 	struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
 	int ret = 0;
+	WARN_ON(!mutex_is_locked(&phydev->lock));
 	if (phydev->drv && phydrv->resume)
 		ret = phydrv->resume(phydev);
 {
 	int value;
-	mutex_lock(&phydev->lock);
 	value = phy_read(phydev, MII_BMCR);
 	phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
-	mutex_unlock(&phydev->lock);
 	return 0;
 }
 EXPORT_SYMBOL(genphy_resume);

drivers/net/phy/phylink.c+2−0

 	pl->link_config.pause = MLO_PAUSE_AN;
 	pl->link_config.speed = SPEED_UNKNOWN;
 	pl->link_config.duplex = DUPLEX_UNKNOWN;
+	pl->link_config.an_enabled = true;
 	pl->ops = ops;
 	__set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
 	mutex_lock(&pl->state_mutex);
 	/* Configure the MAC to match the new settings */
 	linkmode_copy(pl->link_config.advertising, our_kset.link_modes.advertising);
+	pl->link_config.interface = config.interface;
 	pl->link_config.speed = our_kset.base.speed;
 	pl->link_config.duplex = our_kset.base.duplex;
 	pl->link_config.an_enabled = our_kset.base.autoneg != AUTONEG_DISABLE;

drivers/net/usb/qmi_wwan.c+2−0

 	{QMI_FIXED_INTF(0x1199, 0x9079, 10)},	/* Sierra Wireless EM74xx */
 	{QMI_FIXED_INTF(0x1199, 0x907b, 8)},	/* Sierra Wireless EM74xx */
 	{QMI_FIXED_INTF(0x1199, 0x907b, 10)},	/* Sierra Wireless EM74xx */
+	{QMI_FIXED_INTF(0x1199, 0x9091, 8)},	/* Sierra Wireless EM7565 */
 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
 	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
 	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
+	{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},	/* Telit ME910 dual modem */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)},	/* Telit LE920, LE920A4 */
 	{QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},	/* Telewell TW-3G HSPA+ */

drivers/net/vxlan.c+19−0

@@ -2155,6 +2155,13 @@ static void vxlan_xmit_one(struct sk_buff skb, struct net_device dev, · 2154 unmodified lines
2155	}	2155	}
2156		2156
2157	ndst = &rt->dst;	2157	ndst = &rt->dst;
		2158	if (skb_dst(skb)) {
		2159	int mtu = dst_mtu(ndst) - VXLAN_HEADROOM;
		2160
		2161	skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
		2162	skb, mtu);
		2163	}
		2164
2158	tos = ip_tunnel_ecn_encap(tos, old_iph, skb);	2165	tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
2159	ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);	2166	ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
2160	err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),	2167	err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
@@ -2190,6 +2197,13 @@ static void vxlan_xmit_one(struct sk_buff skb, struct net_device dev, · 29 unmodified lines
2190	goto out_unlock;	2197	goto out_unlock;
2191	}	2198	}
2192		2199
		2200	if (skb_dst(skb)) {
		2201	int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM;
		2202
		2203	skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
		2204	skb, mtu);
		2205	}
		2206
2193	tos = ip_tunnel_ecn_encap(tos, old_iph, skb);	2207	tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
2194	ttl = ttl ? : ip6_dst_hoplimit(ndst);	2208	ttl = ttl ? : ip6_dst_hoplimit(ndst);
2195	skb_scrub_packet(skb, xnet);	2209	skb_scrub_packet(skb, xnet);
@@ -3103,6 +3117,11 @@ static void vxlan_config_apply(struct net_device *dev, · 907 unmodified lines
3103		3117
3104	max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :	3118	max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
3105	VXLAN_HEADROOM);	3119	VXLAN_HEADROOM);
		3120	if (max_mtu < ETH_MIN_MTU)
		3121	max_mtu = ETH_MIN_MTU;
		3122
		3123	if (!changelink && !conf->mtu)
		3124	dev->mtu = max_mtu;
3106	}	3125	}
3107		3126
3108	if (dev->mtu > max_mtu)	3127	if (dev->mtu > max_mtu)

drivers/net/wireless/mac80211_hwsim.c+2−1

 	hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
 	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
 					 IEEE80211_STYPE_NULLFUNC |
+					 IEEE80211_FCTL_TODS |
 					 (ps ? IEEE80211_FCTL_PM : 0));
 	hdr->duration_id = cpu_to_le16(0);
 	memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
 			continue;
-		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
 		if (!skb) {
 			res = -ENOMEM;
 			goto out_err;

drivers/nvdimm/btt.c+167−34

@@ -211,12 +211,12 @@ static int btt_map_read(struct arena_info arena, u32 lba, u32 mapping, · 210 unmodified lines
211	return ret;	211	return ret;
212	}	212	}
213		213
214	static int btt_log_read_pair(struct arena_info *arena, u32 lane,	214	static int btt_log_group_read(struct arena_info *arena, u32 lane,
215	struct log_entry *ent)	215	struct log_group *log)
216	{	216	{
217	return arena_read_bytes(arena,	217	return arena_read_bytes(arena,
218	arena->logoff + (2 * lane * LOG_ENT_SIZE), ent,	218	arena->logoff + (lane * LOG_GRP_SIZE), log,
219	2 * LOG_ENT_SIZE, 0);	219	LOG_GRP_SIZE, 0);
220	}	220	}
221		221
222	static struct dentry *debugfs_root;	222	static struct dentry *debugfs_root;
@@ -256,6 +256,8 @@ static void arena_debugfs_init(struct arena_info a, struct dentry parent, · 33 unmodified lines
256	debugfs_create_x64("logoff", S_IRUGO, d, &a->logoff);	256	debugfs_create_x64("logoff", S_IRUGO, d, &a->logoff);
257	debugfs_create_x64("info2off", S_IRUGO, d, &a->info2off);	257	debugfs_create_x64("info2off", S_IRUGO, d, &a->info2off);
258	debugfs_create_x32("flags", S_IRUGO, d, &a->flags);	258	debugfs_create_x32("flags", S_IRUGO, d, &a->flags);
		259	debugfs_create_u32("log_index_0", S_IRUGO, d, &a->log_index[0]);
		260	debugfs_create_u32("log_index_1", S_IRUGO, d, &a->log_index[1]);
259	}	261	}
260		262
261	static void btt_debugfs_init(struct btt *btt)	263	static void btt_debugfs_init(struct btt *btt)
@@ -274,6 +276,11 @@ static void btt_debugfs_init(struct btt *btt) · 12 unmodified lines
274	}	276	}
275	}	277	}
276		278
		279	static u32 log_seq(struct log_group *log, int log_idx)
		280	{
		281	return le32_to_cpu(log->ent[log_idx].seq);
		282	}
		283
277	/*	284	/*
278	* This function accepts two log entries, and uses the	285	* This function accepts two log entries, and uses the
279	* sequence number to find the 'older' entry.	286	* sequence number to find the 'older' entry.
@@ -283,8 +290,10 @@ static void btt_debugfs_init(struct btt *btt) · 3 unmodified lines
283	*	290	*
284	* TODO The logic feels a bit kludge-y. make it better..	291	* TODO The logic feels a bit kludge-y. make it better..
285	*/	292	*/
286	static int btt_log_get_old(struct log_entry *ent)	293	static int btt_log_get_old(struct arena_info a, struct log_group log)
287	{	294	{
		295	int idx0 = a->log_index[0];
		296	int idx1 = a->log_index[1];
288	int old;	297	int old;
289		298
290	/*	299	/*
@@ -292,23 +301,23 @@ static int btt_log_get_old(struct log_entry *ent) · 1 unmodified line
292	* the next time, the following logic works out to put this	301	* the next time, the following logic works out to put this
293	* (next) entry into [1]	302	* (next) entry into [1]
294	*/	303	*/
295	if (ent[0].seq == 0) {	304	if (log_seq(log, idx0) == 0) {
296	ent[0].seq = cpu_to_le32(1);	305	log->ent[idx0].seq = cpu_to_le32(1);
297	return 0;	306	return 0;
298	}	307	}
299		308
300	if (ent[0].seq == ent[1].seq)	309	if (log_seq(log, idx0) == log_seq(log, idx1))
301	return -EINVAL;	310	return -EINVAL;
302	if (le32_to_cpu(ent[0].seq) + le32_to_cpu(ent[1].seq) > 5)	311	if (log_seq(log, idx0) + log_seq(log, idx1) > 5)
303	return -EINVAL;	312	return -EINVAL;
304		313
305	if (le32_to_cpu(ent[0].seq) < le32_to_cpu(ent[1].seq)) {	314	if (log_seq(log, idx0) < log_seq(log, idx1)) {
306	if (le32_to_cpu(ent[1].seq) - le32_to_cpu(ent[0].seq) == 1)	315	if ((log_seq(log, idx1) - log_seq(log, idx0)) == 1)
307	old = 0;	316	old = 0;
308	else	317	else
309	old = 1;	318	old = 1;
310	} else {	319	} else {
311	if (le32_to_cpu(ent[0].seq) - le32_to_cpu(ent[1].seq) == 1)	320	if ((log_seq(log, idx0) - log_seq(log, idx1)) == 1)
312	old = 1;	321	old = 1;
313	else	322	else
314	old = 0;	323	old = 0;
@@ -328,17 +337,18 @@ static int btt_log_read(struct arena_info *arena, u32 lane, · 13 unmodified lines
328	{	337	{
329	int ret;	338	int ret;
330	int old_ent, ret_ent;	339	int old_ent, ret_ent;
331	struct log_entry log[2];	340	struct log_group log;
332		341
333	ret = btt_log_read_pair(arena, lane, log);	342	ret = btt_log_group_read(arena, lane, &log);
334	if (ret)	343	if (ret)
335	return -EIO;	344	return -EIO;
336		345
337	old_ent = btt_log_get_old(log);	346	old_ent = btt_log_get_old(arena, &log);
338	if (old_ent < 0 \|\| old_ent > 1) {	347	if (old_ent < 0 \|\| old_ent > 1) {
339	dev_err(to_dev(arena),	348	dev_err(to_dev(arena),
340	"log corruption (%d): lane %d seq [%d, %d]\n",	349	"log corruption (%d): lane %d seq [%d, %d]\n",
341	old_ent, lane, log[0].seq, log[1].seq);	350	old_ent, lane, log.ent[arena->log_index[0]].seq,
		351	log.ent[arena->log_index[1]].seq);
342	/* TODO set error state? */	352	/* TODO set error state? */
343	return -EIO;	353	return -EIO;
344	}	354	}
@@ -346,7 +356,7 @@ static int btt_log_read(struct arena_info *arena, u32 lane, · 1 unmodified line
346	ret_ent = (old_flag ? old_ent : (1 - old_ent));	356	ret_ent = (old_flag ? old_ent : (1 - old_ent));
347		357
348	if (ent != NULL)	358	if (ent != NULL)
349	memcpy(ent, &log[ret_ent], LOG_ENT_SIZE);	359	memcpy(ent, &log.ent[arena->log_index[ret_ent]], LOG_ENT_SIZE);
350		360
351	return ret_ent;	361	return ret_ent;
352	}	362	}
@@ -360,17 +370,13 @@ static int __btt_log_write(struct arena_info *arena, u32 lane, · 7 unmodified lines
360	u32 sub, struct log_entry *ent, unsigned long flags)	370	u32 sub, struct log_entry *ent, unsigned long flags)
361	{	371	{
362	int ret;	372	int ret;
363	/*	373	u32 group_slot = arena->log_index[sub];
364	* Ignore the padding in log_entry for calculating log_half.	374	unsigned int log_half = LOG_ENT_SIZE / 2;
365	* The entry is 'committed' when we write the sequence number,
366	* and we want to ensure that that is the last thing written.
367	* We don't bother writing the padding as that would be extra
368	* media wear and write amplification
369	*/
370	unsigned int log_half = (LOG_ENT_SIZE - 2 * sizeof(u64)) / 2;
371	u64 ns_off = arena->logoff + (((2 * lane) + sub) * LOG_ENT_SIZE);
372	void *src = ent;	375	void *src = ent;
		376	u64 ns_off;
373		377
		378	ns_off = arena->logoff + (lane * LOG_GRP_SIZE) +
		379	(group_slot * LOG_ENT_SIZE);
374	/* split the 16B write into atomic, durable halves */	380	/* split the 16B write into atomic, durable halves */
375	ret = arena_write_bytes(arena, ns_off, src, log_half, flags);	381	ret = arena_write_bytes(arena, ns_off, src, log_half, flags);
376	if (ret)	382	if (ret)
@@ -453,7 +459,7 @@ static int btt_log_init(struct arena_info *arena) · 76 unmodified lines
453	{	459	{
454	size_t logsize = arena->info2off - arena->logoff;	460	size_t logsize = arena->info2off - arena->logoff;
455	size_t chunk_size = SZ_4K, offset = 0;	461	size_t chunk_size = SZ_4K, offset = 0;
456	struct log_entry log;	462	struct log_entry ent;
457	void *zerobuf;	463	void *zerobuf;
458	int ret;	464	int ret;
459	u32 i;	465	u32 i;
@@ -485,11 +491,11 @@ static int btt_log_init(struct arena_info *arena) · 25 unmodified lines
485	}	491	}
486		492
487	for (i = 0; i < arena->nfree; i++) {	493	for (i = 0; i < arena->nfree; i++) {
488	log.lba = cpu_to_le32(i);	494	ent.lba = cpu_to_le32(i);
489	log.old_map = cpu_to_le32(arena->external_nlba + i);	495	ent.old_map = cpu_to_le32(arena->external_nlba + i);
490	log.new_map = cpu_to_le32(arena->external_nlba + i);	496	ent.new_map = cpu_to_le32(arena->external_nlba + i);
491	log.seq = cpu_to_le32(LOG_SEQ_INIT);	497	ent.seq = cpu_to_le32(LOG_SEQ_INIT);
492	ret = __btt_log_write(arena, i, 0, &log, 0);	498	ret = __btt_log_write(arena, i, 0, &ent, 0);
493	if (ret)	499	if (ret)
494	goto free;	500	goto free;
495	}	501	}
@@ -594,6 +600,123 @@ static int btt_freelist_init(struct arena_info *arena) · 98 unmodified lines
594	return 0;	600	return 0;
595	}	601	}
596		602
		603	static bool ent_is_padding(struct log_entry *ent)
		604	{
		605	return (ent->lba == 0) && (ent->old_map == 0) && (ent->new_map == 0)
		606	&& (ent->seq == 0);
		607	}
		608
		609	/*
		610	* Detecting valid log indices: We read a log group (see the comments in btt.h
		611	* for a description of a 'log_group' and its 'slots'), and iterate over its
		612	* four slots. We expect that a padding slot will be all-zeroes, and use this
		613	* to detect a padding slot vs. an actual entry.
		614	*
		615	* If a log_group is in the initial state, i.e. hasn't been used since the
		616	* creation of this BTT layout, it will have three of the four slots with
		617	* zeroes. We skip over these log_groups for the detection of log_index. If
		618	* all log_groups are in the initial state (i.e. the BTT has never been
		619	* written to), it is safe to assume the 'new format' of log entries in slots
		620	* (0, 1).
		621	*/
		622	static int log_set_indices(struct arena_info *arena)
		623	{
		624	bool idx_set = false, initial_state = true;
		625	int ret, log_index[2] = {-1, -1};
		626	u32 i, j, next_idx = 0;
		627	struct log_group log;
		628	u32 pad_count = 0;
		629
		630	for (i = 0; i < arena->nfree; i++) {
		631	ret = btt_log_group_read(arena, i, &log);
		632	if (ret < 0)
		633	return ret;
		634
		635	for (j = 0; j < 4; j++) {
		636	if (!idx_set) {
		637	if (ent_is_padding(&log.ent[j])) {
		638	pad_count++;
		639	continue;
		640	} else {
		641	/* Skip if index has been recorded */
		642	if ((next_idx == 1) &&
		643	(j == log_index[0]))
		644	continue;
		645	/* valid entry, record index */
		646	log_index[next_idx] = j;
		647	next_idx++;
		648	}
		649	if (next_idx == 2) {
		650	/* two valid entries found */
		651	idx_set = true;
		652	} else if (next_idx > 2) {
		653	/* too many valid indices */
		654	return -ENXIO;
		655	}
		656	} else {
		657	/*
		658	* once the indices have been set, just verify
		659	* that all subsequent log groups are either in
		660	* their initial state or follow the same
		661	* indices.
		662	*/
		663	if (j == log_index[0]) {
		664	/* entry must be 'valid' */
		665	if (ent_is_padding(&log.ent[j]))
		666	return -ENXIO;
		667	} else if (j == log_index[1]) {
		668	;
		669	/*
		670	* log_index[1] can be padding if the
		671	* lane never got used and it is still
		672	* in the initial state (three 'padding'
		673	* entries)
		674	*/
		675	} else {
		676	/* entry must be invalid (padding) */
		677	if (!ent_is_padding(&log.ent[j]))
		678	return -ENXIO;
		679	}
		680	}
		681	}
		682	/*
		683	* If any of the log_groups have more than one valid,
		684	* non-padding entry, then the we are no longer in the
		685	* initial_state
		686	*/
		687	if (pad_count < 3)
		688	initial_state = false;
		689	pad_count = 0;
		690	}
		691
		692	if (!initial_state && !idx_set)
		693	return -ENXIO;
		694
		695	/*
		696	* If all the entries in the log were in the initial state,
		697	* assume new padding scheme
		698	*/
		699	if (initial_state)
		700	log_index[1] = 1;
		701
		702	/*
		703	* Only allow the known permutations of log/padding indices,
		704	* i.e. (0, 1), and (0, 2)
		705	*/
		706	if ((log_index[0] == 0) && ((log_index[1] == 1) \|\| (log_index[1] == 2)))
		707	; /* known index possibilities */
		708	else {
		709	dev_err(to_dev(arena), "Found an unknown padding scheme\n");
		710	return -ENXIO;
		711	}
		712
		713	arena->log_index[0] = log_index[0];
		714	arena->log_index[1] = log_index[1];
		715	dev_dbg(to_dev(arena), "log_index_0 = %d\n", log_index[0]);
		716	dev_dbg(to_dev(arena), "log_index_1 = %d\n", log_index[1]);
		717	return 0;
		718	}
		719
597	static int btt_rtt_init(struct arena_info *arena)	720	static int btt_rtt_init(struct arena_info *arena)
598	{	721	{
599	arena->rtt = kcalloc(arena->nfree, sizeof(u32), GFP_KERNEL);	722	arena->rtt = kcalloc(arena->nfree, sizeof(u32), GFP_KERNEL);
@@ -650,8 +773,7 @@ static struct arena_info alloc_arena(struct btt btt, size_t size, · 50 unmodified lines
650	available -= 2 * BTT_PG_SIZE;	773	available -= 2 * BTT_PG_SIZE;
651		774
652	/* The log takes a fixed amount of space based on nfree */	775	/* The log takes a fixed amount of space based on nfree */
653	logsize = roundup(2 * arena->nfree * sizeof(struct log_entry),	776	logsize = roundup(arena->nfree * LOG_GRP_SIZE, BTT_PG_SIZE);
654	BTT_PG_SIZE);
655	available -= logsize;	777	available -= logsize;
656		778
657	/* Calculate optimal split between map and data area */	779	/* Calculate optimal split between map and data area */
@@ -668,6 +790,10 @@ static struct arena_info alloc_arena(struct btt btt, size_t size, · 10 unmodified lines
668	arena->mapoff = arena->dataoff + datasize;	790	arena->mapoff = arena->dataoff + datasize;
669	arena->logoff = arena->mapoff + mapsize;	791	arena->logoff = arena->mapoff + mapsize;
670	arena->info2off = arena->logoff + logsize;	792	arena->info2off = arena->logoff + logsize;
		793
		794	/* Default log indices are (0,1) */
		795	arena->log_index[0] = 0;
		796	arena->log_index[1] = 1;
671	return arena;	797	return arena;
672	}	798	}
673		799
@@ -758,6 +884,13 @@ static int discover_arenas(struct btt *btt) · 84 unmodified lines
758	arena->external_lba_start = cur_nlba;	884	arena->external_lba_start = cur_nlba;
759	parse_arena_meta(arena, super, cur_off);	885	parse_arena_meta(arena, super, cur_off);
760		886
		887	ret = log_set_indices(arena);
		888	if (ret) {
		889	dev_err(to_dev(arena),
		890	"Unable to deduce log/padding indices\n");
		891	goto out;
		892	}
		893
761	mutex_init(&arena->err_lock);	894	mutex_init(&arena->err_lock);
762	ret = btt_freelist_init(arena);	895	ret = btt_freelist_init(arena);
763	if (ret)	896	if (ret)

drivers/nvdimm/btt.h+46−1

@@ -27,6 +27,7 @@ · 26 unmodified lines
27	#define MAP_ERR_MASK (1 << MAP_ERR_SHIFT)	27	#define MAP_ERR_MASK (1 << MAP_ERR_SHIFT)
28	#define MAP_LBA_MASK (~((1 << MAP_TRIM_SHIFT) \| (1 << MAP_ERR_SHIFT)))	28	#define MAP_LBA_MASK (~((1 << MAP_TRIM_SHIFT) \| (1 << MAP_ERR_SHIFT)))
29	#define MAP_ENT_NORMAL 0xC0000000	29	#define MAP_ENT_NORMAL 0xC0000000
		30	#define LOG_GRP_SIZE sizeof(struct log_group)
30	#define LOG_ENT_SIZE sizeof(struct log_entry)	31	#define LOG_ENT_SIZE sizeof(struct log_entry)
31	#define ARENA_MIN_SIZE (1UL << 24) /* 16 MB */	32	#define ARENA_MIN_SIZE (1UL << 24) /* 16 MB */
32	#define ARENA_MAX_SIZE (1ULL << 39) /* 512 GB */	33	#define ARENA_MAX_SIZE (1ULL << 39) /* 512 GB */
@@ -50,12 +51,52 @@ enum btt_init_state { · 17 unmodified lines
50	INIT_READY	51	INIT_READY
51	};	52	};
52		53
		54	/*
		55	* A log group represents one log 'lane', and consists of four log entries.
		56	* Two of the four entries are valid entries, and the remaining two are
		57	* padding. Due to an old bug in the padding location, we need to perform a
		58	* test to determine the padding scheme being used, and use that scheme
		59	* thereafter.
		60	*
		61	* In kernels prior to 4.15, 'log group' would have actual log entries at
		62	* indices (0, 2) and padding at indices (1, 3), where as the correct/updated
		63	* format has log entries at indices (0, 1) and padding at indices (2, 3).
		64	*
		65	* Old (pre 4.15) format:
		66	* +-----------------+-----------------+
		67	* \| ent[0] \| ent[1] \|
		68	* \| 16B \| 16B \|
		69	* \| lba/old/new/seq \| pad \|
		70	* +-----------------------------------+
		71	* \| ent[2] \| ent[3] \|
		72	* \| 16B \| 16B \|
		73	* \| lba/old/new/seq \| pad \|
		74	* +-----------------+-----------------+
		75	*
		76	* New format:
		77	* +-----------------+-----------------+
		78	* \| ent[0] \| ent[1] \|
		79	* \| 16B \| 16B \|
		80	* \| lba/old/new/seq \| lba/old/new/seq \|
		81	* +-----------------------------------+
		82	* \| ent[2] \| ent[3] \|
		83	* \| 16B \| 16B \|
		84	* \| pad \| pad \|
		85	* +-----------------+-----------------+
		86	*
		87	* We detect during start-up which format is in use, and set
		88	* arena->log_index[(0, 1)] with the detected format.
		89	*/
		90
53	struct log_entry {	91	struct log_entry {
54	__le32 lba;	92	__le32 lba;
55	__le32 old_map;	93	__le32 old_map;
56	__le32 new_map;	94	__le32 new_map;
57	__le32 seq;	95	__le32 seq;
58	__le64 padding[2];	96	};
		97
		98	struct log_group {
		99	struct log_entry ent[4];
59	};	100	};
60		101
61	struct btt_sb {	102	struct btt_sb {
@@ -125,6 +166,8 @@ struct aligned_lock { · 63 unmodified lines
125	* @list: List head for list of arenas	166	* @list: List head for list of arenas
126	* @debugfs_dir: Debugfs dentry	167	* @debugfs_dir: Debugfs dentry
127	* @flags: Arena flags - may signify error states.	168	* @flags: Arena flags - may signify error states.
		169	* @err_lock: Mutex for synchronizing error clearing.
		170	* @log_index: Indices of the valid log entries in a log_group
128	*	171	*
129	* arena_info is a per-arena handle. Once an arena is narrowed down for an	172	* arena_info is a per-arena handle. Once an arena is narrowed down for an
130	* IO, this struct is passed around for the duration of the IO.	173	* IO, this struct is passed around for the duration of the IO.
@@ -157,6 +200,7 @@ struct arena_info { · 26 unmodified lines
157	/* Arena flags */	200	/* Arena flags */
158	u32 flags;	201	u32 flags;
159	struct mutex err_lock;	202	struct mutex err_lock;
		203	int log_index[2];
160	};	204	};
161		205
162	/**	206	/**
@@ -176,6 +220,7 @@ struct arena_info { · 13 unmodified lines
176	* @init_lock: Mutex used for the BTT initialization	220	* @init_lock: Mutex used for the BTT initialization
177	* @init_state: Flag describing the initialization state for the BTT	221	* @init_state: Flag describing the initialization state for the BTT
178	* @num_arenas: Number of arenas in the BTT instance	222	* @num_arenas: Number of arenas in the BTT instance
		223	* @phys_bb: Pointer to the namespace's badblocks structure
179	*/	224	*/
180	struct btt {	225	struct btt {
181	struct gendisk *btt_disk;	226	struct gendisk *btt_disk;

drivers/nvdimm/pfn_devs.c+15−5

 int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 {
 	u64 checksum, offset;
-	unsigned long align;
 	enum nd_pfn_mode mode;
 	struct nd_namespace_io *nsio;
+	unsigned long align, start_pad;
 	struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
 	struct nd_namespace_common *ndns = nd_pfn->ndns;
 	const u8 *parent_uuid = nd_dev_to_uuid(&ndns->dev);
 	align = le32_to_cpu(pfn_sb->align);
 	offset = le64_to_cpu(pfn_sb->dataoff);
+	start_pad = le32_to_cpu(pfn_sb->start_pad);
 	if (align == 0)
 		align = 1UL << ilog2(offset);
 	mode = le32_to_cpu(pfn_sb->mode);
 		return -EBUSY;
 	}
-	if ((align && !IS_ALIGNED(offset, align))
+	if ((align && !IS_ALIGNED(nsio->res.start + offset + start_pad, align))
 			|| !IS_ALIGNED(offset, PAGE_SIZE)) {
 		dev_err(&nd_pfn->dev,
 				"bad offset: %#llx dax disabled align: %#lx\n",
 	return altmap;
 }
+static u64 phys_pmem_align_down(struct nd_pfn *nd_pfn, u64 phys)
+{
+	return min_t(u64, PHYS_SECTION_ALIGN_DOWN(phys),
+			ALIGN_DOWN(phys, nd_pfn->align));
+}
 static int nd_pfn_init(struct nd_pfn *nd_pfn)
 {
 	u32 dax_label_reserve = is_nd_dax(&nd_pfn->dev) ? SZ_128K : 0;
 	start = nsio->res.start;
 	size = PHYS_SECTION_ALIGN_UP(start + size) - start;
 	if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
-				IORES_DESC_NONE) == REGION_MIXED) {
+				IORES_DESC_NONE) == REGION_MIXED
+			|| !IS_ALIGNED(start + resource_size(&nsio->res),
+				nd_pfn->align)) {
 		size = resource_size(&nsio->res);
-		end_trunc = start + size - PHYS_SECTION_ALIGN_DOWN(start + size);
+		end_trunc = start + size - phys_pmem_align_down(nd_pfn,
+				start + size);
 	}
 	if (start_pad + end_trunc)
-		dev_info(&nd_pfn->dev, "%s section collision, truncate %d bytes\n",
+		dev_info(&nd_pfn->dev, "%s alignment collision, truncate %d bytes\n",
 				dev_name(&ndns->dev), start_pad + end_trunc);
 	/*

