lael-labs/linux

Documentation/driver-api/fpga/fpga-mgr.rst+5−0

@@ -184,6 +184,11 @@ API for implementing a new FPGA Manager driver · 183 unmodified lines
184	API for programming an FPGA	184	API for programming an FPGA
185	---------------------------	185	---------------------------
186		186
		187	FPGA Manager flags
		188
		189	.. kernel-doc:: include/linux/fpga/fpga-mgr.h
		190	:doc: FPGA Manager flags
		191
187	.. kernel-doc:: include/linux/fpga/fpga-mgr.h	192	.. kernel-doc:: include/linux/fpga/fpga-mgr.h
188	:functions: fpga_image_info	193	:functions: fpga_image_info
189		194

Documentation/fb/uvesafb.txt+3−2

@@ -15,7 +15,8 @@ than x86. Check the v86d documentation for a list of currently supported · 14 unmodified lines
15	arches.	15	arches.
16		16
17	v86d source code can be downloaded from the following website:	17	v86d source code can be downloaded from the following website:
18	http://dev.gentoo.org/~spock/projects/uvesafb	18
		19	https://github.com/mjanusz/v86d
19		20
20	Please refer to the v86d documentation for detailed configuration and	21	Please refer to the v86d documentation for detailed configuration and
21	installation instructions.	22	installation instructions.
@@ -177,7 +178,7 @@ from the Video BIOS if you set pixclock to 0 in fb_var_screeninfo. · 155 unmodified lines
177		178
178	--	179	--
179	Michal Januszewski <spock@gentoo.org>	180	Michal Januszewski <spock@gentoo.org>
180	Last updated: 2009-03-30	181	Last updated: 2017-10-10
181		182
182	Documentation of the uvesafb options is loosely based on vesafb.txt.	183	Documentation of the uvesafb options is loosely based on vesafb.txt.
183		184

Documentation/networking/ip-sysctl.txt+1−1

@@ -425,7 +425,7 @@ tcp_mtu_probing - INTEGER · 424 unmodified lines
425	1 - Disabled by default, enabled when an ICMP black hole detected	425	1 - Disabled by default, enabled when an ICMP black hole detected
426	2 - Always enabled, use initial MSS of tcp_base_mss.	426	2 - Always enabled, use initial MSS of tcp_base_mss.
427		427
428	tcp_probe_interval - INTEGER	428	tcp_probe_interval - UNSIGNED INTEGER
429	Controls how often to start TCP Packetization-Layer Path MTU	429	Controls how often to start TCP Packetization-Layer Path MTU
430	Discovery reprobe. The default is reprobing every 10 minutes as	430	Discovery reprobe. The default is reprobing every 10 minutes as
431	per RFC4821.	431	per RFC4821.

MAINTAINERS+6−8

@@ -324,7 +324,6 @@ F: Documentation/ABI/testing/sysfs-bus-acpi · 323 unmodified lines
324	F: Documentation/ABI/testing/configfs-acpi	324	F: Documentation/ABI/testing/configfs-acpi
325	F: drivers/pci/acpi	325	F: drivers/pci/acpi
326	F: drivers/pci//acpi*	326	F: drivers/pci//acpi*
327	F: drivers/pci///acpi
328	F: tools/power/acpi/	327	F: tools/power/acpi/
329		328
330	ACPI APEI	329	ACPI APEI
@@ -1251,7 +1250,7 @@ N: meson · 920 unmodified lines
1251		1250
1252	ARM/Annapurna Labs ALPINE ARCHITECTURE	1251	ARM/Annapurna Labs ALPINE ARCHITECTURE
1253	M: Tsahee Zidenberg <tsahee@annapurnalabs.com>	1252	M: Tsahee Zidenberg <tsahee@annapurnalabs.com>
1254	M: Antoine Tenart <antoine.tenart@free-electrons.com>	1253	M: Antoine Tenart <antoine.tenart@bootlin.com>
1255	L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)	1254	L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
1256	S: Maintained	1255	S: Maintained
1257	F: arch/arm/mach-alpine/	1256	F: arch/arm/mach-alpine/
@@ -2956,7 +2955,6 @@ F: include/linux/bcm963xx_tag.h · 1698 unmodified lines
2956		2955
2957	BROADCOM BNX2 GIGABIT ETHERNET DRIVER	2956	BROADCOM BNX2 GIGABIT ETHERNET DRIVER
2958	M: Rasesh Mody <rasesh.mody@cavium.com>	2957	M: Rasesh Mody <rasesh.mody@cavium.com>
2959	M: Harish Patil <harish.patil@cavium.com>
2960	M: Dept-GELinuxNICDev@cavium.com	2958	M: Dept-GELinuxNICDev@cavium.com
2961	L: netdev@vger.kernel.org	2959	L: netdev@vger.kernel.org
2962	S: Supported	2960	S: Supported
@@ -2977,6 +2975,7 @@ F: drivers/scsi/bnx2i/ · 14 unmodified lines
2977		2975
2978	BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER	2976	BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
2979	M: Ariel Elior <ariel.elior@cavium.com>	2977	M: Ariel Elior <ariel.elior@cavium.com>
		2978	M: Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
2980	M: everest-linux-l2@cavium.com	2979	M: everest-linux-l2@cavium.com
2981	L: netdev@vger.kernel.org	2980	L: netdev@vger.kernel.org
2982	S: Supported	2981	S: Supported
@@ -5470,7 +5469,8 @@ S: Odd Fixes · 2487 unmodified lines
5470	F: drivers/net/ethernet/agere/	5469	F: drivers/net/ethernet/agere/
5471		5470
5472	ETHERNET BRIDGE	5471	ETHERNET BRIDGE
5473	M: Stephen Hemminger <stephen@networkplumber.org>	5472	M: Roopa Prabhu <roopa@cumulusnetworks.com>
		5473	M: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
5474	L: bridge@lists.linux-foundation.org (moderated for non-subscribers)	5474	L: bridge@lists.linux-foundation.org (moderated for non-subscribers)
5475	L: netdev@vger.kernel.org	5475	L: netdev@vger.kernel.org
5476	W: http://www.linuxfoundation.org/en/Net:Bridge	5476	W: http://www.linuxfoundation.org/en/Net:Bridge
@@ -8598,7 +8598,6 @@ F: include/linux/spinlock*.h · 3121 unmodified lines
8598	F: arch//include/asm/spinlock.h	8598	F: arch//include/asm/spinlock.h
8599	F: include/linux/rwlock*.h	8599	F: include/linux/rwlock*.h
8600	F: include/linux/mutex*.h	8600	F: include/linux/mutex*.h
8601	F: arch//include/asm/mutex.h
8602	F: include/linux/rwsem*.h	8601	F: include/linux/rwsem*.h
8603	F: arch/*/include/asm/rwsem.h	8602	F: arch/*/include/asm/rwsem.h
8604	F: include/linux/seqlock.h	8603	F: include/linux/seqlock.h
@@ -11979,7 +11978,7 @@ F: Documentation/scsi/LICENSE.qla4xxx · 3374 unmodified lines
11979	F: drivers/scsi/qla4xxx/	11978	F: drivers/scsi/qla4xxx/
11980		11979
11981	QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER	11980	QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
11982	M: Harish Patil <harish.patil@cavium.com>	11981	M: Shahed Shaikh <Shahed.Shaikh@cavium.com>
11983	M: Manish Chopra <manish.chopra@cavium.com>	11982	M: Manish Chopra <manish.chopra@cavium.com>
11984	M: Dept-GELinuxNICDev@cavium.com	11983	M: Dept-GELinuxNICDev@cavium.com
11985	L: netdev@vger.kernel.org	11984	L: netdev@vger.kernel.org
@@ -11987,7 +11986,6 @@ S: Supported · 1 unmodified line
11987	F: drivers/net/ethernet/qlogic/qlcnic/	11986	F: drivers/net/ethernet/qlogic/qlcnic/
11988		11987
11989	QLOGIC QLGE 10Gb ETHERNET DRIVER	11988	QLOGIC QLGE 10Gb ETHERNET DRIVER
11990	M: Harish Patil <harish.patil@cavium.com>
11991	M: Manish Chopra <manish.chopra@cavium.com>	11989	M: Manish Chopra <manish.chopra@cavium.com>
11992	M: Dept-GELinuxNICDev@cavium.com	11990	M: Dept-GELinuxNICDev@cavium.com
11993	L: netdev@vger.kernel.org	11991	L: netdev@vger.kernel.org
@@ -15395,7 +15393,7 @@ S: Maintained · 3401 unmodified lines
15395	UVESAFB DRIVER	15393	UVESAFB DRIVER
15396	M: Michal Januszewski <spock@gentoo.org>	15394	M: Michal Januszewski <spock@gentoo.org>
15397	L: linux-fbdev@vger.kernel.org	15395	L: linux-fbdev@vger.kernel.org
15398	W: http://dev.gentoo.org/~spock/projects/uvesafb/	15396	W: https://github.com/mjanusz/v86d
15399	S: Maintained	15397	S: Maintained
15400	F: Documentation/fb/uvesafb.txt	15398	F: Documentation/fb/uvesafb.txt
15401	F: drivers/video/fbdev/uvesafb.*	15399	F: drivers/video/fbdev/uvesafb.*

Makefile+1−1

@@ -2,7 +2,7 @@ · 1 unmodified line
2	VERSION = 4	2	VERSION = 4
3	PATCHLEVEL = 19	3	PATCHLEVEL = 19
4	SUBLEVEL = 0	4	SUBLEVEL = 0
5	EXTRAVERSION = -rc6	5	EXTRAVERSION = -rc7
6	NAME = Merciless Moray	6	NAME = Merciless Moray
7		7
8	# DOCUMENTATION	8	# DOCUMENTATION

arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts+2−0

 #include "sama5d2-pinfunc.h"
 #include <dt-bindings/mfd/atmel-flexcom.h>
 #include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/pinctrl/at91.h>
 / {
 	model = "Atmel SAMA5D2 PTC EK";
 							 <PIN_PA30__NWE_NANDWE>,
 							 <PIN_PB2__NRD_NANDOE>;
 						bias-pull-up;
+						atmel,drive-strength = <ATMEL_PIO_DRVSTR_ME>;
 					};
 					ale_cle_rdy_cs {

arch/arm/boot/dts/bcm63138.dtsi+8−6

 		global_timer: timer@1e200 {
 			compatible = "arm,cortex-a9-global-timer";
 			reg = <0x1e200 0x20>;
-			interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
+			interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
 			clocks = <&axi_clk>;
 		};
 		local_timer: local-timer@1e600 {
 			compatible = "arm,cortex-a9-twd-timer";
 			reg = <0x1e600 0x20>;
-			interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>;
+			interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) |
+						  IRQ_TYPE_EDGE_RISING)>;
 			clocks = <&axi_clk>;
 		};
 		twd_watchdog: watchdog@1e620 {
 			compatible = "arm,cortex-a9-twd-wdt";
 			reg = <0x1e620 0x20>;
-			interrupts = <GIC_PPI 14 IRQ_TYPE_LEVEL_HIGH>;
+			interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) |
+						  IRQ_TYPE_LEVEL_HIGH)>;
 		};
 		armpll: armpll {
 		serial0: serial@600 {
 			compatible = "brcm,bcm6345-uart";
 			reg = <0x600 0x1b>;
-			interrupts = <GIC_SPI 32 0>;
+			interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&periph_clk>;
 			clock-names = "periph";
 			status = "disabled";
 		serial1: serial@620 {
 			compatible = "brcm,bcm6345-uart";
 			reg = <0x620 0x1b>;
-			interrupts = <GIC_SPI 33 0>;
+			interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&periph_clk>;
 			clock-names = "periph";
 			status = "disabled";
 			reg = <0x2000 0x600>, <0xf0 0x10>;
 			reg-names = "nand", "nand-int-base";
 			status = "disabled";
-			interrupts = <GIC_SPI 38 0>;
+			interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "nand";
 		};

arch/arm/boot/dts/stm32mp157c.dtsi+2−2

@@ -1078,8 +1078,8 @@ · 1077 unmodified lines
1078	interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;	1078	interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
1079	clocks = <&rcc SPI6_K>;	1079	clocks = <&rcc SPI6_K>;
1080	resets = <&rcc SPI6_R>;	1080	resets = <&rcc SPI6_R>;
1081	dmas = <&mdma1 34 0x0 0x40008 0x0 0x0 0>,	1081	dmas = <&mdma1 34 0x0 0x40008 0x0 0x0>,
1082	<&mdma1 35 0x0 0x40002 0x0 0x0 0>;	1082	<&mdma1 35 0x0 0x40002 0x0 0x0>;
1083	dma-names = "rx", "tx";	1083	dma-names = "rx", "tx";
1084	status = "disabled";	1084	status = "disabled";
1085	};	1085	};

arch/arm/boot/dts/sun8i-r40.dtsi+1−2

@@ -800,8 +800,7 @@ · 799 unmodified lines
800	};	800	};
801		801
802	hdmi_phy: hdmi-phy@1ef0000 {	802	hdmi_phy: hdmi-phy@1ef0000 {
803	compatible = "allwinner,sun8i-r40-hdmi-phy",	803	compatible = "allwinner,sun8i-r40-hdmi-phy";
804	"allwinner,sun50i-a64-hdmi-phy";
805	reg = <0x01ef0000 0x10000>;	804	reg = <0x01ef0000 0x10000>;
806	clocks = <&ccu CLK_BUS_HDMI1>, <&ccu CLK_HDMI_SLOW>,	805	clocks = <&ccu CLK_BUS_HDMI1>, <&ccu CLK_HDMI_SLOW>,
807	<&ccu 7>, <&ccu 16>;	806	<&ccu 7>, <&ccu 16>;

arch/arm/mm/ioremap.c+1−1

@@ -473,7 +473,7 @@ void pci_ioremap_set_mem_type(int mem_type) · 472 unmodified lines
473		473
474	int pci_ioremap_io(unsigned int offset, phys_addr_t phys_addr)	474	int pci_ioremap_io(unsigned int offset, phys_addr_t phys_addr)
475	{	475	{
476	BUG_ON(offset + SZ_64K > IO_SPACE_LIMIT);	476	BUG_ON(offset + SZ_64K - 1 > IO_SPACE_LIMIT);
477		477
478	return ioremap_page_range(PCI_IO_VIRT_BASE + offset,	478	return ioremap_page_range(PCI_IO_VIRT_BASE + offset,
479	PCI_IO_VIRT_BASE + offset + SZ_64K,	479	PCI_IO_VIRT_BASE + offset + SZ_64K,

arch/arm/tools/syscall.tbl+1−0

@@ -413,3 +413,4 @@ · 412 unmodified lines
413	396 common pkey_free sys_pkey_free	413	396 common pkey_free sys_pkey_free
414	397 common statx sys_statx	414	397 common statx sys_statx
415	398 common rseq sys_rseq	415	398 common rseq sys_rseq
		416	399 common io_pgetevents sys_io_pgetevents

arch/arm64/kvm/guest.c+54−1

@@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 id) · 56 unmodified lines
57	return id & ~(KVM_REG_ARCH_MASK \| KVM_REG_SIZE_MASK \| KVM_REG_ARM_CORE);	57	return id & ~(KVM_REG_ARCH_MASK \| KVM_REG_SIZE_MASK \| KVM_REG_ARM_CORE);
58	}	58	}
59		59
		60	static int validate_core_offset(const struct kvm_one_reg *reg)
		61	{
		62	u64 off = core_reg_offset_from_id(reg->id);
		63	int size;
		64
		65	switch (off) {
		66	case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
		67	KVM_REG_ARM_CORE_REG(regs.regs[30]):
		68	case KVM_REG_ARM_CORE_REG(regs.sp):
		69	case KVM_REG_ARM_CORE_REG(regs.pc):
		70	case KVM_REG_ARM_CORE_REG(regs.pstate):
		71	case KVM_REG_ARM_CORE_REG(sp_el1):
		72	case KVM_REG_ARM_CORE_REG(elr_el1):
		73	case KVM_REG_ARM_CORE_REG(spsr[0]) ...
		74	KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
		75	size = sizeof(__u64);
		76	break;
		77
		78	case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
		79	KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
		80	size = sizeof(__uint128_t);
		81	break;
		82
		83	case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
		84	case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
		85	size = sizeof(__u32);
		86	break;
		87
		88	default:
		89	return -EINVAL;
		90	}
		91
		92	if (KVM_REG_SIZE(reg->id) == size &&
		93	IS_ALIGNED(off, size / sizeof(__u32)))
		94	return 0;
		95
		96	return -EINVAL;
		97	}
		98
60	static int get_core_reg(struct kvm_vcpu vcpu, const struct kvm_one_reg reg)	99	static int get_core_reg(struct kvm_vcpu vcpu, const struct kvm_one_reg reg)
61	{	100	{
62	/*	101	/*
@@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu vcpu, const struct kvm_one_reg reg) · 13 unmodified lines
76	(off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)	115	(off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
77	return -ENOENT;	116	return -ENOENT;
78		117
		118	if (validate_core_offset(reg))
		119	return -EINVAL;
		120
79	if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))	121	if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
80	return -EFAULT;	122	return -EFAULT;
81		123
@@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu vcpu, const struct kvm_one_reg reg) · 16 unmodified lines
98	(off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)	140	(off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
99	return -ENOENT;	141	return -ENOENT;
100		142
		143	if (validate_core_offset(reg))
		144	return -EINVAL;
		145
101	if (KVM_REG_SIZE(reg->id) > sizeof(tmp))	146	if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
102	return -EINVAL;	147	return -EINVAL;
103		148
@@ -107,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu vcpu, const struct kvm_one_reg reg) · 3 unmodified lines
107	}	152	}
108		153
109	if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {	154	if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {
110	u32 mode = ((u32 )valp) & PSR_AA32_MODE_MASK;	155	u64 mode = ((u64 )valp) & PSR_AA32_MODE_MASK;
111	switch (mode) {	156	switch (mode) {
112	case PSR_AA32_MODE_USR:	157	case PSR_AA32_MODE_USR:
		158	if (!system_supports_32bit_el0())
		159	return -EINVAL;
		160	break;
113	case PSR_AA32_MODE_FIQ:	161	case PSR_AA32_MODE_FIQ:
114	case PSR_AA32_MODE_IRQ:	162	case PSR_AA32_MODE_IRQ:
115	case PSR_AA32_MODE_SVC:	163	case PSR_AA32_MODE_SVC:
116	case PSR_AA32_MODE_ABT:	164	case PSR_AA32_MODE_ABT:
117	case PSR_AA32_MODE_UND:	165	case PSR_AA32_MODE_UND:
		166	if (!vcpu_el1_is_32bit(vcpu))
		167	return -EINVAL;
		168	break;
118	case PSR_MODE_EL0t:	169	case PSR_MODE_EL0t:
119	case PSR_MODE_EL1t:	170	case PSR_MODE_EL1t:
120	case PSR_MODE_EL1h:	171	case PSR_MODE_EL1h:
		172	if (vcpu_el1_is_32bit(vcpu))
		173	return -EINVAL;
121	break;	174	break;
122	default:	175	default:
123	err = -EINVAL;	176	err = -EINVAL;

arch/arm64/mm/hugetlbpage.c+43−7

 		/*
 		 * If HW_AFDBM is enabled, then the HW could turn on
-		 * the dirty bit for any page in the set, so check
+		 * the dirty or accessed bit for any page in the set,
-		 * them all.  All hugetlb entries are already young.
+		 * so check them all.
 		 */
 		if (pte_dirty(pte))
 			orig_pte = pte_mkdirty(orig_pte);
+		if (pte_young(pte))
+			orig_pte = pte_mkyoung(orig_pte);
 	}
 	if (valid) {
 	return get_clear_flush(mm, addr, ptep, pgsize, ncontig);
 }
+/*
+ * huge_ptep_set_access_flags will update access flags (dirty, accesssed)
+ * and write permission.
+ *
+ * For a contiguous huge pte range we need to check whether or not write
+ * permission has to change only on the first pte in the set. Then for
+ * all the contiguous ptes we need to check whether or not there is a
+ * discrepancy between dirty or young.
+ */
+static int __cont_access_flags_changed(pte_t *ptep, pte_t pte, int ncontig)
+{
+	int i;
+	if (pte_write(pte) != pte_write(huge_ptep_get(ptep)))
+		return 1;
+	for (i = 0; i < ncontig; i++) {
+		pte_t orig_pte = huge_ptep_get(ptep + i);
+		if (pte_dirty(pte) != pte_dirty(orig_pte))
+			return 1;
+		if (pte_young(pte) != pte_young(orig_pte))
+			return 1;
+	}
+	return 0;
+}
 int huge_ptep_set_access_flags(struct vm_area_struct *vma,
 			       unsigned long addr, pte_t *ptep,
 			       pte_t pte, int dirty)
 {
-	int ncontig, i, changed = 0;
+	int ncontig, i;
 	size_t pgsize = 0;
 	unsigned long pfn = pte_pfn(pte), dpfn;
 	pgprot_t hugeprot;
 	ncontig = find_num_contig(vma->vm_mm, addr, ptep, &pgsize);
 	dpfn = pgsize >> PAGE_SHIFT;
+	if (!__cont_access_flags_changed(ptep, pte, ncontig))
+		return 0;
 	orig_pte = get_clear_flush(vma->vm_mm, addr, ptep, pgsize, ncontig);
-	if (!pte_same(orig_pte, pte))
-		changed = 1;
-	/* Make sure we don't lose the dirty state */
+	/* Make sure we don't lose the dirty or young state */
 	if (pte_dirty(orig_pte))
 		pte = pte_mkdirty(pte);
+	if (pte_young(orig_pte))
+		pte = pte_mkyoung(pte);
 	hugeprot = pte_pgprot(pte);
 	for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
 		set_pte_at(vma->vm_mm, addr, ptep, pfn_pte(pfn, hugeprot));
-	return changed;
+	return 1;
 }
 void huge_ptep_set_wrprotect(struct mm_struct *mm,

arch/powerpc/kernel/process.c+10−0

@@ -1306,6 +1306,16 @@ void show_user_instructions(struct pt_regs *regs) · 1305 unmodified lines
1306		1306
1307	pc = regs->nip - (instructions_to_print * 3 / 4 * sizeof(int));	1307	pc = regs->nip - (instructions_to_print * 3 / 4 * sizeof(int));
1308		1308
		1309	/*
		1310	* Make sure the NIP points at userspace, not kernel text/data or
		1311	* elsewhere.
		1312	*/
		1313	if (!__access_ok(pc, instructions_to_print * sizeof(int), USER_DS)) {
		1314	pr_info("%s[%d]: Bad NIP, not dumping instructions.\n",
		1315	current->comm, current->pid);
		1316	return;
		1317	}
		1318
1309	pr_info("%s[%d]: code: ", current->comm, current->pid);	1319	pr_info("%s[%d]: code: ", current->comm, current->pid);
1310		1320
1311	for (i = 0; i < instructions_to_print; i++) {	1321	for (i = 0; i < instructions_to_print; i++) {

arch/powerpc/kvm/book3s_64_mmu_radix.c+10−0

@@ -646,6 +646,16 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run run, struct kvm_vcpu vcpu, · 645 unmodified lines
646	*/	646	*/
647	local_irq_disable();	647	local_irq_disable();
648	ptep = __find_linux_pte(vcpu->arch.pgdir, hva, NULL, &shift);	648	ptep = __find_linux_pte(vcpu->arch.pgdir, hva, NULL, &shift);
		649	/*
		650	* If the PTE disappeared temporarily due to a THP
		651	* collapse, just return and let the guest try again.
		652	*/
		653	if (!ptep) {
		654	local_irq_enable();
		655	if (page)
		656	put_page(page);
		657	return RESUME_GUEST;
		658	}
649	pte = *ptep;	659	pte = *ptep;
650	local_irq_enable();	660	local_irq_enable();
651		661

arch/powerpc/lib/code-patching.c+12−8

 {
 	int err;
-	/* Make sure we aren't patching a freed init section */
-	if (init_mem_is_free && init_section_contains(exec_addr, 4)) {
-		pr_debug("Skipping init section patching addr: 0x%px\n", exec_addr);
-		return 0;
-	}
 	__put_user_size(instr, patch_addr, 4, err);
 	if (err)
 		return err;
 	return 0;
 }
-int patch_instruction(unsigned int *addr, unsigned int instr)
+static int do_patch_instruction(unsigned int *addr, unsigned int instr)
 {
 	int err;
 	unsigned int *patch_addr = NULL;
 }
 #else /* !CONFIG_STRICT_KERNEL_RWX */
-int patch_instruction(unsigned int *addr, unsigned int instr)
+static int do_patch_instruction(unsigned int *addr, unsigned int instr)
 {
 	return raw_patch_instruction(addr, instr);
 }
 #endif /* CONFIG_STRICT_KERNEL_RWX */
+int patch_instruction(unsigned int *addr, unsigned int instr)
+{
+	/* Make sure we aren't patching a freed init section */
+	if (init_mem_is_free && init_section_contains(addr, 4)) {
+		pr_debug("Skipping init section patching addr: 0x%px\n", addr);
+		return 0;
+	}
+	return do_patch_instruction(addr, instr);
+}
 NOKPROBE_SYMBOL(patch_instruction);
 int patch_branch(unsigned int *addr, unsigned long target, int flags)

arch/powerpc/mm/numa.c+3−2

 		 * Need to ensure that NODE_DATA is initialized for a node from
 		 * available memory (see memblock_alloc_try_nid). If unable to
 		 * init the node, then default to nearest node that has memory
-		 * installed.
+		 * installed. Skip onlining a node if the subsystems are not
+		 * yet initialized.
 		 */
-		if (try_online_node(new_nid))
+		if (!topology_inited || try_online_node(new_nid))
 			new_nid = first_online_node;
 #else
 		/*

arch/riscv/kernel/setup.c+1−1

@@ -186,7 +186,7 @@ static void __init setup_bootmem(void) · 185 unmodified lines
186	BUG_ON(mem_size == 0);	186	BUG_ON(mem_size == 0);
187		187
188	set_max_mapnr(PFN_DOWN(mem_size));	188	set_max_mapnr(PFN_DOWN(mem_size));
189	max_low_pfn = pfn_base + PFN_DOWN(mem_size);	189	max_low_pfn = memblock_end_of_DRAM();
190		190
191	#ifdef CONFIG_BLK_DEV_INITRD	191	#ifdef CONFIG_BLK_DEV_INITRD
192	setup_initrd();	192	setup_initrd();

arch/x86/entry/vdso/Makefile+14−2

@@ -68,7 +68,13 @@ $(obj)/vdso-image-%.c: $(obj)/vdso%.so.dbg $(obj)/vdso%.so $(obj)/vdso2c FORCE · 67 unmodified lines
68	CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \	68	CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \
69	$(filter -g%,$(KBUILD_CFLAGS)) $(call cc-option, -fno-stack-protector) \	69	$(filter -g%,$(KBUILD_CFLAGS)) $(call cc-option, -fno-stack-protector) \
70	-fno-omit-frame-pointer -foptimize-sibling-calls \	70	-fno-omit-frame-pointer -foptimize-sibling-calls \
71	-DDISABLE_BRANCH_PROFILING -DBUILD_VDSO $(RETPOLINE_VDSO_CFLAGS)	71	-DDISABLE_BRANCH_PROFILING -DBUILD_VDSO
		72
		73	ifdef CONFIG_RETPOLINE
		74	ifneq ($(RETPOLINE_VDSO_CFLAGS),)
		75	CFL += $(RETPOLINE_VDSO_CFLAGS)
		76	endif
		77	endif
72		78
73	$(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS),$(KBUILD_CFLAGS)) $(CFL)	79	$(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS),$(KBUILD_CFLAGS)) $(CFL)
74		80
@@ -138,7 +144,13 @@ KBUILD_CFLAGS_32 += $(call cc-option, -fno-stack-protector) · 63 unmodified lines
138	KBUILD_CFLAGS_32 += $(call cc-option, -foptimize-sibling-calls)	144	KBUILD_CFLAGS_32 += $(call cc-option, -foptimize-sibling-calls)
139	KBUILD_CFLAGS_32 += -fno-omit-frame-pointer	145	KBUILD_CFLAGS_32 += -fno-omit-frame-pointer
140	KBUILD_CFLAGS_32 += -DDISABLE_BRANCH_PROFILING	146	KBUILD_CFLAGS_32 += -DDISABLE_BRANCH_PROFILING
141	KBUILD_CFLAGS_32 += $(RETPOLINE_VDSO_CFLAGS)	147
		148	ifdef CONFIG_RETPOLINE
		149	ifneq ($(RETPOLINE_VDSO_CFLAGS),)
		150	KBUILD_CFLAGS_32 += $(RETPOLINE_VDSO_CFLAGS)
		151	endif
		152	endif
		153
142	$(obj)/vdso32.so.dbg: KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)	154	$(obj)/vdso32.so.dbg: KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
143		155
144	$(obj)/vdso32.so.dbg: FORCE \	156	$(obj)/vdso32.so.dbg: FORCE \

arch/x86/entry/vdso/vclock_gettime.c+14−12

 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
 {
 	long ret;
-	asm("syscall" : "=a" (ret) :
+	asm ("syscall" : "=a" (ret), "=m" (*ts) :
-	    "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory");
+	     "0" (__NR_clock_gettime), "D" (clock), "S" (ts) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 {
 	long ret;
-	asm("syscall" : "=a" (ret) :
+	asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) :
-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+	     "0" (__NR_gettimeofday), "D" (tv), "S" (tz) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 {
 	long ret;
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
-		"mov %2, %%ebx \n"
+		"mov %[clock], %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
+		: "=a" (ret), "=m" (*ts)
-		: "0" (__NR_clock_gettime), "g" (clock), "c" (ts)
+		: "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts)
 		: "memory", "edx");
 	return ret;
 }
 {
 	long ret;
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
-		"mov %2, %%ebx \n"
+		"mov %[tv], %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
+		: "=a" (ret), "=m" (*tv), "=m" (*tz)
-		: "0" (__NR_gettimeofday), "g" (tv), "c" (tz)
+		: "0" (__NR_gettimeofday), [tv] "g" (tv), "c" (tz)
 		: "memory", "edx");
 	return ret;
 }

arch/x86/events/amd/uncore.c+10−0

 static int num_counters_llc;
 static int num_counters_nb;
+static bool l3_mask;
 static HLIST_HEAD(uncore_unused_list);
 	hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB;
 	hwc->idx = -1;
+	/*
+	 * SliceMask and ThreadMask need to be set for certain L3 events in
+	 * Family 17h. For other events, the two fields do not affect the count.
+	 */
+	if (l3_mask)
+		hwc->config |= (AMD64_L3_SLICE_MASK | AMD64_L3_THREAD_MASK);
 	if (event->cpu < 0)
 		return -EINVAL;
 		amd_llc_pmu.name	  = "amd_l3";
 		format_attr_event_df.show = &event_show_df;
 		format_attr_event_l3.show = &event_show_l3;
+		l3_mask			  = true;
 	} else {
 		num_counters_nb		  = NUM_COUNTERS_NB;
 		num_counters_llc	  = NUM_COUNTERS_L2;
 		amd_llc_pmu.name	  = "amd_l2";
 		format_attr_event_df	  = format_attr_event;
 		format_attr_event_l3	  = format_attr_event;
+		l3_mask			  = false;
 	}
 	amd_nb_pmu.attr_groups	= amd_uncore_attr_groups_df;

arch/x86/events/intel/uncore_snbep.c+7−7

@@ -3061,7 +3061,7 @@ static struct event_constraint bdx_uncore_pcu_constraints[] = { · 3060 unmodified lines
3061		3061
3062	void bdx_uncore_cpu_init(void)	3062	void bdx_uncore_cpu_init(void)
3063	{	3063	{
3064	int pkg = topology_phys_to_logical_pkg(0);	3064	int pkg = topology_phys_to_logical_pkg(boot_cpu_data.phys_proc_id);
3065		3065
3066	if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)	3066	if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
3067	bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;	3067	bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
@@ -3931,16 +3931,16 @@ static const struct pci_device_id skx_uncore_pci_ids[] = { · 863 unmodified lines
3931	.driver_data = UNCORE_PCI_DEV_FULL_DATA(21, 5, SKX_PCI_UNCORE_M2PCIE, 3),	3931	.driver_data = UNCORE_PCI_DEV_FULL_DATA(21, 5, SKX_PCI_UNCORE_M2PCIE, 3),
3932	},	3932	},
3933	{ /* M3UPI0 Link 0 */	3933	{ /* M3UPI0 Link 0 */
3934	PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204C),	3934	PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204D),
3935	.driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 0, SKX_PCI_UNCORE_M3UPI, 0),	3935	.driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 1, SKX_PCI_UNCORE_M3UPI, 0),
3936	},	3936	},
3937	{ /* M3UPI0 Link 1 */	3937	{ /* M3UPI0 Link 1 */
3938	PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204D),	3938	PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204E),
3939	.driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 1, SKX_PCI_UNCORE_M3UPI, 1),	3939	.driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 2, SKX_PCI_UNCORE_M3UPI, 1),
3940	},	3940	},
3941	{ /* M3UPI1 Link 2 */	3941	{ /* M3UPI1 Link 2 */
3942	PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204C),	3942	PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x204D),
3943	.driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 4, SKX_PCI_UNCORE_M3UPI, 2),	3943	.driver_data = UNCORE_PCI_DEV_FULL_DATA(18, 5, SKX_PCI_UNCORE_M3UPI, 2),
3944	},	3944	},
3945	{ /* end: all zeroes */ }	3945	{ /* end: all zeroes */ }
3946	};	3946	};