drivers/nvme/host/core.c+6−5

 	BUILD_BUG_ON(PAGE_SIZE / sizeof(struct nvme_dsm_range) <
 			NVME_DSM_MAX_RANGES);
-	queue->limits.discard_alignment = size;
+	queue->limits.discard_alignment = 0;
 	queue->limits.discard_granularity = size;
 	blk_queue_max_discard_sectors(queue, UINT_MAX);
 		blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
 		blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
 	}
-	if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE)
+	if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) &&
+	    is_power_of_2(ctrl->max_hw_sectors))
 		blk_queue_chunk_sectors(q, ctrl->max_hw_sectors);
 	blk_queue_virt_boundary(q, ctrl->page_size - 1);
 	if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
 	blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
 	nvme_set_queue_limits(ctrl, ns->queue);
-	nvme_setup_streams_ns(ctrl, ns);
 	id = nvme_identify_ns(ctrl, nsid);
 	if (!id)
 	if (nvme_init_ns_head(ns, nsid, id, &new))
 		goto out_free_id;
+	nvme_setup_streams_ns(ctrl, ns);
 #ifdef CONFIG_NVME_MULTIPATH
 	/*
 		return;
 	if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
-		if (blk_get_integrity(ns->disk))
-			blk_integrity_unregister(ns->disk);
 		nvme_mpath_remove_disk_links(ns);
 		sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
 					&nvme_ns_id_attr_group);
 			nvme_nvm_unregister_sysfs(ns);
 		del_gendisk(ns->disk);
 		blk_cleanup_queue(ns->queue);
+		if (blk_get_integrity(ns->disk))
+			blk_integrity_unregister(ns->disk);
 	}
 	mutex_lock(&ns->ctrl->subsys->lock);

drivers/nvme/host/fc.c+0−1

@@ -3221,7 +3221,6 @@ nvme_fc_init_ctrl(struct device dev, struct nvmf_ctrl_options opts, · 3220 unmodified lines
3221		3221
3222	/* initiate nvme ctrl ref counting teardown */	3222	/* initiate nvme ctrl ref counting teardown */
3223	nvme_uninit_ctrl(&ctrl->ctrl);	3223	nvme_uninit_ctrl(&ctrl->ctrl);
3224	nvme_put_ctrl(&ctrl->ctrl);
3225		3224
3226	/* Remove core ctrl ref. */	3225	/* Remove core ctrl ref. */
3227	nvme_put_ctrl(&ctrl->ctrl);	3226	nvme_put_ctrl(&ctrl->ctrl);

drivers/nvmem/meson-mx-efuse.c+2−2

@@ -156,8 +156,8 @@ static int meson_mx_efuse_read(void *context, unsigned int offset, · 155 unmodified lines
156	MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE,	156	MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE,
157	MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE);	157	MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE);
158		158
159	for (i = offset; i < offset + bytes; i += efuse->config.word_size) {	159	for (i = 0; i < bytes; i += efuse->config.word_size) {
160	addr = i / efuse->config.word_size;	160	addr = (offset + i) / efuse->config.word_size;
161		161
162	err = meson_mx_efuse_read_addr(efuse, addr, &tmp);	162	err = meson_mx_efuse_read_addr(efuse, addr, &tmp);
163	if (err)	163	if (err)

drivers/of/of_mdio.c+3−0

 	 * can be looked up later */
 	of_node_get(child);
 	phy->mdio.dev.of_node = child;
+	phy->mdio.dev.fwnode = of_fwnode_handle(child);
 	/* All data is now stored in the phy struct;
 	 * register it */
 	 */
 	of_node_get(child);
 	mdiodev->dev.of_node = child;
+	mdiodev->dev.fwnode = of_fwnode_handle(child);
 	/* All data is now stored in the mdiodev struct; register it. */
 	rc = mdio_device_register(mdiodev);
 	mdio->phy_mask = ~0;
 	mdio->dev.of_node = np;
+	mdio->dev.fwnode = of_fwnode_handle(np);
 	/* Get bus level PHY reset GPIO details */
 	mdio->reset_delay_us = DEFAULT_GPIO_RESET_DELAY;

drivers/parisc/lba_pci.c+33−0

@@ -1692,3 +1692,36 @@ void lba_set_iregs(struct parisc_device *lba, u32 ibase, u32 imask) · 1691 unmodified lines
1692	iounmap(base_addr);	1692	iounmap(base_addr);
1693	}	1693	}
1694		1694
		1695
		1696	/*
		1697	* The design of the Diva management card in rp34x0 machines (rp3410, rp3440)
		1698	* seems rushed, so that many built-in components simply don't work.
		1699	* The following quirks disable the serial AUX port and the built-in ATI RV100
		1700	* Radeon 7000 graphics card which both don't have any external connectors and
		1701	* thus are useless, and even worse, e.g. the AUX port occupies ttyS0 and as
		1702	* such makes those machines the only PARISC machines on which we can't use
		1703	* ttyS0 as boot console.
		1704	*/
		1705	static void quirk_diva_ati_card(struct pci_dev *dev)
		1706	{
		1707	if (dev->subsystem_vendor != PCI_VENDOR_ID_HP \|\|
		1708	dev->subsystem_device != 0x1292)
		1709	return;
		1710
		1711	dev_info(&dev->dev, "Hiding Diva built-in ATI card");
		1712	dev->device = 0;
		1713	}
		1714	DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QY,
		1715	quirk_diva_ati_card);
		1716
		1717	static void quirk_diva_aux_disable(struct pci_dev *dev)
		1718	{
		1719	if (dev->subsystem_vendor != PCI_VENDOR_ID_HP \|\|
		1720	dev->subsystem_device != 0x1291)
		1721	return;
		1722
		1723	dev_info(&dev->dev, "Hiding Diva built-in AUX serial device");
		1724	dev->device = 0;
		1725	}
		1726	DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_DIVA_AUX,
		1727	quirk_diva_aux_disable);

drivers/pci/host/pci-hyperv.c+2−6

 	int_pkt->wslot.slot = slot;
 	int_pkt->int_desc.vector = vector;
 	int_pkt->int_desc.vector_count = 1;
-	int_pkt->int_desc.delivery_mode =
+	int_pkt->int_desc.delivery_mode = dest_Fixed;
-		(apic->irq_delivery_mode == dest_LowestPrio) ?
-			dest_LowestPrio : dest_Fixed;
 	/*
 	 * Create MSI w/ dummy vCPU set, overwritten by subsequent retarget in
 	int_pkt->wslot.slot = slot;
 	int_pkt->int_desc.vector = vector;
 	int_pkt->int_desc.vector_count = 1;
-	int_pkt->int_desc.delivery_mode =
+	int_pkt->int_desc.delivery_mode = dest_Fixed;
-		(apic->irq_delivery_mode == dest_LowestPrio) ?
-			dest_LowestPrio : dest_Fixed;
 	/*
 	 * Create MSI w/ dummy vCPU set targeting just one vCPU, overwritten

drivers/pci/host/pcie-rcar.c+4−4

 	err = rcar_pcie_get_resources(pcie);
 	if (err < 0) {
 		dev_err(dev, "failed to request resources: %d\n", err);
-		goto err_free_bridge;
+		goto err_free_resource_list;
 	}
 	err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node);
 	if (err)
-		goto err_free_bridge;
+		goto err_free_resource_list;
 	pm_runtime_enable(dev);
 	err = pm_runtime_get_sync(dev);
 err_pm_disable:
 	pm_runtime_disable(dev);
-err_free_bridge:
+err_free_resource_list:
-	pci_free_host_bridge(bridge);
 	pci_free_resource_list(&pcie->resources);
+	pci_free_host_bridge(bridge);
 	return err;
 }

drivers/pci/pci-driver.c+7−2

 	 * the subsequent "thaw" callbacks for the device.
 	 */
 	if (dev_pm_smart_suspend_and_suspended(dev)) {
-		dev->power.direct_complete = true;
+		dev_pm_skip_next_resume_phases(dev);
 		return 0;
 	}
 	if (pci_has_legacy_pm_support(pci_dev))
 		return pci_legacy_resume_early(dev);
-	pci_update_current_state(pci_dev, PCI_D0);
+	/*
+	 * pci_restore_state() requires the device to be in D0 (because of MSI
+	 * restoration among other things), so force it into D0 in case the
+	 * driver's "freeze" callbacks put it into a low-power state directly.
+	 */
+	pci_set_power_state(pci_dev, PCI_D0);
 	pci_restore_state(pci_dev);
 	if (drv && drv->pm && drv->pm->thaw_noirq)

drivers/phy/motorola/phy-cpcap-usb.c+1−1

@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct platform_device *pdev, · 309 unmodified lines
310	int irq, error;	310	int irq, error;
311		311
312	irq = platform_get_irq_byname(pdev, name);	312	irq = platform_get_irq_byname(pdev, name);
313	if (!irq)	313	if (irq < 0)
314	return -ENODEV;	314	return -ENODEV;
315		315
316	error = devm_request_threaded_irq(ddata->dev, irq, NULL,	316	error = devm_request_threaded_irq(ddata->dev, irq, NULL,

drivers/phy/renesas/Kconfig+2−0

 	tristate "Renesas R-Car generation 3 USB 2.0 PHY driver"
 	depends on ARCH_RENESAS
 	depends on EXTCON
+	depends on USB_SUPPORT
 	select GENERIC_PHY
+	select USB_COMMON
 	help
 	  Support for USB 2.0 PHY found on Renesas R-Car generation 3 SoCs.

drivers/phy/rockchip/phy-rockchip-typec.c+2−0

 		if (IS_ERR(phy)) {
 			dev_err(dev, "failed to create phy: %s\n",
 				child_np->name);
+			pm_runtime_disable(dev);
 			return PTR_ERR(phy);
 		}
 	phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
 	if (IS_ERR(phy_provider)) {
 		dev_err(dev, "Failed to register phy provider\n");
+		pm_runtime_disable(dev);
 		return PTR_ERR(phy_provider);
 	}

drivers/phy/tegra/xusb.c+29−29

@@ -75,14 +75,14 @@ MODULE_DEVICE_TABLE(of, tegra_xusb_padctl_of_match); · 74 unmodified lines
75	static struct device_node *	75	static struct device_node *
76	tegra_xusb_find_pad_node(struct tegra_xusb_padctl padctl, const char name)	76	tegra_xusb_find_pad_node(struct tegra_xusb_padctl padctl, const char name)
77	{	77	{
78	/*	78	struct device_node pads, np;
79	* of_find_node_by_name() drops a reference, so make sure to grab one.	79
80	*/	80	pads = of_get_child_by_name(padctl->dev->of_node, "pads");
81	struct device_node *np = of_node_get(padctl->dev->of_node);	81	if (!pads)
		82	return NULL;
82		83
83	np = of_find_node_by_name(np, "pads");	84	np = of_get_child_by_name(pads, name);
84	if (np)	85	of_node_put(pads);
85	np = of_find_node_by_name(np, name);
86		86
87	return np;	87	return np;
88	}	88	}
@@ -90,16 +90,16 @@ tegra_xusb_find_pad_node(struct tegra_xusb_padctl padctl, const char name) · 1 unmodified line
90	static struct device_node *	90	static struct device_node *
91	tegra_xusb_pad_find_phy_node(struct tegra_xusb_pad *pad, unsigned int index)	91	tegra_xusb_pad_find_phy_node(struct tegra_xusb_pad *pad, unsigned int index)
92	{	92	{
93	/*	93	struct device_node np, lanes;
94	* of_find_node_by_name() drops a reference, so make sure to grab one.
95	*/
96	struct device_node *np = of_node_get(pad->dev.of_node);
97		94
98	np = of_find_node_by_name(np, "lanes");	95	lanes = of_get_child_by_name(pad->dev.of_node, "lanes");
99	if (!np)	96	if (!lanes)
100	return NULL;	97	return NULL;
101		98
102	return of_find_node_by_name(np, pad->soc->lanes[index].name);	99	np = of_get_child_by_name(lanes, pad->soc->lanes[index].name);
		100	of_node_put(lanes);
		101
		102	return np;
103	}	103	}
104		104
105	static int	105	static int
@@ -195,7 +195,7 @@ int tegra_xusb_pad_register(struct tegra_xusb_pad *pad, · 89 unmodified lines
195	unsigned int i;	195	unsigned int i;
196	int err;	196	int err;
197		197
198	children = of_find_node_by_name(pad->dev.of_node, "lanes");	198	children = of_get_child_by_name(pad->dev.of_node, "lanes");
199	if (!children)	199	if (!children)
200	return -ENODEV;	200	return -ENODEV;
201		201
@@ -444,21 +444,21 @@ static struct device_node * · 242 unmodified lines
444	tegra_xusb_find_port_node(struct tegra_xusb_padctl padctl, const char type,	444	tegra_xusb_find_port_node(struct tegra_xusb_padctl padctl, const char type,
445	unsigned int index)	445	unsigned int index)
446	{	446	{
447	/*	447	struct device_node ports, np;
448	* of_find_node_by_name() drops a reference, so make sure to grab one.	448	char *name;
449	*/
450	struct device_node *np = of_node_get(padctl->dev->of_node);
451		449
452	np = of_find_node_by_name(np, "ports");	450	ports = of_get_child_by_name(padctl->dev->of_node, "ports");
453	if (np) {	451	if (!ports)
454	char *name;	452	return NULL;
455		453
456	name = kasprintf(GFP_KERNEL, "%s-%u", type, index);	454	name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
457	if (!name)	455	if (!name) {
458	return ERR_PTR(-ENOMEM);	456	of_node_put(ports);
459	np = of_find_node_by_name(np, name);	457	return ERR_PTR(-ENOMEM);
460	kfree(name);
461	}	458	}
		459	np = of_get_child_by_name(ports, name);
		460	kfree(name);
		461	of_node_put(ports);
462		462
463	return np;	463	return np;
464	}	464	}
@@ -847,7 +847,7 @@ static void tegra_xusb_remove_ports(struct tegra_xusb_padctl *padctl) · 382 unmodified lines
847		847
848	static int tegra_xusb_padctl_probe(struct platform_device *pdev)	848	static int tegra_xusb_padctl_probe(struct platform_device *pdev)
849	{	849	{
850	struct device_node *np = of_node_get(pdev->dev.of_node);	850	struct device_node *np = pdev->dev.of_node;
851	const struct tegra_xusb_padctl_soc *soc;	851	const struct tegra_xusb_padctl_soc *soc;
852	struct tegra_xusb_padctl *padctl;	852	struct tegra_xusb_padctl *padctl;
853	const struct of_device_id *match;	853	const struct of_device_id *match;
@@ -855,7 +855,7 @@ static int tegra_xusb_padctl_probe(struct platform_device *pdev) · 1 unmodified line
855	int err;	855	int err;
856		856
857	/* for backwards compatibility with old device trees */	857	/* for backwards compatibility with old device trees */
858	np = of_find_node_by_name(np, "pads");	858	np = of_get_child_by_name(np, "pads");
859	if (!np) {	859	if (!np) {
860	dev_warn(&pdev->dev, "deprecated DT, using legacy driver\n");	860	dev_warn(&pdev->dev, "deprecated DT, using legacy driver\n");
861	return tegra_xusb_padctl_legacy_probe(pdev);	861	return tegra_xusb_padctl_legacy_probe(pdev);

drivers/pinctrl/intel/pinctrl-cherryview.c+16−0

@@ -1620,6 +1620,22 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq) · 1619 unmodified lines
1620	clear_bit(i, chip->irq.valid_mask);	1620	clear_bit(i, chip->irq.valid_mask);
1621	}	1621	}
1622		1622
		1623	/*
		1624	* The same set of machines in chv_no_valid_mask[] have incorrectly
		1625	* configured GPIOs that generate spurious interrupts so we use
		1626	* this same list to apply another quirk for them.
		1627	*
		1628	* See also https://bugzilla.kernel.org/show_bug.cgi?id=197953.
		1629	*/
		1630	if (!need_valid_mask) {
		1631	/*
		1632	* Mask all interrupts the community is able to generate
		1633	* but leave the ones that can only generate GPEs unmasked.
		1634	*/
		1635	chv_writel(GENMASK(31, pctrl->community->nirqs),
		1636	pctrl->regs + CHV_INTMASK);
		1637	}
		1638
1623	/* Clear all interrupts */	1639	/* Clear all interrupts */
1624	chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);	1640	chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
1625		1641

drivers/pinctrl/pinctrl-single.c+4−1

  */
 static struct lock_class_key pcs_lock_class;
+/* Class for the IRQ request mutex */
+static struct lock_class_key pcs_request_class;
 /*
  * REVISIT: Reads and writes could eventually use regmap or something
  * generic. But at least on omaps, some mux registers are performance
 	irq_set_chip_data(irq, pcs_soc);
 	irq_set_chip_and_handler(irq, &pcs->chip,
 				 handle_level_irq);
-	irq_set_lockdep_class(irq, &pcs_lock_class);
+	irq_set_lockdep_class(irq, &pcs_lock_class, &pcs_request_class);
 	irq_set_noprobe(irq);
 	return 0;

drivers/pinctrl/stm32/pinctrl-stm32.c+1−1

@@ -290,7 +290,7 @@ static int stm32_gpio_domain_translate(struct irq_domain *d, · 289 unmodified lines
290	}	290	}
291		291
292	static int stm32_gpio_domain_activate(struct irq_domain *d,	292	static int stm32_gpio_domain_activate(struct irq_domain *d,
293	struct irq_data *irq_data, bool early)	293	struct irq_data *irq_data, bool reserve)
294	{	294	{
295	struct stm32_gpio_bank *bank = d->host_data;	295	struct stm32_gpio_bank *bank = d->host_data;
296	struct stm32_pinctrl *pctl = dev_get_drvdata(bank->gpio_chip.parent);	296	struct stm32_pinctrl *pctl = dev_get_drvdata(bank->gpio_chip.parent);

drivers/platform/x86/asus-wireless.c+1−0

@@ -118,6 +118,7 @@ static void asus_wireless_notify(struct acpi_device *adev, u32 event) · 117 unmodified lines
118	return;	118	return;
119	}	119	}
120	input_report_key(data->idev, KEY_RFKILL, 1);	120	input_report_key(data->idev, KEY_RFKILL, 1);
		121	input_sync(data->idev);
121	input_report_key(data->idev, KEY_RFKILL, 0);	122	input_report_key(data->idev, KEY_RFKILL, 0);
122	input_sync(data->idev);	123	input_sync(data->idev);
123	}	124	}

drivers/platform/x86/dell-laptop.c+17−0

 struct quirk_entry {
 	u8 touchpad_led;
+	u8 kbd_led_levels_off_1;
 	int needs_kbd_timeouts;
 	/*
 	.kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
 };
+static struct quirk_entry quirk_dell_latitude_e6410 = {
+	.kbd_led_levels_off_1 = 1,
+};
 static struct platform_driver platform_driver = {
 	.driver = {
 		.name = "dell-laptop",
 		},
 		.driver_data = &quirk_dell_xps13_9333,
 	},
+	{
+		.callback = dmi_matched,
+		.ident = "Dell Latitude E6410",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
+		},
+		.driver_data = &quirk_dell_latitude_e6410,
+	},
 	{ }
 };
 	units = (buffer->output[2] >> 8) & 0xFF;
 	info->levels = (buffer->output[2] >> 16) & 0xFF;
+	if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
+		info->levels--;
 	if (units & BIT(0))
 		info->seconds = (buffer->output[3] >> 0) & 0xFF;
 	if (units & BIT(1))

drivers/platform/x86/dell-wmi.c+2−0

@@ -639,6 +639,8 @@ static int dell_wmi_events_set_enabled(bool enable) · 638 unmodified lines
639	int ret;	639	int ret;
640		640
641	buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);	641	buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
		642	if (!buffer)
		643	return -ENOMEM;
642	buffer->cmd_class = CLASS_INFO;	644	buffer->cmd_class = CLASS_INFO;
643	buffer->cmd_select = SELECT_APP_REGISTRATION;	645	buffer->cmd_select = SELECT_APP_REGISTRATION;
644	buffer->input[0] = 0x10000;	646	buffer->input[0] = 0x10000;

drivers/s390/net/qeth_core.h+3−3

@@ -565,9 +565,9 @@ enum qeth_cq { · 564 unmodified lines
565	};	565	};
566		566
567	struct qeth_ipato {	567	struct qeth_ipato {
568	int enabled;	568	bool enabled;
569	int invert4;	569	bool invert4;
570	int invert6;	570	bool invert6;
571	struct list_head entries;	571	struct list_head entries;
572	};	572	};
573		573

drivers/s390/net/qeth_core_main.c+11−4

 	qeth_set_intial_options(card);
 	/* IP address takeover */
 	INIT_LIST_HEAD(&card->ipato.entries);
-	card->ipato.enabled = 0;
+	card->ipato.enabled = false;
-	card->ipato.invert4 = 0;
+	card->ipato.invert4 = false;
-	card->ipato.invert6 = 0;
+	card->ipato.invert6 = false;
 	/* init QDIO stuff */
 	qeth_init_qdio_info(card);
 	INIT_DELAYED_WORK(&card->buffer_reclaim_work, qeth_buffer_reclaim_work);
 }
 EXPORT_SYMBOL_GPL(qeth_poll);
+static int qeth_setassparms_inspect_rc(struct qeth_ipa_cmd *cmd)
+{
+	if (!cmd->hdr.return_code)
+		cmd->hdr.return_code = cmd->data.setassparms.hdr.return_code;
+	return cmd->hdr.return_code;
+}
 int qeth_setassparms_cb(struct qeth_card *card,
 			struct qeth_reply *reply, unsigned long data)
 {
 				(struct qeth_checksum_cmd *)reply->param;
 	QETH_CARD_TEXT(card, 4, "chkdoccb");
-	if (cmd->hdr.return_code)
+	if (qeth_setassparms_inspect_rc(cmd))
 		return 0;
 	memset(chksum_cb, 0, sizeof(*chksum_cb));

drivers/s390/net/qeth_l3.h+1−1

@@ -82,7 +82,7 @@ void qeth_l3_del_vipa(struct qeth_card , enum qeth_prot_versions, const u8 ); · 81 unmodified lines
82	int qeth_l3_add_rxip(struct qeth_card , enum qeth_prot_versions, const u8 );	82	int qeth_l3_add_rxip(struct qeth_card , enum qeth_prot_versions, const u8 );
83	void qeth_l3_del_rxip(struct qeth_card *card, enum qeth_prot_versions,	83	void qeth_l3_del_rxip(struct qeth_card *card, enum qeth_prot_versions,
84	const u8 *);	84	const u8 *);
85	int qeth_l3_is_addr_covered_by_ipato(struct qeth_card , struct qeth_ipaddr );	85	void qeth_l3_update_ipato(struct qeth_card *card);
86	struct qeth_ipaddr *qeth_l3_get_addr_buffer(enum qeth_prot_versions);	86	struct qeth_ipaddr *qeth_l3_get_addr_buffer(enum qeth_prot_versions);
87	int qeth_l3_add_ip(struct qeth_card , struct qeth_ipaddr );	87	int qeth_l3_add_ip(struct qeth_card , struct qeth_ipaddr );
88	int qeth_l3_delete_ip(struct qeth_card , struct qeth_ipaddr );	88	int qeth_l3_delete_ip(struct qeth_card , struct qeth_ipaddr );

drivers/s390/net/qeth_l3_main.c+31−5

 	}
 }
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
+static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
-						struct qeth_ipaddr *addr)
+					     struct qeth_ipaddr *addr)
 {
 	struct qeth_ipato_entry *ipatoe;
 	u8 addr_bits[128] = {0, };
 	if (!card->ipato.enabled)
 		return 0;
+	if (addr->type != QETH_IP_TYPE_NORMAL)
+		return 0;
 	qeth_l3_convert_addr_to_bits((u8 *) &addr->u, addr_bits,
 				  (addr->proto == QETH_PROT_IPV4)? 4:16);
 		memcpy(addr, tmp_addr, sizeof(struct qeth_ipaddr));
 		addr->ref_counter = 1;
-		if (addr->type == QETH_IP_TYPE_NORMAL  &&
+		if (qeth_l3_is_addr_covered_by_ipato(card, addr)) {
-				qeth_l3_is_addr_covered_by_ipato(card, addr)) {
 			QETH_CARD_TEXT(card, 2, "tkovaddr");
 			addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
 		}
 /*
  * IP address takeover related functions
  */
+/**
+ * qeth_l3_update_ipato() - Update 'takeover' property, for all NORMAL IPs.
+ *
+ * Caller must hold ip_lock.
+ */
+void qeth_l3_update_ipato(struct qeth_card *card)
+{
+	struct qeth_ipaddr *addr;
+	unsigned int i;
+	hash_for_each(card->ip_htable, i, addr, hnode) {
+		if (addr->type != QETH_IP_TYPE_NORMAL)
+			continue;
+		if (qeth_l3_is_addr_covered_by_ipato(card, addr))
+			addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
+		else
+			addr->set_flags &= ~QETH_IPA_SETIP_TAKEOVER_FLAG;
+	}
+}
 static void qeth_l3_clear_ipato_list(struct qeth_card *card)
 {
 	struct qeth_ipato_entry *ipatoe, *tmp;
 		kfree(ipatoe);
 	}
+	qeth_l3_update_ipato(card);
 	spin_unlock_bh(&card->ip_lock);
 }
 		}
 	}
-	if (!rc)
+	if (!rc) {
 		list_add_tail(&new->entry, &card->ipato.entries);
+		qeth_l3_update_ipato(card);
+	}
 	spin_unlock_bh(&card->ip_lock);
 			    (proto == QETH_PROT_IPV4)? 4:16) &&
 		    (ipatoe->mask_bits == mask_bits)) {
 			list_del(&ipatoe->entry);
+			qeth_l3_update_ipato(card);
 			kfree(ipatoe);
 		}
 	}

drivers/s390/net/qeth_l3_sys.c+41−34

 		struct device_attribute *attr, const char *buf, size_t count)
 {
 	struct qeth_card *card = dev_get_drvdata(dev);
-	struct qeth_ipaddr *addr;
+	bool enable;
-	int i, rc = 0;
+	int rc = 0;
 	if (!card)
 		return -EINVAL;
 	}
 	if (sysfs_streq(buf, "toggle")) {
-		card->ipato.enabled = (card->ipato.enabled)? 0 : 1;
+		enable = !card->ipato.enabled;
-	} else if (sysfs_streq(buf, "1")) {
+	} else if (kstrtobool(buf, &enable)) {
-		card->ipato.enabled = 1;
-		hash_for_each(card->ip_htable, i, addr, hnode) {
-				if ((addr->type == QETH_IP_TYPE_NORMAL) &&
-				qeth_l3_is_addr_covered_by_ipato(card, addr))
-					addr->set_flags |=
-					QETH_IPA_SETIP_TAKEOVER_FLAG;
-			}
-	} else if (sysfs_streq(buf, "0")) {
-		card->ipato.enabled = 0;
-		hash_for_each(card->ip_htable, i, addr, hnode) {
-			if (addr->set_flags &
-			QETH_IPA_SETIP_TAKEOVER_FLAG)
-				addr->set_flags &=
-				~QETH_IPA_SETIP_TAKEOVER_FLAG;
-			}
-	} else
 		rc = -EINVAL;
+		goto out;
+	}
+	if (card->ipato.enabled != enable) {
+		card->ipato.enabled = enable;
+		spin_lock_bh(&card->ip_lock);
+		qeth_l3_update_ipato(card);
+		spin_unlock_bh(&card->ip_lock);
+	}
 out:
 	mutex_unlock(&card->conf_mutex);
 	return rc ? rc : count;
 				const char *buf, size_t count)
 {
 	struct qeth_card *card = dev_get_drvdata(dev);
+	bool invert;
 	int rc = 0;
 	if (!card)
 		return -EINVAL;
 	mutex_lock(&card->conf_mutex);
-	if (sysfs_streq(buf, "toggle"))
+	if (sysfs_streq(buf, "toggle")) {
-		card->ipato.invert4 = (card->ipato.invert4)? 0 : 1;
+		invert = !card->ipato.invert4;
-	else if (sysfs_streq(buf, "1"))
+	} else if (kstrtobool(buf, &invert)) {
-		card->ipato.invert4 = 1;
-	else if (sysfs_streq(buf, "0"))
-		card->ipato.invert4 = 0;
-	else
 		rc = -EINVAL;
+		goto out;
+	}
+	if (card->ipato.invert4 != invert) {
+		card->ipato.invert4 = invert;
+		spin_lock_bh(&card->ip_lock);
+		qeth_l3_update_ipato(card);
+		spin_unlock_bh(&card->ip_lock);
+	}
+out:
 	mutex_unlock(&card->conf_mutex);
 	return rc ? rc : count;
 }
 		struct device_attribute *attr, const char *buf, size_t count)
 {
 	struct qeth_card *card = dev_get_drvdata(dev);
+	bool invert;
 	int rc = 0;
 	if (!card)
 		return -EINVAL;
 	mutex_lock(&card->conf_mutex);
-	if (sysfs_streq(buf, "toggle"))
+	if (sysfs_streq(buf, "toggle")) {
-		card->ipato.invert6 = (card->ipato.invert6)? 0 : 1;
+		invert = !card->ipato.invert6;
-	else if (sysfs_streq(buf, "1"))
+	} else if (kstrtobool(buf, &invert)) {
-		card->ipato.invert6 = 1;
-	else if (sysfs_streq(buf, "0"))
-		card->ipato.invert6 = 0;
-	else
 		rc = -EINVAL;
+		goto out;
+	}
+	if (card->ipato.invert6 != invert) {
+		card->ipato.invert6 = invert;
+		spin_lock_bh(&card->ip_lock);
+		qeth_l3_update_ipato(card);
+		spin_unlock_bh(&card->ip_lock);
+	}
+out:
 	mutex_unlock(&card->conf_mutex);
 	return rc ? rc : count;
 }

drivers/scsi/aacraid/aacraid.h+1−0

@@ -1725,6 +1725,7 @@ struct aac_dev · 1724 unmodified lines
1725	#define FIB_CONTEXT_FLAG_NATIVE_HBA (0x00000010)	1725	#define FIB_CONTEXT_FLAG_NATIVE_HBA (0x00000010)
1726	#define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020)	1726	#define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020)
1727	#define FIB_CONTEXT_FLAG_SCSI_CMD (0x00000040)	1727	#define FIB_CONTEXT_FLAG_SCSI_CMD (0x00000040)
		1728	#define FIB_CONTEXT_FLAG_EH_RESET (0x00000080)
1728		1729
1729	/*	1730	/*
1730	* Define the command values	1731	* Define the command values

drivers/scsi/aacraid/commsup.c+6−2

 			/* Synchronize our watches */
 			if (((NSEC_PER_SEC - (NSEC_PER_SEC / HZ)) > now.tv_nsec)
 			 && (now.tv_nsec > (NSEC_PER_SEC / HZ)))
-				difference = (((NSEC_PER_SEC - now.tv_nsec) * HZ)
+				difference = HZ + HZ / 2 -
-				  + NSEC_PER_SEC / 2) / NSEC_PER_SEC;
+					     now.tv_nsec / (NSEC_PER_SEC / HZ);
 			else {
 				if (now.tv_nsec > NSEC_PER_SEC / 2)
 					++now.tv_sec;
 		if (kthread_should_stop())
 			break;
+		/*
+		 * we probably want usleep_range() here instead of the
+		 * jiffies computation
+		 */
 		schedule_timeout(difference);
 		if (kthread_should_stop())

drivers/scsi/aacraid/linit.c+1−1

@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_cmnd* cmd) · 1036 unmodified lines
1037	info = &aac->hba_map[bus][cid];	1037	info = &aac->hba_map[bus][cid];
1038	if (bus >= AAC_MAX_BUSES \|\| cid >= AAC_MAX_TARGETS \|\|	1038	if (bus >= AAC_MAX_BUSES \|\| cid >= AAC_MAX_TARGETS \|\|
1039	info->devtype != AAC_DEVTYPE_NATIVE_RAW) {	1039	info->devtype != AAC_DEVTYPE_NATIVE_RAW) {
1040	fib->flags \|= FIB_CONTEXT_FLAG_TIMED_OUT;	1040	fib->flags \|= FIB_CONTEXT_FLAG_EH_RESET;
1041	cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER;	1041	cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER;
1042	}	1042	}
1043	}	1043	}

drivers/scsi/bfa/bfad_bsg.c+4−2

 	struct fc_bsg_request *bsg_request = job->request;
 	struct fc_bsg_reply *bsg_reply = job->reply;
 	uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
-	struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+	struct Scsi_Host *shost = fc_bsg_to_shost(job);
+	struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
 	struct bfad_s *bfad = im_port->bfad;
 	void *payload_kbuf;
 	int rc = -EINVAL;
 bfad_im_bsg_els_ct_request(struct bsg_job *job)
 {
 	struct bfa_bsg_data *bsg_data;
-	struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+	struct Scsi_Host *shost = fc_bsg_to_shost(job);
+	struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
 	struct bfad_s *bfad = im_port->bfad;
 	bfa_bsg_fcpt_t *bsg_fcpt;
 	struct bfad_fcxp    *drv_fcxp;

drivers/scsi/bfa/bfad_im.c+4−2

 bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
 			struct device *dev)
 {
+	struct bfad_im_port_pointer *im_portp;
 	int error = 1;
 	mutex_lock(&bfad_mutex);
 		goto out_free_idr;
 	}
-	im_port->shost->hostdata[0] = (unsigned long)im_port;
+	im_portp = shost_priv(im_port->shost);
+	im_portp->p = im_port;
 	im_port->shost->unique_id = im_port->idr_id;
 	im_port->shost->this_id = -1;
 	im_port->shost->max_id = MAX_FCP_TARGET;
 	sht->sg_tablesize = bfad->cfg_data.io_max_sge;
-	return scsi_host_alloc(sht, sizeof(unsigned long));
+	return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
 }
 void

drivers/scsi/bfa/bfad_im.h+10−0

@@ -69,6 +69,16 @@ struct bfad_im_port_s { · 68 unmodified lines
69	struct fc_vport *fc_vport;	69	struct fc_vport *fc_vport;
70	};	70	};
71		71
		72	struct bfad_im_port_pointer {
		73	struct bfad_im_port_s *p;
		74	};
		75
		76	static inline struct bfad_im_port_s bfad_get_im_port(struct Scsi_Host host)
		77	{
		78	struct bfad_im_port_pointer *im_portp = shost_priv(host);
		79	return im_portp->p;
		80	}
		81
72	enum bfad_itnim_state {	82	enum bfad_itnim_state {
73	ITNIM_STATE_NONE,	83	ITNIM_STATE_NONE,
74	ITNIM_STATE_ONLINE,	84	ITNIM_STATE_ONLINE,

drivers/scsi/libfc/fc_lport.c+4−0

 		case ELS_FLOGI:
 			if (!lport->point_to_multipoint)
 				fc_lport_recv_flogi_req(lport, fp);
+			else
+				fc_rport_recv_req(lport, fp);
 			break;
 		case ELS_LOGO:
 			if (fc_frame_sid(fp) == FC_FID_FLOGI)
 				fc_lport_recv_logo_req(lport, fp);
+			else
+				fc_rport_recv_req(lport, fp);
 			break;
 		case ELS_RSCN:
 			lport->tt.disc_recv_req(lport, fp);

drivers/scsi/libsas/sas_expander.c+5−5

@@ -2145,7 +2145,7 @@ void sas_smp_handler(struct bsg_job job, struct Scsi_Host shost, · 2144 unmodified lines
2145	struct sas_rphy *rphy)	2145	struct sas_rphy *rphy)
2146	{	2146	{
2147	struct domain_device *dev;	2147	struct domain_device *dev;
2148	unsigned int reslen = 0;	2148	unsigned int rcvlen = 0;
2149	int ret = -EINVAL;	2149	int ret = -EINVAL;
2150		2150
2151	/* no rphy means no smp target support (ie aic94xx host) */	2151	/* no rphy means no smp target support (ie aic94xx host) */
@@ -2179,12 +2179,12 @@ void sas_smp_handler(struct bsg_job job, struct Scsi_Host shost, · 27 unmodified lines
2179		2179
2180	ret = smp_execute_task_sg(dev, job->request_payload.sg_list,	2180	ret = smp_execute_task_sg(dev, job->request_payload.sg_list,
2181	job->reply_payload.sg_list);	2181	job->reply_payload.sg_list);
2182	if (ret > 0) {	2182	if (ret >= 0) {
2183	/* positive number is the untransferred residual */	2183	/* bsg_job_done() requires the length received */
2184	reslen = ret;	2184	rcvlen = job->reply_payload.payload_len - ret;
2185	ret = 0;	2185	ret = 0;
2186	}	2186	}
2187		2187
2188	out:	2188	out:
2189	bsg_job_done(job, ret, reslen);	2189	bsg_job_done(job, ret, rcvlen);
2190	}	2190	}

drivers/scsi/lpfc/lpfc_mem.c+1−1

 	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
 	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
 	if (rc < 0) {
-		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"6409 Cannot post to RQ %d: %x %x\n",
 				rqb_entry->hrq->queue_id,
 				rqb_entry->hrq->host_index,
 				rqb_entry->hrq->hba_index);
+		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 	} else {
 		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
 		rqbp->buffer_count++;

drivers/scsi/osd/osd_initiator.c+3−1

@@ -1576,7 +1576,9 @@ static struct request _make_request(struct request_queue q, bool has_write, · 1575 unmodified lines
1576	return req;	1576	return req;
1577		1577
1578	for_each_bio(bio) {	1578	for_each_bio(bio) {
1579	ret = blk_rq_append_bio(req, bio);	1579	struct bio *bounce_bio = bio;
		1580
		1581	ret = blk_rq_append_bio(req, &bounce_bio);
1580	if (ret)	1582	if (ret)
1581	return ERR_PTR(ret);	1583	return ERR_PTR(ret);
1582	}	1584	}

drivers/scsi/scsi_debugfs.c+4−2

 {
 	struct scsi_cmnd *cmd = container_of(scsi_req(rq), typeof(*cmd), req);
 	int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc);
-	char buf[80];
+	const u8 *const cdb = READ_ONCE(cmd->cmnd);
+	char buf[80] = "(?)";
-	__scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len);
+	if (cdb)
+		__scsi_format_command(buf, sizeof(buf), cdb, cmd->cmd_len);
 	seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf,
 		   cmd->retries, msecs / 1000, msecs % 1000);
 }

drivers/scsi/scsi_devinfo.c+12−21

 };
-static const char spaces[] = "                "; /* 16 of them */
 static blist_flags_t scsi_default_dev_flags;
 static LIST_HEAD(scsi_dev_info_list);
 static char scsi_dev_flags[256];
 	size_t from_length;
 	from_length = strlen(from);
-	strncpy(to, from, min(to_length, from_length));
+	/* This zero-pads the destination */
-	if (from_length < to_length) {
+	strncpy(to, from, to_length);
-		if (compatible) {
+	if (from_length < to_length && !compatible) {
-			/*
+		/*
-			 * NUL terminate the string if it is short.
+		 * space pad the string if it is short.
-			 */
+		 */
-			to[from_length] = '\0';
+		memset(&to[from_length], ' ', to_length - from_length);
-		} else {
-			/*
-			 * space pad the string if it is short.
-			 */
-			strncpy(&to[from_length], spaces,
-				to_length - from_length);
-		}
 	}
 	if (from_length > to_length)
 		 printk(KERN_WARNING "%s: %s string '%s' is too long\n",
 			    model, compatible);
 	if (strflags)
-		devinfo->flags = simple_strtoul(strflags, NULL, 0);
+		flags = (__force blist_flags_t)simple_strtoul(strflags, NULL, 0);
-	else
+	devinfo->flags = flags;
-		devinfo->flags = flags;
 	devinfo->compatible = compatible;
 	if (compatible)
 			/*
 			 * vendor strings must be an exact match
 			 */
-			if (vmax != strlen(devinfo->vendor) ||
+			if (vmax != strnlen(devinfo->vendor,
+					    sizeof(devinfo->vendor)) ||
 			    memcmp(devinfo->vendor, vskip, vmax))
 				continue;
 			 * @model specifies the full string, and
 			 * must be larger or equal to devinfo->model
 			 */
-			mlen = strlen(devinfo->model);
+			mlen = strnlen(devinfo->model, sizeof(devinfo->model));
 			if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
 				continue;
 			return devinfo;

drivers/scsi/scsi_lib.c+2−0

@@ -1967,6 +1967,8 @@ static bool scsi_mq_get_budget(struct blk_mq_hw_ctx *hctx) · 1966 unmodified lines
1967	out_put_device:	1967	out_put_device:
1968	put_device(&sdev->sdev_gendev);	1968	put_device(&sdev->sdev_gendev);
1969	out:	1969	out:
		1970	if (atomic_read(&sdev->device_busy) == 0 && !scsi_device_blocked(sdev))
		1971	blk_mq_delay_run_hw_queue(hctx, SCSI_QUEUE_DELAY);
1970	return false;	1972	return false;
1971	}	1973	}
1972		1974

drivers/scsi/scsi_scan.c+7−6

  *     SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
 static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
-		int *bflags, int async)
+		blist_flags_t *bflags, int async)
 {
 	int ret;
  *   - SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
 static int scsi_probe_and_add_lun(struct scsi_target *starget,
-				  u64 lun, int *bflagsp,
+				  u64 lun, blist_flags_t *bflagsp,
 				  struct scsi_device **sdevp,
 				  enum scsi_scan_mode rescan,
 				  void *hostdata)
 {
 	struct scsi_device *sdev;
 	unsigned char *result;
-	int bflags, res = SCSI_SCAN_NO_RESPONSE, result_len = 256;
+	blist_flags_t bflags;
+	int res = SCSI_SCAN_NO_RESPONSE, result_len = 256;
 	struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
 	/*
  *     Modifies sdevscan->lun.
  **/
 static void scsi_sequential_lun_scan(struct scsi_target *starget,
-				     int bflags, int scsi_level,
+				     blist_flags_t bflags, int scsi_level,
 				     enum scsi_scan_mode rescan)
 {
 	uint max_dev_lun;
  *     0: scan completed (or no memory, so further scanning is futile)
  *     1: could not scan with REPORT LUN
  **/
-static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
+static int scsi_report_lun_scan(struct scsi_target *starget, blist_flags_t bflags,
 				enum scsi_scan_mode rescan)
 {
 	unsigned char scsi_cmd[MAX_COMMAND_SIZE];
 		unsigned int id, u64 lun, enum scsi_scan_mode rescan)
 {
 	struct Scsi_Host *shost = dev_to_shost(parent);
-	int bflags = 0;
+	blist_flags_t bflags = 0;
 	int res;
 	struct scsi_target *starget;

drivers/scsi/scsi_sysfs.c+7−3

 }
 static DEVICE_ATTR(wwid, S_IRUGO, sdev_show_wwid, NULL);
-#define BLIST_FLAG_NAME(name) [ilog2(BLIST_##name)] = #name
+#define BLIST_FLAG_NAME(name)					\
+	[ilog2((__force unsigned int)BLIST_##name)] = #name
 static const char *const sdev_bflags_name[] = {
 #include "scsi_devinfo_tbl.c"
 };
 	for (i = 0; i < sizeof(sdev->sdev_bflags) * BITS_PER_BYTE; i++) {
 		const char *name = NULL;
-		if (!(sdev->sdev_bflags & BIT(i)))
+		if (!(sdev->sdev_bflags & (__force blist_flags_t)BIT(i)))
 			continue;
 		if (i < ARRAY_SIZE(sdev_bflags_name) && sdev_bflags_name[i])
 			name = sdev_bflags_name[i];
 		 * check.
 		 */
 		if (sdev->channel != starget->channel ||
-		    sdev->id != starget->id ||
+		    sdev->id != starget->id)
+			continue;
+		if (sdev->sdev_state == SDEV_DEL ||
+		    sdev->sdev_state == SDEV_CANCEL ||
 		    !get_device(&sdev->sdev_gendev))
 			continue;
 		spin_unlock_irqrestore(shost->host_lock, flags);

drivers/scsi/scsi_transport_spi.c+7−5

@@ -50,14 +50,14 @@ · 49 unmodified lines
50		50
51	/* Our blacklist flags */	51	/* Our blacklist flags */
52	enum {	52	enum {
53	SPI_BLIST_NOIUS = 0x1,	53	SPI_BLIST_NOIUS = (__force blist_flags_t)0x1,
54	};	54	};
55		55
56	/* blacklist table, modelled on scsi_devinfo.c */	56	/* blacklist table, modelled on scsi_devinfo.c */
57	static struct {	57	static struct {
58	char *vendor;	58	char *vendor;
59	char *model;	59	char *model;
60	unsigned flags;	60	blist_flags_t flags;
61	} spi_static_device_list[] __initdata = {	61	} spi_static_device_list[] __initdata = {
62	{"HP", "Ultrium 3-SCSI", SPI_BLIST_NOIUS },	62	{"HP", "Ultrium 3-SCSI", SPI_BLIST_NOIUS },
63	{"IBM", "ULTRIUM-TD3", SPI_BLIST_NOIUS },	63	{"IBM", "ULTRIUM-TD3", SPI_BLIST_NOIUS },
@@ -221,9 +221,11 @@ static int spi_device_configure(struct transport_container *tc, · 157 unmodified lines
221	{	221	{
222	struct scsi_device *sdev = to_scsi_device(dev);	222	struct scsi_device *sdev = to_scsi_device(dev);
223	struct scsi_target *starget = sdev->sdev_target;	223	struct scsi_target *starget = sdev->sdev_target;
224	unsigned bflags = scsi_get_device_flags_keyed(sdev, &sdev->inquiry[8],	224	blist_flags_t bflags;
225	&sdev->inquiry[16],	225
226	SCSI_DEVINFO_SPI);	226	bflags = scsi_get_device_flags_keyed(sdev, &sdev->inquiry[8],
		227	&sdev->inquiry[16],
		228	SCSI_DEVINFO_SPI);
227		229
228	/* Populate the target capability fields with the values	230	/* Populate the target capability fields with the values
229	* gleaned from the device inquiry */	231	* gleaned from the device inquiry */

drivers/scsi/sd.c+3−1

 static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
 	struct request *rq = SCpnt->request;
+	u8 *cmnd;
 	if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
 		sd_zbc_write_unlock_zone(SCpnt);
 		__free_page(rq->special_vec.bv_page);
 	if (SCpnt->cmnd != scsi_req(rq)->cmd) {
-		mempool_free(SCpnt->cmnd, sd_cdb_pool);
+		cmnd = SCpnt->cmnd;
 		SCpnt->cmnd = NULL;
 		SCpnt->cmd_len = 0;
+		mempool_free(cmnd, sd_cdb_pool);
 	}
 }

drivers/scsi/storvsc_drv.c+2−1

 		case TEST_UNIT_READY:
 			break;
 		default:
-			set_host_byte(scmnd, DID_TARGET_FAILURE);
+			set_host_byte(scmnd, DID_ERROR);
 		}
 		break;
 	case SRB_STATUS_INVALID_LUN:
+		set_host_byte(scmnd, DID_NO_CONNECT);
 		do_work = true;
 		process_err_fn = storvsc_remove_lun;
 		break;

drivers/spi/spi-armada-3700.c+8−0

 #define A3700_SPI_BYTE_LEN		BIT(5)
 #define A3700_SPI_CLK_PRESCALE		BIT(0)
 #define A3700_SPI_CLK_PRESCALE_MASK	(0x1f)
+#define A3700_SPI_CLK_EVEN_OFFS		(0x10)
 #define A3700_SPI_WFIFO_THRS_BIT	28
 #define A3700_SPI_RFIFO_THRS_BIT	24
 	prescale = DIV_ROUND_UP(clk_get_rate(a3700_spi->clk), speed_hz);
+	/* For prescaler values over 15, we can only set it by steps of 2.
+	 * Starting from A3700_SPI_CLK_EVEN_OFFS, we set values from 0 up to
+	 * 30. We only use this range from 16 to 30.
+	 */
+	if (prescale > 15)
+		prescale = A3700_SPI_CLK_EVEN_OFFS + DIV_ROUND_UP(prescale, 2);
 	val = spireg_read(a3700_spi, A3700_SPI_IF_CFG_REG);
 	val = val & ~A3700_SPI_CLK_PRESCALE_MASK;

drivers/spi/spi-atmel.c+1−1

 	pm_runtime_get_sync(&pdev->dev);
 	/* reset the hardware and block queue progress */
-	spin_lock_irq(&as->lock);
 	if (as->use_dma) {
 		atmel_spi_stop_dma(master);
 		atmel_spi_release_dma(master);
 	}
+	spin_lock_irq(&as->lock);
 	spi_writel(as, CR, SPI_BIT(SWRST));
 	spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
 	spi_readl(as, SR);

drivers/spi/spi-rspi.c+2−2

@@ -377,8 +377,8 @@ static int qspi_set_config_register(struct rspi_data *rspi, int access_size) · 376 unmodified lines
377	/* Sets SPCMD */	377	/* Sets SPCMD */
378	rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);	378	rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
379		379
380	/* Enables SPI function in master mode */	380	/* Sets RSPI mode */
381	rspi_write8(rspi, SPCR_SPE \| SPCR_MSTR, RSPI_SPCR);	381	rspi_write8(rspi, SPCR_MSTR, RSPI_SPCR);
382		382
383	return 0;	383	return 0;
384	}	384	}

drivers/spi/spi-sun4i.c+1−1

@@ -525,7 +525,7 @@ err_free_master: · 524 unmodified lines
525		525
526	static int sun4i_spi_remove(struct platform_device *pdev)	526	static int sun4i_spi_remove(struct platform_device *pdev)
527	{	527	{
528	pm_runtime_disable(&pdev->dev);	528	pm_runtime_force_suspend(&pdev->dev);
529		529
530	return 0;	530	return 0;
531	}	531	}

drivers/spi/spi-xilinx.c+11−0

 	while (remaining_words) {
 		int n_words, tx_words, rx_words;
 		u32 sr;
+		int stalled;
 		n_words = min(remaining_words, xspi->buffer_size);
 		/* Read out all the data from the Rx FIFO */
 		rx_words = n_words;
+		stalled = 10;
 		while (rx_words) {
+			if (rx_words == n_words && !(stalled--) &&
+			    !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+			    (sr & XSPI_SR_RX_EMPTY_MASK)) {
+				dev_err(&spi->dev,
+					"Detected stall. Check C_SPI_MODE and C_SPI_MEMORY\n");
+				xspi_init_hw(xspi);
+				return -EIO;
+			}
 			if ((sr & XSPI_SR_TX_EMPTY_MASK) && (rx_words > 1)) {
 				xilinx_spi_rx(xspi);
 				rx_words--;

drivers/staging/android/ion/Kconfig+1−1

@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP · 36 unmodified lines
37		37
38	config ION_CMA_HEAP	38	config ION_CMA_HEAP
39	bool "Ion CMA heap support"	39	bool "Ion CMA heap support"
40	depends on ION && CMA	40	depends on ION && DMA_CMA
41	help	41	help
42	Choose this option to enable CMA heaps with Ion. This heap is backed	42	Choose this option to enable CMA heaps with Ion. This heap is backed
43	by the Contiguous Memory Allocator (CMA). If your system has these	43	by the Contiguous Memory Allocator (CMA). If your system has these

drivers/staging/android/ion/ion.c+2−2

@@ -346,7 +346,7 @@ static int ion_dma_buf_begin_cpu_access(struct dma_buf *dmabuf, · 345 unmodified lines
346	mutex_lock(&buffer->lock);	346	mutex_lock(&buffer->lock);
347	list_for_each_entry(a, &buffer->attachments, list) {	347	list_for_each_entry(a, &buffer->attachments, list) {
348	dma_sync_sg_for_cpu(a->dev, a->table->sgl, a->table->nents,	348	dma_sync_sg_for_cpu(a->dev, a->table->sgl, a->table->nents,
349	DMA_BIDIRECTIONAL);	349	direction);
350	}	350	}
351	mutex_unlock(&buffer->lock);	351	mutex_unlock(&buffer->lock);
352		352
@@ -368,7 +368,7 @@ static int ion_dma_buf_end_cpu_access(struct dma_buf *dmabuf, · 15 unmodified lines
368	mutex_lock(&buffer->lock);	368	mutex_lock(&buffer->lock);
369	list_for_each_entry(a, &buffer->attachments, list) {	369	list_for_each_entry(a, &buffer->attachments, list) {
370	dma_sync_sg_for_device(a->dev, a->table->sgl, a->table->nents,	370	dma_sync_sg_for_device(a->dev, a->table->sgl, a->table->nents,
371	DMA_BIDIRECTIONAL);	371	direction);
372	}	372	}
373	mutex_unlock(&buffer->lock);	373	mutex_unlock(&buffer->lock);
374		374