arch/x86/include/asm/perf_event.h+8−0

@@ -46,6 +46,14 @@ · 45 unmodified lines
46	#define INTEL_ARCH_EVENT_MASK \	46	#define INTEL_ARCH_EVENT_MASK \
47	(ARCH_PERFMON_EVENTSEL_UMASK \| ARCH_PERFMON_EVENTSEL_EVENT)	47	(ARCH_PERFMON_EVENTSEL_UMASK \| ARCH_PERFMON_EVENTSEL_EVENT)
48		48
		49	#define AMD64_L3_SLICE_SHIFT 48
		50	#define AMD64_L3_SLICE_MASK \
		51	((0xFULL) << AMD64_L3_SLICE_SHIFT)
		52
		53	#define AMD64_L3_THREAD_SHIFT 56
		54	#define AMD64_L3_THREAD_MASK \
		55	((0xFFULL) << AMD64_L3_THREAD_SHIFT)
		56
49	#define X86_RAW_EVENT_MASK \	57	#define X86_RAW_EVENT_MASK \
50	(ARCH_PERFMON_EVENTSEL_EVENT \| \	58	(ARCH_PERFMON_EVENTSEL_EVENT \| \
51	ARCH_PERFMON_EVENTSEL_UMASK \| \	59	ARCH_PERFMON_EVENTSEL_UMASK \| \

arch/x86/include/asm/uv/uv.h+6−0

 struct mm_struct;
 #ifdef CONFIG_X86_UV
+#include <linux/efi.h>
 extern enum uv_system_type get_uv_system_type(void);
+static inline bool is_early_uv_system(void)
+{
+	return !((efi.uv_systab == EFI_INVALID_TABLE_ADDR) || !efi.uv_systab);
+}
 extern int is_uv_system(void);
 extern int is_uv_hubless(void);
 extern void uv_cpu_init(void);
 #else	/* X86_UV */
 static inline enum uv_system_type get_uv_system_type(void) { return UV_NONE; }
+static inline bool is_early_uv_system(void)	{ return 0; }
 static inline int is_uv_system(void)	{ return 0; }
 static inline int is_uv_hubless(void)	{ return 0; }
 static inline void uv_cpu_init(void)	{ }

arch/x86/kernel/cpu/amd.c+1−1

@@ -922,7 +922,7 @@ static void init_amd(struct cpuinfo_x86 *c) · 921 unmodified lines
922	static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)	922	static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
923	{	923	{
924	/* AMD errata T13 (order #21922) */	924	/* AMD errata T13 (order #21922) */
925	if ((c->x86 == 6)) {	925	if (c->x86 == 6) {
926	/* Duron Rev A0 */	926	/* Duron Rev A0 */
927	if (c->x86_model == 3 && c->x86_stepping == 0)	927	if (c->x86_model == 3 && c->x86_stepping == 0)
928	size = 64;	928	size = 64;

arch/x86/kernel/tsc.c+4−0

 #include <asm/apic.h>
 #include <asm/intel-family.h>
 #include <asm/i8259.h>
+#include <asm/uv/uv.h>
 unsigned int __read_mostly cpu_khz;	/* TSC clocks / usec, not used here */
 EXPORT_SYMBOL(cpu_khz);
 {
 	if (!boot_cpu_has(X86_FEATURE_TSC))
 		return;
+	/* Don't change UV TSC multi-chassis synchronization */
+	if (is_early_uv_system())
+		return;
 	if (!determine_cpu_tsc_frequencies(true))
 		return;
 	loops_per_jiffy = get_loops_per_jiffy();

arch/x86/kvm/mmu.c+20−4

  */
 static const u64 shadow_nonpresent_or_rsvd_mask_len = 5;
+/*
+ * In some cases, we need to preserve the GFN of a non-present or reserved
+ * SPTE when we usurp the upper five bits of the physical address space to
+ * defend against L1TF, e.g. for MMIO SPTEs.  To preserve the GFN, we'll
+ * shift bits of the GFN that overlap with shadow_nonpresent_or_rsvd_mask
+ * left into the reserved bits, i.e. the GFN in the SPTE will be split into
+ * high and low parts.  This mask covers the lower bits of the GFN.
+ */
+static u64 __read_mostly shadow_nonpresent_or_rsvd_lower_gfn_mask;
 static void mmu_spte_set(u64 *sptep, u64 spte);
 static union kvm_mmu_page_role
 kvm_mmu_calc_root_page_role(struct kvm_vcpu *vcpu);
 static gfn_t get_mmio_spte_gfn(u64 spte)
 {
-	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask |
+	u64 gpa = spte & shadow_nonpresent_or_rsvd_lower_gfn_mask;
-		   shadow_nonpresent_or_rsvd_mask;
-	u64 gpa = spte & ~mask;
 	gpa |= (spte >> shadow_nonpresent_or_rsvd_mask_len)
 	       & shadow_nonpresent_or_rsvd_mask;
 static void kvm_mmu_reset_all_pte_masks(void)
 {
+	u8 low_phys_bits;
 	shadow_user_mask = 0;
 	shadow_accessed_mask = 0;
 	shadow_dirty_mask = 0;
 	 * appropriate mask to guard against L1TF attacks. Otherwise, it is
 	 * assumed that the CPU is not vulnerable to L1TF.
 	 */
+	low_phys_bits = boot_cpu_data.x86_phys_bits;
 	if (boot_cpu_data.x86_phys_bits <
-	    52 - shadow_nonpresent_or_rsvd_mask_len)
+	    52 - shadow_nonpresent_or_rsvd_mask_len) {
 		shadow_nonpresent_or_rsvd_mask =
 			rsvd_bits(boot_cpu_data.x86_phys_bits -
 				  shadow_nonpresent_or_rsvd_mask_len,
 				  boot_cpu_data.x86_phys_bits - 1);
+		low_phys_bits -= shadow_nonpresent_or_rsvd_mask_len;
+	}
+	shadow_nonpresent_or_rsvd_lower_gfn_mask =
+		GENMASK_ULL(low_phys_bits - 1, PAGE_SHIFT);
 }
 static int is_cpuid_PSE36(void)

arch/x86/kvm/vmx.c+76−61

 #define MSR_BITMAP_MODE_X2APIC		1
 #define MSR_BITMAP_MODE_X2APIC_APICV	2
-#define MSR_BITMAP_MODE_LM		4
 #define KVM_VMX_TSC_MULTIPLIER_MAX     0xffffffffffffffffULL
 	/* to migrate it to L2 if VM_ENTRY_LOAD_DEBUG_CONTROLS is off */
 	u64 vmcs01_debugctl;
+	u64 vmcs01_guest_bndcfgs;
 	u16 vpid02;
 	u16 last_vpid;
 		vmx->msr_host_kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
 	}
-	if (is_long_mode(&vmx->vcpu))
+	wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
-		wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
 #else
 	savesegment(fs, fs_sel);
 	savesegment(gs, gs_sel);
 	vmx->loaded_cpu_state = NULL;
 #ifdef CONFIG_X86_64
-	if (is_long_mode(&vmx->vcpu))
+	rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
-		rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
 #endif
 	if (host_state->ldt_sel || (host_state->gs_sel & 7)) {
 		kvm_load_ldt(host_state->ldt_sel);
 #ifdef CONFIG_X86_64
 static u64 vmx_read_guest_kernel_gs_base(struct vcpu_vmx *vmx)
 {
-	if (is_long_mode(&vmx->vcpu)) {
+	preempt_disable();
-		preempt_disable();
+	if (vmx->loaded_cpu_state)
-		if (vmx->loaded_cpu_state)
+		rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
-			rdmsrl(MSR_KERNEL_GS_BASE,
+	preempt_enable();
-			       vmx->msr_guest_kernel_gs_base);
-		preempt_enable();
-	}
 	return vmx->msr_guest_kernel_gs_base;
 }
 static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data)
 {
-	if (is_long_mode(&vmx->vcpu)) {
+	preempt_disable();
-		preempt_disable();
+	if (vmx->loaded_cpu_state)
-		if (vmx->loaded_cpu_state)
+		wrmsrl(MSR_KERNEL_GS_BASE, data);
-			wrmsrl(MSR_KERNEL_GS_BASE, data);
+	preempt_enable();
-		preempt_enable();
-	}
 	vmx->msr_guest_kernel_gs_base = data;
 }
 #endif
 		VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
 		VM_EXIT_SAVE_VMX_PREEMPTION_TIMER | VM_EXIT_ACK_INTR_ON_EXIT;
-	if (kvm_mpx_supported())
-		msrs->exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
 	/* We support free control of debug control saving. */
 	msrs->exit_ctls_low &= ~VM_EXIT_SAVE_DEBUG_CONTROLS;
 		VM_ENTRY_LOAD_IA32_PAT;
 	msrs->entry_ctls_high |=
 		(VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER);
-	if (kvm_mpx_supported())
-		msrs->entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
 	/* We support free control of debug control loading. */
 	msrs->entry_ctls_low &= ~VM_ENTRY_LOAD_DEBUG_CONTROLS;
 		msrs->secondary_ctls_high);
 	msrs->secondary_ctls_low = 0;
 	msrs->secondary_ctls_high &=
-		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
 		SECONDARY_EXEC_DESC |
 		SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
 		SECONDARY_EXEC_APIC_REGISTER_VIRT |
 		SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
 		SECONDARY_EXEC_WBINVD_EXITING;
 	/*
 	 * We can emulate "VMCS shadowing," even if the hardware
 	 * doesn't support it.
 		msrs->secondary_ctls_high |=
 			SECONDARY_EXEC_UNRESTRICTED_GUEST;
+	if (flexpriority_enabled)
+		msrs->secondary_ctls_high |=
+			SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
 	/* miscellaneous data */
 	rdmsr(MSR_IA32_VMX_MISC,
 		msrs->misc_low,
 	if (!msr)
 		return;
-	/*
-	 * MSR_KERNEL_GS_BASE is not intercepted when the guest is in
-	 * 64-bit mode as a 64-bit kernel may frequently access the
-	 * MSR.  This means we need to manually save/restore the MSR
-	 * when switching between guest and host state, but only if
-	 * the guest is in 64-bit mode.  Sync our cached value if the
-	 * guest is transitioning to 32-bit mode and the CPU contains
-	 * guest state, i.e. the cache is stale.
-	 */
-#ifdef CONFIG_X86_64
-	if (!(efer & EFER_LMA))
-		(void)vmx_read_guest_kernel_gs_base(vmx);
-#endif
 	vcpu->arch.efer = efer;
 	if (efer & EFER_LMA) {
 		vm_entry_controls_setbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
 			mode |= MSR_BITMAP_MODE_X2APIC_APICV;
 	}
-	if (is_long_mode(vcpu))
-		mode |= MSR_BITMAP_MODE_LM;
 	return mode;
 }
 	if (!changed)
 		return;
-	vmx_set_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW,
-				  !(mode & MSR_BITMAP_MODE_LM));
 	if (changed & (MSR_BITMAP_MODE_X2APIC | MSR_BITMAP_MODE_X2APIC_APICV))
 		vmx_update_msr_bitmap_x2apic(msr_bitmap, mode);
 	nested_mark_vmcs12_pages_dirty(vcpu);
 }
+static u8 vmx_get_rvi(void)
+{
+	return vmcs_read16(GUEST_INTR_STATUS) & 0xff;
+}
 static bool vmx_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
 		WARN_ON_ONCE(!vmx->nested.virtual_apic_page))
 		return false;
-	rvi = vmcs_read16(GUEST_INTR_STATUS) & 0xff;
+	rvi = vmx_get_rvi();
 	vapic_page = kmap(vmx->nested.virtual_apic_page);
 	vppr = *((u32 *)(vapic_page + APIC_PROCPRI));
 	if (!lapic_in_kernel(vcpu))
 		return;
+	if (!flexpriority_enabled &&
+	    !cpu_has_vmx_virtualize_x2apic_mode())
+		return;
 	/* Postpone execution until vmcs01 is the current VMCS. */
 	if (is_guest_mode(vcpu)) {
 		to_vmx(vcpu)->nested.change_vmcs01_virtual_apic_mode = true;
 		return;
 	}
-	if (!cpu_need_tpr_shadow(vcpu))
-		return;
 	sec_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
 	sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
 			      SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
 	return max_irr;
 }
+static u8 vmx_has_apicv_interrupt(struct kvm_vcpu *vcpu)
+{
+	u8 rvi = vmx_get_rvi();
+	u8 vppr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_PROCPRI);
+	return ((rvi & 0xf0) > (vppr & 0xf0));
+}
 static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 {
 	if (!kvm_vcpu_apicv_active(vcpu))
 #undef cr4_fixed1_update
 }
+static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
+{
+	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	if (kvm_mpx_supported()) {
+		bool mpx_enabled = guest_cpuid_has(vcpu, X86_FEATURE_MPX);
+		if (mpx_enabled) {
+			vmx->nested.msrs.entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
+			vmx->nested.msrs.exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
+		} else {
+			vmx->nested.msrs.entry_ctls_high &= ~VM_ENTRY_LOAD_BNDCFGS;
+			vmx->nested.msrs.exit_ctls_high &= ~VM_EXIT_CLEAR_BNDCFGS;
+		}
+	}
+}
 static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
 		to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
 			~FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
-	if (nested_vmx_allowed(vcpu))
+	if (nested_vmx_allowed(vcpu)) {
 		nested_vmx_cr_fixed1_bits_update(vcpu);
+		nested_vmx_entry_exit_ctls_update(vcpu);
+	}
 }
 static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
 	set_cr4_guest_host_mask(vmx);
-	if (vmx_mpx_supported())
+	if (kvm_mpx_supported()) {
-		vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
+		if (vmx->nested.nested_run_pending &&
+			(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
+			vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
+		else
+			vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
+	}
 	if (enable_vpid) {
 		if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02)
 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
 	bool from_vmentry = !!exit_qual;
 	u32 dummy_exit_qual;
-	u32 vmcs01_cpu_exec_ctrl;
+	bool evaluate_pending_interrupts;
 	int r = 0;
-	vmcs01_cpu_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+	evaluate_pending_interrupts = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
+		(CPU_BASED_VIRTUAL_INTR_PENDING | CPU_BASED_VIRTUAL_NMI_PENDING);
+	if (likely(!evaluate_pending_interrupts) && kvm_vcpu_apicv_active(vcpu))
+		evaluate_pending_interrupts |= vmx_has_apicv_interrupt(vcpu);
 	enter_guest_mode(vcpu);
 	if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
 		vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
+	if (kvm_mpx_supported() &&
+		!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
+		vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
 	vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
 	vmx_segment_cache_clear(vmx);
 	 * to L1 or delivered directly to L2 (e.g. In case L1 don't
 	 * intercept EXTERNAL_INTERRUPT).
 	 *
-	 * Usually this would be handled by L0 requesting a
+	 * Usually this would be handled by the processor noticing an
-	 * IRQ/NMI window by setting VMCS accordingly. However,
+	 * IRQ/NMI window request, or checking RVI during evaluation of
-	 * this setting was done on VMCS01 and now VMCS02 is active
+	 * pending virtual interrupts.  However, this setting was done
-	 * instead. Thus, we force L0 to perform pending event
+	 * on VMCS01 and now VMCS02 is active instead. Thus, we force L0
-	 * evaluation by requesting a KVM_REQ_EVENT.
+	 * to perform pending event evaluation by requesting a KVM_REQ_EVENT.
 	 */
-	if (vmcs01_cpu_exec_ctrl &
+	if (unlikely(evaluate_pending_interrupts))
-		(CPU_BASED_VIRTUAL_INTR_PENDING | CPU_BASED_VIRTUAL_NMI_PENDING)) {
 		kvm_make_request(KVM_REQ_EVENT, vcpu);
-	}
 	/*
 	 * Note no nested_vmx_succeed or nested_vmx_fail here. At this point

arch/x86/kvm/x86.c+1−1

@@ -4698,7 +4698,7 @@ static void kvm_init_msr_list(void) · 4697 unmodified lines
4698	*/	4698	*/
4699	switch (msrs_to_save[i]) {	4699	switch (msrs_to_save[i]) {
4700	case MSR_IA32_BNDCFGS:	4700	case MSR_IA32_BNDCFGS:
4701	if (!kvm_x86_ops->mpx_supported())	4701	if (!kvm_mpx_supported())
4702	continue;	4702	continue;
4703	break;	4703	break;
4704	case MSR_TSC_AUX:	4704	case MSR_TSC_AUX:

drivers/base/firmware_loader/main.c+5−2

 	}
 	tmp = __allocate_fw_priv(fw_name, fwc, dbuf, size);
-	if (tmp && !(opt_flags & FW_OPT_NOCACHE))
+	if (tmp) {
-		list_add(&tmp->list, &fwc->head);
+		INIT_LIST_HEAD(&tmp->list);
+		if (!(opt_flags & FW_OPT_NOCACHE))
+			list_add(&tmp->list, &fwc->head);
+	}
 	spin_unlock(&fwc->lock);
 	*fw_priv = tmp;

drivers/base/power/main.c+4−1

 	dpm_wait_for_subordinate(dev, async);
-	if (async_error)
+	if (async_error) {
+		dev->power.direct_complete = false;
 		goto Complete;
+	}
 	/*
 	 * If a device configured to wake up the system from sleep states
 		pm_wakeup_event(dev, 0);
 	if (pm_wakeup_pending()) {
+		dev->power.direct_complete = false;
 		async_error = -EBUSY;
 		goto Complete;
 	}

drivers/crypto/caam/caamalg.c+4−4

@@ -1553,8 +1553,8 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request · 1552 unmodified lines
1553	edesc->src_nents = src_nents;	1553	edesc->src_nents = src_nents;
1554	edesc->dst_nents = dst_nents;	1554	edesc->dst_nents = dst_nents;
1555	edesc->sec4_sg_bytes = sec4_sg_bytes;	1555	edesc->sec4_sg_bytes = sec4_sg_bytes;
1556	edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +	1556	edesc->sec4_sg = (struct sec4_sg_entry )((u8 )edesc->hw_desc +
1557	desc_bytes;	1557	desc_bytes);
1558	edesc->iv_dir = DMA_TO_DEVICE;	1558	edesc->iv_dir = DMA_TO_DEVICE;
1559		1559
1560	/* Make sure IV is located in a DMAable area */	1560	/* Make sure IV is located in a DMAable area */
@@ -1757,8 +1757,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( · 196 unmodified lines
1757	edesc->src_nents = src_nents;	1757	edesc->src_nents = src_nents;
1758	edesc->dst_nents = dst_nents;	1758	edesc->dst_nents = dst_nents;
1759	edesc->sec4_sg_bytes = sec4_sg_bytes;	1759	edesc->sec4_sg_bytes = sec4_sg_bytes;
1760	edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +	1760	edesc->sec4_sg = (struct sec4_sg_entry )((u8 )edesc->hw_desc +
1761	desc_bytes;	1761	desc_bytes);
1762	edesc->iv_dir = DMA_FROM_DEVICE;	1762	edesc->iv_dir = DMA_FROM_DEVICE;
1763		1763
1764	/* Make sure IV is located in a DMAable area */	1764	/* Make sure IV is located in a DMAable area */

drivers/crypto/chelsio/chcr_algo.c+22−10

 	walk->to = (struct phys_sge_pairs *)(dsgl + 1);
 }
-static inline void dsgl_walk_end(struct dsgl_walk *walk, unsigned short qid)
+static inline void dsgl_walk_end(struct dsgl_walk *walk, unsigned short qid,
+				 int pci_chan_id)
 {
 	struct cpl_rx_phys_dsgl *phys_cpl;
 	phys_cpl->rss_hdr_int.opcode = CPL_RX_PHYS_ADDR;
 	phys_cpl->rss_hdr_int.qid = htons(qid);
 	phys_cpl->rss_hdr_int.hash_val = 0;
+	phys_cpl->rss_hdr_int.channel = pci_chan_id;
 }
 static inline void dsgl_walk_add_page(struct dsgl_walk *walk,
 		FILL_WR_RX_Q_ID(ctx->dev->rx_channel_id, qid,
 				!!lcb, ctx->tx_qidx);
-	chcr_req->ulptx.cmd_dest = FILL_ULPTX_CMD_DEST(ctx->dev->tx_channel_id,
+	chcr_req->ulptx.cmd_dest = FILL_ULPTX_CMD_DEST(ctx->tx_chan_id,
 						       qid);
 	chcr_req->ulptx.len = htonl((DIV_ROUND_UP(len16, 16) -
 				     ((sizeof(chcr_req->wreq)) >> 4)));
 				    adap->vres.ncrypto_fc);
 		rxq_perchan = u_ctx->lldi.nrxq / u_ctx->lldi.nchan;
 		txq_perchan = ntxq / u_ctx->lldi.nchan;
-		rxq_idx = ctx->dev->tx_channel_id * rxq_perchan;
-		rxq_idx += id % rxq_perchan;
-		txq_idx = ctx->dev->tx_channel_id * txq_perchan;
-		txq_idx += id % txq_perchan;
 		spin_lock(&ctx->dev->lock_chcr_dev);
-		ctx->rx_qidx = rxq_idx;
+		ctx->tx_chan_id = ctx->dev->tx_channel_id;
-		ctx->tx_qidx = txq_idx;
 		ctx->dev->tx_channel_id = !ctx->dev->tx_channel_id;
 		ctx->dev->rx_channel_id = 0;
 		spin_unlock(&ctx->dev->lock_chcr_dev);
+		rxq_idx = ctx->tx_chan_id * rxq_perchan;
+		rxq_idx += id % rxq_perchan;
+		txq_idx = ctx->tx_chan_id * txq_perchan;
+		txq_idx += id % txq_perchan;
+		ctx->rx_qidx = rxq_idx;
+		ctx->tx_qidx = txq_idx;
+		/* Channel Id used by SGE to forward packet to Host.
+		 * Same value should be used in cpl_fw6_pld RSS_CH field
+		 * by FW. Driver programs PCI channel ID to be used in fw
+		 * at the time of queue allocation with value "pi->tx_chan"
+		 */
+		ctx->pci_chan_id = txq_idx / txq_perchan;
 	}
 out:
 	return err;
 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
 	struct dsgl_walk dsgl_walk;
 	unsigned int authsize = crypto_aead_authsize(tfm);
+	struct chcr_context *ctx = a_ctx(tfm);
 	u32 temp;
 	dsgl_walk_init(&dsgl_walk, phys_cpl);
 	dsgl_walk_add_page(&dsgl_walk, IV, &reqctx->iv_dma);
 	temp = req->cryptlen + (reqctx->op ? -authsize : authsize);
 	dsgl_walk_add_sg(&dsgl_walk, req->dst, temp, req->assoclen);
-	dsgl_walk_end(&dsgl_walk, qid);
+	dsgl_walk_end(&dsgl_walk, qid, ctx->pci_chan_id);
 }
 void chcr_add_cipher_src_ent(struct ablkcipher_request *req,
 			     unsigned short qid)
 {
 	struct chcr_blkcipher_req_ctx *reqctx = ablkcipher_request_ctx(req);
+	struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(wrparam->req);
+	struct chcr_context *ctx = c_ctx(tfm);
 	struct dsgl_walk dsgl_walk;
 	dsgl_walk_init(&dsgl_walk, phys_cpl);
 	reqctx->dstsg = dsgl_walk.last_sg;
 	reqctx->dst_ofst = dsgl_walk.last_sg_len;
-	dsgl_walk_end(&dsgl_walk, qid);
+	dsgl_walk_end(&dsgl_walk, qid, ctx->pci_chan_id);
 }
 void chcr_add_hash_src_ent(struct ahash_request *req,

drivers/crypto/chelsio/chcr_crypto.h+2−0

@@ -255,6 +255,8 @@ struct chcr_context { · 254 unmodified lines
255	struct chcr_dev *dev;	255	struct chcr_dev *dev;
256	unsigned char tx_qidx;	256	unsigned char tx_qidx;
257	unsigned char rx_qidx;	257	unsigned char rx_qidx;
		258	unsigned char tx_chan_id;
		259	unsigned char pci_chan_id;
258	struct __crypto_ctx crypto_ctx[0];	260	struct __crypto_ctx crypto_ctx[0];
259	};	261	};
260		262

drivers/crypto/mxs-dcp.c+30−23

@@ -63,7 +63,7 @@ struct dcp { · 62 unmodified lines
63	struct dcp_coherent_block *coh;	63	struct dcp_coherent_block *coh;
64		64
65	struct completion completion[DCP_MAX_CHANS];	65	struct completion completion[DCP_MAX_CHANS];
66	struct mutex mutex[DCP_MAX_CHANS];	66	spinlock_t lock[DCP_MAX_CHANS];
67	struct task_struct *thread[DCP_MAX_CHANS];	67	struct task_struct *thread[DCP_MAX_CHANS];
68	struct crypto_queue queue[DCP_MAX_CHANS];	68	struct crypto_queue queue[DCP_MAX_CHANS];
69	};	69	};
@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *data) · 279 unmodified lines
349		349
350	int ret;	350	int ret;
351		351
352	do {	352	while (!kthread_should_stop()) {
353	__set_current_state(TASK_INTERRUPTIBLE);	353	set_current_state(TASK_INTERRUPTIBLE);
354		354
355	mutex_lock(&sdcp->mutex[chan]);	355	spin_lock(&sdcp->lock[chan]);
356	backlog = crypto_get_backlog(&sdcp->queue[chan]);	356	backlog = crypto_get_backlog(&sdcp->queue[chan]);
357	arq = crypto_dequeue_request(&sdcp->queue[chan]);	357	arq = crypto_dequeue_request(&sdcp->queue[chan]);
358	mutex_unlock(&sdcp->mutex[chan]);	358	spin_unlock(&sdcp->lock[chan]);
		359
		360	if (!backlog && !arq) {
		361	schedule();
		362	continue;
		363	}
		364
		365	set_current_state(TASK_RUNNING);
359		366
360	if (backlog)	367	if (backlog)
361	backlog->complete(backlog, -EINPROGRESS);	368	backlog->complete(backlog, -EINPROGRESS);
@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *data) · 1 unmodified line
363	if (arq) {	370	if (arq) {
364	ret = mxs_dcp_aes_block_crypt(arq);	371	ret = mxs_dcp_aes_block_crypt(arq);
365	arq->complete(arq, ret);	372	arq->complete(arq, ret);
366	continue;
367	}	373	}
368		374	}
369	schedule();
370	} while (!kthread_should_stop());
371		375
372	return 0;	376	return 0;
373	}	377	}
@@ -409,9 +413,9 @@ static int mxs_dcp_aes_enqueue(struct ablkcipher_request *req, int enc, int ecb) · 35 unmodified lines
409	rctx->ecb = ecb;	413	rctx->ecb = ecb;
410	actx->chan = DCP_CHAN_CRYPTO;	414	actx->chan = DCP_CHAN_CRYPTO;
411		415
412	mutex_lock(&sdcp->mutex[actx->chan]);	416	spin_lock(&sdcp->lock[actx->chan]);
413	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);	417	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
414	mutex_unlock(&sdcp->mutex[actx->chan]);	418	spin_unlock(&sdcp->lock[actx->chan]);
415		419
416	wake_up_process(sdcp->thread[actx->chan]);	420	wake_up_process(sdcp->thread[actx->chan]);
417		421
@@ -640,13 +644,20 @@ static int dcp_chan_thread_sha(void *data) · 222 unmodified lines
640	struct ahash_request *req;	644	struct ahash_request *req;
641	int ret, fini;	645	int ret, fini;
642		646
643	do {	647	while (!kthread_should_stop()) {
644	__set_current_state(TASK_INTERRUPTIBLE);	648	set_current_state(TASK_INTERRUPTIBLE);
645		649
646	mutex_lock(&sdcp->mutex[chan]);	650	spin_lock(&sdcp->lock[chan]);
647	backlog = crypto_get_backlog(&sdcp->queue[chan]);	651	backlog = crypto_get_backlog(&sdcp->queue[chan]);
648	arq = crypto_dequeue_request(&sdcp->queue[chan]);	652	arq = crypto_dequeue_request(&sdcp->queue[chan]);
649	mutex_unlock(&sdcp->mutex[chan]);	653	spin_unlock(&sdcp->lock[chan]);
		654
		655	if (!backlog && !arq) {
		656	schedule();
		657	continue;
		658	}
		659
		660	set_current_state(TASK_RUNNING);
650		661
651	if (backlog)	662	if (backlog)
652	backlog->complete(backlog, -EINPROGRESS);	663	backlog->complete(backlog, -EINPROGRESS);
@@ -658,12 +669,8 @@ static int dcp_chan_thread_sha(void *data) · 5 unmodified lines
658	ret = dcp_sha_req_to_buf(arq);	669	ret = dcp_sha_req_to_buf(arq);
659	fini = rctx->fini;	670	fini = rctx->fini;
660	arq->complete(arq, ret);	671	arq->complete(arq, ret);
661	if (!fini)
662	continue;
663	}	672	}
664		673	}
665	schedule();
666	} while (!kthread_should_stop());
667		674
668	return 0;	675	return 0;
669	}	676	}
@@ -721,9 +728,9 @@ static int dcp_sha_update_fx(struct ahash_request *req, int fini) · 51 unmodified lines
721	rctx->init = 1;	728	rctx->init = 1;
722	}	729	}
723		730
724	mutex_lock(&sdcp->mutex[actx->chan]);	731	spin_lock(&sdcp->lock[actx->chan]);
725	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);	732	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
726	mutex_unlock(&sdcp->mutex[actx->chan]);	733	spin_unlock(&sdcp->lock[actx->chan]);
727		734
728	wake_up_process(sdcp->thread[actx->chan]);	735	wake_up_process(sdcp->thread[actx->chan]);
729	mutex_unlock(&actx->mutex);	736	mutex_unlock(&actx->mutex);
@@ -997,7 +1004,7 @@ static int mxs_dcp_probe(struct platform_device *pdev) · 267 unmodified lines
997	platform_set_drvdata(pdev, sdcp);	1004	platform_set_drvdata(pdev, sdcp);
998		1005
999	for (i = 0; i < DCP_MAX_CHANS; i++) {	1006	for (i = 0; i < DCP_MAX_CHANS; i++) {
1000	mutex_init(&sdcp->mutex[i]);	1007	spin_lock_init(&sdcp->lock[i]);
1001	init_completion(&sdcp->completion[i]);	1008	init_completion(&sdcp->completion[i]);
1002	crypto_init_queue(&sdcp->queue[i], 50);	1009	crypto_init_queue(&sdcp->queue[i], 50);
1003	}	1010	}

drivers/crypto/qat/qat_c3xxx/adf_drv.c+3−3

 	struct adf_hw_device_data *hw_data;
 	char name[ADF_DEVICE_NAME_LENGTH];
 	unsigned int i, bar_nr;
-	int ret, bar_mask;
+	unsigned long bar_mask;
+	int ret;
 	switch (ent->device) {
 	case ADF_C3XXX_PCI_DEVICE_ID:
 	/* Find and map all the device's BARS */
 	i = 0;
 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
-			 ADF_PCI_MAX_BARS * 2) {
 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
 		bar->base_addr = pci_resource_start(pdev, bar_nr);

drivers/crypto/qat/qat_c3xxxvf/adf_drv.c+3−3

 	struct adf_hw_device_data *hw_data;
 	char name[ADF_DEVICE_NAME_LENGTH];
 	unsigned int i, bar_nr;
-	int ret, bar_mask;
+	unsigned long bar_mask;
+	int ret;
 	switch (ent->device) {
 	case ADF_C3XXXIOV_PCI_DEVICE_ID:
 	/* Find and map all the device's BARS */
 	i = 0;
 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
-			 ADF_PCI_MAX_BARS * 2) {
 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
 		bar->base_addr = pci_resource_start(pdev, bar_nr);

drivers/crypto/qat/qat_c62x/adf_drv.c+3−3

 	struct adf_hw_device_data *hw_data;
 	char name[ADF_DEVICE_NAME_LENGTH];
 	unsigned int i, bar_nr;
-	int ret, bar_mask;
+	unsigned long bar_mask;
+	int ret;
 	switch (ent->device) {
 	case ADF_C62X_PCI_DEVICE_ID:
 	/* Find and map all the device's BARS */
 	i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
-			 ADF_PCI_MAX_BARS * 2) {
 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
 		bar->base_addr = pci_resource_start(pdev, bar_nr);

drivers/crypto/qat/qat_c62xvf/adf_drv.c+3−3

 	struct adf_hw_device_data *hw_data;
 	char name[ADF_DEVICE_NAME_LENGTH];
 	unsigned int i, bar_nr;
-	int ret, bar_mask;
+	unsigned long bar_mask;
+	int ret;
 	switch (ent->device) {
 	case ADF_C62XIOV_PCI_DEVICE_ID:
 	/* Find and map all the device's BARS */
 	i = 0;
 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
-			 ADF_PCI_MAX_BARS * 2) {
 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
 		bar->base_addr = pci_resource_start(pdev, bar_nr);

drivers/crypto/qat/qat_dh895xcc/adf_drv.c+3−3

 	struct adf_hw_device_data *hw_data;
 	char name[ADF_DEVICE_NAME_LENGTH];
 	unsigned int i, bar_nr;
-	int ret, bar_mask;
+	unsigned long bar_mask;
+	int ret;
 	switch (ent->device) {
 	case ADF_DH895XCC_PCI_DEVICE_ID:
 	/* Find and map all the device's BARS */
 	i = 0;
 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
-			 ADF_PCI_MAX_BARS * 2) {
 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
 		bar->base_addr = pci_resource_start(pdev, bar_nr);

drivers/crypto/qat/qat_dh895xccvf/adf_drv.c+3−3

 	struct adf_hw_device_data *hw_data;
 	char name[ADF_DEVICE_NAME_LENGTH];
 	unsigned int i, bar_nr;
-	int ret, bar_mask;
+	unsigned long bar_mask;
+	int ret;
 	switch (ent->device) {
 	case ADF_DH895XCCIOV_PCI_DEVICE_ID:
 	/* Find and map all the device's BARS */
 	i = 0;
 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
-			 ADF_PCI_MAX_BARS * 2) {
 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
 		bar->base_addr = pci_resource_start(pdev, bar_nr);

drivers/fpga/dfl-fme-region.c+3−1

  */
 #include <linux/module.h>
+#include <linux/fpga/fpga-mgr.h>
 #include <linux/fpga/fpga-region.h>
 #include "dfl-fme-pr.h"
 static int fme_region_remove(struct platform_device *pdev)
 {
 	struct fpga_region *region = dev_get_drvdata(&pdev->dev);
+	struct fpga_manager *mgr = region->mgr;
 	fpga_region_unregister(region);
-	fpga_mgr_put(region->mgr);
+	fpga_mgr_put(mgr);
 	return 0;
 }

drivers/fpga/fpga-bridge.c+1−1

@@ -125,7 +125,7 @@ static int fpga_bridge_dev_match(struct device dev, const void data) · 124 unmodified lines
125	*	125	*
126	* Given a device, get an exclusive reference to a fpga bridge.	126	* Given a device, get an exclusive reference to a fpga bridge.
127	*	127	*
128	* Return: fpga manager struct or IS_ERR() condition containing error code.	128	* Return: fpga bridge struct or IS_ERR() condition containing error code.
129	*/	129	*/
130	struct fpga_bridge fpga_bridge_get(struct device dev,	130	struct fpga_bridge fpga_bridge_get(struct device dev,
131	struct fpga_image_info *info)	131	struct fpga_image_info *info)

drivers/fpga/of-fpga-region.c+2−1

 static int of_fpga_region_remove(struct platform_device *pdev)
 {
 	struct fpga_region *region = platform_get_drvdata(pdev);
+	struct fpga_manager *mgr = region->mgr;
 	fpga_region_unregister(region);
-	fpga_mgr_put(region->mgr);
+	fpga_mgr_put(mgr);
 	return 0;
 }

drivers/gpio/gpiolib.c+1−1

@@ -571,7 +571,7 @@ static int linehandle_create(struct gpio_device gdev, void __user ip) · 570 unmodified lines
571	if (ret)	571	if (ret)
572	goto out_free_descs;	572	goto out_free_descs;
573	lh->descs[i] = desc;	573	lh->descs[i] = desc;
574	count = i;	574	count = i + 1;
575		575
576	if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)	576	if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
577	set_bit(FLAG_ACTIVE_LOW, &desc->flags);	577	set_bit(FLAG_ACTIVE_LOW, &desc->flags);