drivers/staging/android/ion/ion_cma_heap.c+11−4

 	struct ion_cma_heap *cma_heap = to_cma_heap(heap);
 	struct sg_table *table;
 	struct page *pages;
+	unsigned long size = PAGE_ALIGN(len);
+	unsigned long nr_pages = size >> PAGE_SHIFT;
+	unsigned long align = get_order(size);
 	int ret;
-	pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL);
+	if (align > CONFIG_CMA_ALIGNMENT)
+		align = CONFIG_CMA_ALIGNMENT;
+	pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL);
 	if (!pages)
 		return -ENOMEM;
 	if (ret)
 		goto free_mem;
-	sg_set_page(table->sgl, pages, len, 0);
+	sg_set_page(table->sgl, pages, size, 0);
 	buffer->priv_virt = pages;
 	buffer->sg_table = table;
 free_mem:
 	kfree(table);
 err:
-	cma_release(cma_heap->cma, pages, buffer->size);
+	cma_release(cma_heap->cma, pages, nr_pages);
 	return -ENOMEM;
 }
 {
 	struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap);
 	struct page *pages = buffer->priv_virt;
+	unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT;
 	/* release memory */
-	cma_release(cma_heap->cma, pages, buffer->size);
+	cma_release(cma_heap->cma, pages, nr_pages);
 	/* release sg table */
 	sg_free_table(buffer->sg_table);
 	kfree(buffer->sg_table);

drivers/staging/ccree/ssi_hash.c+1−1

@@ -1769,7 +1769,7 @@ static int ssi_ahash_import(struct ahash_request req, const void in) · 1768 unmodified lines
1769	struct device *dev = drvdata_to_dev(ctx->drvdata);	1769	struct device *dev = drvdata_to_dev(ctx->drvdata);
1770	struct ahash_req_ctx *state = ahash_request_ctx(req);	1770	struct ahash_req_ctx *state = ahash_request_ctx(req);
1771	u32 tmp;	1771	u32 tmp;
1772	int rc;	1772	int rc = 0;
1773		1773
1774	memcpy(&tmp, in, sizeof(u32));	1774	memcpy(&tmp, in, sizeof(u32));
1775	if (tmp != CC_EXPORT_MAGIC) {	1775	if (tmp != CC_EXPORT_MAGIC) {

drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c+10−13

@@ -487,21 +487,18 @@ ksocknal_add_peer(struct lnet_ni *ni, struct lnet_process_id id, __u32 ipaddr, · 486 unmodified lines
487	ksocknal_nid2peerlist(id.nid));	487	ksocknal_nid2peerlist(id.nid));
488	}	488	}
489		489
490	route2 = NULL;
491	list_for_each_entry(route2, &peer->ksnp_routes, ksnr_list) {	490	list_for_each_entry(route2, &peer->ksnp_routes, ksnr_list) {
492	if (route2->ksnr_ipaddr == ipaddr)	491	if (route2->ksnr_ipaddr == ipaddr) {
493	break;	492	/* Route already exists, use the old one */
494		493	ksocknal_route_decref(route);
495	route2 = NULL;	494	route2->ksnr_share_count++;
496	}	495	goto out;
497	if (!route2) {	496	}
498	ksocknal_add_route_locked(peer, route);
499	route->ksnr_share_count++;
500	} else {
501	ksocknal_route_decref(route);
502	route2->ksnr_share_count++;
503	}	497	}
504		498	/* Route doesn't already exist, add the new one */
		499	ksocknal_add_route_locked(peer, route);
		500	route->ksnr_share_count++;
		501	out:
505	write_unlock_bh(&ksocknal_data.ksnd_global_lock);	502	write_unlock_bh(&ksocknal_data.ksnd_global_lock);
506		503
507	return 0;	504	return 0;

drivers/staging/pi433/rf69.c+1−1

@@ -102,7 +102,7 @@ enum modulation rf69_get_modulation(struct spi_device *spi) · 101 unmodified lines
102		102
103	currentValue = READ_REG(REG_DATAMODUL);	103	currentValue = READ_REG(REG_DATAMODUL);
104		104
105	switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE >> 3) { // TODO improvement: change 3 to define	105	switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE) {
106	case DATAMODUL_MODULATION_TYPE_OOK: return OOK;	106	case DATAMODUL_MODULATION_TYPE_OOK: return OOK;
107	case DATAMODUL_MODULATION_TYPE_FSK: return FSK;	107	case DATAMODUL_MODULATION_TYPE_FSK: return FSK;
108	default: return undefined;	108	default: return undefined;

drivers/target/target_core_pscsi.c+2−2

@@ -920,7 +920,7 @@ pscsi_map_sg(struct se_cmd cmd, struct scatterlist sgl, u32 sgl_nents, · 919 unmodified lines
920	" %d i: %d bio: %p, allocating another"	920	" %d i: %d bio: %p, allocating another"
921	" bio\n", bio->bi_vcnt, i, bio);	921	" bio\n", bio->bi_vcnt, i, bio);
922		922
923	rc = blk_rq_append_bio(req, bio);	923	rc = blk_rq_append_bio(req, &bio);
924	if (rc) {	924	if (rc) {
925	pr_err("pSCSI: failed to append bio\n");	925	pr_err("pSCSI: failed to append bio\n");
926	goto fail;	926	goto fail;
@@ -938,7 +938,7 @@ pscsi_map_sg(struct se_cmd cmd, struct scatterlist sgl, u32 sgl_nents, · 11 unmodified lines
938	}	938	}
939		939
940	if (bio) {	940	if (bio) {
941	rc = blk_rq_append_bio(req, bio);	941	rc = blk_rq_append_bio(req, &bio);
942	if (rc) {	942	if (rc) {
943	pr_err("pSCSI: failed to append bio\n");	943	pr_err("pSCSI: failed to append bio\n");
944	goto fail;	944	goto fail;

drivers/thunderbolt/nhi.c+1−1

@@ -339,7 +339,7 @@ static void __ring_interrupt(struct tb_ring *ring) · 338 unmodified lines
339	return;	339	return;
340		340
341	if (ring->start_poll) {	341	if (ring->start_poll) {
342	__ring_interrupt_mask(ring, false);	342	__ring_interrupt_mask(ring, true);
343	ring->start_poll(ring->poll_data);	343	ring->start_poll(ring->poll_data);
344	} else {	344	} else {
345	schedule_work(&ring->work);	345	schedule_work(&ring->work);

drivers/tty/n_tty.c+2−2

@@ -1762,7 +1762,7 @@ static void n_tty_set_termios(struct tty_struct tty, struct ktermios old) · 1761 unmodified lines
1762	{	1762	{
1763	struct n_tty_data *ldata = tty->disc_data;	1763	struct n_tty_data *ldata = tty->disc_data;
1764		1764
1765	if (!old \|\| (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {	1765	if (!old \|\| (old->c_lflag ^ tty->termios.c_lflag) & (ICANON \| EXTPROC)) {
1766	bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);	1766	bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
1767	ldata->line_start = ldata->read_tail;	1767	ldata->line_start = ldata->read_tail;
1768	if (!L_ICANON(tty) \|\| !read_cnt(ldata)) {	1768	if (!L_ICANON(tty) \|\| !read_cnt(ldata)) {
@@ -2425,7 +2425,7 @@ static int n_tty_ioctl(struct tty_struct tty, struct file file, · 656 unmodified lines
2425	return put_user(tty_chars_in_buffer(tty), (int __user *) arg);	2425	return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
2426	case TIOCINQ:	2426	case TIOCINQ:
2427	down_write(&tty->termios_rwsem);	2427	down_write(&tty->termios_rwsem);
2428	if (L_ICANON(tty))	2428	if (L_ICANON(tty) && !L_EXTPROC(tty))
2429	retval = inq_canon(ldata);	2429	retval = inq_canon(ldata);
2430	else	2430	else
2431	retval = read_cnt(ldata);	2431	retval = read_cnt(ldata);

drivers/usb/chipidea/ci_hdrc_msm.c+1−1

@@ -247,7 +247,7 @@ static int ci_hdrc_msm_probe(struct platform_device *pdev) · 246 unmodified lines
247	if (ret)	247	if (ret)
248	goto err_mux;	248	goto err_mux;
249		249
250	ulpi_node = of_find_node_by_name(of_node_get(pdev->dev.of_node), "ulpi");	250	ulpi_node = of_get_child_by_name(pdev->dev.of_node, "ulpi");
251	if (ulpi_node) {	251	if (ulpi_node) {
252	phy_node = of_get_next_available_child(ulpi_node, NULL);	252	phy_node = of_get_next_available_child(ulpi_node, NULL);
253	ci->hsic = of_device_is_compatible(phy_node, "qcom,usb-hsic-phy");	253	ci->hsic = of_device_is_compatible(phy_node, "qcom,usb-hsic-phy");

drivers/usb/core/config.c+4−2

 	unsigned iad_num = 0;
 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+	nintf = nintf_orig = config->desc.bNumInterfaces;
+	config->desc.bNumInterfaces = 0;	// Adjusted later
 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
 	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
 	    config->desc.bLength > size) {
 	buffer += config->desc.bLength;
 	size -= config->desc.bLength;
-	nintf = nintf_orig = config->desc.bNumInterfaces;
 	if (nintf > USB_MAXINTERFACES) {
 		dev_warn(ddev, "config %d has too many interfaces: %d, "
 		    "using maximum allowed: %d\n",
 		case USB_SSP_CAP_TYPE:
 			ssp_cap = (struct usb_ssp_cap_descriptor *)buffer;
 			ssac = (le32_to_cpu(ssp_cap->bmAttributes) &
-				USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1;
+				USB_SSP_SUBLINK_SPEED_ATTRIBS);
 			if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac))
 				dev->bos->ssp_cap = ssp_cap;
 			break;

drivers/usb/core/quirks.c+5−1

 	/* Microsoft LifeCam-VX700 v2.0 */
 	{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
-	/* Logitech HD Pro Webcams C920, C920-C and C930e */
+	/* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+	{ USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
 	/* Logitech ConferenceCam CC3000e */
 	{ USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
 	/* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */
 	{ USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM },
+	/* ELSA MicroLink 56K */
+	{ USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_RESET_RESUME },
 	/* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
 	{ USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },

drivers/usb/dwc2/core.h+4−0

  *                       2 - Internal DMA
  * @power_optimized     Are power optimizations enabled?
  * @num_dev_ep          Number of device endpoints available
+ * @num_dev_in_eps      Number of device IN endpoints available
  * @num_dev_perio_in_ep Number of device periodic IN endpoints
  *                      available
  * @dev_token_q_depth   Device Mode IN Token Sequence Learning Queue
  *                       2 - 8 or 16 bits
  * @snpsid:             Value from SNPSID register
  * @dev_ep_dirs:        Direction of device endpoints (GHWCFG1)
+ * @g_tx_fifo_size[]	Power-on values of TxFIFO sizes
  */
 struct dwc2_hw_params {
 	unsigned op_mode:3;
 	unsigned fs_phy_type:2;
 	unsigned i2c_enable:1;
 	unsigned num_dev_ep:4;
+	unsigned num_dev_in_eps : 4;
 	unsigned num_dev_perio_in_ep:4;
 	unsigned total_fifo_size:16;
 	unsigned power_optimized:1;
 	unsigned utmi_phy_data_width:2;
 	u32 snpsid;
 	u32 dev_ep_dirs;
+	u32 g_tx_fifo_size[MAX_EPS_CHANNELS];
 };
 /* Size of control and EP0 buffers */

drivers/usb/dwc2/gadget.c+2−40

@@ -195,55 +195,18 @@ int dwc2_hsotg_tx_fifo_count(struct dwc2_hsotg *hsotg) · 194 unmodified lines
195	{	195	{
196	if (hsotg->hw_params.en_multiple_tx_fifo)	196	if (hsotg->hw_params.en_multiple_tx_fifo)
197	/* In dedicated FIFO mode we need count of IN EPs */	197	/* In dedicated FIFO mode we need count of IN EPs */
198	return (dwc2_readl(hsotg->regs + GHWCFG4) &	198	return hsotg->hw_params.num_dev_in_eps;
199	GHWCFG4_NUM_IN_EPS_MASK) >> GHWCFG4_NUM_IN_EPS_SHIFT;
200	else	199	else
201	/* In shared FIFO mode we need count of Periodic IN EPs */	200	/* In shared FIFO mode we need count of Periodic IN EPs */
202	return hsotg->hw_params.num_dev_perio_in_ep;	201	return hsotg->hw_params.num_dev_perio_in_ep;
203	}	202	}
204		203
205	/**
206	* dwc2_hsotg_ep_info_size - return Endpoint Info Control block size in DWORDs
207	*/
208	static int dwc2_hsotg_ep_info_size(struct dwc2_hsotg *hsotg)
209	{
210	int val = 0;
211	int i;
212	u32 ep_dirs;
213
214	/*
215	* Don't need additional space for ep info control registers in
216	* slave mode.
217	*/
218	if (!using_dma(hsotg)) {
219	dev_dbg(hsotg->dev, "Buffer DMA ep info size 0\n");
220	return 0;
221	}
222
223	/*
224	* Buffer DMA mode - 1 location per endpoit
225	* Descriptor DMA mode - 4 locations per endpoint
226	*/
227	ep_dirs = hsotg->hw_params.dev_ep_dirs;
228
229	for (i = 0; i <= hsotg->hw_params.num_dev_ep; i++) {
230	val += ep_dirs & 3 ? 1 : 2;
231	ep_dirs >>= 2;
232	}
233
234	if (using_desc_dma(hsotg))
235	val = val * 4;
236
237	return val;
238	}
239
240	/**	204	/**
241	* dwc2_hsotg_tx_fifo_total_depth - return total FIFO depth available for	205	* dwc2_hsotg_tx_fifo_total_depth - return total FIFO depth available for
242	* device mode TX FIFOs	206	* device mode TX FIFOs
243	*/	207	*/
244	int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)	208	int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
245	{	209	{
246	int ep_info_size;
247	int addr;	210	int addr;
248	int tx_addr_max;	211	int tx_addr_max;
249	u32 np_tx_fifo_size;	212	u32 np_tx_fifo_size;
@@ -252,8 +215,7 @@ int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg) · 2 unmodified lines
252	hsotg->params.g_np_tx_fifo_size);	215	hsotg->params.g_np_tx_fifo_size);
253		216
254	/* Get Endpoint Info Control block size in DWORDs. */	217	/* Get Endpoint Info Control block size in DWORDs. */
255	ep_info_size = dwc2_hsotg_ep_info_size(hsotg);	218	tx_addr_max = hsotg->hw_params.total_fifo_size;
256	tx_addr_max = hsotg->hw_params.total_fifo_size - ep_info_size;
257		219
258	addr = hsotg->params.g_rx_fifo_size + np_tx_fifo_size;	220	addr = hsotg->params.g_rx_fifo_size + np_tx_fifo_size;
259	if (tx_addr_max <= addr)	221	if (tx_addr_max <= addr)

drivers/usb/dwc2/params.c+19−10

 	}
 	for (fifo = 1; fifo <= fifo_count; fifo++) {
-		dptxfszn = (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
+		dptxfszn = hsotg->hw_params.g_tx_fifo_size[fifo];
-			FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
 		if (hsotg->params.g_tx_fifo_size[fifo] < min ||
 		    hsotg->params.g_tx_fifo_size[fifo] >  dptxfszn) {
 	struct dwc2_hw_params *hw = &hsotg->hw_params;
 	bool forced;
 	u32 gnptxfsiz;
+	int fifo, fifo_count;
 	if (hsotg->dr_mode == USB_DR_MODE_HOST)
 		return;
 	gnptxfsiz = dwc2_readl(hsotg->regs + GNPTXFSIZ);
+	fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+	for (fifo = 1; fifo <= fifo_count; fifo++) {
+		hw->g_tx_fifo_size[fifo] =
+			(dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
+			 FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
+	}
 	if (forced)
 		dwc2_clear_force_mode(hsotg);
 	hwcfg4 = dwc2_readl(hsotg->regs + GHWCFG4);
 	grxfsiz = dwc2_readl(hsotg->regs + GRXFSIZ);
-	/*
-	 * Host specific hardware parameters. Reading these parameters
-	 * requires the controller to be in host mode. The mode will
-	 * be forced, if necessary, to read these values.
-	 */
-	dwc2_get_host_hwparams(hsotg);
-	dwc2_get_dev_hwparams(hsotg);
 	/* hwcfg1 */
 	hw->dev_ep_dirs = hwcfg1;
 	hw->en_multiple_tx_fifo = !!(hwcfg4 & GHWCFG4_DED_FIFO_EN);
 	hw->num_dev_perio_in_ep = (hwcfg4 & GHWCFG4_NUM_DEV_PERIO_IN_EP_MASK) >>
 				  GHWCFG4_NUM_DEV_PERIO_IN_EP_SHIFT;
+	hw->num_dev_in_eps = (hwcfg4 & GHWCFG4_NUM_IN_EPS_MASK) >>
+			     GHWCFG4_NUM_IN_EPS_SHIFT;
 	hw->dma_desc_enable = !!(hwcfg4 & GHWCFG4_DESC_DMA);
 	hw->power_optimized = !!(hwcfg4 & GHWCFG4_POWER_OPTIMIZ);
 	hw->utmi_phy_data_width = (hwcfg4 & GHWCFG4_UTMI_PHY_DATA_WIDTH_MASK) >>
 	/* fifo sizes */
 	hw->rx_fifo_size = (grxfsiz & GRXFSIZ_DEPTH_MASK) >>
 				GRXFSIZ_DEPTH_SHIFT;
+	/*
+	 * Host specific hardware parameters. Reading these parameters
+	 * requires the controller to be in host mode. The mode will
+	 * be forced, if necessary, to read these values.
+	 */
+	dwc2_get_host_hwparams(hsotg);
+	dwc2_get_dev_hwparams(hsotg);
 	return 0;
 }

drivers/usb/dwc3/dwc3-of-simple.c+4−1

 		clk = of_clk_get(np, i);
 		if (IS_ERR(clk)) {
-			while (--i >= 0)
+			while (--i >= 0) {
+				clk_disable_unprepare(simple->clks[i]);
 				clk_put(simple->clks[i]);
+			}
 			return PTR_ERR(clk);
 		}
 	.driver		= {
 		.name	= "dwc3-of-simple",
 		.of_match_table = of_dwc3_simple_match,
+		.pm	= &dwc3_of_simple_dev_pm_ops,
 	},
 };

drivers/usb/dwc3/gadget.c+2−2

@@ -259,7 +259,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd, · 258 unmodified lines
259	{	259	{
260	const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;	260	const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
261	struct dwc3 *dwc = dep->dwc;	261	struct dwc3 *dwc = dep->dwc;
262	u32 timeout = 500;	262	u32 timeout = 1000;
263	u32 reg;	263	u32 reg;
264		264
265	int cmd_status = 0;	265	int cmd_status = 0;
@@ -912,7 +912,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep dep, struct dwc3_trb trb, · 646 unmodified lines
912	*/	912	*/
913	if (speed == USB_SPEED_HIGH) {	913	if (speed == USB_SPEED_HIGH) {
914	struct usb_ep *ep = &dep->endpoint;	914	struct usb_ep *ep = &dep->endpoint;
915	unsigned int mult = ep->mult - 1;	915	unsigned int mult = 2;
916	unsigned int maxp = usb_endpoint_maxp(ep->desc);	916	unsigned int maxp = usb_endpoint_maxp(ep->desc);
917		917
918	if (length <= (2 * maxp))	918	if (length <= (2 * maxp))

drivers/usb/gadget/Kconfig+2−2

@@ -508,8 +508,8 @@ choice · 507 unmodified lines
508	controller, and the relevant drivers for each function declared	508	controller, and the relevant drivers for each function declared
509	by the device.	509	by the device.
510		510
511	endchoice
512
513	source "drivers/usb/gadget/legacy/Kconfig"	511	source "drivers/usb/gadget/legacy/Kconfig"
514		512
		513	endchoice
		514
515	endif # USB_GADGET	515	endif # USB_GADGET

drivers/usb/gadget/legacy/Kconfig+1−11

 # both kinds of controller can also support "USB On-the-Go" (CONFIG_USB_OTG).
 #
-menuconfig USB_GADGET_LEGACY
-	bool "Legacy USB Gadget Support"
-	help
-	   Legacy USB gadgets are USB gadgets that do not use the USB gadget
-	   configfs interface.
-if USB_GADGET_LEGACY
 config USB_ZERO
 	tristate "Gadget Zero (DEVELOPMENT)"
 	select USB_LIBCOMPOSITE
 # or video class gadget drivers), or specific hardware, here.
 config USB_G_WEBCAM
 	tristate "USB Webcam Gadget"
-	depends on VIDEO_DEV
+	depends on VIDEO_V4L2
 	select USB_LIBCOMPOSITE
 	select VIDEOBUF2_VMALLOC
 	select USB_F_UVC
 	  Say "y" to link the driver statically, or "m" to build a
 	  dynamically linked module called "g_webcam".
-endif

drivers/usb/host/xhci-debugfs.c+8−8

@@ -162,7 +162,7 @@ static void xhci_debugfs_extcap_regset(struct xhci_hcd *xhci, int cap_id, · 161 unmodified lines
162	static int xhci_ring_enqueue_show(struct seq_file s, void unused)	162	static int xhci_ring_enqueue_show(struct seq_file s, void unused)
163	{	163	{
164	dma_addr_t dma;	164	dma_addr_t dma;
165	struct xhci_ring *ring = s->private;	165	struct xhci_ring ring = (struct xhci_ring **)s->private;
166		166
167	dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);	167	dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);
168	seq_printf(s, "%pad\n", &dma);	168	seq_printf(s, "%pad\n", &dma);
@@ -173,7 +173,7 @@ static int xhci_ring_enqueue_show(struct seq_file s, void unused) · 4 unmodified lines
173	static int xhci_ring_dequeue_show(struct seq_file s, void unused)	173	static int xhci_ring_dequeue_show(struct seq_file s, void unused)
174	{	174	{
175	dma_addr_t dma;	175	dma_addr_t dma;
176	struct xhci_ring *ring = s->private;	176	struct xhci_ring ring = (struct xhci_ring **)s->private;
177		177
178	dma = xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);	178	dma = xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
179	seq_printf(s, "%pad\n", &dma);	179	seq_printf(s, "%pad\n", &dma);
@@ -183,7 +183,7 @@ static int xhci_ring_dequeue_show(struct seq_file s, void unused) · 3 unmodified lines
183		183
184	static int xhci_ring_cycle_show(struct seq_file s, void unused)	184	static int xhci_ring_cycle_show(struct seq_file s, void unused)
185	{	185	{
186	struct xhci_ring *ring = s->private;	186	struct xhci_ring ring = (struct xhci_ring **)s->private;
187		187
188	seq_printf(s, "%d\n", ring->cycle_state);	188	seq_printf(s, "%d\n", ring->cycle_state);
189		189
@@ -346,7 +346,7 @@ static void xhci_debugfs_create_files(struct xhci_hcd *xhci, · 156 unmodified lines
346	}	346	}
347		347
348	static struct dentry xhci_debugfs_create_ring_dir(struct xhci_hcd xhci,	348	static struct dentry xhci_debugfs_create_ring_dir(struct xhci_hcd xhci,
349	struct xhci_ring *ring,	349	struct xhci_ring **ring,
350	const char *name,	350	const char *name,
351	struct dentry *parent)	351	struct dentry *parent)
352	{	352	{
@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci, · 34 unmodified lines
387		387
388	snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);	388	snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
389	epriv->root = xhci_debugfs_create_ring_dir(xhci,	389	epriv->root = xhci_debugfs_create_ring_dir(xhci,
390	dev->eps[ep_index].new_ring,	390	&dev->eps[ep_index].new_ring,
391	epriv->name,	391	epriv->name,
392	spriv->root);	392	spriv->root);
393	spriv->eps[ep_index] = epriv;	393	spriv->eps[ep_index] = epriv;
@@ -423,7 +423,7 @@ void xhci_debugfs_create_slot(struct xhci_hcd *xhci, int slot_id) · 29 unmodified lines
423	priv->dev = dev;	423	priv->dev = dev;
424	dev->debugfs_private = priv;	424	dev->debugfs_private = priv;
425		425
426	xhci_debugfs_create_ring_dir(xhci, dev->eps[0].ring,	426	xhci_debugfs_create_ring_dir(xhci, &dev->eps[0].ring,
427	"ep00", priv->root);	427	"ep00", priv->root);
428		428
429	xhci_debugfs_create_context_files(xhci, priv->root, slot_id);	429	xhci_debugfs_create_context_files(xhci, priv->root, slot_id);
@@ -488,11 +488,11 @@ void xhci_debugfs_init(struct xhci_hcd *xhci) · 58 unmodified lines
488	ARRAY_SIZE(xhci_extcap_dbc),	488	ARRAY_SIZE(xhci_extcap_dbc),
489	"reg-ext-dbc");	489	"reg-ext-dbc");
490		490
491	xhci_debugfs_create_ring_dir(xhci, xhci->cmd_ring,	491	xhci_debugfs_create_ring_dir(xhci, &xhci->cmd_ring,
492	"command-ring",	492	"command-ring",
493	xhci->debugfs_root);	493	xhci->debugfs_root);
494		494
495	xhci_debugfs_create_ring_dir(xhci, xhci->event_ring,	495	xhci_debugfs_create_ring_dir(xhci, &xhci->event_ring,
496	"event-ring",	496	"event-ring",
497	xhci->debugfs_root);	497	xhci->debugfs_root);
498		498

drivers/usb/host/xhci-mem.c+11−4

@@ -971,10 +971,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, · 970 unmodified lines
971	return 0;	971	return 0;
972	}	972	}
973		973
974	xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags);	974	dev = kzalloc(sizeof(*dev), flags);
975	if (!xhci->devs[slot_id])	975	if (!dev)
976	return 0;	976	return 0;
977	dev = xhci->devs[slot_id];
978		977
979	/* Allocate the (output) device context that will be used in the HC. */	978	/* Allocate the (output) device context that will be used in the HC. */
980	dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);	979	dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
@@ -1015,9 +1014,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, · 34 unmodified lines
1015		1014
1016	trace_xhci_alloc_virt_device(dev);	1015	trace_xhci_alloc_virt_device(dev);
1017		1016
		1017	xhci->devs[slot_id] = dev;
		1018
1018	return 1;	1019	return 1;
1019	fail:	1020	fail:
1020	xhci_free_virt_device(xhci, slot_id);	1021
		1022	if (dev->in_ctx)
		1023	xhci_free_container_ctx(xhci, dev->in_ctx);
		1024	if (dev->out_ctx)
		1025	xhci_free_container_ctx(xhci, dev->out_ctx);
		1026	kfree(dev);
		1027
1021	return 0;	1028	return 0;
1022	}	1029	}
1023		1030

drivers/usb/host/xhci-pci.c+3−0

 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 	}
+	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+			pdev->device == 0x0014)
+		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 	if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
 			pdev->device == 0x0015)
 		xhci->quirks |= XHCI_RESET_ON_RESUME;

drivers/usb/host/xhci-ring.c+3−3

@@ -3112,7 +3112,7 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred, · 3111 unmodified lines
3112	{	3112	{
3113	u32 maxp, total_packet_count;	3113	u32 maxp, total_packet_count;
3114		3114
3115	/* MTK xHCI is mostly 0.97 but contains some features from 1.0 */	3115	/* MTK xHCI 0.96 contains some features from 1.0 */
3116	if (xhci->hci_version < 0x100 && !(xhci->quirks & XHCI_MTK_HOST))	3116	if (xhci->hci_version < 0x100 && !(xhci->quirks & XHCI_MTK_HOST))
3117	return ((td_total_len - transferred) >> 10);	3117	return ((td_total_len - transferred) >> 10);
3118		3118
@@ -3121,8 +3121,8 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred, · 2 unmodified lines
3121	trb_buff_len == td_total_len)	3121	trb_buff_len == td_total_len)
3122	return 0;	3122	return 0;
3123		3123
3124	/* for MTK xHCI, TD size doesn't include this TRB */	3124	/* for MTK xHCI 0.96, TD size include this TRB, but not in 1.x */
3125	if (xhci->quirks & XHCI_MTK_HOST)	3125	if ((xhci->quirks & XHCI_MTK_HOST) && (xhci->hci_version < 0x100))
3126	trb_buff_len = 0;	3126	trb_buff_len = 0;
3127		3127
3128	maxp = usb_endpoint_maxp(&urb->ep->desc);	3128	maxp = usb_endpoint_maxp(&urb->ep->desc);

drivers/usb/host/xhci.c+3−3

 	struct xhci_slot_ctx *slot_ctx;
 	int i, ret;
-	xhci_debugfs_remove_slot(xhci, udev->slot_id);
 #ifndef CONFIG_USB_DEFAULT_PERSIST
 	/*
 	 * We called pm_runtime_get_noresume when the device was attached.
 	}
 	ret = xhci_disable_slot(xhci, udev->slot_id);
-	if (ret)
+	if (ret) {
+		xhci_debugfs_remove_slot(xhci, udev->slot_id);
 		xhci_free_virt_device(xhci, udev->slot_id);
+	}
 }
 int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)

drivers/usb/musb/da8xx.c+9−1

@@ -284,7 +284,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci) · 283 unmodified lines
284	musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;	284	musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
285	portstate(musb->port1_status \|= USB_PORT_STAT_POWER);	285	portstate(musb->port1_status \|= USB_PORT_STAT_POWER);
286	del_timer(&musb->dev_timer);	286	del_timer(&musb->dev_timer);
287	} else {	287	} else if (!(musb->int_usb & MUSB_INTR_BABBLE)) {
		288	/*
		289	* When babble condition happens, drvvbus interrupt
		290	* is also generated. Ignore this drvvbus interrupt
		291	* and let babble interrupt handler recovers the
		292	* controller; otherwise, the host-mode flag is lost
		293	* due to the MUSB_DEV_MODE() call below and babble
		294	* recovery logic will not be called.
		295	*/
288	musb->is_active = 0;	296	musb->is_active = 0;
289	MUSB_DEV_MODE(musb);	297	MUSB_DEV_MODE(musb);
290	otg->default_a = 0;	298	otg->default_a = 0;

drivers/usb/serial/ftdi_sio.c+1−0

@@ -1013,6 +1013,7 @@ static const struct usb_device_id id_table_combined[] = { · 1012 unmodified lines
1013	.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },	1013	.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
1014	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },	1014	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
1015	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },	1015	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
		1016	{ USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
1016	{ } /* Terminating entry */	1017	{ } /* Terminating entry */
1017	};	1018	};
1018		1019

drivers/usb/serial/ftdi_sio_ids.h+6−0

 #define ICPDAS_I7561U_PID		0x0104
 #define ICPDAS_I7563U_PID		0x0105
+/*
+ * Airbus Defence and Space
+ */
+#define AIRBUS_DS_VID			0x1e8e  /* Vendor ID */
+#define AIRBUS_DS_P8GR			0x6001  /* Tetra P8GR */
 /*
  * RT Systems programming cables for various ham radios
  */

drivers/usb/serial/option.c+17−0

 /* These Quectel products use Qualcomm's vendor ID */
 #define QUECTEL_PRODUCT_UC20			0x9003
 #define QUECTEL_PRODUCT_UC15			0x9090
+/* These Yuga products use Qualcomm's vendor ID */
+#define YUGA_PRODUCT_CLM920_NC5			0x9625
 #define QUECTEL_VENDOR_ID			0x2c7c
 /* These Quectel products use Quectel's vendor ID */
 #define TELIT_PRODUCT_LE922_USBCFG3		0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5		0x1045
 #define TELIT_PRODUCT_ME910			0x1100
+#define TELIT_PRODUCT_ME910_DUAL_MODEM		0x1101
 #define TELIT_PRODUCT_LE920			0x1200
 #define TELIT_PRODUCT_LE910			0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4		0x1206
 	.reserved = BIT(1) | BIT(3),
 };
+static const struct option_blacklist_info telit_me910_dual_modem_blacklist = {
+	.sendsetup = BIT(0),
+	.reserved = BIT(3),
+};
 static const struct option_blacklist_info telit_le910_blacklist = {
 	.sendsetup = BIT(0),
 	.reserved = BIT(1) | BIT(2),
 	.reserved = BIT(4) | BIT(5),
 };
+static const struct option_blacklist_info yuga_clm920_nc5_blacklist = {
+	.reserved = BIT(1) | BIT(4),
+};
 static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+	/* Yuga products use Qualcomm vendor ID */
+	{ USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5),
+	  .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist },
 	/* Quectel products using Quectel vendor ID */
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
 		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 		.driver_info = (kernel_ulong_t)&telit_me910_blacklist },
+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+		.driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
 		.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),

drivers/usb/serial/qcserial.c+3−0

 	{DEVICE_SWI(0x1199, 0x9079)},	/* Sierra Wireless EM74xx */
 	{DEVICE_SWI(0x1199, 0x907a)},	/* Sierra Wireless EM74xx QDL */
 	{DEVICE_SWI(0x1199, 0x907b)},	/* Sierra Wireless EM74xx */
+	{DEVICE_SWI(0x1199, 0x9090)},	/* Sierra Wireless EM7565 QDL */
+	{DEVICE_SWI(0x1199, 0x9091)},	/* Sierra Wireless EM7565 */
 	{DEVICE_SWI(0x413c, 0x81a2)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a3)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a4)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
 			break;
 		case 2:
 			dev_dbg(dev, "NMEA GPS interface found\n");
+			sendsetup = true;
 			break;
 		case 3:
 			dev_dbg(dev, "Modem port found\n");

drivers/usb/storage/unusual_devs.h+7−0

@@ -2100,6 +2100,13 @@ UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0116, · 2099 unmodified lines
2100	USB_SC_DEVICE, USB_PR_DEVICE, NULL,	2100	USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2101	US_FL_BROKEN_FUA ),	2101	US_FL_BROKEN_FUA ),
2102		2102
		2103	/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */
		2104	UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
		2105	"JMicron",
		2106	"JMS567",
		2107	USB_SC_DEVICE, USB_PR_DEVICE, NULL,
		2108	US_FL_BROKEN_FUA),
		2109
2103	/*	2110	/*
2104	* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>	2111	* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
2105	* JMicron responds to USN and several other SCSI ioctls with a	2112	* JMicron responds to USN and several other SCSI ioctls with a

drivers/usb/storage/unusual_uas.h+7−0

@@ -129,6 +129,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, · 128 unmodified lines
129	USB_SC_DEVICE, USB_PR_DEVICE, NULL,	129	USB_SC_DEVICE, USB_PR_DEVICE, NULL,
130	US_FL_BROKEN_FUA \| US_FL_NO_REPORT_OPCODES),	130	US_FL_BROKEN_FUA \| US_FL_NO_REPORT_OPCODES),
131		131
		132	/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */
		133	UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
		134	"JMicron",
		135	"JMS567",
		136	USB_SC_DEVICE, USB_PR_DEVICE, NULL,
		137	US_FL_BROKEN_FUA),
		138
132	/* Reported-by: Hans de Goede <hdegoede@redhat.com> */	139	/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
133	UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,	140	UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
134	"VIA",	141	"VIA",

drivers/usb/usbip/stub_dev.c+1−2

@@ -149,8 +149,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) · 148 unmodified lines
149	* step 1?	149	* step 1?
150	*/	150	*/
151	if (ud->tcp_socket) {	151	if (ud->tcp_socket) {
152	dev_dbg(&sdev->udev->dev, "shutdown tcp_socket %p\n",	152	dev_dbg(&sdev->udev->dev, "shutdown sockfd %d\n", ud->sockfd);
153	ud->tcp_socket);
154	kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);	153	kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
155	}	154	}
156		155

drivers/usb/usbip/stub_main.c+3−2

 	struct stub_priv *priv;
 	struct urb *urb;
-	dev_dbg(&sdev->udev->dev, "free sdev %p\n", sdev);
+	dev_dbg(&sdev->udev->dev, "Stub device cleaning up urbs\n");
 	while ((priv = stub_priv_pop(sdev))) {
 		urb = priv->urb;
-		dev_dbg(&sdev->udev->dev, "free urb %p\n", urb);
+		dev_dbg(&sdev->udev->dev, "free urb seqnum %lu\n",
+			priv->seqnum);
 		usb_kill_urb(urb);
 		kmem_cache_free(stub_priv_cache, priv);

drivers/usb/usbip/stub_rx.c+33−14

 		if (priv->seqnum != pdu->u.cmd_unlink.seqnum)
 			continue;
-		dev_info(&priv->urb->dev->dev, "unlink urb %p\n",
-			 priv->urb);
 		/*
 		 * This matched urb is not completed yet (i.e., be in
 		 * flight in usb hcd hardware/driver). Now we are
 		ret = usb_unlink_urb(priv->urb);
 		if (ret != -EINPROGRESS)
 			dev_err(&priv->urb->dev->dev,
-				"failed to unlink a urb %p, ret %d\n",
+				"failed to unlink a urb # %lu, ret %d\n",
-				priv->urb, ret);
+				priv->seqnum, ret);
 		return 0;
 	}
 	return priv;
 }
-static int get_pipe(struct stub_device *sdev, int epnum, int dir)
+static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
 {
 	struct usb_device *udev = sdev->udev;
 	struct usb_host_endpoint *ep;
 	struct usb_endpoint_descriptor *epd = NULL;
+	int epnum = pdu->base.ep;
+	int dir = pdu->base.direction;
+	if (epnum < 0 || epnum > 15)
+		goto err_ret;
 	if (dir == USBIP_DIR_IN)
 		ep = udev->ep_in[epnum & 0x7f];
 	else
 		ep = udev->ep_out[epnum & 0x7f];
-	if (!ep) {
+	if (!ep)
-		dev_err(&sdev->udev->dev, "no such endpoint?, %d\n",
+		goto err_ret;
-			epnum);
-		BUG();
-	}
 	epd = &ep->desc;
 	if (usb_endpoint_xfer_control(epd)) {
 		if (dir == USBIP_DIR_OUT)
 			return usb_sndctrlpipe(udev, epnum);
 	}
 	if (usb_endpoint_xfer_isoc(epd)) {
+		/* validate packet size and number of packets */
+		unsigned int maxp, packets, bytes;
+		maxp = usb_endpoint_maxp(epd);
+		maxp *= usb_endpoint_maxp_mult(epd);
+		bytes = pdu->u.cmd_submit.transfer_buffer_length;
+		packets = DIV_ROUND_UP(bytes, maxp);
+		if (pdu->u.cmd_submit.number_of_packets < 0 ||
+		    pdu->u.cmd_submit.number_of_packets > packets) {
+			dev_err(&sdev->udev->dev,
+				"CMD_SUBMIT: isoc invalid num packets %d\n",
+				pdu->u.cmd_submit.number_of_packets);
+			return -1;
+		}
 		if (dir == USBIP_DIR_OUT)
 			return usb_sndisocpipe(udev, epnum);
 		else
 			return usb_rcvisocpipe(udev, epnum);
 	}
+err_ret:
 	/* NOT REACHED */
-	dev_err(&sdev->udev->dev, "get pipe, epnum %d\n", epnum);
+	dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum);
-	return 0;
+	return -1;
 }
 static void masking_bogus_flags(struct urb *urb)
 	struct stub_priv *priv;
 	struct usbip_device *ud = &sdev->ud;
 	struct usb_device *udev = sdev->udev;
-	int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
+	int pipe = get_pipe(sdev, pdu);
+	if (pipe == -1)
+		return;
 	priv = stub_priv_alloc(sdev, pdu);
 	if (!priv)

drivers/usb/usbip/stub_tx.c+10−3

 	/* link a urb to the queue of tx. */
 	spin_lock_irqsave(&sdev->priv_lock, flags);
 	if (sdev->ud.tcp_socket == NULL) {
-		usbip_dbg_stub_tx("ignore urb for closed connection %p", urb);
+		usbip_dbg_stub_tx("ignore urb for closed connection\n");
 		/* It will be freed in stub_device_cleanup_urbs(). */
 	} else if (priv->unlinking) {
 		stub_enqueue_ret_unlink(sdev, priv->seqnum, urb->status);
 		memset(&pdu_header, 0, sizeof(pdu_header));
 		memset(&msg, 0, sizeof(msg));
+		if (urb->actual_length > 0 && !urb->transfer_buffer) {
+			dev_err(&sdev->udev->dev,
+				"urb: actual_length %d transfer_buffer null\n",
+				urb->actual_length);
+			return -1;
+		}
 		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
 			iovnum = 2 + urb->number_of_packets;
 		else
 		/* 1. setup usbip_header */
 		setup_ret_submit_pdu(&pdu_header, urb);
-		usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n",
+		usbip_dbg_stub_tx("setup txdata seqnum: %d\n",
-				  pdu_header.base.seqnum, urb);
+				  pdu_header.base.seqnum);
 		usbip_header_correct_endian(&pdu_header, 1);
 		iov[iovnum].iov_base = &pdu_header;

drivers/usb/usbip/usbip_common.c+5−11

 	struct msghdr msg = {.msg_flags = MSG_NOSIGNAL};
 	int total = 0;
+	if (!sock || !buf || !size)
+		return -EINVAL;
 	iov_iter_kvec(&msg.msg_iter, READ|ITER_KVEC, &iov, 1, size);
 	usbip_dbg_xmit("enter\n");
-	if (!sock || !buf || !size) {
-		pr_err("invalid arg, sock %p buff %p size %d\n", sock, buf,
-		       size);
-		return -EINVAL;
-	}
 	do {
-		int sz = msg_data_left(&msg);
+		msg_data_left(&msg);
 		sock->sk->sk_allocation = GFP_NOIO;
 		result = sock_recvmsg(sock, &msg, MSG_WAITALL);
-		if (result <= 0) {
+		if (result <= 0)
-			pr_debug("receive sock %p buf %p size %u ret %d total %d\n",
-				 sock, buf + total, sz, result, total);
 			goto err;
-		}
 		total += result;
 	} while (msg_data_left(&msg));

drivers/usb/usbip/usbip_common.h+1−0

@@ -256,6 +256,7 @@ struct usbip_device { · 255 unmodified lines
256	/* lock for status */	256	/* lock for status */
257	spinlock_t lock;	257	spinlock_t lock;
258		258
		259	int sockfd;
259	struct socket *tcp_socket;	260	struct socket *tcp_socket;
260		261
261	struct task_struct *tcp_rx;	262	struct task_struct *tcp_rx;

drivers/usb/usbip/vhci_hcd.c+1−11

 	struct vhci_device *vdev;
 	unsigned long flags;
-	usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
-			  hcd, urb, mem_flags);
 	if (portnum > VHCI_HC_PORTS) {
 		pr_err("invalid port number %d\n", portnum);
 		return -ENODEV;
 	struct vhci_device *vdev;
 	unsigned long flags;
-	pr_info("dequeue a urb %p\n", urb);
 	spin_lock_irqsave(&vhci->lock, flags);
 	priv = urb->hcpriv;
 		/* tcp connection is closed */
 		spin_lock(&vdev->priv_lock);
-		pr_info("device %p seems to be disconnected\n", vdev);
 		list_del(&priv->list);
 		kfree(priv);
 		urb->hcpriv = NULL;
 		 * vhci_rx will receive RET_UNLINK and give back the URB.
 		 * Otherwise, we give back it here.
 		 */
-		pr_info("gives back urb %p\n", urb);
 		usb_hcd_unlink_urb_from_ep(hcd, urb);
 		spin_unlock_irqrestore(&vhci->lock, flags);
 		unlink->unlink_seqnum = priv->seqnum;
-		pr_info("device %p seems to be still connected\n", vdev);
 		/* send cmd_unlink and try to cancel the pending URB in the
 		 * peer */
 		list_add_tail(&unlink->list, &vdev->unlink_tx);
 	/* need this? see stub_dev.c */
 	if (ud->tcp_socket) {
-		pr_debug("shutdown tcp_socket %p\n", ud->tcp_socket);
+		pr_debug("shutdown tcp_socket %d\n", ud->sockfd);
 		kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
 	}

drivers/usb/usbip/vhci_rx.c+11−12

 		urb = priv->urb;
 		status = urb->status;
-		usbip_dbg_vhci_rx("find urb %p vurb %p seqnum %u\n",
+		usbip_dbg_vhci_rx("find urb seqnum %u\n", seqnum);
-				urb, priv, seqnum);
 		switch (status) {
 		case -ENOENT:
 			/* fall through */
 		case -ECONNRESET:
-			dev_info(&urb->dev->dev,
+			dev_dbg(&urb->dev->dev,
-				 "urb %p was unlinked %ssynchronuously.\n", urb,
+				 "urb seq# %u was unlinked %ssynchronuously\n",
-				 status == -ENOENT ? "" : "a");
+				 seqnum, status == -ENOENT ? "" : "a");
 			break;
 		case -EINPROGRESS:
 			/* no info output */
 			break;
 		default:
-			dev_info(&urb->dev->dev,
+			dev_dbg(&urb->dev->dev,
-				 "urb %p may be in a error, status %d\n", urb,
+				 "urb seq# %u may be in a error, status %d\n",
-				 status);
+				 seqnum, status);
 		}
 		list_del(&priv->list);
 	spin_unlock_irqrestore(&vdev->priv_lock, flags);
 	if (!urb) {
-		pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
+		pr_err("cannot find a urb of seqnum %u max seqnum %d\n",
-		pr_info("max seqnum %d\n",
+			pdu->base.seqnum,
 			atomic_read(&vhci_hcd->seqnum));
 		usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
 		return;
 	if (usbip_dbg_flag_vhci_rx)
 		usbip_dump_urb(urb);
-	usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+	usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum);
 	spin_lock_irqsave(&vhci->lock, flags);
 	usb_hcd_unlink_urb_from_ep(vhci_hcd_to_hcd(vhci_hcd), urb);
 		pr_info("the urb (seqnum %d) was already given back\n",
 			pdu->base.seqnum);
 	} else {
-		usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+		usbip_dbg_vhci_rx("now giveback urb %d\n", pdu->base.seqnum);
 		/* If unlink is successful, status is -ECONNRESET */
 		urb->status = pdu->u.ret_unlink.status;

drivers/usb/usbip/vhci_sysfs.c+16−9

 /*
  * output example:
- * hub port sta spd dev      socket           local_busid
+ * hub port sta spd dev       sockfd    local_busid
- * hs  0000 004 000 00000000         c5a7bb80 1-2.3
+ * hs  0000 004 000 00000000  3         1-2.3
  * ................................................
- * ss  0008 004 000 00000000         d8cee980 2-3.4
+ * ss  0008 004 000 00000000  4         2-3.4
  * ................................................
  *
- * IP address can be retrieved from a socket pointer address by looking
+ * Output includes socket fd instead of socket pointer address to avoid
- * up /proc/net/{tcp,tcp6}. Also, a userland program may remember a
+ * leaking kernel memory address in:
- * port number and its peer IP address.
+ *	/sys/devices/platform/vhci_hcd.0/status and in debug output.
+ * The socket pointer address is not used at the moment and it was made
+ * visible as a convenient way to find IP address from socket pointer
+ * address by looking up /proc/net/{tcp,tcp6}. As this opens a security
+ * hole, the change is made to use sockfd instead.
+ *
  */
 static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vdev)
 {
 	if (vdev->ud.status == VDEV_ST_USED) {
 		*out += sprintf(*out, "%03u %08x ",
 				      vdev->speed, vdev->devid);
-		*out += sprintf(*out, "%16p %s",
+		*out += sprintf(*out, "%u %s",
-				      vdev->ud.tcp_socket,
+				      vdev->ud.sockfd,
 				      dev_name(&vdev->udev->dev));
 	} else {
 	char *s = out;
 	/*
-	 * Half the ports are for SPEED_HIGH and half for SPEED_SUPER, thus the * 2.
+	 * Half the ports are for SPEED_HIGH and half for SPEED_SUPER,
+	 * thus the * 2.
 	 */
 	out += sprintf(out, "%d\n", VHCI_PORTS * vhci_num_controllers);
 	return out - s;
 	vdev->devid         = devid;
 	vdev->speed         = speed;
+	vdev->ud.sockfd     = sockfd;
 	vdev->ud.tcp_socket = socket;
 	vdev->ud.status     = VDEV_ST_NOTASSIGNED;

drivers/usb/usbip/vhci_tx.c+2−1

@@ -69,7 +69,8 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) · 68 unmodified lines
69	memset(&msg, 0, sizeof(msg));	69	memset(&msg, 0, sizeof(msg));
70	memset(&iov, 0, sizeof(iov));	70	memset(&iov, 0, sizeof(iov));
71		71
72	usbip_dbg_vhci_tx("setup txdata urb %p\n", urb);	72	usbip_dbg_vhci_tx("setup txdata urb seqnum %lu\n",
		73	priv->seqnum);
73		74
74	/* 1. setup usbip_header */	75	/* 1. setup usbip_header */
75	setup_cmd_submit_pdu(&pdu_header, urb);	76	setup_cmd_submit_pdu(&pdu_header, urb);

drivers/virtio/virtio_mmio.c+9−34

@@ -522,10 +522,8 @@ static int virtio_mmio_probe(struct platform_device *pdev) · 521 unmodified lines
522	return -EBUSY;	522	return -EBUSY;
523		523
524	vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);	524	vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);
525	if (!vm_dev) {	525	if (!vm_dev)
526	rc = -ENOMEM;	526	return -ENOMEM;
527	goto free_mem;
528	}
529		527
530	vm_dev->vdev.dev.parent = &pdev->dev;	528	vm_dev->vdev.dev.parent = &pdev->dev;
531	vm_dev->vdev.dev.release = virtio_mmio_release_dev;	529	vm_dev->vdev.dev.release = virtio_mmio_release_dev;
@@ -535,17 +533,14 @@ static int virtio_mmio_probe(struct platform_device *pdev) · 3 unmodified lines
535	spin_lock_init(&vm_dev->lock);	533	spin_lock_init(&vm_dev->lock);
536		534
537	vm_dev->base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));	535	vm_dev->base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
538	if (vm_dev->base == NULL) {	536	if (vm_dev->base == NULL)
539	rc = -EFAULT;	537	return -EFAULT;
540	goto free_vmdev;
541	}
542		538
543	/* Check magic value */	539	/* Check magic value */
544	magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE);	540	magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE);
545	if (magic != ('v' \| 'i' << 8 \| 'r' << 16 \| 't' << 24)) {	541	if (magic != ('v' \| 'i' << 8 \| 'r' << 16 \| 't' << 24)) {
546	dev_warn(&pdev->dev, "Wrong magic value 0x%08lx!\n", magic);	542	dev_warn(&pdev->dev, "Wrong magic value 0x%08lx!\n", magic);
547	rc = -ENODEV;	543	return -ENODEV;
548	goto unmap;
549	}	544	}
550		545
551	/* Check device version */	546	/* Check device version */
@@ -553,8 +548,7 @@ static int virtio_mmio_probe(struct platform_device *pdev) · 1 unmodified line
553	if (vm_dev->version < 1 \|\| vm_dev->version > 2) {	548	if (vm_dev->version < 1 \|\| vm_dev->version > 2) {
554	dev_err(&pdev->dev, "Version %ld not supported!\n",	549	dev_err(&pdev->dev, "Version %ld not supported!\n",
555	vm_dev->version);	550	vm_dev->version);
556	rc = -ENXIO;	551	return -ENXIO;
557	goto unmap;
558	}	552	}
559		553
560	vm_dev->vdev.id.device = readl(vm_dev->base + VIRTIO_MMIO_DEVICE_ID);	554	vm_dev->vdev.id.device = readl(vm_dev->base + VIRTIO_MMIO_DEVICE_ID);
@@ -563,8 +557,7 @@ static int virtio_mmio_probe(struct platform_device *pdev) · 2 unmodified lines
563	* virtio-mmio device with an ID 0 is a (dummy) placeholder	557	* virtio-mmio device with an ID 0 is a (dummy) placeholder
564	* with no function. End probing now with no error reported.	558	* with no function. End probing now with no error reported.
565	*/	559	*/
566	rc = -ENODEV;	560	return -ENODEV;
567	goto unmap;
568	}	561	}
569	vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID);	562	vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID);
570		563
@@ -590,33 +583,15 @@ static int virtio_mmio_probe(struct platform_device *pdev) · 19 unmodified lines
590	platform_set_drvdata(pdev, vm_dev);	583	platform_set_drvdata(pdev, vm_dev);
591		584
592	rc = register_virtio_device(&vm_dev->vdev);	585	rc = register_virtio_device(&vm_dev->vdev);
593	if (rc) {	586	if (rc)
594	iounmap(vm_dev->base);
595	devm_release_mem_region(&pdev->dev, mem->start,
596	resource_size(mem));
597	put_device(&vm_dev->vdev.dev);	587	put_device(&vm_dev->vdev.dev);
598	}	588
599	return rc;
600	unmap:
601	iounmap(vm_dev->base);
602	free_mem:
603	devm_release_mem_region(&pdev->dev, mem->start,
604	resource_size(mem));
605	free_vmdev:
606	devm_kfree(&pdev->dev, vm_dev);
607	return rc;	589	return rc;
608	}	590	}
609		591
610	static int virtio_mmio_remove(struct platform_device *pdev)	592	static int virtio_mmio_remove(struct platform_device *pdev)
611	{	593	{
612	struct virtio_mmio_device *vm_dev = platform_get_drvdata(pdev);	594	struct virtio_mmio_device *vm_dev = platform_get_drvdata(pdev);
613	struct resource *mem;
614
615	iounmap(vm_dev->base);
616	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
617	if (mem)
618	devm_release_mem_region(&pdev->dev, mem->start,
619	resource_size(mem));
620	unregister_virtio_device(&vm_dev->vdev);	595	unregister_virtio_device(&vm_dev->vdev);
621		596
622	return 0;	597	return 0;

drivers/xen/Kconfig+1−1

@@ -269,7 +269,7 @@ config XEN_ACPI_HOTPLUG_CPU · 268 unmodified lines
269		269
270	config XEN_ACPI_PROCESSOR	270	config XEN_ACPI_PROCESSOR
271	tristate "Xen ACPI processor"	271	tristate "Xen ACPI processor"
272	depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ	272	depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
273	default m	273	default m
274	help	274	help
275	This ACPI processor uploads Power Management information to the Xen	275	This ACPI processor uploads Power Management information to the Xen