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c+29−8

 					struct queue *q,
 					struct qcm_process_device *qpd)
 {
-	int retval;
 	struct mqd_manager *mqd_mgr;
+	int retval;
 	mqd_mgr = dqm->ops.get_mqd_manager(dqm, KFD_MQD_TYPE_COMPUTE);
 	if (!mqd_mgr)
 	if (!q->properties.is_active)
 		return 0;
-	retval = mqd_mgr->load_mqd(mqd_mgr, q->mqd, q->pipe, q->queue,
+	if (WARN(q->process->mm != current->mm,
-			&q->properties, q->process->mm);
+		 "should only run in user thread"))
+		retval = -EFAULT;
+	else
+		retval = mqd_mgr->load_mqd(mqd_mgr, q->mqd, q->pipe, q->queue,
+					   &q->properties, current->mm);
 	if (retval)
 		goto out_uninit_mqd;
 		retval = map_queues_cpsch(dqm);
 	else if (q->properties.is_active &&
 		 (q->properties.type == KFD_QUEUE_TYPE_COMPUTE ||
-		  q->properties.type == KFD_QUEUE_TYPE_SDMA))
+		  q->properties.type == KFD_QUEUE_TYPE_SDMA)) {
-		retval = mqd_mgr->load_mqd(mqd_mgr, q->mqd, q->pipe, q->queue,
+		if (WARN(q->process->mm != current->mm,
-				       &q->properties, q->process->mm);
+			 "should only run in user thread"))
+			retval = -EFAULT;
+		else
+			retval = mqd_mgr->load_mqd(mqd_mgr, q->mqd,
+						   q->pipe, q->queue,
+						   &q->properties, current->mm);
+	}
 out_unlock:
 	dqm_unlock(dqm);
 static int restore_process_queues_nocpsch(struct device_queue_manager *dqm,
 					  struct qcm_process_device *qpd)
 {
+	struct mm_struct *mm = NULL;
 	struct queue *q;
 	struct mqd_manager *mqd_mgr;
 	struct kfd_process_device *pdd;
 		kfd_flush_tlb(pdd);
 	}
+	/* Take a safe reference to the mm_struct, which may otherwise
+	 * disappear even while the kfd_process is still referenced.
+	 */
+	mm = get_task_mm(pdd->process->lead_thread);
+	if (!mm) {
+		retval = -EFAULT;
+		goto out;
+	}
 	/* activate all active queues on the qpd */
 	list_for_each_entry(q, &qpd->queues_list, list) {
 		if (!q->properties.is_evicted)
 		q->properties.is_evicted = false;
 		q->properties.is_active = true;
 		retval = mqd_mgr->load_mqd(mqd_mgr, q->mqd, q->pipe,
-				       q->queue, &q->properties,
+				       q->queue, &q->properties, mm);
-				       q->process->mm);
 		if (retval)
 			goto out;
 		dqm->queue_count++;
 	}
 	qpd->evicted = 0;
 out:
+	if (mm)
+		mmput(mm);
 	dqm_unlock(dqm);
 	return retval;
 }

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+8−2

 	}
 	spin_unlock_irqrestore(&adev->ddev->event_lock, flags);
-	/* Signal HW programming completion */
-	drm_atomic_helper_commit_hw_done(state);
 	if (wait_for_vblank)
 		drm_atomic_helper_wait_for_flip_done(dev, state);
+	/*
+	 * FIXME:
+	 * Delay hw_done() until flip_done() is signaled. This is to block
+	 * another commit from freeing the CRTC state while we're still
+	 * waiting on flip_done.
+	 */
+	drm_atomic_helper_commit_hw_done(state);
 	drm_atomic_helper_cleanup_planes(dev, state);
 	/* Finally, drop a runtime PM reference for each newly disabled CRTC,

drivers/gpu/drm/drm_client.c+26−9

 EXPORT_SYMBOL(drm_client_close);
 /**
- * drm_client_new - Create a DRM client
+ * drm_client_init - Initialise a DRM client
  * @dev: DRM device
  * @client: DRM client
  * @name: Client name
  * @funcs: DRM client functions (optional)
  *
+ * This initialises the client and opens a &drm_file. Use drm_client_add() to complete the process.
  * The caller needs to hold a reference on @dev before calling this function.
  * The client is freed when the &drm_device is unregistered. See drm_client_release().
  *
  * Returns:
  * Zero on success or negative error code on failure.
  */
-int drm_client_new(struct drm_device *dev, struct drm_client_dev *client,
+int drm_client_init(struct drm_device *dev, struct drm_client_dev *client,
-		   const char *name, const struct drm_client_funcs *funcs)
+		    const char *name, const struct drm_client_funcs *funcs)
 {
 	int ret;
 	if (ret)
 		goto err_put_module;
-	mutex_lock(&dev->clientlist_mutex);
-	list_add(&client->list, &dev->clientlist);
-	mutex_unlock(&dev->clientlist_mutex);
 	drm_dev_get(dev);
 	return 0;
 	return ret;
 }
-EXPORT_SYMBOL(drm_client_new);
+EXPORT_SYMBOL(drm_client_init);
+/**
+ * drm_client_add - Add client to the device list
+ * @client: DRM client
+ *
+ * Add the client to the &drm_device client list to activate its callbacks.
+ * @client must be initialized by a call to drm_client_init(). After
+ * drm_client_add() it is no longer permissible to call drm_client_release()
+ * directly (outside the unregister callback), instead cleanup will happen
+ * automatically on driver unload.
+ */
+void drm_client_add(struct drm_client_dev *client)
+{
+	struct drm_device *dev = client->dev;
+	mutex_lock(&dev->clientlist_mutex);
+	list_add(&client->list, &dev->clientlist);
+	mutex_unlock(&dev->clientlist_mutex);
+}
+EXPORT_SYMBOL(drm_client_add);
 /**
  * drm_client_release - Release DRM client resources
  * @client: DRM client
  *
- * Releases resources by closing the &drm_file that was opened by drm_client_new().
+ * Releases resources by closing the &drm_file that was opened by drm_client_init().
  * It is called automatically if the &drm_client_funcs.unregister callback is _not_ set.
  *
  * This function should only be called from the unregister callback. An exception

drivers/gpu/drm/drm_fb_cma_helper.c+3−1

 	fb_helper = &fbdev_cma->fb_helper;
-	ret = drm_client_new(dev, &fb_helper->client, "fbdev", NULL);
+	ret = drm_client_init(dev, &fb_helper->client, "fbdev", NULL);
 	if (ret)
 		goto err_free;
 	if (ret)
 		goto err_client_put;
+	drm_client_add(&fb_helper->client);
 	return fbdev_cma;
 err_client_put:

drivers/gpu/drm/drm_fb_helper.c+3−1

 	if (!fb_helper)
 		return -ENOMEM;
-	ret = drm_client_new(dev, &fb_helper->client, "fbdev", &drm_fbdev_client_funcs);
+	ret = drm_client_init(dev, &fb_helper->client, "fbdev", &drm_fbdev_client_funcs);
 	if (ret) {
 		kfree(fb_helper);
 		return ret;
 	}
+	drm_client_add(&fb_helper->client);
 	fb_helper->preferred_bpp = preferred_bpp;
 	drm_fbdev_client_hotplug(&fb_helper->client);

drivers/gpu/drm/drm_lease.c+3−3

 	lessee_priv->is_master = 1;
 	lessee_priv->authenticated = 1;
-	/* Hook up the fd */
-	fd_install(fd, lessee_file);
 	/* Pass fd back to userspace */
 	DRM_DEBUG_LEASE("Returning fd %d id %d\n", fd, lessee->lessee_id);
 	cl->fd = fd;
 	cl->lessee_id = lessee->lessee_id;
+	/* Hook up the fd */
+	fd_install(fd, lessee_file);
 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
 	return 0;

drivers/gpu/drm/exynos/exynos_drm_iommu.h+6−28

 static inline int __exynos_iommu_create_mapping(struct exynos_drm_private *priv,
 					unsigned long start, unsigned long size)
 {
-	struct iommu_domain *domain;
+	priv->mapping = iommu_get_domain_for_dev(priv->dma_dev);
-	int ret;
-	domain = iommu_domain_alloc(priv->dma_dev->bus);
-	if (!domain)
-		return -ENOMEM;
-	ret = iommu_get_dma_cookie(domain);
-	if (ret)
-		goto free_domain;
-	ret = iommu_dma_init_domain(domain, start, size, NULL);
-	if (ret)
-		goto put_cookie;
-	priv->mapping = domain;
 	return 0;
-put_cookie:
-	iommu_put_dma_cookie(domain);
-free_domain:
-	iommu_domain_free(domain);
-	return ret;
 }
 static inline void __exynos_iommu_release_mapping(struct exynos_drm_private *priv)
 {
-	struct iommu_domain *domain = priv->mapping;
-	iommu_put_dma_cookie(domain);
-	iommu_domain_free(domain);
 	priv->mapping = NULL;
 }
 {
 	struct iommu_domain *domain = priv->mapping;
-	return iommu_attach_device(domain, dev);
+	if (dev != priv->dma_dev)
+		return iommu_attach_device(domain, dev);
+	return 0;
 }
 static inline void __exynos_iommu_detach(struct exynos_drm_private *priv,
 {
 	struct iommu_domain *domain = priv->mapping;
-	iommu_detach_device(domain, dev);
+	if (dev != priv->dma_dev)
+		iommu_detach_device(domain, dev);
 }
 #else
 #error Unsupported architecture and IOMMU/DMA-mapping glue code

drivers/gpu/drm/i2c/tda9950.c+3−2

 			break;
 		}
 		/* TDA9950 executes all retries for us */
-		tx_status |= CEC_TX_STATUS_MAX_RETRIES;
+		if (tx_status != CEC_TX_STATUS_OK)
+			tx_status |= CEC_TX_STATUS_MAX_RETRIES;
 		cec_transmit_done(priv->adap, tx_status, arb_lost_cnt,
 				  nack_cnt, 0, err_cnt);
 		break;
 	/* Wait up to .5s for it to signal non-busy */
 	do {
 		csr = tda9950_read(client, REG_CSR);
-		if (!(csr & CSR_BUSY) || --timeout)
+		if (!(csr & CSR_BUSY) || !--timeout)
 			break;
 		msleep(10);
 	} while (1);

drivers/gpu/drm/i915/i915_gpu_error.c+63−25

@@ -232,6 +232,20 @@ static bool compress_init(struct compress *c) · 231 unmodified lines
232	return true;	232	return true;
233	}	233	}
234		234
		235	static void compress_next_page(struct drm_i915_error_object dst)
		236	{
		237	unsigned long page;
		238
		239	if (dst->page_count >= dst->num_pages)
		240	return ERR_PTR(-ENOSPC);
		241
		242	page = __get_free_page(GFP_ATOMIC \| __GFP_NOWARN);
		243	if (!page)
		244	return ERR_PTR(-ENOMEM);
		245
		246	return dst->pages[dst->page_count++] = (void *)page;
		247	}
		248
235	static int compress_page(struct compress *c,	249	static int compress_page(struct compress *c,
236	void *src,	250	void *src,
237	struct drm_i915_error_object *dst)	251	struct drm_i915_error_object *dst)
@@ -245,19 +259,14 @@ static int compress_page(struct compress *c, · 7 unmodified lines
245		259
246	do {	260	do {
247	if (zstream->avail_out == 0) {	261	if (zstream->avail_out == 0) {
248	unsigned long page;	262	zstream->next_out = compress_next_page(dst);
249		263	if (IS_ERR(zstream->next_out))
250	page = __get_free_page(GFP_ATOMIC \| __GFP_NOWARN);	264	return PTR_ERR(zstream->next_out);
251	if (!page)
252	return -ENOMEM;
253		265
254	dst->pages[dst->page_count++] = (void *)page;
255
256	zstream->next_out = (void *)page;
257	zstream->avail_out = PAGE_SIZE;	266	zstream->avail_out = PAGE_SIZE;
258	}	267	}
259		268
260	if (zlib_deflate(zstream, Z_SYNC_FLUSH) != Z_OK)	269	if (zlib_deflate(zstream, Z_NO_FLUSH) != Z_OK)
261	return -EIO;	270	return -EIO;
262	} while (zstream->avail_in);	271	} while (zstream->avail_in);
263		272
@@ -268,19 +277,42 @@ static int compress_page(struct compress *c, · 4 unmodified lines
268	return 0;	277	return 0;
269	}	278	}
270		279
271	static void compress_fini(struct compress *c,	280	static int compress_flush(struct compress *c,
272	struct drm_i915_error_object *dst)	281	struct drm_i915_error_object *dst)
273	{	282	{
274	struct z_stream_s *zstream = &c->zstream;	283	struct z_stream_s *zstream = &c->zstream;
275		284
276	if (dst) {	285	do {
277	zlib_deflate(zstream, Z_FINISH);	286	switch (zlib_deflate(zstream, Z_FINISH)) {
278	dst->unused = zstream->avail_out;	287	case Z_OK: /* more space requested */
279	}	288	zstream->next_out = compress_next_page(dst);
		289	if (IS_ERR(zstream->next_out))
		290	return PTR_ERR(zstream->next_out);
		291
		292	zstream->avail_out = PAGE_SIZE;
		293	break;
		294
		295	case Z_STREAM_END:
		296	goto end;
		297
		298	default: /* any error */
		299	return -EIO;
		300	}
		301	} while (1);
		302
		303	end:
		304	memset(zstream->next_out, 0, zstream->avail_out);
		305	dst->unused = zstream->avail_out;
		306	return 0;
		307	}
		308
		309	static void compress_fini(struct compress *c,
		310	struct drm_i915_error_object *dst)
		311	{
		312	struct z_stream_s *zstream = &c->zstream;
280		313
281	zlib_deflateEnd(zstream);	314	zlib_deflateEnd(zstream);
282	kfree(zstream->workspace);	315	kfree(zstream->workspace);
283
284	if (c->tmp)	316	if (c->tmp)
285	free_page((unsigned long)c->tmp);	317	free_page((unsigned long)c->tmp);
286	}	318	}
@@ -319,6 +351,12 @@ static int compress_page(struct compress *c, · 32 unmodified lines
319	return 0;	351	return 0;
320	}	352	}
321		353
		354	static int compress_flush(struct compress *c,
		355	struct drm_i915_error_object *dst)
		356	{
		357	return 0;
		358	}
		359
322	static void compress_fini(struct compress *c,	360	static void compress_fini(struct compress *c,
323	struct drm_i915_error_object *dst)	361	struct drm_i915_error_object *dst)
324	{	362	{
@@ -917,6 +955,7 @@ i915_error_object_create(struct drm_i915_private *i915, · 592 unmodified lines
917	unsigned long num_pages;	955	unsigned long num_pages;
918	struct sgt_iter iter;	956	struct sgt_iter iter;
919	dma_addr_t dma;	957	dma_addr_t dma;
		958	int ret;
920		959
921	if (!vma)	960	if (!vma)
922	return NULL;	961	return NULL;
@@ -930,6 +969,7 @@ i915_error_object_create(struct drm_i915_private *i915, · 7 unmodified lines
930		969
931	dst->gtt_offset = vma->node.start;	970	dst->gtt_offset = vma->node.start;
932	dst->gtt_size = vma->node.size;	971	dst->gtt_size = vma->node.size;
		972	dst->num_pages = num_pages;
933	dst->page_count = 0;	973	dst->page_count = 0;
934	dst->unused = 0;	974	dst->unused = 0;
935		975
@@ -938,28 +978,26 @@ i915_error_object_create(struct drm_i915_private *i915, · 2 unmodified lines
938	return NULL;	978	return NULL;
939	}	979	}
940		980
		981	ret = -EINVAL;
941	for_each_sgt_dma(dma, iter, vma->pages) {	982	for_each_sgt_dma(dma, iter, vma->pages) {
942	void __iomem *s;	983	void __iomem *s;
943	int ret;
944		984
945	ggtt->vm.insert_page(&ggtt->vm, dma, slot, I915_CACHE_NONE, 0);	985	ggtt->vm.insert_page(&ggtt->vm, dma, slot, I915_CACHE_NONE, 0);
946		986
947	s = io_mapping_map_atomic_wc(&ggtt->iomap, slot);	987	s = io_mapping_map_atomic_wc(&ggtt->iomap, slot);
948	ret = compress_page(&compress, (void __force *)s, dst);	988	ret = compress_page(&compress, (void __force *)s, dst);
949	io_mapping_unmap_atomic(s);	989	io_mapping_unmap_atomic(s);
950
951	if (ret)	990	if (ret)
952	goto unwind;	991	break;
953	}	992	}
954	goto out;
955		993
956	unwind:	994	if (ret \|\| compress_flush(&compress, dst)) {
957	while (dst->page_count--)	995	while (dst->page_count--)
958	free_page((unsigned long)dst->pages[dst->page_count]);	996	free_page((unsigned long)dst->pages[dst->page_count]);
959	kfree(dst);	997	kfree(dst);
960	dst = NULL;	998	dst = NULL;
		999	}
961		1000
962	out:
963	compress_fini(&compress, dst);	1001	compress_fini(&compress, dst);
964	ggtt->vm.clear_range(&ggtt->vm, slot, PAGE_SIZE);	1002	ggtt->vm.clear_range(&ggtt->vm, slot, PAGE_SIZE);
965	return dst;	1003	return dst;

drivers/gpu/drm/i915/i915_gpu_error.h+1−0

@@ -135,6 +135,7 @@ struct i915_gpu_state { · 134 unmodified lines
135	struct drm_i915_error_object {	135	struct drm_i915_error_object {
136	u64 gtt_offset;	136	u64 gtt_offset;
137	u64 gtt_size;	137	u64 gtt_size;
		138	int num_pages;
138	int page_count;	139	int page_count;
139	int unused;	140	int unused;
140	u32 *pages[0];	141	u32 *pages[0];

drivers/gpu/drm/i915/i915_irq.c+12−21

 	spin_unlock(&i915->irq_lock);
 }
-static void
+static u32
-gen11_gu_misc_irq_ack(struct drm_i915_private *dev_priv, const u32 master_ctl,
+gen11_gu_misc_irq_ack(struct drm_i915_private *dev_priv, const u32 master_ctl)
-		      u32 *iir)
 {
 	void __iomem * const regs = dev_priv->regs;
+	u32 iir;
 	if (!(master_ctl & GEN11_GU_MISC_IRQ))
-		return;
+		return 0;
+	iir = raw_reg_read(regs, GEN11_GU_MISC_IIR);
+	if (likely(iir))
+		raw_reg_write(regs, GEN11_GU_MISC_IIR, iir);
-	*iir = raw_reg_read(regs, GEN11_GU_MISC_IIR);
+	return iir;
-	if (likely(*iir))
-		raw_reg_write(regs, GEN11_GU_MISC_IIR, *iir);
 }
 static void
-gen11_gu_misc_irq_handler(struct drm_i915_private *dev_priv,
+gen11_gu_misc_irq_handler(struct drm_i915_private *dev_priv, const u32 iir)
-			  const u32 master_ctl, const u32 iir)
 {
-	if (!(master_ctl & GEN11_GU_MISC_IRQ))
-		return;
-	if (unlikely(!iir)) {
-		DRM_ERROR("GU_MISC iir blank!\n");
-		return;
-	}
 	if (iir & GEN11_GU_MISC_GSE)
 		intel_opregion_asle_intr(dev_priv);
-	else
-		DRM_ERROR("Unexpected GU_MISC interrupt 0x%x\n", iir);
 }
 static irqreturn_t gen11_irq_handler(int irq, void *arg)
 		enable_rpm_wakeref_asserts(i915);
 	}
-	gen11_gu_misc_irq_ack(i915, master_ctl, &gu_misc_iir);
+	gu_misc_iir = gen11_gu_misc_irq_ack(i915, master_ctl);
 	/* Acknowledge and enable interrupts. */
 	raw_reg_write(regs, GEN11_GFX_MSTR_IRQ, GEN11_MASTER_IRQ | master_ctl);
-	gen11_gu_misc_irq_handler(i915, master_ctl, gu_misc_iir);
+	gen11_gu_misc_irq_handler(i915, gu_misc_iir);
 	return IRQ_HANDLED;
 }

drivers/gpu/drm/i915/i915_pci.c+0−1

@@ -592,7 +592,6 @@ static const struct intel_device_info intel_cannonlake_info = { · 591 unmodified lines
592	GEN10_FEATURES, \	592	GEN10_FEATURES, \
593	GEN(11), \	593	GEN(11), \
594	.ddb_size = 2048, \	594	.ddb_size = 2048, \
595	.has_csr = 0, \
596	.has_logical_ring_elsq = 1	595	.has_logical_ring_elsq = 1
597		596
598	static const struct intel_device_info intel_icelake_11_info = {	597	static const struct intel_device_info intel_icelake_11_info = {

drivers/hid/hid-ids.h+0−1

@@ -976,7 +976,6 @@ · 975 unmodified lines
976	#define USB_DEVICE_ID_SIS817_TOUCH 0x0817	976	#define USB_DEVICE_ID_SIS817_TOUCH 0x0817
977	#define USB_DEVICE_ID_SIS_TS 0x1013	977	#define USB_DEVICE_ID_SIS_TS 0x1013
978	#define USB_DEVICE_ID_SIS1030_TOUCH 0x1030	978	#define USB_DEVICE_ID_SIS1030_TOUCH 0x1030
979	#define USB_DEVICE_ID_SIS10FB_TOUCH 0x10fb
980		979
981	#define USB_VENDOR_ID_SKYCABLE 0x1223	980	#define USB_VENDOR_ID_SKYCABLE 0x1223
982	#define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER 0x3F07	981	#define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER 0x3F07

drivers/hid/i2c-hid/i2c-hid.c+10−17

 /* quirks to control the device */
 #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV	BIT(0)
 #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET	BIT(1)
-#define I2C_HID_QUIRK_RESEND_REPORT_DESCR	BIT(2)
+#define I2C_HID_QUIRK_NO_RUNTIME_PM		BIT(2)
 /* flags */
 #define I2C_HID_STARTED		0
 	{ USB_VENDOR_ID_WEIDA, USB_DEVICE_ID_WEIDA_8755,
 		I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
 	{ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
-		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
-	{ USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH,
+		I2C_HID_QUIRK_NO_RUNTIME_PM },
-		I2C_HID_QUIRK_RESEND_REPORT_DESCR },
 	{ 0, 0 }
 };
 		goto err_mem_free;
 	}
-	pm_runtime_put(&client->dev);
+	if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
+		pm_runtime_put(&client->dev);
 	return 0;
 err_mem_free:
 	struct i2c_hid *ihid = i2c_get_clientdata(client);
 	struct hid_device *hid;
-	pm_runtime_get_sync(&client->dev);
+	if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
+		pm_runtime_get_sync(&client->dev);
 	pm_runtime_disable(&client->dev);
 	pm_runtime_set_suspended(&client->dev);
 	pm_runtime_put_noidle(&client->dev);
 	/* Instead of resetting device, simply powers the device on. This
 	 * solves "incomplete reports" on Raydium devices 2386:3118 and
-	 * 2386:4B33
+	 * 2386:4B33 and fixes various SIS touchscreens no longer sending
+	 * data after a suspend/resume.
 	 */
 	ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
 	if (ret)
 		return ret;
-	/* Some devices need to re-send report descr cmd
-	 * after resume, after this it will be back normal.
-	 * otherwise it issues too many incomplete reports.
-	 */
-	if (ihid->quirks & I2C_HID_QUIRK_RESEND_REPORT_DESCR) {
-		ret = i2c_hid_command(client, &hid_report_descr_cmd, NULL, 0);
-		if (ret)
-			return ret;
-	}
 	if (hid->driver && hid->driver->reset_resume) {
 		ret = hid->driver->reset_resume(hid);
 		return ret;

drivers/hid/intel-ish-hid/ipc/hw-ish.h+1−0

@@ -29,6 +29,7 @@ · 28 unmodified lines
29	#define CNL_Ax_DEVICE_ID 0x9DFC	29	#define CNL_Ax_DEVICE_ID 0x9DFC
30	#define GLK_Ax_DEVICE_ID 0x31A2	30	#define GLK_Ax_DEVICE_ID 0x31A2
31	#define CNL_H_DEVICE_ID 0xA37C	31	#define CNL_H_DEVICE_ID 0xA37C
		32	#define ICL_MOBILE_DEVICE_ID 0x34FC
32	#define SPT_H_DEVICE_ID 0xA135	33	#define SPT_H_DEVICE_ID 0xA135
33		34
34	#define REVISION_ID_CHT_A0 0x6	35	#define REVISION_ID_CHT_A0 0x6

drivers/hid/intel-ish-hid/ipc/pci-ish.c+1−0

@@ -38,6 +38,7 @@ static const struct pci_device_id ish_pci_tbl[] = { · 37 unmodified lines
38	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_Ax_DEVICE_ID)},	38	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_Ax_DEVICE_ID)},
39	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, GLK_Ax_DEVICE_ID)},	39	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, GLK_Ax_DEVICE_ID)},
40	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_H_DEVICE_ID)},	40	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_H_DEVICE_ID)},
		41	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, ICL_MOBILE_DEVICE_ID)},
41	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},	42	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},
42	{0, }	43	{0, }
43	};	44	};

drivers/hv/connection.c+5−3

 					__u32 version)
 {
 	int ret = 0;
+	unsigned int cur_cpu;
 	struct vmbus_channel_initiate_contact *msg;
 	unsigned long flags;
 	 * the CPU attempting to connect may not be CPU 0.
 	 */
 	if (version >= VERSION_WIN8_1) {
-		msg->target_vcpu =
+		cur_cpu = get_cpu();
-			hv_cpu_number_to_vp_number(smp_processor_id());
+		msg->target_vcpu = hv_cpu_number_to_vp_number(cur_cpu);
-		vmbus_connection.connect_cpu = smp_processor_id();
+		vmbus_connection.connect_cpu = cur_cpu;
+		put_cpu();
 	} else {
 		msg->target_vcpu = 0;
 		vmbus_connection.connect_cpu = 0;

drivers/i2c/busses/i2c-designware-master.c+3−1

 static int i2c_dw_set_timings_master(struct dw_i2c_dev *dev)
 {
-	u32 ic_clk = i2c_dw_clk_rate(dev);
 	const char *mode_str, *fp_str = "";
 	u32 comp_param1;
 	u32 sda_falling_time, scl_falling_time;
 	struct i2c_timings *t = &dev->timings;
+	u32 ic_clk;
 	int ret;
 	ret = i2c_dw_acquire_lock(dev);
 	/* Calculate SCL timing parameters for standard mode if not set */
 	if (!dev->ss_hcnt || !dev->ss_lcnt) {
+		ic_clk = i2c_dw_clk_rate(dev);
 		dev->ss_hcnt =
 			i2c_dw_scl_hcnt(ic_clk,
 					4000,	/* tHD;STA = tHIGH = 4.0 us */
 	 * needed also in high speed mode.
 	 */
 	if (!dev->fs_hcnt || !dev->fs_lcnt) {
+		ic_clk = i2c_dw_clk_rate(dev);
 		dev->fs_hcnt =
 			i2c_dw_scl_hcnt(ic_clk,
 					600,	/* tHD;STA = tHIGH = 0.6 us */

drivers/i2c/busses/i2c-isch.c+1−1

@@ -164,7 +164,7 @@ static s32 sch_access(struct i2c_adapter *adap, u16 addr, · 163 unmodified lines
164	* run ~75 kHz instead which should do no harm.	164	* run ~75 kHz instead which should do no harm.
165	*/	165	*/
166	dev_notice(&sch_adapter.dev,	166	dev_notice(&sch_adapter.dev,
167	"Clock divider unitialized. Setting defaults\n");	167	"Clock divider uninitialized. Setting defaults\n");
168	outw(backbone_speed / (4 * 100), SMBHSTCLK);	168	outw(backbone_speed / (4 * 100), SMBHSTCLK);
169	}	169	}
170		170

drivers/i2c/busses/i2c-qcom-geni.c+18−4

 	dma_addr_t rx_dma;
 	enum geni_se_xfer_mode mode;
 	unsigned long time_left = XFER_TIMEOUT;
+	void *dma_buf;
 	gi2c->cur = msg;
-	mode = msg->len > 32 ? GENI_SE_DMA : GENI_SE_FIFO;
+	mode = GENI_SE_FIFO;
+	dma_buf = i2c_get_dma_safe_msg_buf(msg, 32);
+	if (dma_buf)
+		mode = GENI_SE_DMA;
 	geni_se_select_mode(&gi2c->se, mode);
 	writel_relaxed(msg->len, gi2c->se.base + SE_I2C_RX_TRANS_LEN);
 	geni_se_setup_m_cmd(&gi2c->se, I2C_READ, m_param);
 	if (mode == GENI_SE_DMA) {
 		int ret;
-		ret = geni_se_rx_dma_prep(&gi2c->se, msg->buf, msg->len,
+		ret = geni_se_rx_dma_prep(&gi2c->se, dma_buf, msg->len,
 								&rx_dma);
 		if (ret) {
 			mode = GENI_SE_FIFO;
 			geni_se_select_mode(&gi2c->se, mode);
+			i2c_put_dma_safe_msg_buf(dma_buf, msg, false);
 		}
 	}
 		if (gi2c->err)
 			geni_i2c_rx_fsm_rst(gi2c);
 		geni_se_rx_dma_unprep(&gi2c->se, rx_dma, msg->len);
+		i2c_put_dma_safe_msg_buf(dma_buf, msg, !gi2c->err);
 	}
 	return gi2c->err;
 }
 	dma_addr_t tx_dma;
 	enum geni_se_xfer_mode mode;
 	unsigned long time_left;
+	void *dma_buf;
 	gi2c->cur = msg;
-	mode = msg->len > 32 ? GENI_SE_DMA : GENI_SE_FIFO;
+	mode = GENI_SE_FIFO;
+	dma_buf = i2c_get_dma_safe_msg_buf(msg, 32);
+	if (dma_buf)
+		mode = GENI_SE_DMA;
 	geni_se_select_mode(&gi2c->se, mode);
 	writel_relaxed(msg->len, gi2c->se.base + SE_I2C_TX_TRANS_LEN);
 	geni_se_setup_m_cmd(&gi2c->se, I2C_WRITE, m_param);
 	if (mode == GENI_SE_DMA) {
 		int ret;
-		ret = geni_se_tx_dma_prep(&gi2c->se, msg->buf, msg->len,
+		ret = geni_se_tx_dma_prep(&gi2c->se, dma_buf, msg->len,
 								&tx_dma);
 		if (ret) {
 			mode = GENI_SE_FIFO;
 			geni_se_select_mode(&gi2c->se, mode);
+			i2c_put_dma_safe_msg_buf(dma_buf, msg, false);
 		}
 	}
 		if (gi2c->err)
 			geni_i2c_tx_fsm_rst(gi2c);
 		geni_se_tx_dma_unprep(&gi2c->se, tx_dma, msg->len);
+		i2c_put_dma_safe_msg_buf(dma_buf, msg, !gi2c->err);
 	}
 	return gi2c->err;
 }

drivers/i2c/busses/i2c-scmi.c+1−0

@@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, · 151 unmodified lines
152	mt_params[3].type = ACPI_TYPE_INTEGER;	152	mt_params[3].type = ACPI_TYPE_INTEGER;
153	mt_params[3].integer.value = len;	153	mt_params[3].integer.value = len;
154	mt_params[4].type = ACPI_TYPE_BUFFER;	154	mt_params[4].type = ACPI_TYPE_BUFFER;
		155	mt_params[4].buffer.length = len;
155	mt_params[4].buffer.pointer = data->block + 1;	156	mt_params[4].buffer.pointer = data->block + 1;
156	}	157	}
157	break;	158	break;

drivers/iommu/amd_iommu.c+1−1

@@ -3069,7 +3069,7 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom, · 3068 unmodified lines
3069	return 0;	3069	return 0;
3070		3070
3071	offset_mask = pte_pgsize - 1;	3071	offset_mask = pte_pgsize - 1;
3072	__pte = *pte & PM_ADDR_MASK;	3072	__pte = __sme_clr(*pte & PM_ADDR_MASK);
3073		3073
3074	return (__pte & ~offset_mask) \| (iova & offset_mask);	3074	return (__pte & ~offset_mask) \| (iova & offset_mask);
3075	}	3075	}

drivers/md/dm-cache-metadata.c+2−2

@@ -1455,8 +1455,8 @@ static int __load_mappings(struct dm_cache_metadata *cmd, · 1454 unmodified lines
1455	if (hints_valid) {	1455	if (hints_valid) {
1456	r = dm_array_cursor_next(&cmd->hint_cursor);	1456	r = dm_array_cursor_next(&cmd->hint_cursor);
1457	if (r) {	1457	if (r) {
1458	DMERR("dm_array_cursor_next for hint failed");	1458	dm_array_cursor_end(&cmd->hint_cursor);
1459	goto out;	1459	hints_valid = false;
1460	}	1460	}
1461	}	1461	}
1462		1462

drivers/md/dm-cache-target.c+7−2

 static bool can_resize(struct cache *cache, dm_cblock_t new_size)
 {
-	if (from_cblock(new_size) > from_cblock(cache->cache_size))
+	if (from_cblock(new_size) > from_cblock(cache->cache_size)) {
-		return true;
+		if (cache->sized) {
+			DMERR("%s: unable to extend cache due to missing cache table reload",
+			      cache_device_name(cache));
+			return false;
+		}
+	}
 	/*
 	 * We can't drop a dirty block when shrinking the cache.