drivers/xen/balloon.c+56−9

@@ -257,10 +257,25 @@ static void release_memory_resource(struct resource *resource) · 256 unmodified lines
257	kfree(resource);	257	kfree(resource);
258	}	258	}
259		259
		260	/*
		261	* Host memory not allocated to dom0. We can use this range for hotplug-based
		262	* ballooning.
		263	*
		264	* It's a type-less resource. Setting IORESOURCE_MEM will make resource
		265	* management algorithms (arch_remove_reservations()) look into guest e820,
		266	* which we don't want.
		267	*/
		268	static struct resource hostmem_resource = {
		269	.name = "Host RAM",
		270	};
		271
		272	void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
		273	{}
		274
260	static struct resource *additional_memory_resource(phys_addr_t size)	275	static struct resource *additional_memory_resource(phys_addr_t size)
261	{	276	{
262	struct resource *res;	277	struct resource res, res_hostmem;
263	int ret;	278	int ret = -ENOMEM;
264		279
265	res = kzalloc(sizeof(*res), GFP_KERNEL);	280	res = kzalloc(sizeof(*res), GFP_KERNEL);
266	if (!res)	281	if (!res)
@@ -269,13 +284,42 @@ static struct resource *additional_memory_resource(phys_addr_t size) · 2 unmodified lines
269	res->name = "System RAM";	284	res->name = "System RAM";
270	res->flags = IORESOURCE_SYSTEM_RAM \| IORESOURCE_BUSY;	285	res->flags = IORESOURCE_SYSTEM_RAM \| IORESOURCE_BUSY;
271		286
272	ret = allocate_resource(&iomem_resource, res,	287	res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
273	size, 0, -1,	288	if (res_hostmem) {
274	PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);	289	/* Try to grab a range from hostmem */
275	if (ret < 0) {	290	res_hostmem->name = "Host memory";
276	pr_err("Cannot allocate new System RAM resource\n");	291	ret = allocate_resource(&hostmem_resource, res_hostmem,
277	kfree(res);	292	size, 0, -1,
278	return NULL;	293	PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
		294	}
		295
		296	if (!ret) {
		297	/*
		298	* Insert this resource into iomem. Because hostmem_resource
		299	* tracks portion of guest e820 marked as UNUSABLE noone else
		300	* should try to use it.
		301	*/
		302	res->start = res_hostmem->start;
		303	res->end = res_hostmem->end;
		304	ret = insert_resource(&iomem_resource, res);
		305	if (ret < 0) {
		306	pr_err("Can't insert iomem_resource [%llx - %llx]\n",
		307	res->start, res->end);
		308	release_memory_resource(res_hostmem);
		309	res_hostmem = NULL;
		310	res->start = res->end = 0;
		311	}
		312	}
		313
		314	if (ret) {
		315	ret = allocate_resource(&iomem_resource, res,
		316	size, 0, -1,
		317	PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
		318	if (ret < 0) {
		319	pr_err("Cannot allocate new System RAM resource\n");
		320	kfree(res);
		321	return NULL;
		322	}
279	}	323	}
280		324
281	#ifdef CONFIG_SPARSEMEM	325	#ifdef CONFIG_SPARSEMEM
@@ -287,6 +331,7 @@ static struct resource *additional_memory_resource(phys_addr_t size) · 5 unmodified lines
287	pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",	331	pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
288	pfn, limit);	332	pfn, limit);
289	release_memory_resource(res);	333	release_memory_resource(res);
		334	release_memory_resource(res_hostmem);
290	return NULL;	335	return NULL;
291	}	336	}
292	}	337	}
@@ -765,6 +810,8 @@ static int __init balloon_init(void) · 472 unmodified lines
765	set_online_page_callback(&xen_online_page);	810	set_online_page_callback(&xen_online_page);
766	register_memory_notifier(&xen_memory_nb);	811	register_memory_notifier(&xen_memory_nb);
767	register_sysctl_table(xen_root);	812	register_sysctl_table(xen_root);
		813
		814	arch_xen_balloon_init(&hostmem_resource);
768	#endif	815	#endif
769		816
770	#ifdef CONFIG_XEN_PV	817	#ifdef CONFIG_XEN_PV

fs/autofs4/waitq.c+0−1

@@ -170,7 +170,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, · 169 unmodified lines
170		170
171	mutex_unlock(&sbi->wq_mutex);	171	mutex_unlock(&sbi->wq_mutex);
172		172
173	if (autofs4_write(sbi, pipe, &pkt, pktsz))
174	switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {	173	switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
175	case 0:	174	case 0:
176	break;	175	break;

fs/ceph/mds_client.c+38−4

@@ -1440,6 +1440,29 @@ static int __close_session(struct ceph_mds_client *mdsc, · 1439 unmodified lines
1440	return request_close_session(mdsc, session);	1440	return request_close_session(mdsc, session);
1441	}	1441	}
1442		1442
		1443	static bool drop_negative_children(struct dentry *dentry)
		1444	{
		1445	struct dentry *child;
		1446	bool all_negative = true;
		1447
		1448	if (!d_is_dir(dentry))
		1449	goto out;
		1450
		1451	spin_lock(&dentry->d_lock);
		1452	list_for_each_entry(child, &dentry->d_subdirs, d_child) {
		1453	if (d_really_is_positive(child)) {
		1454	all_negative = false;
		1455	break;
		1456	}
		1457	}
		1458	spin_unlock(&dentry->d_lock);
		1459
		1460	if (all_negative)
		1461	shrink_dcache_parent(dentry);
		1462	out:
		1463	return all_negative;
		1464	}
		1465
1443	/*	1466	/*
1444	* Trim old(er) caps.	1467	* Trim old(er) caps.
1445	*	1468	*
@@ -1490,16 +1513,27 @@ static int trim_caps_cb(struct inode inode, struct ceph_cap cap, void *arg) · 44 unmodified lines
1490	if ((used \| wanted) & ~oissued & mine)	1513	if ((used \| wanted) & ~oissued & mine)
1491	goto out; /* we need these caps */	1514	goto out; /* we need these caps */
1492		1515
1493	session->s_trim_caps--;
1494	if (oissued) {	1516	if (oissued) {
1495	/* we aren't the only cap.. just remove us */	1517	/* we aren't the only cap.. just remove us */
1496	__ceph_remove_cap(cap, true);	1518	__ceph_remove_cap(cap, true);
		1519	session->s_trim_caps--;
1497	} else {	1520	} else {
		1521	struct dentry *dentry;
1498	/* try dropping referring dentries */	1522	/* try dropping referring dentries */
1499	spin_unlock(&ci->i_ceph_lock);	1523	spin_unlock(&ci->i_ceph_lock);
1500	d_prune_aliases(inode);	1524	dentry = d_find_any_alias(inode);
1501	dout("trim_caps_cb %p cap %p pruned, count now %d\n",	1525	if (dentry && drop_negative_children(dentry)) {
1502	inode, cap, atomic_read(&inode->i_count));	1526	int count;
		1527	dput(dentry);
		1528	d_prune_aliases(inode);
		1529	count = atomic_read(&inode->i_count);
		1530	if (count == 1)
		1531	session->s_trim_caps--;
		1532	dout("trim_caps_cb %p cap %p pruned, count now %d\n",
		1533	inode, cap, count);
		1534	} else {
		1535	dput(dentry);
		1536	}
1503	return 0;	1537	return 0;
1504	}	1538	}
1505		1539

fs/cifs/smb2ops.c+2−1

@@ -1406,7 +1406,8 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, · 1405 unmodified lines
1406	} while (rc == -EAGAIN);	1406	} while (rc == -EAGAIN);
1407		1407
1408	if (rc) {	1408	if (rc) {
1409	cifs_dbg(VFS, "ioctl error in smb2_get_dfs_refer rc=%d\n", rc);	1409	if (rc != -ENOENT)
		1410	cifs_dbg(VFS, "ioctl error in smb2_get_dfs_refer rc=%d\n", rc);
1410	goto out;	1411	goto out;
1411	}	1412	}
1412		1413

fs/cifs/smb2pdu.c+15−15

 	cifs_small_buf_release(req);
 	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
-	shdr = get_sync_hdr(rsp);
-	if (shdr->Status == STATUS_END_OF_FILE) {
+	if (rc) {
+		if (rc != -ENODATA) {
+			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
+			cifs_dbg(VFS, "Send error in read = %d\n", rc);
+		}
 		free_rsp_buf(resp_buftype, rsp_iov.iov_base);
-		return 0;
+		return rc == -ENODATA ? 0 : rc;
 	}
-	if (rc) {
+	*nbytes = le32_to_cpu(rsp->DataLength);
-		cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
+	if ((*nbytes > CIFS_MAX_MSGSIZE) ||
-		cifs_dbg(VFS, "Send error in read = %d\n", rc);
+	    (*nbytes > io_parms->length)) {
-	} else {
+		cifs_dbg(FYI, "bad length %d for count %d\n",
-		*nbytes = le32_to_cpu(rsp->DataLength);
+			 *nbytes, io_parms->length);
-		if ((*nbytes > CIFS_MAX_MSGSIZE) ||
+		rc = -EIO;
-		    (*nbytes > io_parms->length)) {
+		*nbytes = 0;
-			cifs_dbg(FYI, "bad length %d for count %d\n",
-				 *nbytes, io_parms->length);
-			rc = -EIO;
-			*nbytes = 0;
-		}
 	}
+	shdr = get_sync_hdr(rsp);
 	if (*buf) {
 		memcpy(*buf, (char *)shdr + rsp->DataOffset, *nbytes);
 		free_rsp_buf(resp_buftype, rsp_iov.iov_base);

fs/cramfs/Kconfig+1−0

@@ -34,6 +34,7 @@ config CRAMFS_BLOCKDEV · 33 unmodified lines
34	config CRAMFS_MTD	34	config CRAMFS_MTD
35	bool "Support CramFs image directly mapped in physical memory"	35	bool "Support CramFs image directly mapped in physical memory"
36	depends on CRAMFS && MTD	36	depends on CRAMFS && MTD
		37	depends on CRAMFS=m \|\| MTD=y
37	default y if !CRAMFS_BLOCKDEV	38	default y if !CRAMFS_BLOCKDEV
38	help	39	help
39	This option allows the CramFs driver to load data directly from	40	This option allows the CramFs driver to load data directly from

fs/dax.c+1−2

@@ -627,8 +627,7 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping, · 626 unmodified lines
627		627
628	if (pfn != pmd_pfn(*pmdp))	628	if (pfn != pmd_pfn(*pmdp))
629	goto unlock_pmd;	629	goto unlock_pmd;
630	if (!pmd_dirty(*pmdp)	630	if (!pmd_dirty(pmdp) && !pmd_write(pmdp))
631	&& !pmd_access_permitted(*pmdp, WRITE))
632	goto unlock_pmd;	631	goto unlock_pmd;
633		632
634	flush_cache_page(vma, address, pfn);	633	flush_cache_page(vma, address, pfn);

fs/exec.c+4−10

 	return -EAGAIN;
 }
-char *get_task_comm(char *buf, struct task_struct *tsk)
+char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
 {
-	/* buf must be at least sizeof(tsk->comm) in size */
 	task_lock(tsk);
-	strncpy(buf, tsk->comm, sizeof(tsk->comm));
+	strncpy(buf, tsk->comm, buf_size);
 	task_unlock(tsk);
 	return buf;
 }
-EXPORT_SYMBOL_GPL(get_task_comm);
+EXPORT_SYMBOL_GPL(__get_task_comm);
 /*
  * These functions flushes out all traces of the currently running executable
 		 * avoid bad behavior from the prior rlimits. This has to
 		 * happen before arch_pick_mmap_layout(), which examines
 		 * RLIMIT_STACK, but after the point of no return to avoid
-		 * races from other threads changing the limits. This also
+		 * needing to clean up the change on failure.
-		 * must be protected from races with prlimit() calls.
 		 */
-		task_lock(current->group_leader);
 		if (current->signal->rlim[RLIMIT_STACK].rlim_cur > _STK_LIM)
 			current->signal->rlim[RLIMIT_STACK].rlim_cur = _STK_LIM;
-		if (current->signal->rlim[RLIMIT_STACK].rlim_max > _STK_LIM)
-			current->signal->rlim[RLIMIT_STACK].rlim_max = _STK_LIM;
-		task_unlock(current->group_leader);
 	}
 	arch_pick_mmap_layout(current->mm);

fs/ext4/extents.c+1−0

@@ -4722,6 +4722,7 @@ retry: · 4721 unmodified lines
4722	EXT4_INODE_EOFBLOCKS);	4722	EXT4_INODE_EOFBLOCKS);
4723	}	4723	}
4724	ext4_mark_inode_dirty(handle, inode);	4724	ext4_mark_inode_dirty(handle, inode);
		4725	ext4_update_inode_fsync_trans(handle, inode, 1);
4725	ret2 = ext4_journal_stop(handle);	4726	ret2 = ext4_journal_stop(handle);
4726	if (ret2)	4727	if (ret2)
4727	break;	4728	break;

fs/ext4/ialloc.c+2−0

@@ -816,6 +816,8 @@ struct inode __ext4_new_inode(handle_t handle, struct inode *dir, · 815 unmodified lines
816	#ifdef CONFIG_EXT4_FS_POSIX_ACL	816	#ifdef CONFIG_EXT4_FS_POSIX_ACL
817	struct posix_acl *p = get_acl(dir, ACL_TYPE_DEFAULT);	817	struct posix_acl *p = get_acl(dir, ACL_TYPE_DEFAULT);
818		818
		819	if (IS_ERR(p))
		820	return ERR_CAST(p);
819	if (p) {	821	if (p) {
820	int acl_size = p->a_count * sizeof(ext4_acl_entry);	822	int acl_size = p->a_count * sizeof(ext4_acl_entry);
821		823

fs/ext4/inode.c+9−0

@@ -149,6 +149,15 @@ static int ext4_meta_trans_blocks(struct inode *inode, int lblocks, · 148 unmodified lines
149	*/	149	*/
150	int ext4_inode_is_fast_symlink(struct inode *inode)	150	int ext4_inode_is_fast_symlink(struct inode *inode)
151	{	151	{
		152	if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
		153	int ea_blocks = EXT4_I(inode)->i_file_acl ?
		154	EXT4_CLUSTER_SIZE(inode->i_sb) >> 9 : 0;
		155
		156	if (ext4_has_inline_data(inode))
		157	return 0;
		158
		159	return (S_ISLNK(inode->i_mode) && inode->i_blocks - ea_blocks == 0);
		160	}
152	return S_ISLNK(inode->i_mode) && inode->i_size &&	161	return S_ISLNK(inode->i_mode) && inode->i_size &&
153	(inode->i_size < EXT4_N_BLOCKS * 4);	162	(inode->i_size < EXT4_N_BLOCKS * 4);
154	}	163	}

fs/ext4/namei.c+4−0

 			       "falling back\n"));
 	}
 	nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
+	if (!nblocks) {
+		ret = NULL;
+		goto cleanup_and_exit;
+	}
 	start = EXT4_I(dir)->i_dir_start_lookup;
 	if (start >= nblocks)
 		start = 0;

fs/namespace.c+1−0

@@ -2826,6 +2826,7 @@ long do_mount(const char dev_name, const char __user dir_name, · 2825 unmodified lines
2826	SB_DIRSYNC \|	2826	SB_DIRSYNC \|
2827	SB_SILENT \|	2827	SB_SILENT \|
2828	SB_POSIXACL \|	2828	SB_POSIXACL \|
		2829	SB_LAZYTIME \|
2829	SB_I_VERSION);	2830	SB_I_VERSION);
2830		2831
2831	if (flags & MS_REMOUNT)	2832	if (flags & MS_REMOUNT)

fs/nfs/client.c+11−0

 	const struct sockaddr *sap = data->addr;
 	struct nfs_net *nn = net_generic(data->net, nfs_net_id);
+again:
 	list_for_each_entry(clp, &nn->nfs_client_list, cl_share_link) {
 	        const struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
 		/* Don't match clients that failed to initialise properly */
 		if (clp->cl_cons_state < 0)
 			continue;
+		/* If a client is still initializing then we need to wait */
+		if (clp->cl_cons_state > NFS_CS_READY) {
+			refcount_inc(&clp->cl_count);
+			spin_unlock(&nn->nfs_client_lock);
+			nfs_wait_client_init_complete(clp);
+			nfs_put_client(clp);
+			spin_lock(&nn->nfs_client_lock);
+			goto again;
+		}
 		/* Different NFS versions cannot share the same nfs_client */
 		if (clp->rpc_ops != data->nfs_mod->rpc_ops)
 			continue;

fs/nfs/nfs4client.c+13−4

 	if (error < 0)
 		goto error;
-	if (!nfs4_has_session(clp))
-		nfs_mark_client_ready(clp, NFS_CS_READY);
 	error = nfs4_discover_server_trunking(clp, &old);
 	if (error < 0)
 		goto error;
-	if (clp != old)
+	if (clp != old) {
 		clp->cl_preserve_clid = true;
+		/*
+		 * Mark the client as having failed initialization so other
+		 * processes walking the nfs_client_list in nfs_match_client()
+		 * won't try to use it.
+		 */
+		nfs_mark_client_ready(clp, -EPERM);
+	}
 	nfs_put_client(clp);
 	clear_bit(NFS_CS_TSM_POSSIBLE, &clp->cl_flags);
 	return old;
 	spin_lock(&nn->nfs_client_lock);
 	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+		if (pos == new)
+			goto found;
 		status = nfs4_match_client(pos, new, &prev, nn);
 		if (status < 0)
 			goto out_unlock;
 		 * way that a SETCLIENTID_CONFIRM to pos can succeed is
 		 * if new and pos point to the same server:
 		 */
+found:
 		refcount_inc(&pos->cl_count);
 		spin_unlock(&nn->nfs_client_lock);
 		case 0:
 			nfs4_swap_callback_idents(pos, new);
 			pos->cl_confirm = new->cl_confirm;
+			nfs_mark_client_ready(pos, NFS_CS_READY);
 			prev = NULL;
 			*result = pos;

fs/nfs/write.c+2−0

 	if (res)
 		error = nfs_generic_commit_list(inode, &head, how, &cinfo);
 	nfs_commit_end(cinfo.mds);
+	if (res == 0)
+		return res;
 	if (error < 0)
 		goto out_error;
 	if (!may_wait)

fs/nfsd/auth.c+3−0

 				gi->gid[i] = exp->ex_anon_gid;
 			else
 				gi->gid[i] = rqgi->gid[i];
+			/* Each thread allocates its own gi, no race */
+			groups_sort(gi);
 		}
 	} else {
 		gi = get_group_info(rqgi);

fs/overlayfs/Kconfig+10−0

@@ -24,6 +24,16 @@ config OVERLAY_FS_REDIRECT_DIR · 23 unmodified lines
24	an overlay which has redirects on a kernel that doesn't support this	24	an overlay which has redirects on a kernel that doesn't support this
25	feature will have unexpected results.	25	feature will have unexpected results.
26		26
		27	config OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW
		28	bool "Overlayfs: follow redirects even if redirects are turned off"
		29	default y
		30	depends on OVERLAY_FS
		31	help
		32	Disable this to get a possibly more secure configuration, but that
		33	might not be backward compatible with previous kernels.
		34
		35	For more information, see Documentation/filesystems/overlayfs.txt
		36
27	config OVERLAY_FS_INDEX	37	config OVERLAY_FS_INDEX
28	bool "Overlayfs: turn on inodes index feature by default"	38	bool "Overlayfs: turn on inodes index feature by default"
29	depends on OVERLAY_FS	39	depends on OVERLAY_FS

fs/overlayfs/dir.c+2−1

 		spin_unlock(&dentry->d_lock);
 	} else {
 		kfree(redirect);
-		pr_warn_ratelimited("overlay: failed to set redirect (%i)\n", err);
+		pr_warn_ratelimited("overlayfs: failed to set redirect (%i)\n",
+				    err);
 		/* Fall back to userspace copy-up */
 		err = -EXDEV;
 	}

fs/overlayfs/namei.c+17−1

@@ -435,7 +435,7 @@ int ovl_verify_index(struct dentry index, struct ovl_path lower, · 434 unmodified lines
435		435
436	/* Check if index is orphan and don't warn before cleaning it */	436	/* Check if index is orphan and don't warn before cleaning it */
437	if (d_inode(index)->i_nlink == 1 &&	437	if (d_inode(index)->i_nlink == 1 &&
438	ovl_get_nlink(index, origin.dentry, 0) == 0)	438	ovl_get_nlink(origin.dentry, index, 0) == 0)
439	err = -ENOENT;	439	err = -ENOENT;
440		440
441	dput(origin.dentry);	441	dput(origin.dentry);
@@ -681,6 +681,22 @@ struct dentry ovl_lookup(struct inode dir, struct dentry *dentry, · 239 unmodified lines
681	if (d.stop)	681	if (d.stop)
682	break;	682	break;
683		683
		684	/*
		685	* Following redirects can have security consequences: it's like
		686	* a symlink into the lower layer without the permission checks.
		687	* This is only a problem if the upper layer is untrusted (e.g
		688	* comes from an USB drive). This can allow a non-readable file
		689	* or directory to become readable.
		690	*
		691	* Only following redirects when redirects are enabled disables
		692	* this attack vector when not necessary.
		693	*/
		694	err = -EPERM;
		695	if (d.redirect && !ofs->config.redirect_follow) {
		696	pr_warn_ratelimited("overlay: refusing to follow redirect for (%pd2)\n", dentry);
		697	goto out_put;
		698	}
		699
684	if (d.redirect && d.redirect[0] == '/' && poe != roe) {	700	if (d.redirect && d.redirect[0] == '/' && poe != roe) {
685	poe = roe;	701	poe = roe;
686		702

fs/overlayfs/overlayfs.h+1−1

@@ -180,7 +180,7 @@ static inline int ovl_do_whiteout(struct inode dir, struct dentry dentry) · 179 unmodified lines
180	static inline struct dentry ovl_do_tmpfile(struct dentry dentry, umode_t mode)	180	static inline struct dentry ovl_do_tmpfile(struct dentry dentry, umode_t mode)
181	{	181	{
182	struct dentry *ret = vfs_tmpfile(dentry, mode, 0);	182	struct dentry *ret = vfs_tmpfile(dentry, mode, 0);
183	int err = IS_ERR(ret) ? PTR_ERR(ret) : 0;	183	int err = PTR_ERR_OR_ZERO(ret);
184		184
185	pr_debug("tmpfile(%pd2, 0%o) = %i\n", dentry, mode, err);	185	pr_debug("tmpfile(%pd2, 0%o) = %i\n", dentry, mode, err);
186	return ret;	186	return ret;

fs/overlayfs/ovl_entry.h+2−0

@@ -14,6 +14,8 @@ struct ovl_config { · 13 unmodified lines
14	char *workdir;	14	char *workdir;
15	bool default_permissions;	15	bool default_permissions;
16	bool redirect_dir;	16	bool redirect_dir;
		17	bool redirect_follow;
		18	const char *redirect_mode;
17	bool index;	19	bool index;
18	};	20	};
19		21

fs/overlayfs/readdir.c+5−2

 	return err;
 fail:
-	pr_warn_ratelimited("overlay: failed to look up (%s) for ino (%i)\n",
+	pr_warn_ratelimited("overlayfs: failed to look up (%s) for ino (%i)\n",
 			    p->name, err);
 	goto out;
 }
 			return PTR_ERR(rdt.cache);
 	}
-	return iterate_dir(od->realfile, &rdt.ctx);
+	err = iterate_dir(od->realfile, &rdt.ctx);
+	ctx->pos = rdt.ctx.pos;
+	return err;
 }

fs/overlayfs/super.c+66−21

@@ -33,6 +33,13 @@ module_param_named(redirect_dir, ovl_redirect_dir_def, bool, 0644); · 32 unmodified lines
33	MODULE_PARM_DESC(ovl_redirect_dir_def,	33	MODULE_PARM_DESC(ovl_redirect_dir_def,
34	"Default to on or off for the redirect_dir feature");	34	"Default to on or off for the redirect_dir feature");
35		35
		36	static bool ovl_redirect_always_follow =
		37	IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW);
		38	module_param_named(redirect_always_follow, ovl_redirect_always_follow,
		39	bool, 0644);
		40	MODULE_PARM_DESC(ovl_redirect_always_follow,
		41	"Follow redirects even if redirect_dir feature is turned off");
		42
36	static bool ovl_index_def = IS_ENABLED(CONFIG_OVERLAY_FS_INDEX);	43	static bool ovl_index_def = IS_ENABLED(CONFIG_OVERLAY_FS_INDEX);
37	module_param_named(index, ovl_index_def, bool, 0644);	44	module_param_named(index, ovl_index_def, bool, 0644);
38	MODULE_PARM_DESC(ovl_index_def,	45	MODULE_PARM_DESC(ovl_index_def,
@@ -232,6 +239,7 @@ static void ovl_free_fs(struct ovl_fs *ofs) · 193 unmodified lines
232	kfree(ofs->config.lowerdir);	239	kfree(ofs->config.lowerdir);
233	kfree(ofs->config.upperdir);	240	kfree(ofs->config.upperdir);
234	kfree(ofs->config.workdir);	241	kfree(ofs->config.workdir);
		242	kfree(ofs->config.redirect_mode);
235	if (ofs->creator_cred)	243	if (ofs->creator_cred)
236	put_cred(ofs->creator_cred);	244	put_cred(ofs->creator_cred);
237	kfree(ofs);	245	kfree(ofs);
@@ -244,6 +252,7 @@ static void ovl_put_super(struct super_block *sb) · 6 unmodified lines
244	ovl_free_fs(ofs);	252	ovl_free_fs(ofs);
245	}	253	}
246		254
		255	/* Sync real dirty inodes in upper filesystem (if it exists) */
247	static int ovl_sync_fs(struct super_block *sb, int wait)	256	static int ovl_sync_fs(struct super_block *sb, int wait)
248	{	257	{
249	struct ovl_fs *ofs = sb->s_fs_info;	258	struct ovl_fs *ofs = sb->s_fs_info;
@@ -252,14 +261,24 @@ static int ovl_sync_fs(struct super_block *sb, int wait) · 2 unmodified lines
252		261
253	if (!ofs->upper_mnt)	262	if (!ofs->upper_mnt)
254	return 0;	263	return 0;
255	upper_sb = ofs->upper_mnt->mnt_sb;	264
256	if (!upper_sb->s_op->sync_fs)	265	/*
		266	* If this is a sync(2) call or an emergency sync, all the super blocks
		267	* will be iterated, including upper_sb, so no need to do anything.
		268	*
		269	* If this is a syncfs(2) call, then we do need to call
		270	* sync_filesystem() on upper_sb, but enough if we do it when being
		271	* called with wait == 1.
		272	*/
		273	if (!wait)
257	return 0;	274	return 0;
258		275
259	/* real inodes have already been synced by sync_filesystem(ovl_sb) */	276	upper_sb = ofs->upper_mnt->mnt_sb;
		277
260	down_read(&upper_sb->s_umount);	278	down_read(&upper_sb->s_umount);
261	ret = upper_sb->s_op->sync_fs(upper_sb, wait);	279	ret = sync_filesystem(upper_sb);
262	up_read(&upper_sb->s_umount);	280	up_read(&upper_sb->s_umount);
		281
263	return ret;	282	return ret;
264	}	283	}
265		284
@@ -295,6 +314,11 @@ static bool ovl_force_readonly(struct ovl_fs *ofs) · 29 unmodified lines
295	return (!ofs->upper_mnt \|\| !ofs->workdir);	314	return (!ofs->upper_mnt \|\| !ofs->workdir);
296	}	315	}
297		316
		317	static const char *ovl_redirect_mode_def(void)
		318	{
		319	return ovl_redirect_dir_def ? "on" : "off";
		320	}
		321
298	/**	322	/**
299	* ovl_show_options	323	* ovl_show_options
300	*	324	*
@@ -313,12 +337,10 @@ static int ovl_show_options(struct seq_file m, struct dentry dentry) · 12 unmodified lines
313	}	337	}
314	if (ofs->config.default_permissions)	338	if (ofs->config.default_permissions)
315	seq_puts(m, ",default_permissions");	339	seq_puts(m, ",default_permissions");
316	if (ofs->config.redirect_dir != ovl_redirect_dir_def)	340	if (strcmp(ofs->config.redirect_mode, ovl_redirect_mode_def()) != 0)
317	seq_printf(m, ",redirect_dir=%s",	341	seq_printf(m, ",redirect_dir=%s", ofs->config.redirect_mode);
318	ofs->config.redirect_dir ? "on" : "off");
319	if (ofs->config.index != ovl_index_def)	342	if (ofs->config.index != ovl_index_def)
320	seq_printf(m, ",index=%s",	343	seq_printf(m, ",index=%s", ofs->config.index ? "on" : "off");
321	ofs->config.index ? "on" : "off");
322	return 0;	344	return 0;
323	}	345	}
324		346
@@ -348,8 +370,7 @@ enum { · 23 unmodified lines
348	OPT_UPPERDIR,	370	OPT_UPPERDIR,
349	OPT_WORKDIR,	371	OPT_WORKDIR,
350	OPT_DEFAULT_PERMISSIONS,	372	OPT_DEFAULT_PERMISSIONS,
351	OPT_REDIRECT_DIR_ON,	373	OPT_REDIRECT_DIR,
352	OPT_REDIRECT_DIR_OFF,
353	OPT_INDEX_ON,	374	OPT_INDEX_ON,
354	OPT_INDEX_OFF,	375	OPT_INDEX_OFF,
355	OPT_ERR,	376	OPT_ERR,
@@ -360,8 +381,7 @@ static const match_table_t ovl_tokens = { · 4 unmodified lines
360	{OPT_UPPERDIR, "upperdir=%s"},	381	{OPT_UPPERDIR, "upperdir=%s"},
361	{OPT_WORKDIR, "workdir=%s"},	382	{OPT_WORKDIR, "workdir=%s"},
362	{OPT_DEFAULT_PERMISSIONS, "default_permissions"},	383	{OPT_DEFAULT_PERMISSIONS, "default_permissions"},
363	{OPT_REDIRECT_DIR_ON, "redirect_dir=on"},	384	{OPT_REDIRECT_DIR, "redirect_dir=%s"},
364	{OPT_REDIRECT_DIR_OFF, "redirect_dir=off"},
365	{OPT_INDEX_ON, "index=on"},	385	{OPT_INDEX_ON, "index=on"},
366	{OPT_INDEX_OFF, "index=off"},	386	{OPT_INDEX_OFF, "index=off"},
367	{OPT_ERR, NULL}	387	{OPT_ERR, NULL}
@@ -390,10 +410,37 @@ static char ovl_next_opt(char *s) · 22 unmodified lines
390	return sbegin;	410	return sbegin;
391	}	411	}
392		412
		413	static int ovl_parse_redirect_mode(struct ovl_config config, const char mode)
		414	{
		415	if (strcmp(mode, "on") == 0) {
		416	config->redirect_dir = true;
		417	/*
		418	* Does not make sense to have redirect creation without
		419	* redirect following.
		420	*/
		421	config->redirect_follow = true;
		422	} else if (strcmp(mode, "follow") == 0) {
		423	config->redirect_follow = true;
		424	} else if (strcmp(mode, "off") == 0) {
		425	if (ovl_redirect_always_follow)
		426	config->redirect_follow = true;
		427	} else if (strcmp(mode, "nofollow") != 0) {
		428	pr_err("overlayfs: bad mount option \"redirect_dir=%s\"\n",
		429	mode);
		430	return -EINVAL;
		431	}
		432
		433	return 0;
		434	}
		435
393	static int ovl_parse_opt(char opt, struct ovl_config config)	436	static int ovl_parse_opt(char opt, struct ovl_config config)
394	{	437	{
395	char *p;	438	char *p;
396		439
		440	config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL);
		441	if (!config->redirect_mode)
		442	return -ENOMEM;
		443
397	while ((p = ovl_next_opt(&opt)) != NULL) {	444	while ((p = ovl_next_opt(&opt)) != NULL) {
398	int token;	445	int token;
399	substring_t args[MAX_OPT_ARGS];	446	substring_t args[MAX_OPT_ARGS];
@@ -428,12 +475,11 @@ static int ovl_parse_opt(char opt, struct ovl_config config) · 28 unmodified lines
428	config->default_permissions = true;	475	config->default_permissions = true;
429	break;	476	break;
430		477
431	case OPT_REDIRECT_DIR_ON:	478	case OPT_REDIRECT_DIR:
432	config->redirect_dir = true;	479	kfree(config->redirect_mode);
433	break;	480	config->redirect_mode = match_strdup(&args[0]);
434		481	if (!config->redirect_mode)
435	case OPT_REDIRECT_DIR_OFF:	482	return -ENOMEM;
436	config->redirect_dir = false;
437	break;	483	break;
438		484
439	case OPT_INDEX_ON:	485	case OPT_INDEX_ON:
@@ -458,7 +504,7 @@ static int ovl_parse_opt(char opt, struct ovl_config config) · 18 unmodified lines
458	config->workdir = NULL;	504	config->workdir = NULL;
459	}	505	}
460		506
461	return 0;	507	return ovl_parse_redirect_mode(config, config->redirect_mode);
462	}	508	}
463		509
464	#define OVL_WORKDIR_NAME "work"	510	#define OVL_WORKDIR_NAME "work"
@@ -1160,7 +1206,6 @@ static int ovl_fill_super(struct super_block sb, void data, int silent) · 695 unmodified lines
1160	if (!cred)	1206	if (!cred)
1161	goto out_err;	1207	goto out_err;
1162		1208
1163	ofs->config.redirect_dir = ovl_redirect_dir_def;
1164	ofs->config.index = ovl_index_def;	1209	ofs->config.index = ovl_index_def;
1165	err = ovl_parse_opt((char *) data, &ofs->config);	1210	err = ovl_parse_opt((char *) data, &ofs->config);
1166	if (err)	1211	if (err)

fs/super.c+18−19

 	INIT_LIST_HEAD(&s->s_mounts);
 	s->s_user_ns = get_user_ns(user_ns);
+	init_rwsem(&s->s_umount);
+	lockdep_set_class(&s->s_umount, &type->s_umount_key);
+	/*
+	 * sget() can have s_umount recursion.
+	 *
+	 * When it cannot find a suitable sb, it allocates a new
+	 * one (this one), and tries again to find a suitable old
+	 * one.
+	 *
+	 * In case that succeeds, it will acquire the s_umount
+	 * lock of the old one. Since these are clearly distrinct
+	 * locks, and this object isn't exposed yet, there's no
+	 * risk of deadlocks.
+	 *
+	 * Annotate this by putting this lock in a different
+	 * subclass.
+	 */
+	down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING);
 	if (security_sb_alloc(s))
 		goto fail;
 		goto fail;
 	if (list_lru_init_memcg(&s->s_inode_lru))
 		goto fail;
-	init_rwsem(&s->s_umount);
-	lockdep_set_class(&s->s_umount, &type->s_umount_key);
-	/*
-	 * sget() can have s_umount recursion.
-	 *
-	 * When it cannot find a suitable sb, it allocates a new
-	 * one (this one), and tries again to find a suitable old
-	 * one.
-	 *
-	 * In case that succeeds, it will acquire the s_umount
-	 * lock of the old one. Since these are clearly distrinct
-	 * locks, and this object isn't exposed yet, there's no
-	 * risk of deadlocks.
-	 *
-	 * Annotate this by putting this lock in a different
-	 * subclass.
-	 */
-	down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING);
 	s->s_count = 1;
 	atomic_set(&s->s_active, 1);
 	mutex_init(&s->s_vfs_rename_mutex);

fs/xfs/libxfs/xfs_alloc.c+2−2

@@ -702,7 +702,7 @@ xfs_alloc_ag_vextent( · 701 unmodified lines
702	ASSERT(args->agbno % args->alignment == 0);	702	ASSERT(args->agbno % args->alignment == 0);
703		703
704	/* if not file data, insert new block into the reverse map btree */	704	/* if not file data, insert new block into the reverse map btree */
705	if (args->oinfo.oi_owner != XFS_RMAP_OWN_UNKNOWN) {	705	if (!xfs_rmap_should_skip_owner_update(&args->oinfo)) {
706	error = xfs_rmap_alloc(args->tp, args->agbp, args->agno,	706	error = xfs_rmap_alloc(args->tp, args->agbp, args->agno,
707	args->agbno, args->len, &args->oinfo);	707	args->agbno, args->len, &args->oinfo);
708	if (error)	708	if (error)
@@ -1682,7 +1682,7 @@ xfs_free_ag_extent( · 973 unmodified lines
1682	bno_cur = cnt_cur = NULL;	1682	bno_cur = cnt_cur = NULL;
1683	mp = tp->t_mountp;	1683	mp = tp->t_mountp;
1684		1684
1685	if (oinfo->oi_owner != XFS_RMAP_OWN_UNKNOWN) {	1685	if (!xfs_rmap_should_skip_owner_update(oinfo)) {
1686	error = xfs_rmap_free(tp, agbp, agno, bno, len, oinfo);	1686	error = xfs_rmap_free(tp, agbp, agno, bno, len, oinfo);
1687	if (error)	1687	if (error)
1688	goto error0;	1688	goto error0;

fs/xfs/libxfs/xfs_attr.c+15−5

@@ -212,6 +212,7 @@ xfs_attr_set( · 211 unmodified lines
212	int flags)	212	int flags)
213	{	213	{
214	struct xfs_mount *mp = dp->i_mount;	214	struct xfs_mount *mp = dp->i_mount;
		215	struct xfs_buf *leaf_bp = NULL;
215	struct xfs_da_args args;	216	struct xfs_da_args args;
216	struct xfs_defer_ops dfops;	217	struct xfs_defer_ops dfops;
217	struct xfs_trans_res tres;	218	struct xfs_trans_res tres;
@@ -327,9 +328,16 @@ xfs_attr_set( · 109 unmodified lines
327	* GROT: another possible req'mt for a double-split btree op.	328	* GROT: another possible req'mt for a double-split btree op.
328	*/	329	*/
329	xfs_defer_init(args.dfops, args.firstblock);	330	xfs_defer_init(args.dfops, args.firstblock);
330	error = xfs_attr_shortform_to_leaf(&args);	331	error = xfs_attr_shortform_to_leaf(&args, &leaf_bp);
331	if (error)	332	if (error)
332	goto out_defer_cancel;	333	goto out_defer_cancel;
		334	/*
		335	* Prevent the leaf buffer from being unlocked so that a
		336	* concurrent AIL push cannot grab the half-baked leaf
		337	* buffer and run into problems with the write verifier.
		338	*/
		339	xfs_trans_bhold(args.trans, leaf_bp);
		340	xfs_defer_bjoin(args.dfops, leaf_bp);
333	xfs_defer_ijoin(args.dfops, dp);	341	xfs_defer_ijoin(args.dfops, dp);
334	error = xfs_defer_finish(&args.trans, args.dfops);	342	error = xfs_defer_finish(&args.trans, args.dfops);
335	if (error)	343	if (error)
@@ -337,13 +345,14 @@ xfs_attr_set( · 1 unmodified line
337		345
338	/*	346	/*
339	* Commit the leaf transformation. We'll need another (linked)	347	* Commit the leaf transformation. We'll need another (linked)
340	* transaction to add the new attribute to the leaf.	348	* transaction to add the new attribute to the leaf, which
		349	* means that we have to hold & join the leaf buffer here too.
341	*/	350	*/
342
343	error = xfs_trans_roll_inode(&args.trans, dp);	351	error = xfs_trans_roll_inode(&args.trans, dp);
344	if (error)	352	if (error)
345	goto out;	353	goto out;
346		354	xfs_trans_bjoin(args.trans, leaf_bp);
		355	leaf_bp = NULL;
347	}	356	}
348		357
349	if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))	358	if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
@@ -374,8 +383,9 @@ xfs_attr_set( · 24 unmodified lines
374		383
375	out_defer_cancel:	384	out_defer_cancel:
376	xfs_defer_cancel(&dfops);	385	xfs_defer_cancel(&dfops);
377	args.trans = NULL;
378	out:	386	out:
		387	if (leaf_bp)
		388	xfs_trans_brelse(args.trans, leaf_bp);
379	if (args.trans)	389	if (args.trans)
380	xfs_trans_cancel(args.trans);	390	xfs_trans_cancel(args.trans);
381	xfs_iunlock(dp, XFS_ILOCK_EXCL);	391	xfs_iunlock(dp, XFS_ILOCK_EXCL);

fs/xfs/libxfs/xfs_attr_leaf.c+6−3

@@ -735,10 +735,13 @@ xfs_attr_shortform_getvalue(xfs_da_args_t *args) · 734 unmodified lines
735	}	735	}
736		736
737	/*	737	/*
738	* Convert from using the shortform to the leaf.	738	* Convert from using the shortform to the leaf. On success, return the
		739	* buffer so that we can keep it locked until we're totally done with it.
739	*/	740	*/
740	int	741	int
741	xfs_attr_shortform_to_leaf(xfs_da_args_t *args)	742	xfs_attr_shortform_to_leaf(
		743	struct xfs_da_args *args,
		744	struct xfs_buf **leaf_bp)
742	{	745	{
743	xfs_inode_t *dp;	746	xfs_inode_t *dp;
744	xfs_attr_shortform_t *sf;	747	xfs_attr_shortform_t *sf;
@@ -818,7 +821,7 @@ xfs_attr_shortform_to_leaf(xfs_da_args_t *args) · 73 unmodified lines
818	sfe = XFS_ATTR_SF_NEXTENTRY(sfe);	821	sfe = XFS_ATTR_SF_NEXTENTRY(sfe);
819	}	822	}
820	error = 0;	823	error = 0;
821		824	*leaf_bp = bp;
822	out:	825	out:
823	kmem_free(tmpbuffer);	826	kmem_free(tmpbuffer);
824	return error;	827	return error;

fs/xfs/libxfs/xfs_attr_leaf.h+2−1

 void	xfs_attr_shortform_add(struct xfs_da_args *args, int forkoff);
 int	xfs_attr_shortform_lookup(struct xfs_da_args *args);
 int	xfs_attr_shortform_getvalue(struct xfs_da_args *args);
-int	xfs_attr_shortform_to_leaf(struct xfs_da_args *args);
+int	xfs_attr_shortform_to_leaf(struct xfs_da_args *args,
+			struct xfs_buf **leaf_bp);
 int	xfs_attr_shortform_remove(struct xfs_da_args *args);
 int	xfs_attr_shortform_allfit(struct xfs_buf *bp, struct xfs_inode *dp);
 int	xfs_attr_shortform_bytesfit(struct xfs_inode *dp, int bytes);

fs/xfs/libxfs/xfs_bmap.c+1−1

@@ -5136,7 +5136,7 @@ __xfs_bunmapi( · 5135 unmodified lines
5136	* blowing out the transaction with a mix of EFIs and reflink	5136	* blowing out the transaction with a mix of EFIs and reflink
5137	* adjustments.	5137	* adjustments.
5138	*/	5138	*/
5139	if (xfs_is_reflink_inode(ip) && whichfork == XFS_DATA_FORK)	5139	if (tp && xfs_is_reflink_inode(ip) && whichfork == XFS_DATA_FORK)
5140	max_len = min(len, xfs_refcount_max_unmap(tp->t_log_res));	5140	max_len = min(len, xfs_refcount_max_unmap(tp->t_log_res));
5141	else	5141	else
5142	max_len = len;	5142	max_len = len;

fs/xfs/libxfs/xfs_defer.c+36−3

@@ -249,6 +249,10 @@ xfs_defer_trans_roll( · 248 unmodified lines
249	for (i = 0; i < XFS_DEFER_OPS_NR_INODES && dop->dop_inodes[i]; i++)	249	for (i = 0; i < XFS_DEFER_OPS_NR_INODES && dop->dop_inodes[i]; i++)
250	xfs_trans_log_inode(*tp, dop->dop_inodes[i], XFS_ILOG_CORE);	250	xfs_trans_log_inode(*tp, dop->dop_inodes[i], XFS_ILOG_CORE);
251		251
		252	/* Hold the (previously bjoin'd) buffer locked across the roll. */
		253	for (i = 0; i < XFS_DEFER_OPS_NR_BUFS && dop->dop_bufs[i]; i++)
		254	xfs_trans_dirty_buf(*tp, dop->dop_bufs[i]);
		255
252	trace_xfs_defer_trans_roll((*tp)->t_mountp, dop);	256	trace_xfs_defer_trans_roll((*tp)->t_mountp, dop);
253		257
254	/* Roll the transaction. */	258	/* Roll the transaction. */
@@ -264,6 +268,12 @@ xfs_defer_trans_roll( · 9 unmodified lines
264	for (i = 0; i < XFS_DEFER_OPS_NR_INODES && dop->dop_inodes[i]; i++)	268	for (i = 0; i < XFS_DEFER_OPS_NR_INODES && dop->dop_inodes[i]; i++)
265	xfs_trans_ijoin(*tp, dop->dop_inodes[i], 0);	269	xfs_trans_ijoin(*tp, dop->dop_inodes[i], 0);
266		270
		271	/* Rejoin the buffers and dirty them so the log moves forward. */
		272	for (i = 0; i < XFS_DEFER_OPS_NR_BUFS && dop->dop_bufs[i]; i++) {
		273	xfs_trans_bjoin(*tp, dop->dop_bufs[i]);
		274	xfs_trans_bhold(*tp, dop->dop_bufs[i]);
		275	}
		276
267	return error;	277	return error;
268	}	278	}
269		279
@@ -295,6 +305,31 @@ xfs_defer_ijoin( · 25 unmodified lines
295	}	305	}
296	}	306	}
297		307
		308	ASSERT(0);
		309	return -EFSCORRUPTED;
		310	}
		311
		312	/*
		313	* Add this buffer to the deferred op. Each joined buffer is relogged
		314	* each time we roll the transaction.
		315	*/
		316	int
		317	xfs_defer_bjoin(
		318	struct xfs_defer_ops *dop,
		319	struct xfs_buf *bp)
		320	{
		321	int i;
		322
		323	for (i = 0; i < XFS_DEFER_OPS_NR_BUFS; i++) {
		324	if (dop->dop_bufs[i] == bp)
		325	return 0;
		326	else if (dop->dop_bufs[i] == NULL) {
		327	dop->dop_bufs[i] = bp;
		328	return 0;
		329	}
		330	}
		331
		332	ASSERT(0);
298	return -EFSCORRUPTED;	333	return -EFSCORRUPTED;
299	}	334	}
300		335
@@ -493,9 +528,7 @@ xfs_defer_init( · 192 unmodified lines
493	struct xfs_defer_ops *dop,	528	struct xfs_defer_ops *dop,
494	xfs_fsblock_t *fbp)	529	xfs_fsblock_t *fbp)
495	{	530	{
496	dop->dop_committed = false;	531	memset(dop, 0, sizeof(struct xfs_defer_ops));
497	dop->dop_low = false;
498	memset(&dop->dop_inodes, 0, sizeof(dop->dop_inodes));
499	*fbp = NULLFSBLOCK;	532	*fbp = NULLFSBLOCK;
500	INIT_LIST_HEAD(&dop->dop_intake);	533	INIT_LIST_HEAD(&dop->dop_intake);
501	INIT_LIST_HEAD(&dop->dop_pending);	534	INIT_LIST_HEAD(&dop->dop_pending);

fs/xfs/libxfs/xfs_defer.h+4−1

 };
 #define XFS_DEFER_OPS_NR_INODES	2	/* join up to two inodes */
+#define XFS_DEFER_OPS_NR_BUFS	2	/* join up to two buffers */
 struct xfs_defer_ops {
 	bool			dop_committed;	/* did any trans commit? */
 	struct list_head	dop_intake;	/* unlogged pending work */
 	struct list_head	dop_pending;	/* logged pending work */
-	/* relog these inodes with each roll */
+	/* relog these with each roll */
 	struct xfs_inode	*dop_inodes[XFS_DEFER_OPS_NR_INODES];
+	struct xfs_buf		*dop_bufs[XFS_DEFER_OPS_NR_BUFS];

11 more lines aren’t shown here.

fs/xfs/libxfs/xfs_ialloc.c+3−7

This diff is large: its 45 lines aren’t shown here.

fs/xfs/libxfs/xfs_ialloc.h+0−1

This diff is large: its 8 lines aren’t shown here.

fs/xfs/libxfs/xfs_iext_tree.c+2−2

This diff is large: its 18 lines aren’t shown here.

fs/xfs/libxfs/xfs_refcount.c+19−33

This diff is large: its 97 lines aren’t shown here.

fs/xfs/libxfs/xfs_rmap.c+76−23

This diff is large: its 124 lines aren’t shown here.

fs/xfs/libxfs/xfs_rmap.h+15−1

This diff is large: its 23 lines aren’t shown here.

fs/xfs/scrub/scrub.c+0−1

This diff is large: its 8 lines aren’t shown here.

fs/xfs/scrub/trace.c+0−1

This diff is large: its 8 lines aren’t shown here.

fs/xfs/xfs_extfree_item.c+1−1

This diff is large: its 9 lines aren’t shown here.

fs/xfs/xfs_fsops.c+5−0

This diff is large: its 12 lines aren’t shown here.

fs/xfs/xfs_icache.c+25−10

This diff is large: its 98 lines aren’t shown here.

fs/xfs/xfs_icache.h+1−0

This diff is large: its 8 lines aren’t shown here.

fs/xfs/xfs_inode.c+26−35

This diff is large: its 143 lines aren’t shown here.

fs/xfs/xfs_inode.h+2−1

This diff is large: its 17 lines aren’t shown here.

fs/xfs/xfs_iomap.c+1−1

This diff is large: its 9 lines aren’t shown here.

fs/xfs/xfs_qm.c+2−2

This diff is large: its 11 lines aren’t shown here.

fs/xfs/xfs_reflink.c+19−4

This diff is large: its 66 lines aren’t shown here.

fs/xfs/xfs_super.c+9−0

This diff is large: its 23 lines aren’t shown here.

fs/xfs/xfs_symlink.c+1−14

This diff is large: its 36 lines aren’t shown here.

fs/xfs/xfs_trace.c+0−1

This diff is large: its 8 lines aren’t shown here.

include/asm-generic/mm_hooks.h+3−2

This diff is large: its 13 lines aren’t shown here.

include/asm-generic/pgtable.h+5−0

This diff is large: its 12 lines aren’t shown here.

include/crypto/internal/hash.h+8−0

This diff is large: its 15 lines aren’t shown here.

include/crypto/mcryptd.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/drm/drm_connector.h+6−4

This diff is large: its 26 lines aren’t shown here.

include/drm/drm_edid.h+2−0

This diff is large: its 9 lines aren’t shown here.

include/drm/drm_mode_config.h+17−1

This diff is large: its 39 lines aren’t shown here.

include/kvm/arm_arch_timer.h+1−1

This diff is large: its 9 lines aren’t shown here.

include/linux/bio.h+2−0

This diff is large: its 9 lines aren’t shown here.

include/linux/blk_types.h+4−5

This diff is large: its 31 lines aren’t shown here.

include/linux/blkdev.h+21−4

This diff is large: its 59 lines aren’t shown here.

include/linux/bpf_verifier.h+2−2

This diff is large: its 14 lines aren’t shown here.

include/linux/compiler.h+11−36

This diff is large: its 63 lines aren’t shown here.

include/linux/completion.h+0−45

This diff is large: its 69 lines aren’t shown here.

include/linux/cpuhotplug.h+1−1

This diff is large: its 9 lines aren’t shown here.

include/linux/cred.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/linux/gpio/driver.h+21−12

This diff is large: its 97 lines aren’t shown here.

include/linux/idr.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/linux/intel-pti.h+43−0

This diff is large: its 44 lines aren’t shown here.

include/linux/ipv6.h+2−1

This diff is large: its 10 lines aren’t shown here.

include/linux/irq.h+17−0

This diff is large: its 38 lines aren’t shown here.

include/linux/irqdesc.h+6−3

This diff is large: its 19 lines aren’t shown here.

include/linux/irqdomain.h+1−1

This diff is large: its 9 lines aren’t shown here.

include/linux/lockdep.h+0−125

This diff is large: its 155 lines aren’t shown here.

include/linux/mfd/rtsx_pci.h+1−1

This diff is large: its 12 lines aren’t shown here.

include/linux/mlx5/driver.h+6−1

This diff is large: its 28 lines aren’t shown here.

include/linux/mlx5/mlx5_ifc.h+5−3

This diff is large: its 36 lines aren’t shown here.

include/linux/oom.h+9−0

This diff is large: its 16 lines aren’t shown here.

include/linux/pci.h+3−0

This diff is large: its 10 lines aren’t shown here.

include/linux/pm.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/linux/pti.h+9−41

This diff is large: its 53 lines aren’t shown here.

include/linux/ptr_ring.h+9−0

This diff is large: its 29 lines aren’t shown here.

include/linux/rbtree.h+2−0

This diff is large: its 9 lines aren’t shown here.

include/linux/rwlock_types.h+0−3

This diff is large: its 10 lines aren’t shown here.

include/linux/sched.h+5−12

This diff is large: its 31 lines aren’t shown here.

include/linux/sched/coredump.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/linux/spi/spi.h+1−1

This diff is large: its 9 lines aren’t shown here.

include/linux/spinlock.h+0−5

This diff is large: its 17 lines aren’t shown here.

include/linux/spinlock_types.h+0−3

This diff is large: its 10 lines aren’t shown here.

include/linux/string.h+4−1

This diff is large: its 12 lines aren’t shown here.

include/linux/tick.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/linux/timer.h+3−1

This diff is large: its 13 lines aren’t shown here.

include/linux/trace.h+1−1

This diff is large: its 9 lines aren’t shown here.

include/net/cfg80211.h+0−1

This diff is large: its 8 lines aren’t shown here.

include/net/gue.h+9−9

This diff is large: its 45 lines aren’t shown here.

include/net/ip.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/net/pkt_cls.h+2−3

This diff is large: its 19 lines aren’t shown here.

include/net/sch_generic.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/net/sock.h+5−0