drivers/md/dm-mpath.c+8−6

 }
 static int setup_scsi_dh(struct block_device *bdev, struct multipath *m,
-			 const char *attached_handler_name, char **error)
+			 const char **attached_handler_name, char **error)
 {
 	struct request_queue *q = bdev_get_queue(bdev);
 	int r;
 	if (test_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags)) {
 retain:
-		if (attached_handler_name) {
+		if (*attached_handler_name) {
 			/*
 			 * Clear any hw_handler_params associated with a
 			 * handler that isn't already attached.
 			 */
-			if (m->hw_handler_name && strcmp(attached_handler_name, m->hw_handler_name)) {
+			if (m->hw_handler_name && strcmp(*attached_handler_name, m->hw_handler_name)) {
 				kfree(m->hw_handler_params);
 				m->hw_handler_params = NULL;
 			}
 			 * handler instead of the original table passed in.
 			 */
 			kfree(m->hw_handler_name);
-			m->hw_handler_name = attached_handler_name;
+			m->hw_handler_name = *attached_handler_name;
+			*attached_handler_name = NULL;
 		}
 	}
 	struct pgpath *p;
 	struct multipath *m = ti->private;
 	struct request_queue *q;
-	const char *attached_handler_name;
+	const char *attached_handler_name = NULL;
 	/* we need at least a path arg */
 	if (as->argc < 1) {
 	attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
 	if (attached_handler_name || m->hw_handler_name) {
 		INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
-		r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
+		r = setup_scsi_dh(p->path.dev->bdev, m, &attached_handler_name, &ti->error);
 		if (r) {
 			dm_put_device(ti, p->path.dev);
 			goto bad;
 	return p;
  bad:
+	kfree(attached_handler_name);
 	free_pgpath(p);
 	return ERR_PTR(r);
 }

drivers/md/dm-raid.c+1−1

@@ -3353,7 +3353,7 @@ static const char *sync_str(enum sync_state state) · 3352 unmodified lines
3353	};	3353	};
3354		3354
3355	/* Return enum sync_state for @mddev derived from @recovery flags */	3355	/* Return enum sync_state for @mddev derived from @recovery flags */
3356	static const enum sync_state decipher_sync_action(struct mddev *mddev, unsigned long recovery)	3356	static enum sync_state decipher_sync_action(struct mddev *mddev, unsigned long recovery)
3357	{	3357	{
3358	if (test_bit(MD_RECOVERY_FROZEN, &recovery))	3358	if (test_bit(MD_RECOVERY_FROZEN, &recovery))
3359	return st_frozen;	3359	return st_frozen;

drivers/md/dm-thin-metadata.c+2−4

 	if (r) {
 		DMERR("could not get size of metadata device");
 		pmd->metadata_reserve = max_blocks;
-	} else {
+	} else
-		sector_div(total, 10);
+		pmd->metadata_reserve = min(max_blocks, div_u64(total, 10));
-		pmd->metadata_reserve = min(max_blocks, total);
-	}
 }
 struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,

drivers/media/v4l2-core/v4l2-event.c+20−18

 	if (sev == NULL)
 		return;
-	/*
-	 * If the event has been added to the fh->subscribed list, but its
-	 * add op has not completed yet elems will be 0, treat this as
-	 * not being subscribed.
-	 */
-	if (!sev->elems)
-		return;
 	/* Increase event sequence number on fh. */
 	fh->sequence++;
 	struct v4l2_subscribed_event *sev, *found_ev;
 	unsigned long flags;
 	unsigned i;
+	int ret = 0;
 	if (sub->type == V4L2_EVENT_ALL)
 		return -EINVAL;
 	sev->flags = sub->flags;
 	sev->fh = fh;
 	sev->ops = ops;
+	sev->elems = elems;
+	mutex_lock(&fh->subscribe_lock);
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 	found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
-	if (!found_ev)
-		list_add(&sev->list, &fh->subscribed);
 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 	if (found_ev) {
+		/* Already listening */
 		kvfree(sev);
-		return 0; /* Already listening */
+		goto out_unlock;
 	}
 	if (sev->ops && sev->ops->add) {
-		int ret = sev->ops->add(sev, elems);
+		ret = sev->ops->add(sev, elems);
 		if (ret) {
-			sev->ops = NULL;
+			kvfree(sev);
-			v4l2_event_unsubscribe(fh, sub);
+			goto out_unlock;
-			return ret;
 		}
 	}
-	/* Mark as ready for use */
+	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-	sev->elems = elems;
+	list_add(&sev->list, &fh->subscribed);
+	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-	return 0;
+out_unlock:
+	mutex_unlock(&fh->subscribe_lock);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
 		return 0;
 	}
+	mutex_lock(&fh->subscribe_lock);
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 	sev = v4l2_event_subscribed(fh, sub->type, sub->id);
 	if (sev && sev->ops && sev->ops->del)
 		sev->ops->del(sev);
+	mutex_unlock(&fh->subscribe_lock);
 	kvfree(sev);
 	return 0;

drivers/media/v4l2-core/v4l2-fh.c+2−0

 	INIT_LIST_HEAD(&fh->available);
 	INIT_LIST_HEAD(&fh->subscribed);
 	fh->sequence = -1;
+	mutex_init(&fh->subscribe_lock);
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_init);
 		return;
 	v4l_disable_media_source(fh->vdev);
 	v4l2_event_unsubscribe_all(fh);
+	mutex_destroy(&fh->subscribe_lock);
 	fh->vdev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_exit);

drivers/mmc/core/host.c+1−1

@@ -235,7 +235,7 @@ int mmc_of_parse(struct mmc_host *host) · 234 unmodified lines
235	host->caps \|= MMC_CAP_NEEDS_POLL;	235	host->caps \|= MMC_CAP_NEEDS_POLL;
236		236
237	ret = mmc_gpiod_request_cd(host, "cd", 0, true,	237	ret = mmc_gpiod_request_cd(host, "cd", 0, true,
238	cd_debounce_delay_ms,	238	cd_debounce_delay_ms * 1000,
239	&cd_gpio_invert);	239	&cd_gpio_invert);
240	if (!ret)	240	if (!ret)
241	dev_info(host->parent, "Got CD GPIO\n");	241	dev_info(host->parent, "Got CD GPIO\n");

drivers/mmc/core/slot-gpio.c+1−1

@@ -271,7 +271,7 @@ int mmc_gpiod_request_cd(struct mmc_host host, const char con_id, · 270 unmodified lines
271	if (debounce) {	271	if (debounce) {
272	ret = gpiod_set_debounce(desc, debounce);	272	ret = gpiod_set_debounce(desc, debounce);
273	if (ret < 0)	273	if (ret < 0)
274	ctx->cd_debounce_delay_ms = debounce;	274	ctx->cd_debounce_delay_ms = debounce / 1000;
275	}	275	}
276		276
277	if (gpio_invert)	277	if (gpio_invert)

drivers/mmc/host/renesas_sdhi_sys_dmac.c+2−1

@@ -498,7 +498,8 @@ static const struct soc_device_attribute gen3_soc_whitelist[] = { · 497 unmodified lines
498		498
499	static int renesas_sdhi_sys_dmac_probe(struct platform_device *pdev)	499	static int renesas_sdhi_sys_dmac_probe(struct platform_device *pdev)
500	{	500	{
501	if (of_device_get_match_data(&pdev->dev) == &of_rcar_gen3_compatible &&	501	if ((of_device_get_match_data(&pdev->dev) == &of_rcar_gen3_compatible \|\|
		502	of_device_get_match_data(&pdev->dev) == &of_rcar_r8a7795_compatible) &&
502	!soc_device_match(gen3_soc_whitelist))	503	!soc_device_match(gen3_soc_whitelist))
503	return -ENODEV;	504	return -ENODEV;
504		505

drivers/net/bonding/bond_main.c+37−28

 static void bond_slave_arr_handler(struct work_struct *work);
 static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act,
 				  int mod);
+static void bond_netdev_notify_work(struct work_struct *work);
 /*---------------------------- General routines -----------------------------*/
 		}
 	}
-	/* don't change skb->dev for link-local packets */
+	/* Link-local multicast packets should be passed to the
-	if (is_link_local_ether_addr(eth_hdr(skb)->h_dest))
+	 * stack on the link they arrive as well as pass them to the
+	 * bond-master device. These packets are mostly usable when
+	 * stack receives it with the link on which they arrive
+	 * (e.g. LLDP) they also must be available on master. Some of
+	 * the use cases include (but are not limited to): LLDP agents
+	 * that must be able to operate both on enslaved interfaces as
+	 * well as on bonds themselves; linux bridges that must be able
+	 * to process/pass BPDUs from attached bonds when any kind of
+	 * STP version is enabled on the network.
+	 */
+	if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) {
+		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+		if (nskb) {
+			nskb->dev = bond->dev;
+			nskb->queue_mapping = 0;
+			netif_rx(nskb);
+		}
 		return RX_HANDLER_PASS;
+	}
 	if (bond_should_deliver_exact_match(skb, slave, bond))
 		return RX_HANDLER_EXACT;
 			return NULL;
 		}
 	}
+	INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
 	return slave;
 }
 {
 	struct bonding *bond = bond_get_bond_by_slave(slave);
+	cancel_delayed_work_sync(&slave->notify_work);
 	if (BOND_MODE(bond) == BOND_MODE_8023AD)
 		kfree(SLAVE_AD_INFO(slave));
 	info->link_failure_count = slave->link_failure_count;
 }
-static void bond_netdev_notify(struct net_device *dev,
-			       struct netdev_bonding_info *info)
-{
-	rtnl_lock();
-	netdev_bonding_info_change(dev, info);
-	rtnl_unlock();
-}
 static void bond_netdev_notify_work(struct work_struct *_work)
 {
-	struct netdev_notify_work *w =
+	struct slave *slave = container_of(_work, struct slave,
-		container_of(_work, struct netdev_notify_work, work.work);
+					   notify_work.work);
+	if (rtnl_trylock()) {
+		struct netdev_bonding_info binfo;
-	bond_netdev_notify(w->dev, &w->bonding_info);
+		bond_fill_ifslave(slave, &binfo.slave);
-	dev_put(w->dev);
+		bond_fill_ifbond(slave->bond, &binfo.master);
-	kfree(w);
+		netdev_bonding_info_change(slave->dev, &binfo);
+		rtnl_unlock();
+	} else {
+		queue_delayed_work(slave->bond->wq, &slave->notify_work, 1);
+	}
 }
 void bond_queue_slave_event(struct slave *slave)
 {
-	struct bonding *bond = slave->bond;
+	queue_delayed_work(slave->bond->wq, &slave->notify_work, 0);
-	struct netdev_notify_work *nnw = kzalloc(sizeof(*nnw), GFP_ATOMIC);
-	if (!nnw)
-		return;
-	dev_hold(slave->dev);
-	nnw->dev = slave->dev;
-	bond_fill_ifslave(slave, &nnw->bonding_info.slave);
-	bond_fill_ifbond(bond, &nnw->bonding_info.master);
-	INIT_DELAYED_WORK(&nnw->work, bond_netdev_notify_work);
-	queue_delayed_work(slave->bond->wq, &nnw->work, 0);
 }
 void bond_lower_state_changed(struct slave *slave)

drivers/net/dsa/b53/b53_common.c+2−2

@@ -1107,7 +1107,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port, · 1106 unmodified lines
1107	b53_get_vlan_entry(dev, vid, vl);	1107	b53_get_vlan_entry(dev, vid, vl);
1108		1108
1109	vl->members \|= BIT(port);	1109	vl->members \|= BIT(port);
1110	if (untagged)	1110	if (untagged && !dsa_is_cpu_port(ds, port))
1111	vl->untag \|= BIT(port);	1111	vl->untag \|= BIT(port);
1112	else	1112	else
1113	vl->untag &= ~BIT(port);	1113	vl->untag &= ~BIT(port);
@@ -1149,7 +1149,7 @@ int b53_vlan_del(struct dsa_switch *ds, int port, · 35 unmodified lines
1149	pvid = 0;	1149	pvid = 0;
1150	}	1150	}
1151		1151
1152	if (untagged)	1152	if (untagged && !dsa_is_cpu_port(ds, port))
1153	vl->untag &= ~(BIT(port));	1153	vl->untag &= ~(BIT(port));
1154		1154
1155	b53_set_vlan_entry(dev, vid, vl);	1155	b53_set_vlan_entry(dev, vid, vl);

drivers/net/ethernet/amazon/ena/ena_netdev.c+0−22

@@ -2185,25 +2185,6 @@ error_drop_packet: · 2184 unmodified lines
2185	return NETDEV_TX_OK;	2185	return NETDEV_TX_OK;
2186	}	2186	}
2187		2187
2188	#ifdef CONFIG_NET_POLL_CONTROLLER
2189	static void ena_netpoll(struct net_device *netdev)
2190	{
2191	struct ena_adapter *adapter = netdev_priv(netdev);
2192	int i;
2193
2194	/* Dont schedule NAPI if the driver is in the middle of reset
2195	* or netdev is down.
2196	*/
2197
2198	if (!test_bit(ENA_FLAG_DEV_UP, &adapter->flags) \|\|
2199	test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))
2200	return;
2201
2202	for (i = 0; i < adapter->num_queues; i++)
2203	napi_schedule(&adapter->ena_napi[i].napi);
2204	}
2205	#endif /* CONFIG_NET_POLL_CONTROLLER */
2206
2207	static u16 ena_select_queue(struct net_device dev, struct sk_buff skb,	2188	static u16 ena_select_queue(struct net_device dev, struct sk_buff skb,
2208	struct net_device *sb_dev,	2189	struct net_device *sb_dev,
2209	select_queue_fallback_t fallback)	2190	select_queue_fallback_t fallback)
@@ -2369,9 +2350,6 @@ static const struct net_device_ops ena_netdev_ops = { · 159 unmodified lines
2369	.ndo_change_mtu = ena_change_mtu,	2350	.ndo_change_mtu = ena_change_mtu,
2370	.ndo_set_mac_address = NULL,	2351	.ndo_set_mac_address = NULL,
2371	.ndo_validate_addr = eth_validate_addr,	2352	.ndo_validate_addr = eth_validate_addr,
2372	#ifdef CONFIG_NET_POLL_CONTROLLER
2373	.ndo_poll_controller = ena_netpoll,
2374	#endif /* CONFIG_NET_POLL_CONTROLLER */
2375	};	2353	};
2376		2354
2377	static int ena_device_validate_params(struct ena_adapter *adapter,	2355	static int ena_device_validate_params(struct ena_adapter *adapter,

drivers/net/ethernet/amd/declance.c+6−4

 	int i, ret;
 	unsigned long esar_base;
 	unsigned char *esar;
+	const char *desc;
 	if (dec_lance_debug && version_printed++ == 0)
 		printk(version);
 	 */
 	switch (type) {
 	case ASIC_LANCE:
-		printk("%s: IOASIC onboard LANCE", name);
+		desc = "IOASIC onboard LANCE";
 		break;
 	case PMAD_LANCE:
-		printk("%s: PMAD-AA", name);
+		desc = "PMAD-AA";
 		break;
 	case PMAX_LANCE:
-		printk("%s: PMAX onboard LANCE", name);
+		desc = "PMAX onboard LANCE";
 		break;
 	}
 	for (i = 0; i < 6; i++)
 		dev->dev_addr[i] = esar[i * 4];
-	printk(", addr = %pM, irq = %d\n", dev->dev_addr, dev->irq);
+	printk("%s: %s, addr = %pM, irq = %d\n",
+	       name, desc, dev->dev_addr, dev->irq);
 	dev->netdev_ops = &lance_netdev_ops;
 	dev->watchdog_timeo = 5*HZ;

drivers/net/ethernet/broadcom/bcmsysport.c+11−17

 {
 	u32 reg;
-	/* Stop monitoring MPD interrupt */
-	intrl2_0_mask_set(priv, INTRL2_0_MPD | INTRL2_0_BRCM_MATCH_TAG);
 	/* Disable RXCHK, active filters and Broadcom tag matching */
 	reg = rxchk_readl(priv, RXCHK_CONTROL);
 	reg &= ~(RXCHK_BRCM_TAG_MATCH_MASK <<
 	/* Clear the MagicPacket detection logic */
 	mpd_enable_set(priv, false);
+	reg = intrl2_0_readl(priv, INTRL2_CPU_STATUS);
+	if (reg & INTRL2_0_MPD)
+		netdev_info(priv->netdev, "Wake-on-LAN (MPD) interrupt!\n");
+	if (reg & INTRL2_0_BRCM_MATCH_TAG) {
+		reg = rxchk_readl(priv, RXCHK_BRCM_TAG_MATCH_STATUS) &
+				  RXCHK_BRCM_TAG_MATCH_MASK;
+		netdev_info(priv->netdev,
+			    "Wake-on-LAN (filters 0x%02x) interrupt!\n", reg);
+	}
 	netif_dbg(priv, wol, priv->netdev, "resumed from WOL\n");
 }
 	struct bcm_sysport_priv *priv = netdev_priv(dev);
 	struct bcm_sysport_tx_ring *txr;
 	unsigned int ring, ring_bit;
-	u32 reg;
 	priv->irq0_stat = intrl2_0_readl(priv, INTRL2_CPU_STATUS) &
 			  ~intrl2_0_readl(priv, INTRL2_CPU_MASK_STATUS);
 	if (priv->irq0_stat & INTRL2_0_TX_RING_FULL)
 		bcm_sysport_tx_reclaim_all(priv);
-	if (priv->irq0_stat & INTRL2_0_MPD)
-		netdev_info(priv->netdev, "Wake-on-LAN (MPD) interrupt!\n");
-	if (priv->irq0_stat & INTRL2_0_BRCM_MATCH_TAG) {
-		reg = rxchk_readl(priv, RXCHK_BRCM_TAG_MATCH_STATUS) &
-				  RXCHK_BRCM_TAG_MATCH_MASK;
-		netdev_info(priv->netdev,
-			    "Wake-on-LAN (filters 0x%02x) interrupt!\n", reg);
-	}
 	if (!priv->is_lite)
 		goto out;
 	/* UniMAC receive needs to be turned on */
 	umac_enable_set(priv, CMD_RX_EN, 1);
-	/* Enable the interrupt wake-up source */
-	intrl2_0_mask_clear(priv, INTRL2_0_MPD | INTRL2_0_BRCM_MATCH_TAG);
 	netif_dbg(priv, wol, ndev, "entered WOL mode\n");
 	return 0;

drivers/net/ethernet/broadcom/bnxt/bnxt.c+18−9

@@ -1884,8 +1884,11 @@ static int bnxt_poll_work(struct bnxt bp, struct bnxt_napi bnapi, int budget) · 1883 unmodified lines
1884	if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) {	1884	if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) {
1885	tx_pkts++;	1885	tx_pkts++;
1886	/* return full budget so NAPI will complete. */	1886	/* return full budget so NAPI will complete. */
1887	if (unlikely(tx_pkts > bp->tx_wake_thresh))	1887	if (unlikely(tx_pkts > bp->tx_wake_thresh)) {
1888	rx_pkts = budget;	1888	rx_pkts = budget;
		1889	raw_cons = NEXT_RAW_CMP(raw_cons);
		1890	break;
		1891	}
1889	} else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {	1892	} else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
1890	if (likely(budget))	1893	if (likely(budget))
1891	rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);	1894	rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
@@ -1913,7 +1916,7 @@ static int bnxt_poll_work(struct bnxt bp, struct bnxt_napi bnapi, int budget) · 21 unmodified lines
1913	}	1916	}
1914	raw_cons = NEXT_RAW_CMP(raw_cons);	1917	raw_cons = NEXT_RAW_CMP(raw_cons);
1915		1918
1916	if (rx_pkts == budget)	1919	if (rx_pkts && rx_pkts == budget)
1917	break;	1920	break;
1918	}	1921	}
1919		1922
@@ -2027,8 +2030,12 @@ static int bnxt_poll(struct napi_struct *napi, int budget) · 107 unmodified lines
2027	while (1) {	2030	while (1) {
2028	work_done += bnxt_poll_work(bp, bnapi, budget - work_done);	2031	work_done += bnxt_poll_work(bp, bnapi, budget - work_done);
2029		2032
2030	if (work_done >= budget)	2033	if (work_done >= budget) {
		2034	if (!budget)
		2035	BNXT_CP_DB_REARM(cpr->cp_doorbell,
		2036	cpr->cp_raw_cons);
2031	break;	2037	break;
		2038	}
2032		2039
2033	if (!bnxt_has_work(bp, cpr)) {	2040	if (!bnxt_has_work(bp, cpr)) {
2034	if (napi_complete_done(napi, work_done))	2041	if (napi_complete_done(napi, work_done))
@@ -3010,10 +3017,11 @@ static void bnxt_free_hwrm_resources(struct bnxt *bp) · 975 unmodified lines
3010	{	3017	{
3011	struct pci_dev *pdev = bp->pdev;	3018	struct pci_dev *pdev = bp->pdev;
3012		3019
3013	dma_free_coherent(&pdev->dev, PAGE_SIZE, bp->hwrm_cmd_resp_addr,	3020	if (bp->hwrm_cmd_resp_addr) {
3014	bp->hwrm_cmd_resp_dma_addr);	3021	dma_free_coherent(&pdev->dev, PAGE_SIZE, bp->hwrm_cmd_resp_addr,
3015		3022	bp->hwrm_cmd_resp_dma_addr);
3016	bp->hwrm_cmd_resp_addr = NULL;	3023	bp->hwrm_cmd_resp_addr = NULL;
		3024	}
3017	}	3025	}
3018		3026
3019	static int bnxt_alloc_hwrm_resources(struct bnxt *bp)	3027	static int bnxt_alloc_hwrm_resources(struct bnxt *bp)
@@ -4643,7 +4651,7 @@ __bnxt_hwrm_reserve_pf_rings(struct bnxt bp, struct hwrm_func_cfg_input req, · 1623 unmodified lines
4643	FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;	4651	FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
4644	enables \|= ring_grps ?	4652	enables \|= ring_grps ?
4645	FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;	4653	FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
4646	enables \|= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;	4654	enables \|= vnics ? FUNC_CFG_REQ_ENABLES_NUM_VNICS : 0;
4647		4655
4648	req->num_rx_rings = cpu_to_le16(rx_rings);	4656	req->num_rx_rings = cpu_to_le16(rx_rings);
4649	req->num_hw_ring_grps = cpu_to_le16(ring_grps);	4657	req->num_hw_ring_grps = cpu_to_le16(ring_grps);
@@ -8614,7 +8622,7 @@ static void _bnxt_get_max_rings(struct bnxt bp, int max_rx, int *max_tx, · 3964 unmodified lines
8614	*max_tx = hw_resc->max_tx_rings;	8622	*max_tx = hw_resc->max_tx_rings;
8615	*max_rx = hw_resc->max_rx_rings;	8623	*max_rx = hw_resc->max_rx_rings;
8616	*max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),	8624	*max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),
8617	hw_resc->max_irqs);	8625	hw_resc->max_irqs - bnxt_get_ulp_msix_num(bp));
8618	max_cp = min_t(int, max_cp, hw_resc->max_stat_ctxs);	8626	max_cp = min_t(int, max_cp, hw_resc->max_stat_ctxs);
8619	max_ring_grps = hw_resc->max_hw_ring_grps;	8627	max_ring_grps = hw_resc->max_hw_ring_grps;
8620	if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {	8628	if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {
@@ -9050,6 +9058,7 @@ init_err_cleanup_tc: · 429 unmodified lines
9050	bnxt_clear_int_mode(bp);	9058	bnxt_clear_int_mode(bp);
9051		9059
9052	init_err_pci_clean:	9060	init_err_pci_clean:
		9061	bnxt_free_hwrm_resources(bp);
9053	bnxt_cleanup_pci(bp);	9062	bnxt_cleanup_pci(bp);
9054		9063
9055	init_err_free:	9064	init_err_free:

drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c+3−3

 	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_COS2BW_CFG, -1, -1);
 	for (i = 0; i < max_tc; i++) {
-		u8 qidx;
+		u8 qidx = bp->tc_to_qidx[i];
 		req.enables |= cpu_to_le32(
-			QUEUE_COS2BW_CFG_REQ_ENABLES_COS_QUEUE_ID0_VALID << i);
+			QUEUE_COS2BW_CFG_REQ_ENABLES_COS_QUEUE_ID0_VALID <<
+			qidx);
 		memset(&cos2bw, 0, sizeof(cos2bw));
-		qidx = bp->tc_to_qidx[i];
 		cos2bw.queue_id = bp->q_info[qidx].queue_id;
 		if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_STRICT) {
 			cos2bw.tsa =

drivers/net/ethernet/cadence/macb_main.c+1−0

@@ -2160,6 +2160,7 @@ static void macb_configure_dma(struct macb *bp) · 2159 unmodified lines
2160	else	2160	else
2161	dmacfg &= ~GEM_BIT(TXCOEN);	2161	dmacfg &= ~GEM_BIT(TXCOEN);
2162		2162
		2163	dmacfg &= ~GEM_BIT(ADDR64);
2163	#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT	2164	#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
2164	if (bp->hw_dma_cap & HW_DMA_CAP_64B)	2165	if (bp->hw_dma_cap & HW_DMA_CAP_64B)
2165	dmacfg \|= GEM_BIT(ADDR64);	2166	dmacfg \|= GEM_BIT(ADDR64);

drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c+17−0

 			return -EPERM;
 		if (copy_from_user(&t, useraddr, sizeof(t)))
 			return -EFAULT;
+		if (t.cmd != CHELSIO_SET_QSET_PARAMS)
+			return -EINVAL;
 		if (t.qset_idx >= SGE_QSETS)
 			return -EINVAL;
 		if (!in_range(t.intr_lat, 0, M_NEWTIMER) ||
 		if (copy_from_user(&t, useraddr, sizeof(t)))
 			return -EFAULT;
+		if (t.cmd != CHELSIO_GET_QSET_PARAMS)
+			return -EINVAL;
 		/* Display qsets for all ports when offload enabled */
 		if (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) {
 			q1 = 0;
 			return -EBUSY;
 		if (copy_from_user(&edata, useraddr, sizeof(edata)))
 			return -EFAULT;
+		if (edata.cmd != CHELSIO_SET_QSET_NUM)
+			return -EINVAL;
 		if (edata.val < 1 ||
 			(edata.val > 1 && !(adapter->flags & USING_MSIX)))
 			return -EINVAL;
 			return -EPERM;
 		if (copy_from_user(&t, useraddr, sizeof(t)))
 			return -EFAULT;
+		if (t.cmd != CHELSIO_LOAD_FW)
+			return -EINVAL;
 		/* Check t.len sanity ? */
 		fw_data = memdup_user(useraddr + sizeof(t), t.len);
 		if (IS_ERR(fw_data))
 			return -EBUSY;
 		if (copy_from_user(&m, useraddr, sizeof(m)))
 			return -EFAULT;
+		if (m.cmd != CHELSIO_SETMTUTAB)
+			return -EINVAL;
 		if (m.nmtus != NMTUS)
 			return -EINVAL;
 		if (m.mtus[0] < 81)	/* accommodate SACK */
 			return -EBUSY;
 		if (copy_from_user(&m, useraddr, sizeof(m)))
 			return -EFAULT;
+		if (m.cmd != CHELSIO_SET_PM)
+			return -EINVAL;
 		if (!is_power_of_2(m.rx_pg_sz) ||
 			!is_power_of_2(m.tx_pg_sz))
 			return -EINVAL;	/* not power of 2 */
 			return -EIO;	/* need the memory controllers */
 		if (copy_from_user(&t, useraddr, sizeof(t)))
 			return -EFAULT;
+		if (t.cmd != CHELSIO_GET_MEM)
+			return -EINVAL;
 		if ((t.addr & 7) || (t.len & 7))
 			return -EINVAL;
 		if (t.mem_id == MEM_CM)
 			return -EAGAIN;
 		if (copy_from_user(&t, useraddr, sizeof(t)))
 			return -EFAULT;
+		if (t.cmd != CHELSIO_SET_TRACE_FILTER)
+			return -EINVAL;
 		tp = (const struct trace_params *)&t.sip;
 		if (t.config_tx)

drivers/net/ethernet/emulex/benet/be_main.c+1−4

 	netdev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
 				   NETIF_F_TSO | NETIF_F_TSO6 |
 				   NETIF_F_GSO_UDP_TUNNEL;
-	netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
-	netdev->features |= NETIF_F_GSO_UDP_TUNNEL;
 	dev_info(dev, "Enabled VxLAN offloads for UDP port %d\n",
 		 be16_to_cpu(port));
 	adapter->vxlan_port = 0;
 	netdev->hw_enc_features = 0;
-	netdev->hw_features &= ~(NETIF_F_GSO_UDP_TUNNEL);
-	netdev->features &= ~(NETIF_F_GSO_UDP_TUNNEL);
 }
 static void be_calculate_vf_res(struct be_adapter *adapter, u16 num_vfs,
 	struct be_adapter *adapter = netdev_priv(netdev);
 	netdev->hw_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
+		NETIF_F_GSO_UDP_TUNNEL |
 		NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM |
 		NETIF_F_HW_VLAN_CTAG_TX;
 	if ((be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS))