This diff is large: its 12 lines aren’t shown here.

include/net/xfrm.h+3−0

This diff is large: its 10 lines aren’t shown here.

include/trace/events/clk.h+2−2

This diff is large: its 15 lines aren’t shown here.

include/trace/events/kvm.h+5−2

This diff is large: its 21 lines aren’t shown here.

include/trace/events/preemptirq.h+7−4

This diff is large: its 23 lines aren’t shown here.

include/trace/events/tcp.h+37−60

This diff is large: its 160 lines aren’t shown here.

include/uapi/linux/pkt_sched.h+0−1

This diff is large: its 8 lines aren’t shown here.

include/uapi/linux/rtnetlink.h+1−0

This diff is large: its 8 lines aren’t shown here.

include/xen/balloon.h+5−0

This diff is large: its 9 lines aren’t shown here.

init/Kconfig+5−1

This diff is large: its 16 lines aren’t shown here.

init/main.c+11−5

This diff is large: its 51 lines aren’t shown here.

kernel/bpf/hashtab.c+2−0

This diff is large: its 16 lines aren’t shown here.

kernel/bpf/verifier.c+166−117

This diff is large: its 482 lines aren’t shown here.

kernel/cgroup/debug.c+2−2

This diff is large: its 18 lines aren’t shown here.

kernel/cgroup/stat.c+6−2

This diff is large: its 15 lines aren’t shown here.

kernel/cpu.c+6−6

This diff is large: its 36 lines aren’t shown here.

kernel/exit.c+8−0

This diff is large: its 12 lines aren’t shown here.

kernel/fork.c+1−2

This diff is large: its 10 lines aren’t shown here.

kernel/groups.c+3−2

This diff is large: its 30 lines aren’t shown here.

kernel/irq/debug.h+5−0

This diff is large: its 12 lines aren’t shown here.

kernel/irq/debugfs.c+1−0

This diff is large: its 8 lines aren’t shown here.

kernel/irq/generic-chip.c+7−4

This diff is large: its 34 lines aren’t shown here.

kernel/irq/internals.h+1−1

This diff is large: its 9 lines aren’t shown here.

kernel/irq/irqdomain.c+7−6

This diff is large: its 43 lines aren’t shown here.

kernel/irq/msi.c+56−8

This diff is large: its 96 lines aren’t shown here.

kernel/kcov.c+2−2

This diff is large: its 18 lines aren’t shown here.

kernel/locking/lockdep.c+35−617

This diff is large: its 760 lines aren’t shown here.

kernel/locking/spinlock.c+3−10

This diff is large: its 29 lines aren’t shown here.

kernel/sched/core.c+11−11

This diff is large: its 36 lines aren’t shown here.

kernel/sched/cpufreq_schedutil.c+1−1

This diff is large: its 9 lines aren’t shown here.

kernel/sched/rt.c+7−1

This diff is large: its 23 lines aren’t shown here.

kernel/time/Kconfig+1−0

This diff is large: its 8 lines aren’t shown here.

kernel/time/posix-timers.c+17−12

This diff is large: its 51 lines aren’t shown here.

kernel/time/tick-sched.c+30−2

This diff is large: its 53 lines aren’t shown here.

kernel/time/timer.c+24−11

This diff is large: its 79 lines aren’t shown here.

kernel/trace/Kconfig+1−0

This diff is large: its 8 lines aren’t shown here.

kernel/trace/bpf_trace.c+12−7

This diff is large: its 71 lines aren’t shown here.

kernel/trace/ring_buffer.c+11−7

This diff is large: its 55 lines aren’t shown here.

kernel/trace/trace.c+19−35

This diff is large: its 155 lines aren’t shown here.

kernel/trace/trace_stack.c+4−0

This diff is large: its 11 lines aren’t shown here.

kernel/uid16.c+1−0

This diff is large: its 8 lines aren’t shown here.

kernel/workqueue.c+12−21

This diff is large: its 100 lines aren’t shown here.

lib/Kconfig.debug+0−33

This diff is large: its 47 lines aren’t shown here.

lib/kobject_uevent.c+12−4

This diff is large: its 32 lines aren’t shown here.

lib/rbtree.c+10−0

This diff is large: its 17 lines aren’t shown here.

lib/test_bpf.c+43−0

This diff is large: its 57 lines aren’t shown here.

lib/timerqueue.c+5−3

This diff is large: its 22 lines aren’t shown here.

mm/backing-dev.c+1−4

This diff is large: its 15 lines aren’t shown here.

mm/early_ioremap.c+1−1

This diff is large: its 9 lines aren’t shown here.

mm/frame_vector.c+4−2

This diff is large: its 13 lines aren’t shown here.

mm/gup.c+1−1

This diff is large: its 9 lines aren’t shown here.

mm/hmm.c+4−4

This diff is large: its 28 lines aren’t shown here.

mm/huge_memory.c+3−3

This diff is large: its 27 lines aren’t shown here.

mm/kmemleak.c+1−1

This diff is large: its 9 lines aren’t shown here.

mm/memory.c+6−5

This diff is large: its 46 lines aren’t shown here.

mm/mmap.c+5−5

This diff is large: its 26 lines aren’t shown here.

mm/oom_kill.c+3−1

This diff is large: its 12 lines aren’t shown here.

mm/page_alloc.c+11−0

This diff is large: its 25 lines aren’t shown here.

mm/percpu.c+4−0

This diff is large: its 12 lines aren’t shown here.

mm/slab.c+10−13

This diff is large: its 84 lines aren’t shown here.

net/batman-adv/bat_iv_ogm.c+2−2

This diff is large: its 18 lines aren’t shown here.

net/batman-adv/bat_v.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/batman-adv/fragmentation.c+2−0

This diff is large: its 9 lines aren’t shown here.

net/batman-adv/tp_meter.c+2−2

This diff is large: its 18 lines aren’t shown here.

net/bridge/br_netlink.c+6−5

This diff is large: its 26 lines aren’t shown here.

net/core/dev.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/core/net_namespace.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/core/netprio_cgroup.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/core/skbuff.c+11−6

This diff is large: its 63 lines aren’t shown here.

net/dsa/slave.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/ipv4/devinet.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/ipv4/fib_frontend.c+7−2

This diff is large: its 22 lines aren’t shown here.

net/ipv4/fib_semantics.c+6−2

This diff is large: its 22 lines aren’t shown here.

net/ipv4/igmp.c+34−10

This diff is large: its 115 lines aren’t shown here.

net/ipv4/ip_gre.c+2−1

This diff is large: its 17 lines aren’t shown here.

net/ipv4/ip_tunnel.c+2−2

This diff is large: its 11 lines aren’t shown here.

net/ipv4/netfilter/arp_tables.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/ipv4/netfilter/ip_tables.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/ipv4/netfilter/ipt_CLUSTERIP.c+2−1

This diff is large: its 15 lines aren’t shown here.

net/ipv4/raw.c+10−5

This diff is large: its 51 lines aren’t shown here.

net/ipv4/tcp_input.c+6−4

This diff is large: its 32 lines aren’t shown here.

net/ipv4/tcp_ipv4.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/ipv4/tcp_timer.c+2−0

This diff is large: its 16 lines aren’t shown here.

net/ipv4/xfrm4_input.c+11−1

This diff is large: its 26 lines aren’t shown here.

net/ipv6/af_inet6.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/ipv6/ip6_gre.c+33−25

This diff is large: its 91 lines aren’t shown here.

net/ipv6/ip6_output.c+10−2

This diff is large: its 33 lines aren’t shown here.

net/ipv6/ip6_tunnel.c+7−2

This diff is large: its 16 lines aren’t shown here.

net/ipv6/ipv6_sockglue.c+1−0

This diff is large: its 8 lines aren’t shown here.

net/ipv6/mcast.c+15−10

This diff is large: its 72 lines aren’t shown here.

net/ipv6/netfilter/ip6_tables.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/ipv6/netfilter/ip6t_MASQUERADE.c+7−1

This diff is large: its 21 lines aren’t shown here.

net/ipv6/route.c+12−8

This diff is large: its 46 lines aren’t shown here.

net/ipv6/tcp_ipv6.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/ipv6/xfrm6_input.c+9−1

This diff is large: its 24 lines aren’t shown here.

net/mac80211/ht.c+2−3

This diff is large: its 19 lines aren’t shown here.

net/netfilter/nf_conntrack_h323_asn1.c+98−30

This diff is large: its 353 lines aren’t shown here.

net/netfilter/nf_conntrack_netlink.c+9−4

This diff is large: its 42 lines aren’t shown here.

net/netfilter/nf_conntrack_proto_tcp.c+3−0

This diff is large: its 10 lines aren’t shown here.

net/netfilter/nf_tables_api.c+7−0

This diff is large: its 21 lines aren’t shown here.

net/netfilter/nfnetlink_cthelper.c+10−0

This diff is large: its 38 lines aren’t shown here.

net/netfilter/nfnetlink_log.c+5−0

This diff is large: its 16 lines aren’t shown here.

net/netfilter/nfnetlink_queue.c+5−0

This diff is large: its 16 lines aren’t shown here.

net/netfilter/nft_exthdr.c+2−0

This diff is large: its 9 lines aren’t shown here.

net/netfilter/x_tables.c+9−0

This diff is large: its 18 lines aren’t shown here.

net/netfilter/xt_bpf.c+6−0

This diff is large: its 20 lines aren’t shown here.

net/netfilter/xt_osf.c+7−0

This diff is large: its 28 lines aren’t shown here.

net/netlink/af_netlink.c+3−0

This diff is large: its 10 lines aren’t shown here.

net/openvswitch/flow.c+12−3

This diff is large: its 35 lines aren’t shown here.

net/rds/send.c+3−0

This diff is large: its 10 lines aren’t shown here.

net/sched/act_meta_mark.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/sched/act_meta_skbtcindex.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/sched/cls_api.c+2−1

This diff is large: its 17 lines aren’t shown here.

net/sched/cls_bpf.c+38−55

This diff is large: its 145 lines aren’t shown here.

net/sched/cls_u32.c+0−1

This diff is large: its 8 lines aren’t shown here.

net/sched/sch_api.c+2−0

This diff is large: its 9 lines aren’t shown here.

net/sched/sch_generic.c+3−1

This diff is large: its 18 lines aren’t shown here.

net/sched/sch_ingress.c+6−9

This diff is large: its 47 lines aren’t shown here.

net/sched/sch_red.c+15−16

This diff is large: its 76 lines aren’t shown here.

net/sctp/debug.c+3−0

This diff is large: its 10 lines aren’t shown here.

net/sctp/socket.c+7−3

This diff is large: its 37 lines aren’t shown here.

net/sctp/ulpqueue.c+8−16

This diff is large: its 38 lines aren’t shown here.

net/strparser/strparser.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/sunrpc/auth_gss/gss_rpc_xdr.c+1−0

This diff is large: its 8 lines aren’t shown here.

net/sunrpc/auth_gss/svcauth_gss.c+1−0

This diff is large: its 8 lines aren’t shown here.

net/sunrpc/svcauth_unix.c+2−0

This diff is large: its 16 lines aren’t shown here.

net/sunrpc/xprt.c+19−9

This diff is large: its 54 lines aren’t shown here.

net/sunrpc/xprtrdma/rpc_rdma.c+1−5

This diff is large: its 13 lines aren’t shown here.

net/sunrpc/xprtrdma/transport.c+2−0

This diff is large: its 16 lines aren’t shown here.

net/sunrpc/xprtrdma/verbs.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/sunrpc/xprtrdma/xprt_rdma.h+1−0

This diff is large: its 8 lines aren’t shown here.

net/tipc/bearer.c+4−1

This diff is large: its 20 lines aren’t shown here.

net/tipc/group.c+29−18

This diff is large: its 109 lines aren’t shown here.

net/tipc/monitor.c+5−1

This diff is large: its 15 lines aren’t shown here.

net/tipc/socket.c+2−2

This diff is large: its 22 lines aren’t shown here.

net/wireless/Makefile+28−11

This diff is large: its 48 lines aren’t shown here.

net/wireless/certs/sforshee.hex+86−0

This diff is large: its 87 lines aren’t shown here.

net/wireless/certs/sforshee.x509+0−0

Binary file not shown.

net/wireless/nl80211.c+4−2

This diff is large: its 27 lines aren’t shown here.

net/xfrm/xfrm_input.c+68−1

This diff is large: its 121 lines aren’t shown here.

net/xfrm/xfrm_policy.c+8−1

This diff is large: its 25 lines aren’t shown here.

net/xfrm/xfrm_state.c+1−0

This diff is large: its 8 lines aren’t shown here.

net/xfrm/xfrm_user.c+25−1

This diff is large: its 59 lines aren’t shown here.

scripts/checkpatch.pl+0−22

This diff is large: its 29 lines aren’t shown here.

scripts/faddr2line+4−4

This diff is large: its 15 lines aren’t shown here.

security/Kconfig+10−0

This diff is large: its 17 lines aren’t shown here.

sound/core/rawmidi.c+12−3

This diff is large: its 35 lines aren’t shown here.

sound/hda/hdac_i915.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/pci/hda/patch_conexant.c+29−0

This diff is large: its 57 lines aren’t shown here.

sound/pci/hda/patch_hdmi.c+4−2

This diff is large: its 22 lines aren’t shown here.

sound/pci/hda/patch_realtek.c+45−4

This diff is large: its 108 lines aren’t shown here.

sound/soc/amd/acp-pcm-dma.c+7−0

This diff is large: its 21 lines aren’t shown here.

sound/soc/atmel/Kconfig+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/codecs/da7218.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/codecs/msm8916-wcd-analog.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/codecs/msm8916-wcd-digital.c+2−2

This diff is large: its 18 lines aren’t shown here.

sound/soc/codecs/nau8825.c+1−0

This diff is large: its 8 lines aren’t shown here.

sound/soc/codecs/rt5514-spi.c+9−6

This diff is large: its 36 lines aren’t shown here.

sound/soc/codecs/rt5514.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/codecs/rt5645.c+2−0

This diff is large: its 9 lines aren’t shown here.

sound/soc/codecs/rt5663.c+4−0

This diff is large: its 11 lines aren’t shown here.

sound/soc/codecs/rt5663.h+4−0

This diff is large: its 11 lines aren’t shown here.

sound/soc/codecs/tlv320aic31xx.h+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/codecs/twl4030.c+3−1

This diff is large: its 21 lines aren’t shown here.

sound/soc/codecs/wm_adsp.c+6−6

This diff is large: its 40 lines aren’t shown here.

sound/soc/fsl/fsl_asrc.h+2−2

This diff is large: its 11 lines aren’t shown here.

sound/soc/fsl/fsl_ssi.c+34−10

This diff is large: its 127 lines aren’t shown here.

sound/soc/intel/boards/kbl_rt5663_max98927.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/intel/skylake/skl-nhlt.c+10−5

This diff is large: its 22 lines aren’t shown here.

sound/soc/intel/skylake/skl-topology.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/rockchip/rockchip_spdif.c+13−5

This diff is large: its 47 lines aren’t shown here.

sound/soc/sh/rcar/adg.c+3−3

This diff is large: its 27 lines aren’t shown here.

sound/soc/sh/rcar/core.c+2−2

This diff is large: its 11 lines aren’t shown here.

sound/soc/sh/rcar/dma.c+6−80

This diff is large: its 145 lines aren’t shown here.

sound/soc/sh/rcar/ssi.c+10−6

This diff is large: its 44 lines aren’t shown here.

sound/soc/sh/rcar/ssiu.c+4−1

This diff is large: its 21 lines aren’t shown here.

sound/usb/mixer.c+16−11

This diff is large: its 37 lines aren’t shown here.

sound/usb/quirks.c+4−3

This diff is large: its 31 lines aren’t shown here.

tools/arch/s390/include/uapi/asm/bpf_perf_event.h+1−1

This diff is large: its 9 lines aren’t shown here.

tools/arch/s390/include/uapi/asm/perf_regs.h+44−0

This diff is large: its 45 lines aren’t shown here.

tools/arch/x86/include/asm/cpufeatures.h+1−0

This diff is large: its 8 lines aren’t shown here.

tools/bpf/bpftool/map.c+5−3

This diff is large: its 27 lines aren’t shown here.

tools/bpf/bpftool/prog.c+2−0

This diff is large: its 9 lines aren’t shown here.

tools/include/linux/compiler.h+9−12

This diff is large: its 39 lines aren’t shown here.

tools/include/linux/lockdep.h+1−0

This diff is large: its 8 lines aren’t shown here.

tools/include/uapi/asm/bpf_perf_event.h+7−0

This diff is large: its 8 lines aren’t shown here.

tools/include/uapi/linux/kvm.h+2−2

This diff is large: its 12 lines aren’t shown here.

tools/kvm/kvm_stat/kvm_stat+43−31

This diff is large: its 168 lines aren’t shown here.

tools/kvm/kvm_stat/kvm_stat.txt+3−1

This diff is large: its 18 lines aren’t shown here.

tools/objtool/arch/x86/decode.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/objtool/arch/x86/lib/x86-opcode-map.txt+12−3

This diff is large: its 43 lines aren’t shown here.

tools/objtool/builtin-orc.c+3−1

This diff is large: its 18 lines aren’t shown here.

tools/objtool/orc_gen.c+2−0

This diff is large: its 9 lines aren’t shown here.

tools/perf/Makefile.config+4−5

This diff is large: its 29 lines aren’t shown here.

tools/perf/arch/s390/include/perf_regs.h+1−1

This diff is large: its 9 lines aren’t shown here.

tools/perf/check-headers.sh+1−0

This diff is large: its 8 lines aren’t shown here.

tools/perf/jvmti/jvmti_agent.c+9−7

This diff is large: its 47 lines aren’t shown here.

tools/perf/jvmti/jvmti_agent.h+3−4

This diff is large: its 22 lines aren’t shown here.

tools/perf/jvmti/libjvmti.c+122−25

This diff is large: its 201 lines aren’t shown here.

tools/perf/util/intel-pt-decoder/x86-opcode-map.txt+11−2

This diff is large: its 34 lines aren’t shown here.

tools/perf/util/mmap.h+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/bpf/Makefile+3−14

This diff is large: its 40 lines aren’t shown here.

tools/testing/selftests/bpf/test_progs.c+4−4

This diff is large: its 36 lines aren’t shown here.

tools/testing/selftests/bpf/test_verifier.c+586−43

This diff is large: its 863 lines aren’t shown here.

tools/testing/selftests/net/config+1−0

This diff is large: its 5 lines aren’t shown here.

tools/testing/selftests/x86/ldt_gdt.c+4−8

This diff is large: its 27 lines aren’t shown here.

tools/usb/usbip/libsrc/vhci_driver.c+5−5

This diff is large: its 36 lines aren’t shown here.

tools/usb/usbip/src/utils.c+6−3

This diff is large: its 26 lines aren’t shown here.

tools/virtio/ringtest/ptr_ring.c+23−6

This diff is large: its 48 lines aren’t shown here.

tools/vm/slabinfo-gnuplot.sh+1−1

This diff is large: its 6 lines aren’t shown here.

virt/kvm/arm/arch_timer.c+24−16

This diff is large: its 78 lines aren’t shown here.

virt/kvm/arm/arm.c+1−1

This diff is large: its 9 lines aren’t shown here.

virt/kvm/arm/mmio.c+3−3

This diff is large: its 26 lines aren’t shown here.

virt/kvm/arm/mmu.c+4−6

This diff is large: its 24 lines aren’t shown here.

@@ -197,11 +197,12 @@ · 196 unmodified lines
197	#define X86_FEATURE_CAT_L3 ( 732+ 4) / Cache Allocation Technology L3 */	197	#define X86_FEATURE_CAT_L3 ( 732+ 4) / Cache Allocation Technology L3 */
198	#define X86_FEATURE_CAT_L2 ( 732+ 5) / Cache Allocation Technology L2 */	198	#define X86_FEATURE_CAT_L2 ( 732+ 5) / Cache Allocation Technology L2 */
199	#define X86_FEATURE_CDP_L3 ( 732+ 6) / Code and Data Prioritization L3 */	199	#define X86_FEATURE_CDP_L3 ( 732+ 6) / Code and Data Prioritization L3 */
		200	#define X86_FEATURE_INVPCID_SINGLE ( 732+ 7) / Effectively INVPCID && CR4.PCIDE=1 */
200		201
201	#define X86_FEATURE_HW_PSTATE ( 732+ 8) / AMD HW-PState */	202	#define X86_FEATURE_HW_PSTATE ( 732+ 8) / AMD HW-PState */
202	#define X86_FEATURE_PROC_FEEDBACK ( 732+ 9) / AMD ProcFeedbackInterface */	203	#define X86_FEATURE_PROC_FEEDBACK ( 732+ 9) / AMD ProcFeedbackInterface */
203	#define X86_FEATURE_SME ( 732+10) / AMD Secure Memory Encryption */	204	#define X86_FEATURE_SME ( 732+10) / AMD Secure Memory Encryption */
204		205	#define X86_FEATURE_PTI ( 732+11) / Kernel Page Table Isolation enabled */
205	#define X86_FEATURE_INTEL_PPIN ( 732+14) / Intel Processor Inventory Number */	206	#define X86_FEATURE_INTEL_PPIN ( 732+14) / Intel Processor Inventory Number */
206	#define X86_FEATURE_INTEL_PT ( 732+15) / Intel Processor Trace */	207	#define X86_FEATURE_INTEL_PT ( 732+15) / Intel Processor Trace */
207	#define X86_FEATURE_AVX512_4VNNIW ( 732+16) / AVX-512 Neural Network Instructions */	208	#define X86_FEATURE_AVX512_4VNNIW ( 732+16) / AVX-512 Neural Network Instructions */
@@ -340,5 +341,6 @@ · 132 unmodified lines
340	#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */	341	#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */
341	#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */	342	#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */
342	#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */	343	#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */
		344	#define X86_BUG_CPU_INSECURE X86_BUG(14) /* CPU is insecure and needs kernel page table isolation */
343		345
344	#endif /* _ASM_X86_CPUFEATURES_H */	346	#endif /* _ASM_X86_CPUFEATURES_H */

@@ -3395,7 +3395,7 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu) · 3394 unmodified lines
3395	spin_lock(&vcpu->kvm->mmu_lock);	3395	spin_lock(&vcpu->kvm->mmu_lock);
3396	if(make_mmu_pages_available(vcpu) < 0) {	3396	if(make_mmu_pages_available(vcpu) < 0) {
3397	spin_unlock(&vcpu->kvm->mmu_lock);	3397	spin_unlock(&vcpu->kvm->mmu_lock);
3398	return 1;	3398	return -ENOSPC;
3399	}	3399	}
3400	sp = kvm_mmu_get_page(vcpu, 0, 0,	3400	sp = kvm_mmu_get_page(vcpu, 0, 0,
3401	vcpu->arch.mmu.shadow_root_level, 1, ACC_ALL);	3401	vcpu->arch.mmu.shadow_root_level, 1, ACC_ALL);
@@ -3410,7 +3410,7 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu) · 8 unmodified lines
3410	spin_lock(&vcpu->kvm->mmu_lock);	3410	spin_lock(&vcpu->kvm->mmu_lock);
3411	if (make_mmu_pages_available(vcpu) < 0) {	3411	if (make_mmu_pages_available(vcpu) < 0) {
3412	spin_unlock(&vcpu->kvm->mmu_lock);	3412	spin_unlock(&vcpu->kvm->mmu_lock);
3413	return 1;	3413	return -ENOSPC;
3414	}	3414	}
3415	sp = kvm_mmu_get_page(vcpu, i << (30 - PAGE_SHIFT),	3415	sp = kvm_mmu_get_page(vcpu, i << (30 - PAGE_SHIFT),
3416	i << 30, PT32_ROOT_LEVEL, 1, ACC_ALL);	3416	i << 30, PT32_ROOT_LEVEL, 1, ACC_ALL);
@@ -3450,7 +3450,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) · 33 unmodified lines
3450	spin_lock(&vcpu->kvm->mmu_lock);	3450	spin_lock(&vcpu->kvm->mmu_lock);
3451	if (make_mmu_pages_available(vcpu) < 0) {	3451	if (make_mmu_pages_available(vcpu) < 0) {
3452	spin_unlock(&vcpu->kvm->mmu_lock);	3452	spin_unlock(&vcpu->kvm->mmu_lock);
3453	return 1;	3453	return -ENOSPC;
3454	}	3454	}
3455	sp = kvm_mmu_get_page(vcpu, root_gfn, 0,	3455	sp = kvm_mmu_get_page(vcpu, root_gfn, 0,
3456	vcpu->arch.mmu.shadow_root_level, 0, ACC_ALL);	3456	vcpu->arch.mmu.shadow_root_level, 0, ACC_ALL);
@@ -3487,7 +3487,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) · 30 unmodified lines
3487	spin_lock(&vcpu->kvm->mmu_lock);	3487	spin_lock(&vcpu->kvm->mmu_lock);
3488	if (make_mmu_pages_available(vcpu) < 0) {	3488	if (make_mmu_pages_available(vcpu) < 0) {
3489	spin_unlock(&vcpu->kvm->mmu_lock);	3489	spin_unlock(&vcpu->kvm->mmu_lock);
3490	return 1;	3490	return -ENOSPC;
3491	}	3491	}
3492	sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL,	3492	sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL,
3493	0, ACC_ALL);	3493	0, ACC_ALL);

@@ -362,7 +362,7 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op, · 361 unmodified lines
362	case MLX5_CMD_OP_QUERY_VPORT_COUNTER:	362	case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
363	case MLX5_CMD_OP_ALLOC_Q_COUNTER:	363	case MLX5_CMD_OP_ALLOC_Q_COUNTER:
364	case MLX5_CMD_OP_QUERY_Q_COUNTER:	364	case MLX5_CMD_OP_QUERY_Q_COUNTER:
365	case MLX5_CMD_OP_SET_RATE_LIMIT:	365	case MLX5_CMD_OP_SET_PP_RATE_LIMIT:
366	case MLX5_CMD_OP_QUERY_RATE_LIMIT:	366	case MLX5_CMD_OP_QUERY_RATE_LIMIT:
367	case MLX5_CMD_OP_CREATE_SCHEDULING_ELEMENT:	367	case MLX5_CMD_OP_CREATE_SCHEDULING_ELEMENT:
368	case MLX5_CMD_OP_QUERY_SCHEDULING_ELEMENT:	368	case MLX5_CMD_OP_QUERY_SCHEDULING_ELEMENT:
@@ -505,7 +505,7 @@ const char *mlx5_command_str(int command) · 136 unmodified lines
505	MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);	505	MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
506	MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);	506	MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
507	MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);	507	MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
508	MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);	508	MLX5_COMMAND_STR_CASE(SET_PP_RATE_LIMIT);
509	MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);	509	MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
510	MLX5_COMMAND_STR_CASE(CREATE_SCHEDULING_ELEMENT);	510	MLX5_COMMAND_STR_CASE(CREATE_SCHEDULING_ELEMENT);
511	MLX5_COMMAND_STR_CASE(DESTROY_SCHEDULING_ELEMENT);	511	MLX5_COMMAND_STR_CASE(DESTROY_SCHEDULING_ELEMENT);