drivers/net/ethernet/freescale/fec_main.c+4−4

@@ -1158,7 +1158,7 @@ static void fec_enet_timeout_work(struct work_struct *work) · 1157 unmodified lines
1158	napi_disable(&fep->napi);	1158	napi_disable(&fep->napi);
1159	netif_tx_lock_bh(ndev);	1159	netif_tx_lock_bh(ndev);
1160	fec_restart(ndev);	1160	fec_restart(ndev);
1161	netif_wake_queue(ndev);	1161	netif_tx_wake_all_queues(ndev);
1162	netif_tx_unlock_bh(ndev);	1162	netif_tx_unlock_bh(ndev);
1163	napi_enable(&fep->napi);	1163	napi_enable(&fep->napi);
1164	}	1164	}
@@ -1273,7 +1273,7 @@ skb_done: · 108 unmodified lines
1273		1273
1274	/* Since we have freed up a buffer, the ring is no longer full	1274	/* Since we have freed up a buffer, the ring is no longer full
1275	*/	1275	*/
1276	if (netif_queue_stopped(ndev)) {	1276	if (netif_tx_queue_stopped(nq)) {
1277	entries_free = fec_enet_get_free_txdesc_num(txq);	1277	entries_free = fec_enet_get_free_txdesc_num(txq);
1278	if (entries_free >= txq->tx_wake_threshold)	1278	if (entries_free >= txq->tx_wake_threshold)
1279	netif_tx_wake_queue(nq);	1279	netif_tx_wake_queue(nq);
@@ -1746,7 +1746,7 @@ static void fec_enet_adjust_link(struct net_device *ndev) · 466 unmodified lines
1746	napi_disable(&fep->napi);	1746	napi_disable(&fep->napi);
1747	netif_tx_lock_bh(ndev);	1747	netif_tx_lock_bh(ndev);
1748	fec_restart(ndev);	1748	fec_restart(ndev);
1749	netif_wake_queue(ndev);	1749	netif_tx_wake_all_queues(ndev);
1750	netif_tx_unlock_bh(ndev);	1750	netif_tx_unlock_bh(ndev);
1751	napi_enable(&fep->napi);	1751	napi_enable(&fep->napi);
1752	}	1752	}
@@ -2247,7 +2247,7 @@ static int fec_enet_set_pauseparam(struct net_device *ndev, · 494 unmodified lines
2247	napi_disable(&fep->napi);	2247	napi_disable(&fep->napi);
2248	netif_tx_lock_bh(ndev);	2248	netif_tx_lock_bh(ndev);
2249	fec_restart(ndev);	2249	fec_restart(ndev);
2250	netif_wake_queue(ndev);	2250	netif_tx_wake_all_queues(ndev);
2251	netif_tx_unlock_bh(ndev);	2251	netif_tx_unlock_bh(ndev);
2252	napi_enable(&fep->napi);	2252	napi_enable(&fep->napi);
2253	}	2253	}

drivers/net/ethernet/hisilicon/hns/hnae.c+1−1

@@ -84,7 +84,7 @@ static void hnae_unmap_buffer(struct hnae_ring ring, struct hnae_desc_cb cb) · 83 unmodified lines
84	if (cb->type == DESC_TYPE_SKB)	84	if (cb->type == DESC_TYPE_SKB)
85	dma_unmap_single(ring_to_dev(ring), cb->dma, cb->length,	85	dma_unmap_single(ring_to_dev(ring), cb->dma, cb->length,
86	ring_to_dma_dir(ring));	86	ring_to_dma_dir(ring));
87	else	87	else if (cb->length)
88	dma_unmap_page(ring_to_dev(ring), cb->dma, cb->length,	88	dma_unmap_page(ring_to_dev(ring), cb->dma, cb->length,
89	ring_to_dma_dir(ring));	89	ring_to_dma_dir(ring));
90	}	90	}

drivers/net/ethernet/hisilicon/hns/hns_enet.c+19−29

 #define SKB_TMP_LEN(SKB) \
 	(((SKB)->transport_header - (SKB)->mac_header) + tcp_hdrlen(SKB))
-static void fill_v2_desc(struct hnae_ring *ring, void *priv,
+static void fill_v2_desc_hw(struct hnae_ring *ring, void *priv, int size,
-			 int size, dma_addr_t dma, int frag_end,
+			    int send_sz, dma_addr_t dma, int frag_end,
-			 int buf_num, enum hns_desc_type type, int mtu)
+			    int buf_num, enum hns_desc_type type, int mtu)
 {
 	struct hnae_desc *desc = &ring->desc[ring->next_to_use];
 	struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use];
 	desc_cb->type = type;
 	desc->addr = cpu_to_le64(dma);
-	desc->tx.send_size = cpu_to_le16((u16)size);
+	desc->tx.send_size = cpu_to_le16((u16)send_sz);
 	/* config bd buffer end */
 	hnae_set_bit(rrcfv, HNSV2_TXD_VLD_B, 1);
 	ring_ptr_move_fw(ring, next_to_use);
 }
+static void fill_v2_desc(struct hnae_ring *ring, void *priv,
+			 int size, dma_addr_t dma, int frag_end,
+			 int buf_num, enum hns_desc_type type, int mtu)
+{
+	fill_v2_desc_hw(ring, priv, size, size, dma, frag_end,
+			buf_num, type, mtu);
+}
 static const struct acpi_device_id hns_enet_acpi_match[] = {
 	{ "HISI00C1", 0 },
 	{ "HISI00C2", 0 },
 	/* when the frag size is bigger than hardware, split this frag */
 	for (k = 0; k < frag_buf_num; k++)
-		fill_v2_desc(ring, priv,
+		fill_v2_desc_hw(ring, priv, k == 0 ? size : 0,
-			     (k == frag_buf_num - 1) ?
+				(k == frag_buf_num - 1) ?
 					sizeoflast : BD_MAX_SEND_SIZE,
-			     dma + BD_MAX_SEND_SIZE * k,
+				dma + BD_MAX_SEND_SIZE * k,
-			     frag_end && (k == frag_buf_num - 1) ? 1 : 0,
+				frag_end && (k == frag_buf_num - 1) ? 1 : 0,
-			     buf_num,
+				buf_num,
-			     (type == DESC_TYPE_SKB && !k) ?
+				(type == DESC_TYPE_SKB && !k) ?
 					DESC_TYPE_SKB : DESC_TYPE_PAGE,
-			     mtu);
+				mtu);
 }
 netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
 	return phy_mii_ioctl(phy_dev, ifr, cmd);
 }
-/* use only for netconsole to poll with the device without interrupt */
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void hns_nic_poll_controller(struct net_device *ndev)
-{
-	struct hns_nic_priv *priv = netdev_priv(ndev);
-	unsigned long flags;
-	int i;
-	local_irq_save(flags);
-	for (i = 0; i < priv->ae_handle->q_num * 2; i++)
-		napi_schedule(&priv->ring_data[i].napi);
-	local_irq_restore(flags);
-}
-#endif
 static netdev_tx_t hns_nic_net_xmit(struct sk_buff *skb,
 				    struct net_device *ndev)
 {
 	.ndo_set_features = hns_nic_set_features,
 	.ndo_fix_features = hns_nic_fix_features,
 	.ndo_get_stats64 = hns_nic_get_stats64,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller = hns_nic_poll_controller,
-#endif
 	.ndo_set_rx_mode = hns_nic_set_rx_mode,
 	.ndo_select_queue = hns_nic_select_queue,
 };

drivers/net/ethernet/huawei/hinic/hinic_main.c+0−20

@@ -789,23 +789,6 @@ static void hinic_get_stats64(struct net_device *netdev, · 788 unmodified lines
789	stats->tx_errors = nic_tx_stats->tx_dropped;	789	stats->tx_errors = nic_tx_stats->tx_dropped;
790	}	790	}
791		791
792	#ifdef CONFIG_NET_POLL_CONTROLLER
793	static void hinic_netpoll(struct net_device *netdev)
794	{
795	struct hinic_dev *nic_dev = netdev_priv(netdev);
796	int i, num_qps;
797
798	num_qps = hinic_hwdev_num_qps(nic_dev->hwdev);
799	for (i = 0; i < num_qps; i++) {
800	struct hinic_txq *txq = &nic_dev->txqs[i];
801	struct hinic_rxq *rxq = &nic_dev->rxqs[i];
802
803	napi_schedule(&txq->napi);
804	napi_schedule(&rxq->napi);
805	}
806	}
807	#endif
808
809	static const struct net_device_ops hinic_netdev_ops = {	792	static const struct net_device_ops hinic_netdev_ops = {
810	.ndo_open = hinic_open,	793	.ndo_open = hinic_open,
811	.ndo_stop = hinic_close,	794	.ndo_stop = hinic_close,
@@ -818,9 +801,6 @@ static const struct net_device_ops hinic_netdev_ops = { · 6 unmodified lines
818	.ndo_start_xmit = hinic_xmit_frame,	801	.ndo_start_xmit = hinic_xmit_frame,
819	.ndo_tx_timeout = hinic_tx_timeout,	802	.ndo_tx_timeout = hinic_tx_timeout,
820	.ndo_get_stats64 = hinic_get_stats64,	803	.ndo_get_stats64 = hinic_get_stats64,
821	#ifdef CONFIG_NET_POLL_CONTROLLER
822	.ndo_poll_controller = hinic_netpoll,
823	#endif
824	};	804	};
825		805
826	static void netdev_features_init(struct net_device *netdev)	806	static void netdev_features_init(struct net_device *netdev)

drivers/net/ethernet/ibm/ehea/ehea_main.c+0−14

@@ -921,17 +921,6 @@ static int ehea_poll(struct napi_struct *napi, int budget) · 920 unmodified lines
921	return rx;	921	return rx;
922	}	922	}
923		923
924	#ifdef CONFIG_NET_POLL_CONTROLLER
925	static void ehea_netpoll(struct net_device *dev)
926	{
927	struct ehea_port *port = netdev_priv(dev);
928	int i;
929
930	for (i = 0; i < port->num_def_qps; i++)
931	napi_schedule(&port->port_res[i].napi);
932	}
933	#endif
934
935	static irqreturn_t ehea_recv_irq_handler(int irq, void *param)	924	static irqreturn_t ehea_recv_irq_handler(int irq, void *param)
936	{	925	{
937	struct ehea_port_res *pr = param;	926	struct ehea_port_res *pr = param;
@@ -2953,9 +2942,6 @@ static const struct net_device_ops ehea_netdev_ops = { · 2015 unmodified lines
2953	.ndo_open = ehea_open,	2942	.ndo_open = ehea_open,
2954	.ndo_stop = ehea_stop,	2943	.ndo_stop = ehea_stop,
2955	.ndo_start_xmit = ehea_start_xmit,	2944	.ndo_start_xmit = ehea_start_xmit,
2956	#ifdef CONFIG_NET_POLL_CONTROLLER
2957	.ndo_poll_controller = ehea_netpoll,
2958	#endif
2959	.ndo_get_stats64 = ehea_get_stats64,	2945	.ndo_get_stats64 = ehea_get_stats64,
2960	.ndo_set_mac_address = ehea_set_mac_addr,	2946	.ndo_set_mac_address = ehea_set_mac_addr,
2961	.ndo_validate_addr = eth_validate_addr,	2947	.ndo_validate_addr = eth_validate_addr,

drivers/net/ethernet/ibm/ibmvnic.c+0−16

@@ -2207,19 +2207,6 @@ restart_poll: · 2206 unmodified lines
2207	return frames_processed;	2207	return frames_processed;
2208	}	2208	}
2209		2209
2210	#ifdef CONFIG_NET_POLL_CONTROLLER
2211	static void ibmvnic_netpoll_controller(struct net_device *dev)
2212	{
2213	struct ibmvnic_adapter *adapter = netdev_priv(dev);
2214	int i;
2215
2216	replenish_pools(netdev_priv(dev));
2217	for (i = 0; i < adapter->req_rx_queues; i++)
2218	ibmvnic_interrupt_rx(adapter->rx_scrq[i]->irq,
2219	adapter->rx_scrq[i]);
2220	}
2221	#endif
2222
2223	static int wait_for_reset(struct ibmvnic_adapter *adapter)	2210	static int wait_for_reset(struct ibmvnic_adapter *adapter)
2224	{	2211	{
2225	int rc, ret;	2212	int rc, ret;
@@ -2292,9 +2279,6 @@ static const struct net_device_ops ibmvnic_netdev_ops = { · 66 unmodified lines
2292	.ndo_set_mac_address = ibmvnic_set_mac,	2279	.ndo_set_mac_address = ibmvnic_set_mac,
2293	.ndo_validate_addr = eth_validate_addr,	2280	.ndo_validate_addr = eth_validate_addr,
2294	.ndo_tx_timeout = ibmvnic_tx_timeout,	2281	.ndo_tx_timeout = ibmvnic_tx_timeout,
2295	#ifdef CONFIG_NET_POLL_CONTROLLER
2296	.ndo_poll_controller = ibmvnic_netpoll_controller,
2297	#endif
2298	.ndo_change_mtu = ibmvnic_change_mtu,	2282	.ndo_change_mtu = ibmvnic_change_mtu,
2299	.ndo_features_check = ibmvnic_features_check,	2283	.ndo_features_check = ibmvnic_features_check,
2300	};	2284	};

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+7−5

@@ -3196,11 +3196,13 @@ int ixgbe_poll(struct napi_struct *napi, int budget) · 3195 unmodified lines
3196	return budget;	3196	return budget;
3197		3197
3198	/* all work done, exit the polling mode */	3198	/* all work done, exit the polling mode */
3199	napi_complete_done(napi, work_done);	3199	if (likely(napi_complete_done(napi, work_done))) {
3200	if (adapter->rx_itr_setting & 1)	3200	if (adapter->rx_itr_setting & 1)
3201	ixgbe_set_itr(q_vector);	3201	ixgbe_set_itr(q_vector);
3202	if (!test_bit(__IXGBE_DOWN, &adapter->state))	3202	if (!test_bit(__IXGBE_DOWN, &adapter->state))
3203	ixgbe_irq_enable_queues(adapter, BIT_ULL(q_vector->v_idx));	3203	ixgbe_irq_enable_queues(adapter,
		3204	BIT_ULL(q_vector->v_idx));
		3205	}
3204		3206
3205	return min(work_done, budget - 1);	3207	return min(work_done, budget - 1);
3206	}	3208	}

drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c+5−4

 }
 /* Set Tx descriptors fields relevant for CSUM calculation */
-static u32 mvpp2_txq_desc_csum(int l3_offs, int l3_proto,
+static u32 mvpp2_txq_desc_csum(int l3_offs, __be16 l3_proto,
 			       int ip_hdr_len, int l4_proto)
 {
 	u32 command;
 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
 		int ip_hdr_len = 0;
 		u8 l4_proto;
+		__be16 l3_proto = vlan_get_protocol(skb);
-		if (skb->protocol == htons(ETH_P_IP)) {
+		if (l3_proto == htons(ETH_P_IP)) {
 			struct iphdr *ip4h = ip_hdr(skb);
 			/* Calculate IPv4 checksum and L4 checksum */
 			ip_hdr_len = ip4h->ihl;
 			l4_proto = ip4h->protocol;
-		} else if (skb->protocol == htons(ETH_P_IPV6)) {
+		} else if (l3_proto == htons(ETH_P_IPV6)) {
 			struct ipv6hdr *ip6h = ipv6_hdr(skb);
 			/* Read l4_protocol from one of IPv6 extra headers */
 		}
 		return mvpp2_txq_desc_csum(skb_network_offset(skb),
-				skb->protocol, ip_hdr_len, l4_proto);
+					   l3_proto, ip_hdr_len, l4_proto);
 	}
 	return MVPP2_TXD_L4_CSUM_NOT | MVPP2_TXD_IP_CSUM_DISABLE;

drivers/net/ethernet/mellanox/mlx5/core/en.h+1−0

@@ -54,6 +54,7 @@ · 53 unmodified lines
54	#include "en_stats.h"	54	#include "en_stats.h"
55	#include "en/fs.h"	55	#include "en/fs.h"
56		56
		57	extern const struct net_device_ops mlx5e_netdev_ops;
57	struct page_pool;	58	struct page_pool;
58		59
59	#define MLX5E_METADATA_ETHER_TYPE (0x8CE4)	60	#define MLX5E_METADATA_ETHER_TYPE (0x8CE4)

drivers/net/ethernet/mellanox/mlx5/core/en/fs.h+2−0

@@ -16,6 +16,8 @@ struct mlx5e_tc_table { · 15 unmodified lines
16		16
17	DECLARE_HASHTABLE(mod_hdr_tbl, 8);	17	DECLARE_HASHTABLE(mod_hdr_tbl, 8);
18	DECLARE_HASHTABLE(hairpin_tbl, 8);	18	DECLARE_HASHTABLE(hairpin_tbl, 8);
		19
		20	struct notifier_block netdevice_nb;
19	};	21	};
20		22
21	struct mlx5e_flow_table {	23	struct mlx5e_flow_table {

drivers/net/ethernet/mellanox/mlx5/core/en_main.c+1−1

@@ -4315,7 +4315,7 @@ static int mlx5e_xdp(struct net_device dev, struct netdev_bpf xdp) · 4314 unmodified lines
4315	}	4315	}
4316	}	4316	}
4317		4317
4318	static const struct net_device_ops mlx5e_netdev_ops = {	4318	const struct net_device_ops mlx5e_netdev_ops = {
4319	.ndo_open = mlx5e_open,	4319	.ndo_open = mlx5e_open,
4320	.ndo_stop = mlx5e_close,	4320	.ndo_stop = mlx5e_close,
4321	.ndo_start_xmit = mlx5e_xmit,	4321	.ndo_start_xmit = mlx5e_xmit,

drivers/net/ethernet/mellanox/mlx5/core/en_tc.c+64−1

@@ -1368,6 +1368,9 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, · 1367 unmodified lines
1368		1368
1369	*match_level = MLX5_MATCH_L2;	1369	*match_level = MLX5_MATCH_L2;
1370	}	1370	}
		1371	} else {
		1372	MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1);
		1373	MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1);
1371	}	1374	}
1372		1375
1373	if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {	1376	if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {
@@ -2946,14 +2949,71 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv, · 1572 unmodified lines
2946	return 0;	2949	return 0;
2947	}	2950	}
2948		2951
		2952	static void mlx5e_tc_hairpin_update_dead_peer(struct mlx5e_priv *priv,
		2953	struct mlx5e_priv *peer_priv)
		2954	{
		2955	struct mlx5_core_dev *peer_mdev = peer_priv->mdev;
		2956	struct mlx5e_hairpin_entry *hpe;
		2957	u16 peer_vhca_id;
		2958	int bkt;
		2959
		2960	if (!same_hw_devs(priv, peer_priv))
		2961	return;
		2962
		2963	peer_vhca_id = MLX5_CAP_GEN(peer_mdev, vhca_id);
		2964
		2965	hash_for_each(priv->fs.tc.hairpin_tbl, bkt, hpe, hairpin_hlist) {
		2966	if (hpe->peer_vhca_id == peer_vhca_id)
		2967	hpe->hp->pair->peer_gone = true;
		2968	}
		2969	}
		2970
		2971	static int mlx5e_tc_netdev_event(struct notifier_block *this,
		2972	unsigned long event, void *ptr)
		2973	{
		2974	struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
		2975	struct mlx5e_flow_steering *fs;
		2976	struct mlx5e_priv *peer_priv;
		2977	struct mlx5e_tc_table *tc;
		2978	struct mlx5e_priv *priv;
		2979
		2980	if (ndev->netdev_ops != &mlx5e_netdev_ops \|\|
		2981	event != NETDEV_UNREGISTER \|\|
		2982	ndev->reg_state == NETREG_REGISTERED)
		2983	return NOTIFY_DONE;
		2984
		2985	tc = container_of(this, struct mlx5e_tc_table, netdevice_nb);
		2986	fs = container_of(tc, struct mlx5e_flow_steering, tc);
		2987	priv = container_of(fs, struct mlx5e_priv, fs);
		2988	peer_priv = netdev_priv(ndev);
		2989	if (priv == peer_priv \|\|
		2990	!(priv->netdev->features & NETIF_F_HW_TC))
		2991	return NOTIFY_DONE;
		2992
		2993	mlx5e_tc_hairpin_update_dead_peer(priv, peer_priv);
		2994
		2995	return NOTIFY_DONE;
		2996	}
		2997
2949	int mlx5e_tc_nic_init(struct mlx5e_priv *priv)	2998	int mlx5e_tc_nic_init(struct mlx5e_priv *priv)
2950	{	2999	{
2951	struct mlx5e_tc_table *tc = &priv->fs.tc;	3000	struct mlx5e_tc_table *tc = &priv->fs.tc;
		3001	int err;
2952		3002
2953	hash_init(tc->mod_hdr_tbl);	3003	hash_init(tc->mod_hdr_tbl);
2954	hash_init(tc->hairpin_tbl);	3004	hash_init(tc->hairpin_tbl);
2955		3005
2956	return rhashtable_init(&tc->ht, &tc_ht_params);	3006	err = rhashtable_init(&tc->ht, &tc_ht_params);
		3007	if (err)
		3008	return err;
		3009
		3010	tc->netdevice_nb.notifier_call = mlx5e_tc_netdev_event;
		3011	if (register_netdevice_notifier(&tc->netdevice_nb)) {
		3012	tc->netdevice_nb.notifier_call = NULL;
		3013	mlx5_core_warn(priv->mdev, "Failed to register netdev notifier\n");
		3014	}
		3015
		3016	return err;
2957	}	3017	}
2958		3018
2959	static void _mlx5e_tc_del_flow(void ptr, void arg)	3019	static void _mlx5e_tc_del_flow(void ptr, void arg)
@@ -2969,6 +3029,9 @@ void mlx5e_tc_nic_cleanup(struct mlx5e_priv *priv) · 9 unmodified lines
2969	{	3029	{
2970	struct mlx5e_tc_table *tc = &priv->fs.tc;	3030	struct mlx5e_tc_table *tc = &priv->fs.tc;
2971		3031
		3032	if (tc->netdevice_nb.notifier_call)
		3033	unregister_netdevice_notifier(&tc->netdevice_nb);
		3034
2972	rhashtable_free_and_destroy(&tc->ht, _mlx5e_tc_del_flow, NULL);	3035	rhashtable_free_and_destroy(&tc->ht, _mlx5e_tc_del_flow, NULL);
2973		3036
2974	if (!IS_ERR_OR_NULL(tc->t)) {	3037	if (!IS_ERR_OR_NULL(tc->t)) {

drivers/net/ethernet/mellanox/mlx5/core/eswitch.c+2−2

@@ -2000,7 +2000,7 @@ static u32 calculate_vports_min_rate_divider(struct mlx5_eswitch *esw) · 1999 unmodified lines
2000	u32 max_guarantee = 0;	2000	u32 max_guarantee = 0;
2001	int i;	2001	int i;
2002		2002
2003	for (i = 0; i <= esw->total_vports; i++) {	2003	for (i = 0; i < esw->total_vports; i++) {
2004	evport = &esw->vports[i];	2004	evport = &esw->vports[i];
2005	if (!evport->enabled \|\| evport->info.min_rate < max_guarantee)	2005	if (!evport->enabled \|\| evport->info.min_rate < max_guarantee)
2006	continue;	2006	continue;
@@ -2020,7 +2020,7 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider) · 13 unmodified lines
2020	int err;	2020	int err;
2021	int i;	2021	int i;
2022		2022
2023	for (i = 0; i <= esw->total_vports; i++) {	2023	for (i = 0; i < esw->total_vports; i++) {
2024	evport = &esw->vports[i];	2024	evport = &esw->vports[i];
2025	if (!evport->enabled)	2025	if (!evport->enabled)
2026	continue;	2026	continue;

drivers/net/ethernet/mellanox/mlx5/core/transobj.c+4−1

 	for (i = 0; i < hp->num_channels; i++) {
 		mlx5_core_destroy_rq(hp->func_mdev, hp->rqn[i]);
-		mlx5_core_destroy_sq(hp->peer_mdev, hp->sqn[i]);
+		if (!hp->peer_gone)
+			mlx5_core_destroy_sq(hp->peer_mdev, hp->sqn[i]);
 	}
 }
 				       MLX5_RQC_STATE_RST, 0, 0);
 	/* unset peer SQs */
+	if (hp->peer_gone)
+		return;
 	for (i = 0; i < hp->num_channels; i++)
 		mlx5_hairpin_modify_sq(hp->peer_mdev, hp->sqn[i], MLX5_SQC_STATE_RDY,
 				       MLX5_SQC_STATE_RST, 0, 0);

drivers/net/ethernet/mellanox/mlxsw/pci.c+7−4

 	memset(&active_cqns, 0, sizeof(active_cqns));
 	while ((eqe = mlxsw_pci_eq_sw_eqe_get(q))) {
-		u8 event_type = mlxsw_pci_eqe_event_type_get(eqe);
-		switch (event_type) {
+		/* Command interface completion events are always received on
-		case MLXSW_PCI_EQE_EVENT_TYPE_CMD:
+		 * queue MLXSW_PCI_EQ_ASYNC_NUM (EQ0) and completion events
+		 * are mapped to queue MLXSW_PCI_EQ_COMP_NUM (EQ1).
+		 */
+		switch (q->num) {
+		case MLXSW_PCI_EQ_ASYNC_NUM:
 			mlxsw_pci_eq_cmd_event(mlxsw_pci, eqe);
 			q->u.eq.ev_cmd_count++;
 			break;
-		case MLXSW_PCI_EQE_EVENT_TYPE_COMP:
+		case MLXSW_PCI_EQ_COMP_NUM:
 			cqn = mlxsw_pci_eqe_cqn_get(eqe);
 			set_bit(cqn, active_cqns);
 			cq_handle = true;

drivers/net/ethernet/mellanox/mlxsw/spectrum.c+2−0

 		upper_dev = info->upper_dev;
 		if (info->linking)
 			break;
+		if (is_vlan_dev(upper_dev))
+			mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, upper_dev);
 		if (netif_is_macvlan(upper_dev))
 			mlxsw_sp_rif_macvlan_del(mlxsw_sp, upper_dev);
 		break;

drivers/net/ethernet/netronome/nfp/nfp_net_common.c+12−5

@@ -2077,14 +2077,17 @@ nfp_ctrl_rx_one(struct nfp_net nn, struct nfp_net_dp dp, · 2076 unmodified lines
2077	return true;	2077	return true;
2078	}	2078	}
2079		2079
2080	static void nfp_ctrl_rx(struct nfp_net_r_vector *r_vec)	2080	static bool nfp_ctrl_rx(struct nfp_net_r_vector *r_vec)
2081	{	2081	{
2082	struct nfp_net_rx_ring *rx_ring = r_vec->rx_ring;	2082	struct nfp_net_rx_ring *rx_ring = r_vec->rx_ring;
2083	struct nfp_net *nn = r_vec->nfp_net;	2083	struct nfp_net *nn = r_vec->nfp_net;
2084	struct nfp_net_dp *dp = &nn->dp;	2084	struct nfp_net_dp *dp = &nn->dp;
		2085	unsigned int budget = 512;
2085		2086
2086	while (nfp_ctrl_rx_one(nn, dp, r_vec, rx_ring))	2087	while (nfp_ctrl_rx_one(nn, dp, r_vec, rx_ring) && budget--)
2087	continue;	2088	continue;
		2089
		2090	return budget;
2088	}	2091	}
2089		2092
2090	static void nfp_ctrl_poll(unsigned long arg)	2093	static void nfp_ctrl_poll(unsigned long arg)
@@ -2096,9 +2099,13 @@ static void nfp_ctrl_poll(unsigned long arg) · 5 unmodified lines
2096	__nfp_ctrl_tx_queued(r_vec);	2099	__nfp_ctrl_tx_queued(r_vec);
2097	spin_unlock_bh(&r_vec->lock);	2100	spin_unlock_bh(&r_vec->lock);
2098		2101
2099	nfp_ctrl_rx(r_vec);	2102	if (nfp_ctrl_rx(r_vec)) {
2100		2103	nfp_net_irq_unmask(r_vec->nfp_net, r_vec->irq_entry);
2101	nfp_net_irq_unmask(r_vec->nfp_net, r_vec->irq_entry);	2104	} else {
		2105	tasklet_schedule(&r_vec->tasklet);
		2106	nn_dp_warn(&r_vec->nfp_net->dp,
		2107	"control message budget exceeded!\n");
		2108	}
2102	}	2109	}
2103		2110
2104	/* Setup and Configuration	2111	/* Setup and Configuration

drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c+0−23

@@ -72,9 +72,6 @@ static void netxen_schedule_work(struct netxen_adapter *adapter, · 71 unmodified lines
72	work_func_t func, int delay);	72	work_func_t func, int delay);
73	static void netxen_cancel_fw_work(struct netxen_adapter *adapter);	73	static void netxen_cancel_fw_work(struct netxen_adapter *adapter);
74	static int netxen_nic_poll(struct napi_struct *napi, int budget);	74	static int netxen_nic_poll(struct napi_struct *napi, int budget);
75	#ifdef CONFIG_NET_POLL_CONTROLLER
76	static void netxen_nic_poll_controller(struct net_device *netdev);
77	#endif
78		75
79	static void netxen_create_sysfs_entries(struct netxen_adapter *adapter);	76	static void netxen_create_sysfs_entries(struct netxen_adapter *adapter);
80	static void netxen_remove_sysfs_entries(struct netxen_adapter *adapter);	77	static void netxen_remove_sysfs_entries(struct netxen_adapter *adapter);
@@ -581,9 +578,6 @@ static const struct net_device_ops netxen_netdev_ops = { · 500 unmodified lines
581	.ndo_tx_timeout = netxen_tx_timeout,	578	.ndo_tx_timeout = netxen_tx_timeout,
582	.ndo_fix_features = netxen_fix_features,	579	.ndo_fix_features = netxen_fix_features,
583	.ndo_set_features = netxen_set_features,	580	.ndo_set_features = netxen_set_features,
584	#ifdef CONFIG_NET_POLL_CONTROLLER
585	.ndo_poll_controller = netxen_nic_poll_controller,
586	#endif
587	};	581	};
588		582
589	static inline bool netxen_function_zero(struct pci_dev *pdev)	583	static inline bool netxen_function_zero(struct pci_dev *pdev)
@@ -2402,23 +2396,6 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget) · 1812 unmodified lines
2402	return work_done;	2396	return work_done;
2403	}	2397	}
2404		2398
2405	#ifdef CONFIG_NET_POLL_CONTROLLER
2406	static void netxen_nic_poll_controller(struct net_device *netdev)
2407	{
2408	int ring;
2409	struct nx_host_sds_ring *sds_ring;
2410	struct netxen_adapter *adapter = netdev_priv(netdev);
2411	struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
2412
2413	disable_irq(adapter->irq);
2414	for (ring = 0; ring < adapter->max_sds_rings; ring++) {
2415	sds_ring = &recv_ctx->sds_rings[ring];
2416	netxen_intr(adapter->irq, sds_ring);
2417	}
2418	enable_irq(adapter->irq);
2419	}
2420	#endif
2421
2422	static int	2399	static int
2423	nx_incr_dev_ref_cnt(struct netxen_adapter *adapter)	2400	nx_incr_dev_ref_cnt(struct netxen_adapter *adapter)
2424	{	2401	{

drivers/net/ethernet/qlogic/qed/qed_hsi.h+1−0

@@ -11987,6 +11987,7 @@ struct public_global { · 11986 unmodified lines
11987	u32 running_bundle_id;	11987	u32 running_bundle_id;
11988	s32 external_temperature;	11988	s32 external_temperature;
11989	u32 mdump_reason;	11989	u32 mdump_reason;
		11990	u64 reserved;
11990	u32 data_ptr;	11991	u32 data_ptr;
11991	u32 data_size;	11992	u32 data_size;
11992	};	11993	};

drivers/net/ethernet/qlogic/qed/qed_iwarp.c+2−2

@@ -1710,7 +1710,7 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn, · 1709 unmodified lines
1710		1710
1711	cm_info->local_ip[0] = ntohl(iph->daddr);	1711	cm_info->local_ip[0] = ntohl(iph->daddr);
1712	cm_info->remote_ip[0] = ntohl(iph->saddr);	1712	cm_info->remote_ip[0] = ntohl(iph->saddr);
1713	cm_info->ip_version = TCP_IPV4;	1713	cm_info->ip_version = QED_TCP_IPV4;
1714		1714
1715	ip_hlen = (iph->ihl) * sizeof(u32);	1715	ip_hlen = (iph->ihl) * sizeof(u32);
1716	*payload_len = ntohs(iph->tot_len) - ip_hlen;	1716	*payload_len = ntohs(iph->tot_len) - ip_hlen;
@@ -1730,7 +1730,7 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn, · 13 unmodified lines
1730	cm_info->remote_ip[i] =	1730	cm_info->remote_ip[i] =
1731	ntohl(ip6h->saddr.in6_u.u6_addr32[i]);	1731	ntohl(ip6h->saddr.in6_u.u6_addr32[i]);
1732	}	1732	}
1733	cm_info->ip_version = TCP_IPV6;	1733	cm_info->ip_version = QED_TCP_IPV6;
1734		1734
1735	ip_hlen = sizeof(*ip6h);	1735	ip_hlen = sizeof(*ip6h);
1736	*payload_len = ntohs(ip6h->payload_len);	1736	*payload_len = ntohs(ip6h->payload_len);

drivers/net/ethernet/qlogic/qed/qed_rdma.c+1−1

@@ -228,7 +228,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn, · 227 unmodified lines
228	num_cons, "Toggle");	228	num_cons, "Toggle");
229	if (rc) {	229	if (rc) {
230	DP_VERBOSE(p_hwfn, QED_MSG_RDMA,	230	DP_VERBOSE(p_hwfn, QED_MSG_RDMA,
231	"Failed to allocate toogle bits, rc = %d\n", rc);	231	"Failed to allocate toggle bits, rc = %d\n", rc);
232	goto free_cq_map;	232	goto free_cq_map;
233	}	233	}
234		234

drivers/net/ethernet/qlogic/qed/qed_roce.c+4−11

 static enum roce_flavor qed_roce_mode_to_flavor(enum roce_mode roce_mode)
 {
-	enum roce_flavor flavor;
 	switch (roce_mode) {
 	case ROCE_V1:
-		flavor = PLAIN_ROCE;
+		return PLAIN_ROCE;
-		break;
 	case ROCE_V2_IPV4:
-		flavor = RROCE_IPV4;
+		return RROCE_IPV4;
-		break;
 	case ROCE_V2_IPV6:
-		flavor = ROCE_V2_IPV6;
+		return RROCE_IPV6;
-		break;
 	default:
-		flavor = MAX_ROCE_MODE;
+		return MAX_ROCE_FLAVOR;
-		break;
 	}
-	return flavor;
 }
 static void qed_roce_free_cid_pair(struct qed_hwfn *p_hwfn, u16 cid)

drivers/net/ethernet/qlogic/qed/qed_sp_commands.c+1−1

@@ -154,7 +154,7 @@ qed_set_pf_update_tunn_mode(struct qed_tunnel_info *p_tun, · 153 unmodified lines
154	static void qed_set_tunn_cls_info(struct qed_tunnel_info *p_tun,	154	static void qed_set_tunn_cls_info(struct qed_tunnel_info *p_tun,
155	struct qed_tunnel_info *p_src)	155	struct qed_tunnel_info *p_src)
156	{	156	{
157	enum tunnel_clss type;	157	int type;
158		158
159	p_tun->b_update_rx_cls = p_src->b_update_rx_cls;	159	p_tun->b_update_rx_cls = p_src->b_update_rx_cls;
160	p_tun->b_update_tx_cls = p_src->b_update_tx_cls;	160	p_tun->b_update_tx_cls = p_src->b_update_tx_cls;

drivers/net/ethernet/qlogic/qed/qed_vf.c+2−3

 	}
 	if (!p_iov->b_pre_fp_hsi &&
-	    ETH_HSI_VER_MINOR &&
 	    (resp->pfdev_info.minor_fp_hsi < ETH_HSI_VER_MINOR)) {
 		DP_INFO(p_hwfn,
 			"PF is using older fastpath HSI; %02x.%02x is configured\n",
 static void
 __qed_vf_prep_tunn_req_tlv(struct vfpf_update_tunn_param_tlv *p_req,
 			   struct qed_tunn_update_type *p_src,
-			   enum qed_tunn_clss mask, u8 *p_cls)
+			   enum qed_tunn_mode mask, u8 *p_cls)
 {
 	if (p_src->b_update_mode) {
 		p_req->tun_mode_update_mask |= BIT(mask);
 static void
 qed_vf_prep_tunn_req_tlv(struct vfpf_update_tunn_param_tlv *p_req,
 			 struct qed_tunn_update_type *p_src,
-			 enum qed_tunn_clss mask,
+			 enum qed_tunn_mode mask,
 			 u8 *p_cls, struct qed_tunn_update_udp_port *p_port,
 			 u8 *p_update_port, u16 *p_udp_port)
 {

drivers/net/ethernet/qlogic/qlcnic/qlcnic.h+5−3

 	int (*config_loopback) (struct qlcnic_adapter *, u8);
 	int (*clear_loopback) (struct qlcnic_adapter *, u8);
 	int (*config_promisc_mode) (struct qlcnic_adapter *, u32);
-	void (*change_l2_filter) (struct qlcnic_adapter *, u64 *, u16);
+	void (*change_l2_filter)(struct qlcnic_adapter *adapter, u64 *addr,
+				 u16 vlan, struct qlcnic_host_tx_ring *tx_ring);
 	int (*get_board_info) (struct qlcnic_adapter *);
 	void (*set_mac_filter_count) (struct qlcnic_adapter *);
 	void (*free_mac_list) (struct qlcnic_adapter *);
 }
 static inline void qlcnic_change_filter(struct qlcnic_adapter *adapter,
-					u64 *addr, u16 id)
+					u64 *addr, u16 vlan,
+					struct qlcnic_host_tx_ring *tx_ring)
 {
-	adapter->ahw->hw_ops->change_l2_filter(adapter, addr, id);
+	adapter->ahw->hw_ops->change_l2_filter(adapter, addr, vlan, tx_ring);
 }
 static inline int qlcnic_get_board_info(struct qlcnic_adapter *adapter)

drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c+2−1

@@ -2135,7 +2135,8 @@ out: · 2134 unmodified lines
2135	}	2135	}
2136		2136
2137	void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter adapter, u64 addr,	2137	void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter adapter, u64 addr,
2138	u16 vlan_id)	2138	u16 vlan_id,
		2139	struct qlcnic_host_tx_ring *tx_ring)
2139	{	2140	{
2140	u8 mac[ETH_ALEN];	2141	u8 mac[ETH_ALEN];
2141	memcpy(&mac, addr, ETH_ALEN);	2142	memcpy(&mac, addr, ETH_ALEN);

drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h+2−1

 int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32);
 int qlcnic_83xx_config_hw_lro(struct qlcnic_adapter *, int);
 int qlcnic_83xx_config_rss(struct qlcnic_adapter *, int);
-void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *, u64 *, u16);
+void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr,
+				  u16 vlan, struct qlcnic_host_tx_ring *ring);
 int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info *);
 int qlcnic_83xx_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *);
 void qlcnic_83xx_initialize_nic(struct qlcnic_adapter *, int);

drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h+2−1

 			 struct net_device *netdev);
 void qlcnic_82xx_get_beacon_state(struct qlcnic_adapter *);
 void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter,
-			       u64 *uaddr, u16 vlan_id);
+			       u64 *uaddr, u16 vlan_id,
+			       struct qlcnic_host_tx_ring *tx_ring);
 int qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *,
 				     struct ethtool_coalesce *);
 int qlcnic_82xx_set_rx_coalesce(struct qlcnic_adapter *);

drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c+6−6

 }
 void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr,
-			       u16 vlan_id)
+			       u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring)
 {
 	struct cmd_desc_type0 *hwdesc;
 	struct qlcnic_nic_req *req;
 	struct qlcnic_mac_req *mac_req;
 	struct qlcnic_vlan_req *vlan_req;
-	struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring;
 	u32 producer;
 	u64 word;
 static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
 			       struct cmd_desc_type0 *first_desc,
-			       struct sk_buff *skb)
+			       struct sk_buff *skb,
+			       struct qlcnic_host_tx_ring *tx_ring)
 {
 	struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data);
 	struct ethhdr *phdr = (struct ethhdr *)(skb->data);
 		    tmp_fil->vlan_id == vlan_id) {
 			if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime))
 				qlcnic_change_filter(adapter, &src_addr,
-						     vlan_id);
+						     vlan_id, tx_ring);
 			tmp_fil->ftime = jiffies;
 			return;
 		}
 	if (!fil)
 		return;
-	qlcnic_change_filter(adapter, &src_addr, vlan_id);
+	qlcnic_change_filter(adapter, &src_addr, vlan_id, tx_ring);
 	fil->ftime = jiffies;
 	fil->vlan_id = vlan_id;
 	memcpy(fil->faddr, &src_addr, ETH_ALEN);
 	}
 	if (adapter->drv_mac_learn)
-		qlcnic_send_filter(adapter, first_desc, skb);
+		qlcnic_send_filter(adapter, first_desc, skb, tx_ring);
 	tx_ring->tx_stats.tx_bytes += skb->len;
 	tx_ring->tx_stats.xmit_called++;

drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c+0−45

@@ -59,9 +59,6 @@ static int qlcnic_close(struct net_device *netdev); · 58 unmodified lines
59	static void qlcnic_tx_timeout(struct net_device *netdev);	59	static void qlcnic_tx_timeout(struct net_device *netdev);
60	static void qlcnic_attach_work(struct work_struct *work);	60	static void qlcnic_attach_work(struct work_struct *work);
61	static void qlcnic_fwinit_work(struct work_struct *work);	61	static void qlcnic_fwinit_work(struct work_struct *work);
62	#ifdef CONFIG_NET_POLL_CONTROLLER
63	static void qlcnic_poll_controller(struct net_device *netdev);
64	#endif
65		62
66	static void qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding);	63	static void qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding);
67	static int qlcnic_can_start_firmware(struct qlcnic_adapter *adapter);	64	static int qlcnic_can_start_firmware(struct qlcnic_adapter *adapter);
@@ -545,9 +542,6 @@ static const struct net_device_ops qlcnic_netdev_ops = { · 477 unmodified lines
545	.ndo_udp_tunnel_add = qlcnic_add_vxlan_port,	542	.ndo_udp_tunnel_add = qlcnic_add_vxlan_port,
546	.ndo_udp_tunnel_del = qlcnic_del_vxlan_port,	543	.ndo_udp_tunnel_del = qlcnic_del_vxlan_port,
547	.ndo_features_check = qlcnic_features_check,	544	.ndo_features_check = qlcnic_features_check,
548	#ifdef CONFIG_NET_POLL_CONTROLLER
549	.ndo_poll_controller = qlcnic_poll_controller,
550	#endif
551	#ifdef CONFIG_QLCNIC_SRIOV	545	#ifdef CONFIG_QLCNIC_SRIOV
552	.ndo_set_vf_mac = qlcnic_sriov_set_vf_mac,	546	.ndo_set_vf_mac = qlcnic_sriov_set_vf_mac,
553	.ndo_set_vf_rate = qlcnic_sriov_set_vf_tx_rate,	547	.ndo_set_vf_rate = qlcnic_sriov_set_vf_tx_rate,
@@ -3200,45 +3194,6 @@ static irqreturn_t qlcnic_msix_tx_intr(int irq, void *data) · 2646 unmodified lines
3200	return IRQ_HANDLED;	3194	return IRQ_HANDLED;
3201	}	3195	}
3202		3196
3203	#ifdef CONFIG_NET_POLL_CONTROLLER
3204	static void qlcnic_poll_controller(struct net_device *netdev)
3205	{
3206	struct qlcnic_adapter *adapter = netdev_priv(netdev);
3207	struct qlcnic_host_sds_ring *sds_ring;
3208	struct qlcnic_recv_context *recv_ctx;
3209	struct qlcnic_host_tx_ring *tx_ring;
3210	int ring;
3211
3212	if (!test_bit(__QLCNIC_DEV_UP, &adapter->state))
3213	return;
3214
3215	recv_ctx = adapter->recv_ctx;
3216
3217	for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
3218	sds_ring = &recv_ctx->sds_rings[ring];
3219	qlcnic_disable_sds_intr(adapter, sds_ring);
3220	napi_schedule(&sds_ring->napi);
3221	}
3222
3223	if (adapter->flags & QLCNIC_MSIX_ENABLED) {
3224	/* Only Multi-Tx queue capable devices need to
3225	* schedule NAPI for TX rings
3226	*/
3227	if ((qlcnic_83xx_check(adapter) &&
3228	(adapter->flags & QLCNIC_TX_INTR_SHARED)) \|\|
3229	(qlcnic_82xx_check(adapter) &&
3230	!qlcnic_check_multi_tx(adapter)))
3231	return;
3232
3233	for (ring = 0; ring < adapter->drv_tx_rings; ring++) {
3234	tx_ring = &adapter->tx_ring[ring];
3235	qlcnic_disable_tx_intr(adapter, tx_ring);
3236	napi_schedule(&tx_ring->napi);
3237	}
3238	}
3239	}
3240	#endif
3241
3242	static void	3197	static void
3243	qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding)	3198	qlcnic_idc_debug_info(struct qlcnic_adapter *adapter, u8 encoding)
3244	{	3199	{

drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c+5−2

 	struct sk_buff *skbn;
 	if (skb->dev->type == ARPHRD_ETHER) {
-		if (pskb_expand_head(skb, ETH_HLEN, 0, GFP_KERNEL)) {
+		if (pskb_expand_head(skb, ETH_HLEN, 0, GFP_ATOMIC)) {
 			kfree_skb(skb);
 			return;
 		}
 	}
 	if (skb_headroom(skb) < required_headroom) {
-		if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL))
+		if (pskb_expand_head(skb, required_headroom, 0, GFP_ATOMIC))
 			return -ENOMEM;
 	}
 	if (!skb)
 		goto done;
+	if (skb->pkt_type == PACKET_LOOPBACK)
+		return RX_HANDLER_PASS;
 	dev = skb->dev;
 	port = rmnet_get_port(dev);

drivers/net/ethernet/realtek/r8169.c+16−16

@@ -4072,13 +4072,12 @@ static void rtl8169_init_phy(struct net_device dev, struct rtl8169_private tp) · 4071 unmodified lines
4072		4072
4073	genphy_soft_reset(dev->phydev);	4073	genphy_soft_reset(dev->phydev);
4074		4074
4075	/* It was reported that chip version 33 ends up with 10MBit/Half on a	4075	/* It was reported that several chips end up with 10MBit/Half on a
4076	* 1GBit link after resuming from S3. For whatever reason the PHY on	4076	* 1GBit link after resuming from S3. For whatever reason the PHY on
4077	* this chip doesn't properly start a renegotiation when soft-reset.	4077	* these chips doesn't properly start a renegotiation when soft-reset.
4078	* Explicitly requesting a renegotiation fixes this.	4078	* Explicitly requesting a renegotiation fixes this.
4079	*/	4079	*/
4080	if (tp->mac_version == RTL_GIGA_MAC_VER_33 &&	4080	if (dev->phydev->autoneg == AUTONEG_ENABLE)
4081	dev->phydev->autoneg == AUTONEG_ENABLE)
4082	phy_restart_aneg(dev->phydev);	4081	phy_restart_aneg(dev->phydev);
4083	}	4082	}
4084		4083
@@ -4536,9 +4535,14 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp) · 451 unmodified lines
4536		4535
4537	static void rtl_set_tx_config_registers(struct rtl8169_private *tp)	4536	static void rtl_set_tx_config_registers(struct rtl8169_private *tp)
4538	{	4537	{
4539	/* Set DMA burst size and Interframe Gap Time */	4538	u32 val = TX_DMA_BURST << TxDMAShift \|
4540	RTL_W32(tp, TxConfig, (TX_DMA_BURST << TxDMAShift) \|	4539	InterFrameGap << TxInterFrameGapShift;
4541	(InterFrameGap << TxInterFrameGapShift));	4540
		4541	if (tp->mac_version >= RTL_GIGA_MAC_VER_34 &&
		4542	tp->mac_version != RTL_GIGA_MAC_VER_39)
		4543	val \|= TXCFG_AUTO_FIFO;
		4544
		4545	RTL_W32(tp, TxConfig, val);
4542	}	4546	}
4543		4547
4544	static void rtl_set_rx_max_size(struct rtl8169_private *tp)	4548	static void rtl_set_rx_max_size(struct rtl8169_private *tp)
@@ -5033,7 +5037,6 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp) · 488 unmodified lines
5033		5037
5034	rtl_disable_clock_request(tp);	5038	rtl_disable_clock_request(tp);
5035		5039
5036	RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) \| TXCFG_AUTO_FIFO);
5037	RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);	5040	RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);
5038		5041
5039	/* Adjust EEE LED frequency */	5042	/* Adjust EEE LED frequency */
@@ -5067,7 +5070,6 @@ static void rtl_hw_start_8168f(struct rtl8169_private *tp) · 27 unmodified lines
5067		5070
5068	rtl_disable_clock_request(tp);	5071	rtl_disable_clock_request(tp);
5069		5072
5070	RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) \| TXCFG_AUTO_FIFO);
5071	RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);	5073	RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);
5072	RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) \| PFM_EN);	5074	RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) \| PFM_EN);
5073	RTL_W32(tp, MISC, RTL_R32(tp, MISC) \| PWM_EN);	5075	RTL_W32(tp, MISC, RTL_R32(tp, MISC) \| PWM_EN);
@@ -5112,8 +5114,6 @@ static void rtl_hw_start_8411(struct rtl8169_private *tp) · 38 unmodified lines
5112		5114
5113	static void rtl_hw_start_8168g(struct rtl8169_private *tp)	5115	static void rtl_hw_start_8168g(struct rtl8169_private *tp)
5114	{	5116	{
5115	RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) \| TXCFG_AUTO_FIFO);
5116
5117	rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x080002, ERIAR_EXGMAC);	5117	rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x080002, ERIAR_EXGMAC);
5118	rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x38, ERIAR_EXGMAC);	5118	rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x38, ERIAR_EXGMAC);
5119	rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x48, ERIAR_EXGMAC);	5119	rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x48, ERIAR_EXGMAC);
@@ -5211,8 +5211,6 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp) · 91 unmodified lines
5211	rtl_hw_aspm_clkreq_enable(tp, false);	5211	rtl_hw_aspm_clkreq_enable(tp, false);
5212	rtl_ephy_init(tp, e_info_8168h_1, ARRAY_SIZE(e_info_8168h_1));	5212	rtl_ephy_init(tp, e_info_8168h_1, ARRAY_SIZE(e_info_8168h_1));
5213		5213
5214	RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) \| TXCFG_AUTO_FIFO);
5215
5216	rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x00080002, ERIAR_EXGMAC);	5214	rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x00080002, ERIAR_EXGMAC);
5217	rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x38, ERIAR_EXGMAC);	5215	rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x38, ERIAR_EXGMAC);
5218	rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x48, ERIAR_EXGMAC);	5216	rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x48, ERIAR_EXGMAC);
@@ -5295,8 +5293,6 @@ static void rtl_hw_start_8168ep(struct rtl8169_private *tp) · 76 unmodified lines
5295	{	5293	{
5296	rtl8168ep_stop_cmac(tp);	5294	rtl8168ep_stop_cmac(tp);
5297		5295
5298	RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) \| TXCFG_AUTO_FIFO);
5299
5300	rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x00080002, ERIAR_EXGMAC);	5296	rtl_eri_write(tp, 0xc8, ERIAR_MASK_0101, 0x00080002, ERIAR_EXGMAC);
5301	rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x2f, ERIAR_EXGMAC);	5297	rtl_eri_write(tp, 0xcc, ERIAR_MASK_0001, 0x2f, ERIAR_EXGMAC);
5302	rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x5f, ERIAR_EXGMAC);	5298	rtl_eri_write(tp, 0xd0, ERIAR_MASK_0001, 0x5f, ERIAR_EXGMAC);
@@ -5618,7 +5614,6 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp) · 315 unmodified lines
5618	/* Force LAN exit from ASPM if Rx/Tx are not idle */	5614	/* Force LAN exit from ASPM if Rx/Tx are not idle */
5619	RTL_W32(tp, FuncEvent, RTL_R32(tp, FuncEvent) \| 0x002800);	5615	RTL_W32(tp, FuncEvent, RTL_R32(tp, FuncEvent) \| 0x002800);
5620		5616
5621	RTL_W32(tp, TxConfig, RTL_R32(tp, TxConfig) \| TXCFG_AUTO_FIFO);
5622	RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);	5617	RTL_W8(tp, MCU, RTL_R8(tp, MCU) & ~NOW_IS_OOB);
5623		5618
5624	rtl_ephy_init(tp, e_info_8402, ARRAY_SIZE(e_info_8402));	5619	rtl_ephy_init(tp, e_info_8402, ARRAY_SIZE(e_info_8402));
@@ -6869,8 +6864,10 @@ static int rtl8169_suspend(struct device *device) · 1244 unmodified lines
6869	{	6864	{
6870	struct pci_dev *pdev = to_pci_dev(device);	6865	struct pci_dev *pdev = to_pci_dev(device);
6871	struct net_device *dev = pci_get_drvdata(pdev);	6866	struct net_device *dev = pci_get_drvdata(pdev);
		6867	struct rtl8169_private *tp = netdev_priv(dev);
6872		6868
6873	rtl8169_net_suspend(dev);	6869	rtl8169_net_suspend(dev);
		6870	clk_disable_unprepare(tp->clk);
6874		6871
6875	return 0;	6872	return 0;
6876	}	6873	}
@@ -6898,6 +6895,9 @@ static int rtl8169_resume(struct device *device) · 21 unmodified lines
6898	{	6895	{
6899	struct pci_dev *pdev = to_pci_dev(device);	6896	struct pci_dev *pdev = to_pci_dev(device);
6900	struct net_device *dev = pci_get_drvdata(pdev);	6897	struct net_device *dev = pci_get_drvdata(pdev);
		6898	struct rtl8169_private *tp = netdev_priv(dev);
		6899
		6900	clk_prepare_enable(tp->clk);
6901		6901
6902	if (netif_running(dev))	6902	if (netif_running(dev))
6903	__rtl8169_resume(dev);	6903	__rtl8169_resume(dev);

drivers/net/ethernet/sfc/efx.c+0−26

@@ -2206,29 +2206,6 @@ static void efx_fini_napi(struct efx_nic *efx) · 2205 unmodified lines
2206	efx_fini_napi_channel(channel);	2206	efx_fini_napi_channel(channel);
2207	}	2207	}
2208		2208
2209	/**************************************************************************
2210	*
2211	* Kernel netpoll interface
2212	*
2213	*************************************************************************/
2214
2215	#ifdef CONFIG_NET_POLL_CONTROLLER
2216
2217	/* Although in the common case interrupts will be disabled, this is not
2218	* guaranteed. However, all our work happens inside the NAPI callback,
2219	* so no locking is required.
2220	*/
2221	static void efx_netpoll(struct net_device *net_dev)
2222	{
2223	struct efx_nic *efx = netdev_priv(net_dev);
2224	struct efx_channel *channel;
2225
2226	efx_for_each_channel(channel, efx)
2227	efx_schedule_channel(channel);
2228	}
2229
2230	#endif
2231
2232	/**************************************************************************	2209	/**************************************************************************
2233	*	2210	*
2234	* Kernel net device interface	2211	* Kernel net device interface
@@ -2509,9 +2486,6 @@ static const struct net_device_ops efx_netdev_ops = { · 274 unmodified lines
2509	#endif	2486	#endif
2510	.ndo_get_phys_port_id = efx_get_phys_port_id,	2487	.ndo_get_phys_port_id = efx_get_phys_port_id,
2511	.ndo_get_phys_port_name = efx_get_phys_port_name,	2488	.ndo_get_phys_port_name = efx_get_phys_port_name,
2512	#ifdef CONFIG_NET_POLL_CONTROLLER
2513	.ndo_poll_controller = efx_netpoll,
2514	#endif
2515	.ndo_setup_tc = efx_setup_tc,	2489	.ndo_setup_tc = efx_setup_tc,
2516	#ifdef CONFIG_RFS_ACCEL	2490	#ifdef CONFIG_RFS_ACCEL
2517	.ndo_rx_flow_steer = efx_filter_rfs,	2491	.ndo_rx_flow_steer = efx_filter_rfs,

drivers/net/ethernet/sfc/falcon/efx.c+0−26

@@ -2052,29 +2052,6 @@ static void ef4_fini_napi(struct ef4_nic *efx) · 2051 unmodified lines
2052	ef4_fini_napi_channel(channel);	2052	ef4_fini_napi_channel(channel);
2053	}	2053	}
2054		2054
2055	/**************************************************************************
2056	*
2057	* Kernel netpoll interface
2058	*
2059	*************************************************************************/
2060
2061	#ifdef CONFIG_NET_POLL_CONTROLLER
2062
2063	/* Although in the common case interrupts will be disabled, this is not
2064	* guaranteed. However, all our work happens inside the NAPI callback,
2065	* so no locking is required.
2066	*/
2067	static void ef4_netpoll(struct net_device *net_dev)
2068	{
2069	struct ef4_nic *efx = netdev_priv(net_dev);
2070	struct ef4_channel *channel;
2071
2072	ef4_for_each_channel(channel, efx)
2073	ef4_schedule_channel(channel);
2074	}
2075
2076	#endif
2077
2078	/**************************************************************************	2055	/**************************************************************************
2079	*	2056	*
2080	* Kernel net device interface	2057	* Kernel net device interface
@@ -2250,9 +2227,6 @@ static const struct net_device_ops ef4_netdev_ops = { · 169 unmodified lines
2250	.ndo_set_mac_address = ef4_set_mac_address,	2227	.ndo_set_mac_address = ef4_set_mac_address,
2251	.ndo_set_rx_mode = ef4_set_rx_mode,	2228	.ndo_set_rx_mode = ef4_set_rx_mode,
2252	.ndo_set_features = ef4_set_features,	2229	.ndo_set_features = ef4_set_features,
2253	#ifdef CONFIG_NET_POLL_CONTROLLER
2254	.ndo_poll_controller = ef4_netpoll,
2255	#endif
2256	.ndo_setup_tc = ef4_setup_tc,	2230	.ndo_setup_tc = ef4_setup_tc,
2257	#ifdef CONFIG_RFS_ACCEL	2231	#ifdef CONFIG_RFS_ACCEL
2258	.ndo_rx_flow_steer = ef4_filter_rfs,	2232	.ndo_rx_flow_steer = ef4_filter_rfs,

drivers/net/hamradio/yam.c+4−0

 				 sizeof(struct yamdrv_ioctl_mcs));
 		if (IS_ERR(ym))
 			return PTR_ERR(ym);
+		if (ym->cmd != SIOCYAMSMCS)
+			return -EINVAL;
 		if (ym->bitrate > YAM_MAXBITRATE) {
 			kfree(ym);
 			return -EINVAL;
 		if (copy_from_user(&yi, ifr->ifr_data, sizeof(struct yamdrv_ioctl_cfg)))
 			 return -EFAULT;
+		if (yi.cmd != SIOCYAMSCFG)
+			return -EINVAL;
 		if ((yi.cfg.mask & YAM_IOBASE) && netif_running(dev))
 			return -EINVAL;		/* Cannot change this parameter when up */
 		if ((yi.cfg.mask & YAM_IRQ) && netif_running(dev))

drivers/net/ieee802154/adf7242.c+1−2

@@ -1308,8 +1308,7 @@ static int adf7242_remove(struct spi_device *spi) · 1307 unmodified lines
1308	{	1308	{
1309	struct adf7242_local *lp = spi_get_drvdata(spi);	1309	struct adf7242_local *lp = spi_get_drvdata(spi);
1310		1310
1311	if (!IS_ERR_OR_NULL(lp->debugfs_root))	1311	debugfs_remove_recursive(lp->debugfs_root);
1312	debugfs_remove_recursive(lp->debugfs_root);
1313		1312
1314	cancel_delayed_work_sync(&lp->work);	1313	cancel_delayed_work_sync(&lp->work);
1315	destroy_workqueue(lp->wqueue);	1314	destroy_workqueue(lp->wqueue);

drivers/net/ieee802154/ca8210.c+2−4

 	for (i = 0; i < len; i++)
 		dev_dbg(&priv->spi->dev, "%#03x\n", buf[i]);
-	fifo_buffer = kmalloc(len, GFP_KERNEL);
+	fifo_buffer = kmemdup(buf, len, GFP_KERNEL);
 	if (!fifo_buffer)
 		return -ENOMEM;
-	memcpy(fifo_buffer, buf, len);
 	kfifo_in(&test->up_fifo, &fifo_buffer, 4);
 	wake_up_interruptible(&priv->test.readq);
 {
 	struct ca8210_test *test = &priv->test;
-	if (!IS_ERR(test->ca8210_dfs_spi_int))
+	debugfs_remove(test->ca8210_dfs_spi_int);
-		debugfs_remove(test->ca8210_dfs_spi_int);
 	kfifo_free(&test->up_fifo);
 	dev_info(&priv->spi->dev, "Test interface removed\n");
 }

drivers/net/ieee802154/mcr20a.c+4−4

@@ -903,19 +903,19 @@ mcr20a_irq_clean_complete(void *context) · 902 unmodified lines
903		903
904	switch (seq_state) {	904	switch (seq_state) {
905	/* TX IRQ, RX IRQ and SEQ IRQ */	905	/* TX IRQ, RX IRQ and SEQ IRQ */
906	case (0x03):	906	case (DAR_IRQSTS1_TXIRQ \| DAR_IRQSTS1_SEQIRQ):
907	if (lp->is_tx) {	907	if (lp->is_tx) {
908	lp->is_tx = 0;	908	lp->is_tx = 0;
909	dev_dbg(printdev(lp), "TX is done. No ACK\n");	909	dev_dbg(printdev(lp), "TX is done. No ACK\n");
910	mcr20a_handle_tx_complete(lp);	910	mcr20a_handle_tx_complete(lp);
911	}	911	}
912	break;	912	break;
913	case (0x05):	913	case (DAR_IRQSTS1_RXIRQ \| DAR_IRQSTS1_SEQIRQ):
914	/* rx is starting */	914	/* rx is starting */
915	dev_dbg(printdev(lp), "RX is starting\n");	915	dev_dbg(printdev(lp), "RX is starting\n");
916	mcr20a_handle_rx(lp);	916	mcr20a_handle_rx(lp);
917	break;	917	break;
918	case (0x07):	918	case (DAR_IRQSTS1_RXIRQ \| DAR_IRQSTS1_TXIRQ \| DAR_IRQSTS1_SEQIRQ):
919	if (lp->is_tx) {	919	if (lp->is_tx) {
920	/* tx is done */	920	/* tx is done */
921	lp->is_tx = 0;	921	lp->is_tx = 0;
@@ -927,7 +927,7 @@ mcr20a_irq_clean_complete(void *context) · 5 unmodified lines
927	mcr20a_handle_rx(lp);	927	mcr20a_handle_rx(lp);
928	}	928	}
929	break;	929	break;
930	case (0x01):	930	case (DAR_IRQSTS1_SEQIRQ):
931	if (lp->is_tx) {	931	if (lp->is_tx) {
932	dev_dbg(printdev(lp), "TX is starting\n");	932	dev_dbg(printdev(lp), "TX is starting\n");
933	mcr20a_handle_tx(lp);	933	mcr20a_handle_tx(lp);

drivers/net/phy/phy_device.c+9−3

 	if (!netdev)
 		return !phydev->suspended;
-	/* Don't suspend PHY if the attached netdev parent may wakeup.
+	if (netdev->wol_enabled)
+		return false;
+	/* As long as not all affected network drivers support the
+	 * wol_enabled flag, let's check for hints that WoL is enabled.
+	 * Don't suspend PHY if the attached netdev parent may wake up.
 	 * The parent may point to a PCI device, as in tg3 driver.
 	 */
 	if (netdev->dev.parent && device_may_wakeup(netdev->dev.parent))
 		sysfs_remove_link(&dev->dev.kobj, "phydev");
 		sysfs_remove_link(&phydev->mdio.dev.kobj, "attached_dev");
 	}
+	phy_suspend(phydev);
 	phydev->attached_dev->phydev = NULL;
 	phydev->attached_dev = NULL;
-	phy_suspend(phydev);
 	phydev->phylink = NULL;
 	phy_led_triggers_unregister(phydev);
 int phy_suspend(struct phy_device *phydev)
 {
 	struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
+	struct net_device *netdev = phydev->attached_dev;
 	struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
 	int ret = 0;
 	/* If the device has WOL enabled, we cannot suspend the PHY */
 	phy_ethtool_get_wol(phydev, &wol);
-	if (wol.wolopts)
+	if (wol.wolopts || (netdev && netdev->wol_enabled))
 		return -EBUSY;
 	if (phydev->drv && phydrv->suspend)

drivers/net/phy/phylink.c+28−20

 	return 0;
 }
+static int __phylink_connect_phy(struct phylink *pl, struct phy_device *phy,
+		phy_interface_t interface)
+{
+	int ret;
+	if (WARN_ON(pl->link_an_mode == MLO_AN_FIXED ||
+		    (pl->link_an_mode == MLO_AN_INBAND &&
+		     phy_interface_mode_is_8023z(interface))))
+		return -EINVAL;
+	if (pl->phydev)
+		return -EBUSY;
+	ret = phy_attach_direct(pl->netdev, phy, 0, interface);
+	if (ret)
+		return ret;
+	ret = phylink_bringup_phy(pl, phy);
+	if (ret)
+		phy_detach(phy);
+	return ret;
+}
 /**
  * phylink_connect_phy() - connect a PHY to the phylink instance
  * @pl: a pointer to a &struct phylink returned from phylink_create()
  */
 int phylink_connect_phy(struct phylink *pl, struct phy_device *phy)
 {
-	int ret;
-	if (WARN_ON(pl->link_an_mode == MLO_AN_FIXED ||
-		    (pl->link_an_mode == MLO_AN_INBAND &&
-		     phy_interface_mode_is_8023z(pl->link_interface))))
-		return -EINVAL;
-	if (pl->phydev)
-		return -EBUSY;
 	/* Use PHY device/driver interface */
 	if (pl->link_interface == PHY_INTERFACE_MODE_NA) {
 		pl->link_interface = phy->interface;
 		pl->link_config.interface = pl->link_interface;
 	}
-	ret = phy_attach_direct(pl->netdev, phy, 0, pl->link_interface);
+	return __phylink_connect_phy(pl, phy, pl->link_interface);
-	if (ret)
-		return ret;
-	ret = phylink_bringup_phy(pl, phy);
-	if (ret)
-		phy_detach(phy);
-	return ret;
 }
 EXPORT_SYMBOL_GPL(phylink_connect_phy);
 static int phylink_sfp_connect_phy(void *upstream, struct phy_device *phy)
 {
-	return phylink_connect_phy(upstream, phy);
+	struct phylink *pl = upstream;
+	return __phylink_connect_phy(upstream, phy, pl->link_config.interface);
 }
 static void phylink_sfp_disconnect_phy(void *upstream)

drivers/net/phy/sfp.c+5−2

 static void sfp_hwmon_remove(struct sfp *sfp)
 {
-	hwmon_device_unregister(sfp->hwmon_dev);
+	if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) {
-	kfree(sfp->hwmon_name);
+		hwmon_device_unregister(sfp->hwmon_dev);
+		sfp->hwmon_dev = NULL;
+		kfree(sfp->hwmon_name);
+	}
 }
 #else
 static int sfp_hwmon_insert(struct sfp *sfp)

drivers/net/team/team.c+6−0

 		return -EBUSY;
 	}
+	if (dev == port_dev) {
+		NL_SET_ERR_MSG(extack, "Cannot enslave team device to itself");
+		netdev_err(dev, "Cannot enslave team device to itself\n");
+		return -EINVAL;
+	}
 	if (port_dev->features & NETIF_F_VLAN_CHALLENGED &&
 	    vlan_uses_dev(dev)) {
 		NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up");

drivers/net/tun.c+21−16

 	};
 	struct napi_struct napi;
 	bool napi_enabled;
+	bool napi_frags_enabled;
 	struct mutex napi_mutex;	/* Protects access to the above napi */
 	struct list_head next;
 	struct tun_struct *detached;
 }
 static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
-			  bool napi_en)
+			  bool napi_en, bool napi_frags)
 {
 	tfile->napi_enabled = napi_en;
+	tfile->napi_frags_enabled = napi_en && napi_frags;
 	if (napi_en) {
 		netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
 			       NAPI_POLL_WEIGHT);
 		napi_enable(&tfile->napi);
-		mutex_init(&tfile->napi_mutex);
 	}
 }
-static void tun_napi_disable(struct tun_struct *tun, struct tun_file *tfile)
+static void tun_napi_disable(struct tun_file *tfile)
 {
 	if (tfile->napi_enabled)
 		napi_disable(&tfile->napi);
 }
-static void tun_napi_del(struct tun_struct *tun, struct tun_file *tfile)
+static void tun_napi_del(struct tun_file *tfile)
 {
 	if (tfile->napi_enabled)
 		netif_napi_del(&tfile->napi);
 }
-static bool tun_napi_frags_enabled(const struct tun_struct *tun)
+static bool tun_napi_frags_enabled(const struct tun_file *tfile)
 {
-	return READ_ONCE(tun->flags) & IFF_NAPI_FRAGS;
+	return tfile->napi_frags_enabled;
 }
 #ifdef CONFIG_TUN_VNET_CROSS_LE
 	tun = rtnl_dereference(tfile->tun);
 	if (tun && clean) {
-		tun_napi_disable(tun, tfile);
+		tun_napi_disable(tfile);
-		tun_napi_del(tun, tfile);
+		tun_napi_del(tfile);
 	}
 	if (tun && !tfile->detached) {
 	for (i = 0; i < n; i++) {
 		tfile = rtnl_dereference(tun->tfiles[i]);
 		BUG_ON(!tfile);
-		tun_napi_disable(tun, tfile);
+		tun_napi_disable(tfile);
 		tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
 		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
 		RCU_INIT_POINTER(tfile->tun, NULL);
 	synchronize_net();
 	for (i = 0; i < n; i++) {
 		tfile = rtnl_dereference(tun->tfiles[i]);
-		tun_napi_del(tun, tfile);
+		tun_napi_del(tfile);
 		/* Drop read queue */
 		tun_queue_purge(tfile);
 		xdp_rxq_info_unreg(&tfile->xdp_rxq);
 }
 static int tun_attach(struct tun_struct *tun, struct file *file,
-		      bool skip_filter, bool napi)
+		      bool skip_filter, bool napi, bool napi_frags)
 {
 	struct tun_file *tfile = file->private_data;
 	struct net_device *dev = tun->dev;
 		tun_enable_queue(tfile);
 	} else {
 		sock_hold(&tfile->sk);
-		tun_napi_init(tun, tfile, napi);
+		tun_napi_init(tun, tfile, napi, napi_frags);
 	}
 	tun_set_real_num_queues(tun);
 	int err;
 	u32 rxhash = 0;
 	int skb_xdp = 1;
-	bool frags = tun_napi_frags_enabled(tun);
+	bool frags = tun_napi_frags_enabled(tfile);
 	if (!(tun->dev->flags & IFF_UP))
 		return -EIO;
 			return err;
 		err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER,
-				 ifr->ifr_flags & IFF_NAPI);
+				 ifr->ifr_flags & IFF_NAPI,
+				 ifr->ifr_flags & IFF_NAPI_FRAGS);
 		if (err < 0)
 			return err;
 			      (ifr->ifr_flags & TUN_FEATURES);
 		INIT_LIST_HEAD(&tun->disabled);
-		err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI);
+		err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
+				 ifr->ifr_flags & IFF_NAPI_FRAGS);
 		if (err < 0)
 			goto err_free_flow;
 		ret = security_tun_dev_attach_queue(tun->security);
 		if (ret < 0)
 			goto unlock;
-		ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI);
+		ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI,
+				 tun->flags & IFF_NAPI_FRAGS);
 	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
 		tun = rtnl_dereference(tfile->tun);
 		if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached)
 		return -ENOMEM;
 	}
+	mutex_init(&tfile->napi_mutex);
 	RCU_INIT_POINTER(tfile->tun, NULL);
 	tfile->flags = 0;
 	tfile->ifindex = 0;

drivers/net/usb/asix_common.c+3−0

@@ -607,6 +607,9 @@ int asix_set_wol(struct net_device net, struct ethtool_wolinfo wolinfo) · 606 unmodified lines
607	struct usbnet *dev = netdev_priv(net);	607	struct usbnet *dev = netdev_priv(net);
608	u8 opt = 0;	608	u8 opt = 0;
609		609
		610	if (wolinfo->wolopts & ~(WAKE_PHY \| WAKE_MAGIC))
		611	return -EINVAL;
		612
610	if (wolinfo->wolopts & WAKE_PHY)	613	if (wolinfo->wolopts & WAKE_PHY)
611	opt \|= AX_MONITOR_LINK;	614	opt \|= AX_MONITOR_LINK;
612	if (wolinfo->wolopts & WAKE_MAGIC)	615	if (wolinfo->wolopts & WAKE_MAGIC)

drivers/net/usb/ax88179_178a.c+3−0

@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device net, struct ethtool_wolinfo wolinfo) · 565 unmodified lines
566	struct usbnet *dev = netdev_priv(net);	566	struct usbnet *dev = netdev_priv(net);
567	u8 opt = 0;	567	u8 opt = 0;
568		568
		569	if (wolinfo->wolopts & ~(WAKE_PHY \| WAKE_MAGIC))
		570	return -EINVAL;
		571
569	if (wolinfo->wolopts & WAKE_PHY)	572	if (wolinfo->wolopts & WAKE_PHY)
570	opt \|= AX_MONITOR_MODE_RWLC;	573	opt \|= AX_MONITOR_MODE_RWLC;
571	if (wolinfo->wolopts & WAKE_MAGIC)	574	if (wolinfo->wolopts & WAKE_MAGIC)

drivers/net/usb/lan78xx.c+4−13

@@ -1401,19 +1401,10 @@ static int lan78xx_set_wol(struct net_device *netdev, · 1400 unmodified lines
1401	if (ret < 0)	1401	if (ret < 0)
1402	return ret;	1402	return ret;
1403		1403
1404	pdata->wol = 0;	1404	if (wol->wolopts & ~WAKE_ALL)
1405	if (wol->wolopts & WAKE_UCAST)	1405	return -EINVAL;
1406	pdata->wol \|= WAKE_UCAST;	1406
1407	if (wol->wolopts & WAKE_MCAST)	1407	pdata->wol = wol->wolopts;
1408	pdata->wol \|= WAKE_MCAST;
1409	if (wol->wolopts & WAKE_BCAST)
1410	pdata->wol \|= WAKE_BCAST;
1411	if (wol->wolopts & WAKE_MAGIC)
1412	pdata->wol \|= WAKE_MAGIC;
1413	if (wol->wolopts & WAKE_PHY)
1414	pdata->wol \|= WAKE_PHY;
1415	if (wol->wolopts & WAKE_ARP)
1416	pdata->wol \|= WAKE_ARP;
1417		1408
1418	device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts);	1409	device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts);
1419		1410

drivers/net/usb/r8152.c+3−0

@@ -4506,6 +4506,9 @@ static int rtl8152_set_wol(struct net_device dev, struct ethtool_wolinfo wol) · 4505 unmodified lines
4506	if (!rtl_can_wakeup(tp))	4506	if (!rtl_can_wakeup(tp))
4507	return -EOPNOTSUPP;	4507	return -EOPNOTSUPP;
4508		4508
		4509	if (wol->wolopts & ~WAKE_ANY)
		4510	return -EINVAL;
		4511
4509	ret = usb_autopm_get_interface(tp->intf);	4512	ret = usb_autopm_get_interface(tp->intf);
4510	if (ret < 0)	4513	if (ret < 0)
4511	goto out_set_wol;	4514	goto out_set_wol;

drivers/net/usb/smsc75xx.c+4−0

 	struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
 	int ret;
+	if (wolinfo->wolopts & ~SUPPORTED_WAKE)
+		return -EINVAL;
 	pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
 	ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
 {
 	struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
 	if (pdata) {
+		cancel_work_sync(&pdata->set_multicast);
 		netif_dbg(dev, ifdown, dev->net, "free pdata\n");
 		kfree(pdata);
 		pdata = NULL;

drivers/net/usb/smsc95xx.c+3−0

@@ -774,6 +774,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net, · 773 unmodified lines
774	struct smsc95xx_priv pdata = (struct smsc95xx_priv )(dev->data[0]);	774	struct smsc95xx_priv pdata = (struct smsc95xx_priv )(dev->data[0]);
775	int ret;	775	int ret;
776		776
		777	if (wolinfo->wolopts & ~SUPPORTED_WAKE)
		778	return -EINVAL;
		779
777	pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;	780	pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
778		781
779	ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);	782	ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);

drivers/net/usb/sr9800.c+3−0

@@ -421,6 +421,9 @@ sr_set_wol(struct net_device net, struct ethtool_wolinfo wolinfo) · 420 unmodified lines
421	struct usbnet *dev = netdev_priv(net);	421	struct usbnet *dev = netdev_priv(net);
422	u8 opt = 0;	422	u8 opt = 0;
423		423
		424	if (wolinfo->wolopts & ~(WAKE_PHY \| WAKE_MAGIC))
		425	return -EINVAL;
		426
424	if (wolinfo->wolopts & WAKE_PHY)	427	if (wolinfo->wolopts & WAKE_PHY)
425	opt \|= SR_MONITOR_LINK;	428	opt \|= SR_MONITOR_LINK;
426	if (wolinfo->wolopts & WAKE_MAGIC)	429	if (wolinfo->wolopts & WAKE_MAGIC)

drivers/net/virtio_net.c+0−14

@@ -1699,17 +1699,6 @@ static void virtnet_stats(struct net_device *dev, · 1698 unmodified lines
1699	tot->rx_frame_errors = dev->stats.rx_frame_errors;	1699	tot->rx_frame_errors = dev->stats.rx_frame_errors;
1700	}	1700	}
1701		1701
1702	#ifdef CONFIG_NET_POLL_CONTROLLER
1703	static void virtnet_netpoll(struct net_device *dev)
1704	{
1705	struct virtnet_info *vi = netdev_priv(dev);
1706	int i;
1707
1708	for (i = 0; i < vi->curr_queue_pairs; i++)
1709	napi_schedule(&vi->rq[i].napi);
1710	}
1711	#endif
1712
1713	static void virtnet_ack_link_announce(struct virtnet_info *vi)	1702	static void virtnet_ack_link_announce(struct virtnet_info *vi)
1714	{	1703	{
1715	rtnl_lock();	1704	rtnl_lock();
@@ -2447,9 +2436,6 @@ static const struct net_device_ops virtnet_netdev = { · 731 unmodified lines
2447	.ndo_get_stats64 = virtnet_stats,	2436	.ndo_get_stats64 = virtnet_stats,
2448	.ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,	2437	.ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
2449	.ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,	2438	.ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
2450	#ifdef CONFIG_NET_POLL_CONTROLLER
2451	.ndo_poll_controller = virtnet_netpoll,
2452	#endif
2453	.ndo_bpf = virtnet_xdp,	2439	.ndo_bpf = virtnet_xdp,
2454	.ndo_xdp_xmit = virtnet_xdp_xmit,	2440	.ndo_xdp_xmit = virtnet_xdp_xmit,
2455	.ndo_features_check = passthru_features_check,	2441	.ndo_features_check = passthru_features_check,

drivers/net/vxlan.c+3−0

 		nla_total_size(sizeof(__u32)) +	/* IFLA_VXLAN_LINK */
 		nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_LOCAL{6} */
 		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_TTL */
+		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_TTL_INHERIT */
 		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_TOS */
 		nla_total_size(sizeof(__be32)) + /* IFLA_VXLAN_LABEL */
 		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_LEARNING */
 	}
 	if (nla_put_u8(skb, IFLA_VXLAN_TTL, vxlan->cfg.ttl) ||
+	    nla_put_u8(skb, IFLA_VXLAN_TTL_INHERIT,
+		       !!(vxlan->cfg.flags & VXLAN_F_TTL_INHERIT)) ||
 	    nla_put_u8(skb, IFLA_VXLAN_TOS, vxlan->cfg.tos) ||
 	    nla_put_be32(skb, IFLA_VXLAN_LABEL, vxlan->cfg.label) ||
 	    nla_put_u8(skb, IFLA_VXLAN_LEARNING,

drivers/net/wimax/i2400m/control.c+1−1

@@ -257,7 +257,7 @@ static const struct · 256 unmodified lines
257	[I2400M_MS_ACCESSIBILITY_ERROR] = { "accesibility error", -EIO },	257	[I2400M_MS_ACCESSIBILITY_ERROR] = { "accesibility error", -EIO },
258	[I2400M_MS_BUSY] = { "busy", -EBUSY },	258	[I2400M_MS_BUSY] = { "busy", -EBUSY },
259	[I2400M_MS_CORRUPTED_TLV] = { "corrupted TLV", -EILSEQ },	259	[I2400M_MS_CORRUPTED_TLV] = { "corrupted TLV", -EILSEQ },
260	[I2400M_MS_UNINITIALIZED] = { "not unitialized", -EILSEQ },	260	[I2400M_MS_UNINITIALIZED] = { "uninitialized", -EILSEQ },
261	[I2400M_MS_UNKNOWN_ERROR] = { "unknown error", -EIO },	261	[I2400M_MS_UNKNOWN_ERROR] = { "unknown error", -EIO },
262	[I2400M_MS_PRODUCTION_ERROR] = { "production error", -EIO },	262	[I2400M_MS_PRODUCTION_ERROR] = { "production error", -EIO },
263	[I2400M_MS_NO_RF] = { "no RF", -EIO },	263	[I2400M_MS_NO_RF] = { "no RF", -EIO },

drivers/net/wireless/broadcom/b43/dma.c+4−2

 			}
 		} else {
 			/* More than a single header/data pair were missed.
-			 * Report this error, and reset the controller to
+			 * Report this error. If running with open-source
+			 * firmware, then reset the controller to
 			 * revive operation.
 			 */
 			b43dbg(dev->wl,
 			       "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
 			       ring->index, firstused, slot);
-			b43_controller_restart(dev, "Out of order TX");
+			if (dev->fw.opensource)
+				b43_controller_restart(dev, "Out of order TX");
 			return;
 		}
 	}

drivers/net/wireless/intel/iwlwifi/cfg/1000.c+1−0

@@ -51,6 +51,7 @@ · 50 unmodified lines
51		51
52	static const struct iwl_base_params iwl1000_base_params = {	52	static const struct iwl_base_params iwl1000_base_params = {
53	.num_of_queues = IWLAGN_NUM_QUEUES,	53	.num_of_queues = IWLAGN_NUM_QUEUES,
		54	.max_tfd_queue_size = 256,
54	.eeprom_size = OTP_LOW_IMAGE_SIZE,	55	.eeprom_size = OTP_LOW_IMAGE_SIZE,
55	.pll_cfg = true,	56	.pll_cfg = true,
56	.max_ll_items = OTP_MAX_LL_ITEMS_1000,	57	.max_ll_items = OTP_MAX_LL_ITEMS_1000,

drivers/net/wireless/mac80211_hwsim.c+17−19

 	int channels, idx;
 	bool use_chanctx;
 	bool destroy_on_close;
-	struct work_struct destroy_work;
 	u32 portid;
 	char alpha2[2];
 	const struct ieee80211_regdomain *regd;
 	hwsim_radios_generation++;
 	spin_unlock_bh(&hwsim_radio_lock);
-	if (idx > 0)
+	hwsim_mcast_new_radio(idx, info, param);
-		hwsim_mcast_new_radio(idx, info, param);
 	return idx;
 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
 };
-static void destroy_radio(struct work_struct *work)
-{
-	struct mac80211_hwsim_data *data =
-		container_of(work, struct mac80211_hwsim_data, destroy_work);
-	hwsim_radios_generation++;
-	mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), NULL);
-}
 static void remove_user_radios(u32 portid)
 {
 	struct mac80211_hwsim_data *entry, *tmp;
+	LIST_HEAD(list);
 	spin_lock_bh(&hwsim_radio_lock);
 	list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
 		if (entry->destroy_on_close && entry->portid == portid) {
-			list_del(&entry->list);
+			list_move(&entry->list, &list);
 			rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
 					       hwsim_rht_params);
-			INIT_WORK(&entry->destroy_work, destroy_radio);
+			hwsim_radios_generation++;
-			queue_work(hwsim_wq, &entry->destroy_work);
 		}
 	}
 	spin_unlock_bh(&hwsim_radio_lock);
+	list_for_each_entry_safe(entry, tmp, &list, list) {
+		list_del(&entry->list);
+		mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
+					 NULL);
+	}
 }
 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
 static void __net_exit hwsim_exit_net(struct net *net)
 {
 	struct mac80211_hwsim_data *data, *tmp;
+	LIST_HEAD(list);
 	spin_lock_bh(&hwsim_radio_lock);
 	list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
 		if (data->netgroup == hwsim_net_get_netgroup(&init_net))
 			continue;
-		list_del(&data->list);
+		list_move(&data->list, &list);
 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
 				       hwsim_rht_params);
 		hwsim_radios_generation++;
-		spin_unlock_bh(&hwsim_radio_lock);
+	}
+	spin_unlock_bh(&hwsim_radio_lock);
+	list_for_each_entry_safe(data, tmp, &list, list) {
+		list_del(&data->list);
 		mac80211_hwsim_del_radio(data,
 					 wiphy_name(data->hw->wiphy),
 					 NULL);
-		spin_lock_bh(&hwsim_radio_lock);
 	}
-	spin_unlock_bh(&hwsim_radio_lock);
 	ida_simple_remove(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
 }

drivers/net/wireless/mediatek/mt76/mt76x0/main.c+1−2

@@ -77,9 +77,8 @@ static void mt76x0_remove_interface(struct ieee80211_hw *hw, · 76 unmodified lines
77	{	77	{
78	struct mt76x0_dev *dev = hw->priv;	78	struct mt76x0_dev *dev = hw->priv;
79	struct mt76_vif mvif = (struct mt76_vif ) vif->drv_priv;	79	struct mt76_vif mvif = (struct mt76_vif ) vif->drv_priv;
80	unsigned int wcid = mvif->group_wcid.idx;
81		80
82	dev->wcid_mask[wcid / BITS_PER_LONG] &= ~BIT(wcid % BITS_PER_LONG);	81	dev->vif_mask &= ~BIT(mvif->idx);
83	}	82	}
84		83
85	static int mt76x0_config(struct ieee80211_hw *hw, u32 changed)	84	static int mt76x0_config(struct ieee80211_hw *hw, u32 changed)

drivers/net/xen-netback/common.h+2−1

 struct xenvif_hash {
 	unsigned int alg;
 	u32 flags;
+	bool mapping_sel;
 	u8 key[XEN_NETBK_MAX_HASH_KEY_SIZE];
-	u32 mapping[XEN_NETBK_MAX_HASH_MAPPING_SIZE];
+	u32 mapping[2][XEN_NETBK_MAX_HASH_MAPPING_SIZE];
 	unsigned int size;
 	struct xenvif_hash_cache cache;
 };

drivers/net/xen-netback/hash.c+36−15

 		return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
 	vif->hash.size = size;
-	memset(vif->hash.mapping, 0, sizeof(u32) * size);
+	memset(vif->hash.mapping[vif->hash.mapping_sel], 0,
+	       sizeof(u32) * size);
 	return XEN_NETIF_CTRL_STATUS_SUCCESS;
 }
 u32 xenvif_set_hash_mapping(struct xenvif *vif, u32 gref, u32 len,
 			    u32 off)
 {
-	u32 *mapping = &vif->hash.mapping[off];
+	u32 *mapping = vif->hash.mapping[!vif->hash.mapping_sel];
-	struct gnttab_copy copy_op = {
+	unsigned int nr = 1;
+	struct gnttab_copy copy_op[2] = {{
 		.source.u.ref = gref,
 		.source.domid = vif->domid,
-		.dest.u.gmfn = virt_to_gfn(mapping),
 		.dest.domid = DOMID_SELF,
-		.dest.offset = xen_offset_in_page(mapping),
+		.len = len * sizeof(*mapping),
-		.len = len * sizeof(u32),
 		.flags = GNTCOPY_source_gref
-	};
+	}};
-	if ((off + len > vif->hash.size) || copy_op.len > XEN_PAGE_SIZE)
+	if ((off + len < off) || (off + len > vif->hash.size) ||
+	    len > XEN_PAGE_SIZE / sizeof(*mapping))
 		return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
-	while (len-- != 0)
+	copy_op[0].dest.u.gmfn = virt_to_gfn(mapping + off);
-		if (mapping[off++] >= vif->num_queues)
+	copy_op[0].dest.offset = xen_offset_in_page(mapping + off);
-			return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+	if (copy_op[0].dest.offset + copy_op[0].len > XEN_PAGE_SIZE) {
+		copy_op[1] = copy_op[0];
+		copy_op[1].source.offset = XEN_PAGE_SIZE - copy_op[0].dest.offset;
+		copy_op[1].dest.u.gmfn = virt_to_gfn(mapping + off + len);
+		copy_op[1].dest.offset = 0;
+		copy_op[1].len = copy_op[0].len - copy_op[1].source.offset;
+		copy_op[0].len = copy_op[1].source.offset;
+		nr = 2;
+	}
-	if (copy_op.len != 0) {
+	memcpy(mapping, vif->hash.mapping[vif->hash.mapping_sel],
-		gnttab_batch_copy(&copy_op, 1);
+	       vif->hash.size * sizeof(*mapping));
-		if (copy_op.status != GNTST_okay)
+	if (copy_op[0].len != 0) {
+		gnttab_batch_copy(copy_op, nr);
+		if (copy_op[0].status != GNTST_okay ||
+		    copy_op[nr - 1].status != GNTST_okay)
 			return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
 	}
+	while (len-- != 0)
+		if (mapping[off++] >= vif->num_queues)
+			return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
+	vif->hash.mapping_sel = !vif->hash.mapping_sel;
 	return XEN_NETIF_CTRL_STATUS_SUCCESS;
 }
 	}
 	if (vif->hash.size != 0) {
+		const u32 *mapping = vif->hash.mapping[vif->hash.mapping_sel];
 		seq_puts(m, "\nHash Mapping:\n");
 		for (i = 0; i < vif->hash.size; ) {
 			seq_printf(m, "[%4u - %4u]: ", i, i + n - 1);
 			for (j = 0; j < n; j++, i++)
-				seq_printf(m, "%4u ", vif->hash.mapping[i]);
+				seq_printf(m, "%4u ", mapping[i]);
 			seq_puts(m, "\n");
 		}

drivers/net/xen-netback/interface.c+2−1

@@ -162,7 +162,8 @@ static u16 xenvif_select_queue(struct net_device dev, struct sk_buff skb, · 161 unmodified lines
162	if (size == 0)	162	if (size == 0)
163	return skb_get_hash_raw(skb) % dev->real_num_tx_queues;	163	return skb_get_hash_raw(skb) % dev->real_num_tx_queues;
164		164
165	return vif->hash.mapping[skb_get_hash_raw(skb) % size];	165	return vif->hash.mapping[vif->hash.mapping_sel]
		166	[skb_get_hash_raw(skb) % size];
166	}	167	}
167		168
168	static int xenvif_start_xmit(struct sk_buff skb, struct net_device dev)	169	static int xenvif_start_xmit(struct sk_buff skb, struct net_device dev)

drivers/pci/controller/pci-mvebu.c+48−4

@@ -1145,7 +1145,6 @@ static int mvebu_pcie_parse_request_resources(struct mvebu_pcie *pcie) · 1144 unmodified lines
1145	{	1145	{
1146	struct device *dev = &pcie->pdev->dev;	1146	struct device *dev = &pcie->pdev->dev;
1147	struct device_node *np = dev->of_node;	1147	struct device_node *np = dev->of_node;
1148	unsigned int i;
1149	int ret;	1148	int ret;
1150		1149
1151	INIT_LIST_HEAD(&pcie->resources);	1150	INIT_LIST_HEAD(&pcie->resources);
@@ -1179,13 +1178,58 @@ static int mvebu_pcie_parse_request_resources(struct mvebu_pcie *pcie) · 27 unmodified lines
1179	resource_size(&pcie->io) - 1);	1178	resource_size(&pcie->io) - 1);
1180	pcie->realio.name = "PCI I/O";	1179	pcie->realio.name = "PCI I/O";
1181		1180
		1181	pci_add_resource(&pcie->resources, &pcie->realio);
		1182	}
		1183
		1184	return devm_request_pci_bus_resources(dev, &pcie->resources);
		1185	}
		1186
		1187	/*
		1188	* This is a copy of pci_host_probe(), except that it does the I/O
		1189	* remap as the last step, once we are sure we won't fail.
		1190	*
		1191	* It should be removed once the I/O remap error handling issue has
		1192	* been sorted out.
		1193	*/
		1194	static int mvebu_pci_host_probe(struct pci_host_bridge *bridge)
		1195	{
		1196	struct mvebu_pcie *pcie;
		1197	struct pci_bus bus, child;
		1198	int ret;
		1199
		1200	ret = pci_scan_root_bus_bridge(bridge);
		1201	if (ret < 0) {
		1202	dev_err(bridge->dev.parent, "Scanning root bridge failed");
		1203	return ret;
		1204	}
		1205
		1206	pcie = pci_host_bridge_priv(bridge);
		1207	if (resource_size(&pcie->io) != 0) {
		1208	unsigned int i;
		1209
1182	for (i = 0; i < resource_size(&pcie->realio); i += SZ_64K)	1210	for (i = 0; i < resource_size(&pcie->realio); i += SZ_64K)
1183	pci_ioremap_io(i, pcie->io.start + i);	1211	pci_ioremap_io(i, pcie->io.start + i);
		1212	}
1184		1213
1185	pci_add_resource(&pcie->resources, &pcie->realio);	1214	bus = bridge->bus;
		1215
		1216	/*
		1217	* We insert PCI resources into the iomem_resource and
		1218	* ioport_resource trees in either pci_bus_claim_resources()
		1219	* or pci_bus_assign_resources().
		1220	*/
		1221	if (pci_has_flag(PCI_PROBE_ONLY)) {
		1222	pci_bus_claim_resources(bus);
		1223	} else {
		1224	pci_bus_size_bridges(bus);
		1225	pci_bus_assign_resources(bus);
		1226
		1227	list_for_each_entry(child, &bus->children, node)
		1228	pcie_bus_configure_settings(child);
1186	}	1229	}
1187		1230
1188	return devm_request_pci_bus_resources(dev, &pcie->resources);	1231	pci_bus_add_devices(bus);
		1232	return 0;
1189	}	1233	}
1190		1234
1191	static int mvebu_pcie_probe(struct platform_device *pdev)	1235	static int mvebu_pcie_probe(struct platform_device *pdev)
@@ -1268,7 +1312,7 @@ static int mvebu_pcie_probe(struct platform_device *pdev) · 76 unmodified lines
1268	bridge->align_resource = mvebu_pcie_align_resource;	1312	bridge->align_resource = mvebu_pcie_align_resource;
1269	bridge->msi = pcie->msi;	1313	bridge->msi = pcie->msi;
1270		1314
1271	return pci_host_probe(bridge);	1315	return mvebu_pci_host_probe(bridge);
1272	}	1316	}
1273		1317
1274	static const struct of_device_id mvebu_pcie_of_match_table[] = {	1318	static const struct of_device_id mvebu_pcie_of_match_table[] = {

drivers/pci/pci.c+19−8

 EXPORT_SYMBOL(pci_save_state);
 static void pci_restore_config_dword(struct pci_dev *pdev, int offset,
-				     u32 saved_val, int retry)
+				     u32 saved_val, int retry, bool force)
 {
 	u32 val;
 	pci_read_config_dword(pdev, offset, &val);
-	if (val == saved_val)
+	if (!force && val == saved_val)
 		return;
 	for (;;) {
 }
 static void pci_restore_config_space_range(struct pci_dev *pdev,
-					   int start, int end, int retry)
+					   int start, int end, int retry,
+					   bool force)
 {
 	int index;
 	for (index = end; index >= start; index--)
 		pci_restore_config_dword(pdev, 4 * index,
 					 pdev->saved_config_space[index],
-					 retry);
+					 retry, force);
 }
 static void pci_restore_config_space(struct pci_dev *pdev)
 {
 	if (pdev->hdr_type == PCI_HEADER_TYPE_NORMAL) {
-		pci_restore_config_space_range(pdev, 10, 15, 0);
+		pci_restore_config_space_range(pdev, 10, 15, 0, false);
 		/* Restore BARs before the command register. */
-		pci_restore_config_space_range(pdev, 4, 9, 10);
+		pci_restore_config_space_range(pdev, 4, 9, 10, false);
-		pci_restore_config_space_range(pdev, 0, 3, 0);
+		pci_restore_config_space_range(pdev, 0, 3, 0, false);
+	} else if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+		pci_restore_config_space_range(pdev, 12, 15, 0, false);
+		/*
+		 * Force rewriting of prefetch registers to avoid S3 resume
+		 * issues on Intel PCI bridges that occur when these
+		 * registers are not explicitly written.
+		 */
+		pci_restore_config_space_range(pdev, 9, 11, 0, true);
+		pci_restore_config_space_range(pdev, 0, 8, 0, false);
 	} else {
-		pci_restore_config_space_range(pdev, 0, 15, 0);
+		pci_restore_config_space_range(pdev, 0, 15, 0, false);
 	}
 }

drivers/s390/net/qeth_core_main.c+1−1

@@ -610,7 +610,7 @@ static void qeth_put_reply(struct qeth_reply *reply) · 609 unmodified lines
610	static void qeth_issue_ipa_msg(struct qeth_ipa_cmd *cmd, int rc,	610	static void qeth_issue_ipa_msg(struct qeth_ipa_cmd *cmd, int rc,
611	struct qeth_card *card)	611	struct qeth_card *card)
612	{	612	{
613	char *ipa_name;	613	const char *ipa_name;
614	int com = cmd->hdr.command;	614	int com = cmd->hdr.command;
615	ipa_name = qeth_get_ipa_cmd_name(com);	615	ipa_name = qeth_get_ipa_cmd_name(com);
616	if (rc)	616	if (rc)

drivers/s390/net/qeth_core_mpc.c+16−17

@@ -148,10 +148,10 @@ EXPORT_SYMBOL_GPL(IPA_PDU_HEADER); · 147 unmodified lines
148		148
149	struct ipa_rc_msg {	149	struct ipa_rc_msg {
150	enum qeth_ipa_return_codes rc;	150	enum qeth_ipa_return_codes rc;
151	char *msg;	151	const char *msg;
152	};	152	};
153		153
154	static struct ipa_rc_msg qeth_ipa_rc_msg[] = {	154	static const struct ipa_rc_msg qeth_ipa_rc_msg[] = {
155	{IPA_RC_SUCCESS, "success"},	155	{IPA_RC_SUCCESS, "success"},
156	{IPA_RC_NOTSUPP, "Command not supported"},	156	{IPA_RC_NOTSUPP, "Command not supported"},
157	{IPA_RC_IP_TABLE_FULL, "Add Addr IP Table Full - ipv6"},	157	{IPA_RC_IP_TABLE_FULL, "Add Addr IP Table Full - ipv6"},
@@ -219,23 +219,23 @@ static struct ipa_rc_msg qeth_ipa_rc_msg[] = { · 61 unmodified lines
219		219
220		220
221		221
222	char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc)	222	const char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc)
223	{	223	{
224	int x = 0;	224	int x;
225	qeth_ipa_rc_msg[sizeof(qeth_ipa_rc_msg) /	225
226	sizeof(struct ipa_rc_msg) - 1].rc = rc;	226	for (x = 0; x < ARRAY_SIZE(qeth_ipa_rc_msg) - 1; x++)
227	while (qeth_ipa_rc_msg[x].rc != rc)	227	if (qeth_ipa_rc_msg[x].rc == rc)
228	x++;	228	return qeth_ipa_rc_msg[x].msg;
229	return qeth_ipa_rc_msg[x].msg;	229	return qeth_ipa_rc_msg[x].msg;
230	}	230	}
231		231
232		232
233	struct ipa_cmd_names {	233	struct ipa_cmd_names {
234	enum qeth_ipa_cmds cmd;	234	enum qeth_ipa_cmds cmd;
235	char *name;	235	const char *name;
236	};	236	};
237		237
238	static struct ipa_cmd_names qeth_ipa_cmd_names[] = {	238	static const struct ipa_cmd_names qeth_ipa_cmd_names[] = {
239	{IPA_CMD_STARTLAN, "startlan"},	239	{IPA_CMD_STARTLAN, "startlan"},
240	{IPA_CMD_STOPLAN, "stoplan"},	240	{IPA_CMD_STOPLAN, "stoplan"},
241	{IPA_CMD_SETVMAC, "setvmac"},	241	{IPA_CMD_SETVMAC, "setvmac"},
@@ -267,13 +267,12 @@ static struct ipa_cmd_names qeth_ipa_cmd_names[] = { · 25 unmodified lines
267	{IPA_CMD_UNKNOWN, "unknown"},	267	{IPA_CMD_UNKNOWN, "unknown"},
268	};	268	};
269		269
270	char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd)	270	const char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd)
271	{	271	{
272	int x = 0;	272	int x;
273	qeth_ipa_cmd_names[	273
274	sizeof(qeth_ipa_cmd_names) /	274	for (x = 0; x < ARRAY_SIZE(qeth_ipa_cmd_names) - 1; x++)
275	sizeof(struct ipa_cmd_names)-1].cmd = cmd;	275	if (qeth_ipa_cmd_names[x].cmd == cmd)
276	while (qeth_ipa_cmd_names[x].cmd != cmd)	276	return qeth_ipa_cmd_names[x].name;
277	x++;
278	return qeth_ipa_cmd_names[x].name;	277	return qeth_ipa_cmd_names[x].name;
279	}	278	}

drivers/s390/net/qeth_core_mpc.h+2−2

@@ -797,8 +797,8 @@ enum qeth_ipa_arp_return_codes { · 796 unmodified lines
797	QETH_IPA_ARP_RC_Q_NO_DATA = 0x0008,	797	QETH_IPA_ARP_RC_Q_NO_DATA = 0x0008,
798	};	798	};
799		799
800	extern char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc);	800	extern const char *qeth_get_ipa_msg(enum qeth_ipa_return_codes rc);
801	extern char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd);	801	extern const char *qeth_get_ipa_cmd_name(enum qeth_ipa_cmds cmd);
802		802
803	#define QETH_SETASS_BASE_LEN (sizeof(struct qeth_ipacmd_hdr) + \	803	#define QETH_SETASS_BASE_LEN (sizeof(struct qeth_ipacmd_hdr) + \
804	sizeof(struct qeth_ipacmd_setassparms_hdr))	804	sizeof(struct qeth_ipacmd_setassparms_hdr))

drivers/scsi/qedi/qedi_main.c+1−0

@@ -2472,6 +2472,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode) · 2471 unmodified lines
2472	/* start qedi context */	2472	/* start qedi context */
2473	spin_lock_init(&qedi->hba_lock);	2473	spin_lock_init(&qedi->hba_lock);
2474	spin_lock_init(&qedi->task_idx_lock);	2474	spin_lock_init(&qedi->task_idx_lock);
		2475	mutex_init(&qedi->stats_lock);
2475	}	2476	}
2476	qedi_ops->ll2->register_cb_ops(qedi->cdev, &qedi_ll2_cb_ops, qedi);	2477	qedi_ops->ll2->register_cb_ops(qedi->cdev, &qedi_ll2_cb_ops, qedi);
2477	qedi_ops->ll2->start(qedi->cdev, &params);	2478	qedi_ops->ll2->start(qedi->cdev, &params);

drivers/soc/fsl/qbman/qman.c+3−0

@@ -2729,6 +2729,9 @@ static int qman_alloc_range(struct gen_pool p, u32 result, u32 cnt) · 2728 unmodified lines
2729	{	2729	{
2730	unsigned long addr;	2730	unsigned long addr;
2731		2731
		2732	if (!p)
		2733	return -ENODEV;
		2734
2732	addr = gen_pool_alloc(p, cnt);	2735	addr = gen_pool_alloc(p, cnt);
2733	if (!addr)	2736	if (!addr)
2734	return -ENOMEM;	2737	return -ENOMEM;

drivers/soc/fsl/qe/ucc.c+1−1

@@ -626,7 +626,7 @@ static u32 ucc_get_tdm_sync_shift(enum comm_dir mode, u32 tdm_num) · 625 unmodified lines
626	{	626	{
627	u32 shift;	627	u32 shift;
628		628
629	shift = (mode == COMM_DIR_RX) ? RX_SYNC_SHIFT_BASE : RX_SYNC_SHIFT_BASE;	629	shift = (mode == COMM_DIR_RX) ? RX_SYNC_SHIFT_BASE : TX_SYNC_SHIFT_BASE;
630	shift -= tdm_num * 2;	630	shift -= tdm_num * 2;
631		631
632	return shift;	632	return shift;

drivers/thunderbolt/icm.c+20−29

 	u8 link, depth;
 	u64 route;
-	/*
-	 * After NVM upgrade adding root switch device fails because we
-	 * initiated reset. During that time ICM might still send
-	 * XDomain connected message which we ignore here.
-	 */
-	if (!tb->root_switch)
-		return;
 	link = pkg->link_info & ICM_LINK_INFO_LINK_MASK;
 	depth = (pkg->link_info & ICM_LINK_INFO_DEPTH_MASK) >>
 		ICM_LINK_INFO_DEPTH_SHIFT;
 	if (pkg->hdr.packet_id)
 		return;
-	/*
-	 * After NVM upgrade adding root switch device fails because we
-	 * initiated reset. During that time ICM might still send device
-	 * connected message which we ignore here.
-	 */
-	if (!tb->root_switch)
-		return;
 	route = get_route(pkg->route_hi, pkg->route_lo);
 	authorized = pkg->link_info & ICM_LINK_INFO_APPROVED;
 	security_level = (pkg->hdr.flags & ICM_FLAGS_SLEVEL_MASK) >>
 	mutex_lock(&tb->lock);
-	switch (n->pkg->code) {
+	/*
-	case ICM_EVENT_DEVICE_CONNECTED:
+	 * When the domain is stopped we flush its workqueue but before
-		icm->device_connected(tb, n->pkg);
+	 * that the root switch is removed. In that case we should treat
-		break;
+	 * the queued events as being canceled.
-	case ICM_EVENT_DEVICE_DISCONNECTED:
+	 */
-		icm->device_disconnected(tb, n->pkg);
+	if (tb->root_switch) {
-		break;
+		switch (n->pkg->code) {
-	case ICM_EVENT_XDOMAIN_CONNECTED:
+		case ICM_EVENT_DEVICE_CONNECTED:
-		icm->xdomain_connected(tb, n->pkg);
+			icm->device_connected(tb, n->pkg);
-		break;
+			break;
-	case ICM_EVENT_XDOMAIN_DISCONNECTED:
+		case ICM_EVENT_DEVICE_DISCONNECTED:
-		icm->xdomain_disconnected(tb, n->pkg);
+			icm->device_disconnected(tb, n->pkg);
-		break;
+			break;
+		case ICM_EVENT_XDOMAIN_CONNECTED:
+			icm->xdomain_connected(tb, n->pkg);
+			break;
+		case ICM_EVENT_XDOMAIN_DISCONNECTED:
+			icm->xdomain_disconnected(tb, n->pkg);
+			break;
+		}
 	}
 	mutex_unlock(&tb->lock);

drivers/thunderbolt/nhi.c+1−1

@@ -1192,5 +1192,5 @@ static void __exit nhi_unload(void) · 1191 unmodified lines
1192	tb_domain_exit();	1192	tb_domain_exit();
1193	}	1193	}
1194		1194
1195	fs_initcall(nhi_init);	1195	rootfs_initcall(nhi_init);
1196	module_exit(nhi_unload);	1196	module_exit(nhi_unload);

drivers/tty/serial/8250/8250_dw.c+0−4

 	if (!data->skip_autocfg)
 		dw8250_setup_port(p);
-#ifdef CONFIG_PM
-	uart.capabilities |= UART_CAP_RPM;
-#endif
 	/* If we have a valid fifosize, try hooking up DMA */
 	if (p->fifosize) {
 		data->dma.rxconf.src_maxburst = p->fifosize / 4;

drivers/tty/serial/sh-sci.c+41−15

 		.error_clear = SCIF_ERROR_CLEAR,
 	},
+	/*
+	 * The "SCIFA" that is in RZ/T and RZ/A2.
+	 * It looks like a normal SCIF with FIFO data, but with a
+	 * compressed address space. Also, the break out of interrupts
+	 * are different: ERI/BRI, RXI, TXI, TEI, DRI.
+	 */
+	[SCIx_RZ_SCIFA_REGTYPE] = {
+		.regs = {
+			[SCSMR]		= { 0x00, 16 },
+			[SCBRR]		= { 0x02,  8 },
+			[SCSCR]		= { 0x04, 16 },
+			[SCxTDR]	= { 0x06,  8 },
+			[SCxSR]		= { 0x08, 16 },
+			[SCxRDR]	= { 0x0A,  8 },
+			[SCFCR]		= { 0x0C, 16 },
+			[SCFDR]		= { 0x0E, 16 },
+			[SCSPTR]	= { 0x10, 16 },
+			[SCLSR]		= { 0x12, 16 },
+		},
+		.fifosize = 16,
+		.overrun_reg = SCLSR,
+		.overrun_mask = SCLSR_ORER,
+		.sampling_rate_mask = SCI_SR(32),
+		.error_mask = SCIF_DEFAULT_ERROR_MASK,
+		.error_clear = SCIF_ERROR_CLEAR,
+	},
 	/*
 	 * Common SH-3 SCIF definitions.
 	 */
 	[SCIx_SH4_SCIF_REGTYPE] = {
 		.regs = {
 			[SCSMR]		= { 0x00, 16 },
-			[SCBRR]		= { 0x02,  8 },
+			[SCBRR]		= { 0x04,  8 },
-			[SCSCR]		= { 0x04, 16 },
+			[SCSCR]		= { 0x08, 16 },
-			[SCxTDR]	= { 0x06,  8 },
+			[SCxTDR]	= { 0x0c,  8 },
-			[SCxSR]		= { 0x08, 16 },
+			[SCxSR]		= { 0x10, 16 },
-			[SCxRDR]	= { 0x0a,  8 },
+			[SCxRDR]	= { 0x14,  8 },
-			[SCFCR]		= { 0x0c, 16 },
+			[SCFCR]		= { 0x18, 16 },
-			[SCFDR]		= { 0x0e, 16 },
+			[SCFDR]		= { 0x1c, 16 },
-			[SCSPTR]	= { 0x10, 16 },
+			[SCSPTR]	= { 0x20, 16 },
-			[SCLSR]		= { 0x12, 16 },
+			[SCLSR]		= { 0x24, 16 },
 		},
 		.fifosize = 16,
 		.overrun_reg = SCLSR,
 {
 	struct uart_port *port = &sci_port->port;
 	const struct resource *res;
-	unsigned int i, regtype;
+	unsigned int i;
 	int ret;
 	sci_port->cfg	= p;
 	if (unlikely(sci_port->params == NULL))
 		return -EINVAL;
-	regtype = sci_port->params - sci_port_params;
 	switch (p->type) {
 	case PORT_SCIFB:
 		sci_port->rx_trigger = 48;
 			port->regshift = 1;
 	}
-	if (regtype == SCIx_SH4_SCIF_REGTYPE)
-		if (sci_port->reg_size >= 0x20)
-			port->regshift = 1;
 	/*
 	 * The UART port needs an IRQ value, so we peg this to the RX IRQ
 	 * for the multi-IRQ ports, which is where we are primarily
 		.compatible = "renesas,scif-r7s72100",
 		.data = SCI_OF_DATA(PORT_SCIF, SCIx_SH2_SCIF_FIFODATA_REGTYPE),
 	},
+	{
+		.compatible = "renesas,scif-r7s9210",
+		.data = SCI_OF_DATA(PORT_SCIF, SCIx_RZ_SCIFA_REGTYPE),
+	},
 	/* Family-specific types */
 	{
 		.compatible = "renesas,rcar-gen1-scif",

drivers/usb/class/cdc-acm.c+6−0

 {
 	struct acm *acm = usb_get_intfdata(intf);
 	struct tty_struct *tty;
+	int i;
 	/* sibling interface is already cleaning up */
 	if (!acm)
 	tty_unregister_device(acm_tty_driver, acm->minor);
+	usb_free_urb(acm->ctrlurb);
+	for (i = 0; i < ACM_NW; i++)
+		usb_free_urb(acm->wb[i].urb);
+	for (i = 0; i < acm->rx_buflimit; i++)
+		usb_free_urb(acm->read_urbs[i]);
 	acm_write_buffers_free(acm);
 	usb_free_coherent(acm->dev, acm->ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
 	acm_read_buffers_free(acm);

drivers/usb/host/xhci-mtk.c+2−2

 	xhci_mtk_host_enable(mtk);
 	xhci_dbg(xhci, "%s: restart port polling\n", __func__);
-	set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
-	usb_hcd_poll_rh_status(hcd);
 	set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
 	usb_hcd_poll_rh_status(xhci->shared_hcd);
+	set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+	usb_hcd_poll_rh_status(hcd);
 	return 0;
 }

drivers/usb/host/xhci-pci.c+2−0

 	}
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
 	    (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
+	     pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+	     pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
 		xhci->quirks |= XHCI_MISSING_CAS;

drivers/usb/serial/option.c+13−2

 /* Interface is reserved */
 #define RSVD(ifnum)	((BIT(ifnum) & 0xff) << 0)
+/* Interface must have two endpoints */
+#define NUMEP2		BIT(16)
 static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
 	  .driver_info = RSVD(4) },
-	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
-	  .driver_info = RSVD(4) | RSVD(5) },
+	  .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
 	if (device_flags & RSVD(iface_desc->bInterfaceNumber))
 		return -ENODEV;
+	/*
+	 * Allow matching on bNumEndpoints for devices whose interface numbers
+	 * can change (e.g. Quectel EP06).
+	 */
+	if (device_flags & NUMEP2 && iface_desc->bNumEndpoints != 2)
+		return -ENODEV;
 	/* Store the device flags so we can use them during attach. */
 	usb_set_serial_data(serial, (void *)device_flags);

drivers/usb/serial/usb-serial-simple.c+2−1

@@ -84,7 +84,8 @@ DEVICE(moto_modem, MOTO_IDS); · 83 unmodified lines
84		84
85	/* Motorola Tetra driver */	85	/* Motorola Tetra driver */
86	#define MOTOROLA_TETRA_IDS() \	86	#define MOTOROLA_TETRA_IDS() \
87	{ USB_DEVICE(0x0cad, 0x9011) } /* Motorola Solutions TETRA PEI */	87	{ USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
		88	{ USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */
88	DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);	89	DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
89		90
90	/* Novatel Wireless GPS driver */	91	/* Novatel Wireless GPS driver */

drivers/video/fbdev/efifb.c+6−0

 	u32 colors_important;
 } __packed;
+static bool use_bgrt = true;
 static bool request_mem_succeeded = false;
 static u64 mem_flags = EFI_MEMORY_WC | EFI_MEMORY_UC;
 	void *bgrt_image = NULL;
 	u8 *dst = info->screen_base;
+	if (!use_bgrt)
+		return;
 	if (!bgrt_tab.image_address) {
 		pr_info("efifb: No BGRT, not showing boot graphics\n");
 		return;
 				screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
 			else if (!strcmp(this_opt, "nowc"))
 				mem_flags &= ~EFI_MEMORY_WC;
+			else if (!strcmp(this_opt, "nobgrt"))
+				use_bgrt = false;
 		}
 	}

drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c+4−1

 	if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size))
 		return -EFAULT;
+	if (mr->w > 4096 || mr->h > 4096)
+		return -EINVAL;
 	if (mr->w * mr->h * 3 > mr->buffer_size)
 		return -EINVAL;
 			mr->x, mr->y, mr->w, mr->h);
 	if (r > 0) {
-		if (copy_to_user(mr->buffer, buf, mr->buffer_size))
+		if (copy_to_user(mr->buffer, buf, r))
 			r = -EFAULT;
 	}

drivers/video/fbdev/pxa168fb.c+3−3

@@ -712,7 +712,7 @@ static int pxa168fb_probe(struct platform_device *pdev) · 711 unmodified lines
712	/*	712	/*
713	* enable controller clock	713	* enable controller clock
714	*/	714	*/
715	clk_enable(fbi->clk);	715	clk_prepare_enable(fbi->clk);
716		716
717	pxa168fb_set_par(info);	717	pxa168fb_set_par(info);
718		718
@@ -767,7 +767,7 @@ static int pxa168fb_probe(struct platform_device *pdev) · 48 unmodified lines
767	failed_free_cmap:	767	failed_free_cmap:
768	fb_dealloc_cmap(&info->cmap);	768	fb_dealloc_cmap(&info->cmap);
769	failed_free_clk:	769	failed_free_clk:
770	clk_disable(fbi->clk);	770	clk_disable_unprepare(fbi->clk);
771	failed_free_fbmem:	771	failed_free_fbmem:
772	dma_free_coherent(fbi->dev, info->fix.smem_len,	772	dma_free_coherent(fbi->dev, info->fix.smem_len,
773	info->screen_base, fbi->fb_start_dma);	773	info->screen_base, fbi->fb_start_dma);
@@ -807,7 +807,7 @@ static int pxa168fb_remove(struct platform_device *pdev) · 33 unmodified lines
807	dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),	807	dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),
808	info->screen_base, info->fix.smem_start);	808	info->screen_base, info->fix.smem_start);
809		809
810	clk_disable(fbi->clk);	810	clk_disable_unprepare(fbi->clk);
811		811
812	framebuffer_release(info);	812	framebuffer_release(info);
813		813

drivers/video/fbdev/stifb.c+1−1

@@ -1157,7 +1157,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref) · 1156 unmodified lines
1157	dev_name);	1157	dev_name);
1158	goto out_err0;	1158	goto out_err0;
1159	}	1159	}
1160	/* fall though */	1160	/* fall through */
1161	case S9000_ID_ARTIST:	1161	case S9000_ID_ARTIST:
1162	case S9000_ID_HCRX:	1162	case S9000_ID_HCRX:
1163	case S9000_ID_TIMBER:	1163	case S9000_ID_TIMBER:

fs/cifs/cifsglob.h+1−0

@@ -1553,6 +1553,7 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param, · 1552 unmodified lines
1553		1553
1554	/* Flags */	1554	/* Flags */
1555	#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */	1555	#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */
		1556	#define MID_DELETED 2 /* Mid has been dequeued/deleted */
1556		1557
1557	/* Types of response buffer returned from SendReceive2 */	1558	/* Types of response buffer returned from SendReceive2 */
1558	#define CIFS_NO_BUFFER 0 /* Response buffer not returned */	1559	#define CIFS_NO_BUFFER 0 /* Response buffer not returned */

fs/cifs/connect.c+10−3

 		mid->mid_state = MID_RESPONSE_RECEIVED;
 	else
 		mid->mid_state = MID_RESPONSE_MALFORMED;
-	list_del_init(&mid->qhead);
+	/*
+	 * Trying to handle/dequeue a mid after the send_recv()
+	 * function has finished processing it is a bug.
+	 */
+	if (mid->mid_flags & MID_DELETED)
+		printk_once(KERN_WARNING
+			    "trying to dequeue a deleted mid\n");
+	else
+		list_del_init(&mid->qhead);
 	spin_unlock(&GlobalMid_Lock);
 }
 		} else {
 			mids[0] = server->ops->find_mid(server, buf);
 			bufs[0] = buf;
-			if (mids[0])
+			num_mids = 1;
-				num_mids = 1;
 			if (!mids[0] || !mids[0]->receive)
 				length = standard_receive3(server, mids[0]);

fs/cifs/smb2ops.c+1−1

@@ -1477,7 +1477,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, · 1476 unmodified lines
1477	}	1477	}
1478		1478
1479	srch_inf->entries_in_buffer = 0;	1479	srch_inf->entries_in_buffer = 0;
1480	srch_inf->index_of_last_entry = 0;	1480	srch_inf->index_of_last_entry = 2;
1481		1481
1482	rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,	1482	rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,
1483	fid->volatile_fid, 0, srch_inf);	1483	fid->volatile_fid, 0, srch_inf);

fs/cifs/transport.c+19−2

 cifs_delete_mid(struct mid_q_entry *mid)
 {
 	spin_lock(&GlobalMid_Lock);
-	list_del(&mid->qhead);
+	list_del_init(&mid->qhead);
+	mid->mid_flags |= MID_DELETED;
 	spin_unlock(&GlobalMid_Lock);
 	DeleteMidQEntry(mid);
 	return mid;
 }
+static void
+cifs_noop_callback(struct mid_q_entry *mid)
+{
+}
 int
 compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
 		   const int flags, const int num_rqst, struct smb_rqst *rqst,
 		}
 		midQ[i]->mid_state = MID_REQUEST_SUBMITTED;
+		/*
+		 * We don't invoke the callback compounds unless it is the last
+		 * request.
+		 */
+		if (i < num_rqst - 1)
+			midQ[i]->callback = cifs_noop_callback;
 	}
 	cifs_in_send_inc(ses->server);
 	rc = smb_send_rqst(ses->server, num_rqst, rqst, flags);
 	cifs_in_send_dec(ses->server);
 			midQ[i]->resp_buf = NULL;
 	}
 out:
+	/*
+	 * This will dequeue all mids. After this it is important that the
+	 * demultiplex_thread will not process any of these mids any futher.
+	 * This is prevented above by using a noop callback that will not
+	 * wake this thread except for the very last PDU.
+	 */
 	for (i = 0; i < num_rqst; i++)
 		cifs_delete_mid(midQ[i]);
 	add_credits(ses->server, credits, optype);

fs/ioctl.c+1−1

@@ -230,7 +230,7 @@ static long ioctl_file_clone(struct file *dst_file, unsigned long srcfd, · 229 unmodified lines
230	ret = -EXDEV;	230	ret = -EXDEV;
231	if (src_file.file->f_path.mnt != dst_file->f_path.mnt)	231	if (src_file.file->f_path.mnt != dst_file->f_path.mnt)
232	goto fdput;	232	goto fdput;
233	ret = do_clone_file_range(src_file.file, off, dst_file, destoff, olen);	233	ret = vfs_clone_file_range(src_file.file, off, dst_file, destoff, olen);
234	fdput:	234	fdput:
235	fdput(src_file);	235	fdput(src_file);
236	return ret;	236	return ret;

fs/iomap.c+1−1

 	} else {
 		WARN_ON_ONCE(!PageUptodate(page));
 		iomap_page_create(inode, page);
+		set_page_dirty(page);
 	}
 	return length;
 		length -= ret;
 	}
-	set_page_dirty(page);
 	wait_for_stable_page(page);
 	return VM_FAULT_LOCKED;
 out_unlock:

fs/nfsd/vfs.c+2−1

@@ -541,7 +541,8 @@ __be32 nfsd4_set_nfs4_label(struct svc_rqst rqstp, struct svc_fh fhp, · 540 unmodified lines
541	__be32 nfsd4_clone_file_range(struct file src, u64 src_pos, struct file dst,	541	__be32 nfsd4_clone_file_range(struct file src, u64 src_pos, struct file dst,
542	u64 dst_pos, u64 count)	542	u64 dst_pos, u64 count)
543	{	543	{
544	return nfserrno(do_clone_file_range(src, src_pos, dst, dst_pos, count));	544	return nfserrno(vfs_clone_file_range(src, src_pos, dst, dst_pos,
		545	count));
545	}	546	}
546		547
547	ssize_t nfsd_copy_file_range(struct file src, u64 src_pos, struct file dst,	548	ssize_t nfsd_copy_file_range(struct file src, u64 src_pos, struct file dst,

fs/ocfs2/dlm/dlmmaster.c+2−2

@@ -584,9 +584,9 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm, · 583 unmodified lines
584		584
585	res->last_used = 0;	585	res->last_used = 0;
586		586
587	spin_lock(&dlm->spinlock);	587	spin_lock(&dlm->track_lock);
588	list_add_tail(&res->tracking, &dlm->tracking_list);	588	list_add_tail(&res->tracking, &dlm->tracking_list);
589	spin_unlock(&dlm->spinlock);	589	spin_unlock(&dlm->track_lock);
590		590
591	memset(res->lvb, 0, DLM_LVB_LEN);	591	memset(res->lvb, 0, DLM_LVB_LEN);
592	memset(res->refmap, 0, sizeof(res->refmap));	592	memset(res->refmap, 0, sizeof(res->refmap));

fs/ocfs2/refcounttree.c+12−4

 		if (map_end & (PAGE_SIZE - 1))
 			to = map_end & (PAGE_SIZE - 1);
+retry:
 		page = find_or_create_page(mapping, page_index, GFP_NOFS);
 		if (!page) {
 			ret = -ENOMEM;
 		}
 		/*
-		 * In case PAGE_SIZE <= CLUSTER_SIZE, This page
+		 * In case PAGE_SIZE <= CLUSTER_SIZE, we do not expect a dirty
-		 * can't be dirtied before we CoW it out.
+		 * page, so write it back.
 		 */
-		if (PAGE_SIZE <= OCFS2_SB(sb)->s_clustersize)
+		if (PAGE_SIZE <= OCFS2_SB(sb)->s_clustersize) {
-			BUG_ON(PageDirty(page));
+			if (PageDirty(page)) {
+				/*
+				 * write_on_page will unlock the page on return
+				 */
+				ret = write_one_page(page);
+				goto retry;
+			}
+		}
 		if (!PageUptodate(page)) {
 			ret = block_read_full_page(page, ocfs2_get_block);

fs/overlayfs/copy_up.c+1−1

@@ -141,7 +141,7 @@ static int ovl_copy_up_data(struct path old, struct path new, loff_t len) · 140 unmodified lines
141	}	141	}
142		142
143	/* Try to use clone_file_range to clone up within the same fs */	143	/* Try to use clone_file_range to clone up within the same fs */
144	error = vfs_clone_file_range(old_file, 0, new_file, 0, len);	144	error = do_clone_file_range(old_file, 0, new_file, 0, len);
145	if (!error)	145	if (!error)
146	goto out;	146	goto out;
147	/* Couldn't clone, so now we try to copy the data */	147	/* Couldn't clone, so now we try to copy the data */

fs/overlayfs/file.c+2−0

 		goto out_unlock;
 	old_cred = ovl_override_creds(file_inode(file)->i_sb);
+	file_start_write(real.file);
 	ret = vfs_iter_write(real.file, iter, &iocb->ki_pos,
 			     ovl_iocb_to_rwf(iocb));
+	file_end_write(real.file);
 	revert_creds(old_cred);
 	/* Update size */

fs/overlayfs/inode.c+1−1

@@ -504,7 +504,7 @@ static const struct inode_operations ovl_special_inode_operations = { · 503 unmodified lines
504	.update_time = ovl_update_time,	504	.update_time = ovl_update_time,
505	};	505	};
506		506
507	const struct address_space_operations ovl_aops = {	507	static const struct address_space_operations ovl_aops = {
508	/* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */	508	/* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */
509	.direct_IO = noop_direct_IO,	509	.direct_IO = noop_direct_IO,
510	};	510	};

fs/overlayfs/namei.c+1−1

@@ -686,7 +686,7 @@ struct dentry ovl_lookup_index(struct ovl_fs ofs, struct dentry *upper, · 685 unmodified lines
686	index = NULL;	686	index = NULL;
687	goto out;	687	goto out;
688	}	688	}
689	pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n"	689	pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
690	"overlayfs: mount with '-o index=off' to disable inodes index.\n",	690	"overlayfs: mount with '-o index=off' to disable inodes index.\n",
691	d_inode(origin)->i_ino, name.len, name.name,	691	d_inode(origin)->i_ino, name.len, name.name,
692	err);	692	err);

fs/overlayfs/overlayfs.h+2−2

@@ -152,8 +152,8 @@ static inline int ovl_do_setxattr(struct dentry dentry, const char name, · 151 unmodified lines
152	const void *value, size_t size, int flags)	152	const void *value, size_t size, int flags)
153	{	153	{
154	int err = vfs_setxattr(dentry, name, value, size, flags);	154	int err = vfs_setxattr(dentry, name, value, size, flags);
155	pr_debug("setxattr(%pd2, \"%s\", \"%*s\", 0x%x) = %i\n",	155	pr_debug("setxattr(%pd2, \"%s\", \"%*pE\", %zu, 0x%x) = %i\n",
156	dentry, name, (int) size, (char *) value, flags, err);	156	dentry, name, min((int)size, 48), value, size, flags, err);
157	return err;	157	return err;
158	}	158	}
159		159

fs/overlayfs/util.c+2−1

 	struct dentry *upperdentry = ovl_dentry_upper(dentry);
 	struct dentry *index = NULL;
 	struct inode *inode;
-	struct qstr name;
+	struct qstr name = { };
 	int err;
 	err = ovl_get_index_name(lowerdentry, &name);
 		goto fail;
 out:
+	kfree(name.name);
 	dput(index);
 	return;

fs/proc/base.c+14−0

@@ -407,6 +407,20 @@ static int proc_pid_stack(struct seq_file m, struct pid_namespace ns, · 406 unmodified lines
407	unsigned long *entries;	407	unsigned long *entries;
408	int err;	408	int err;
409		409
		410	/*
		411	* The ability to racily run the kernel stack unwinder on a running task
		412	* and then observe the unwinder output is scary; while it is useful for
		413	* debugging kernel issues, it can also allow an attacker to leak kernel
		414	* stack contents.
		415	* Doing this in a manner that is at least safe from races would require
		416	* some work to ensure that the remote task can not be scheduled; and
		417	* even then, this would still expose the unwinder as local attack
		418	* surface.
		419	* Therefore, this interface is restricted to root.
		420	*/
		421	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
		422	return -EACCES;
		423
410	entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries),	424	entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries),
411	GFP_KERNEL);	425	GFP_KERNEL);
412	if (!entries)	426	if (!entries)

fs/pstore/ram.c+25−4

 	},
 };
-static void ramoops_register_dummy(void)
+static inline void ramoops_unregister_dummy(void)
 {
+	platform_device_unregister(dummy);
+	dummy = NULL;
+	kfree(dummy_data);
+	dummy_data = NULL;
+}
+static void __init ramoops_register_dummy(void)
+{
+	/*
+	 * Prepare a dummy platform data structure to carry the module
+	 * parameters. If mem_size isn't set, then there are no module
+	 * parameters, and we can skip this.
+	 */
 	if (!mem_size)
 		return;
 	if (IS_ERR(dummy)) {
 		pr_info("could not create platform device: %ld\n",
 			PTR_ERR(dummy));
+		dummy = NULL;
+		ramoops_unregister_dummy();
 	}
 }
 static int __init ramoops_init(void)
 {
+	int ret;
 	ramoops_register_dummy();
-	return platform_driver_register(&ramoops_driver);
+	ret = platform_driver_register(&ramoops_driver);
+	if (ret != 0)
+		ramoops_unregister_dummy();
+	return ret;
 }
 late_initcall(ramoops_init);
 static void __exit ramoops_exit(void)
 {
 	platform_driver_unregister(&ramoops_driver);
-	platform_device_unregister(dummy);
+	ramoops_unregister_dummy();
-	kfree(dummy_data);
 }
 module_exit(ramoops_exit);

fs/read_write.c+15−2

 }
 EXPORT_SYMBOL(vfs_clone_file_prep_inodes);
-int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
+int do_clone_file_range(struct file *file_in, loff_t pos_in,
-		struct file *file_out, loff_t pos_out, u64 len)
+			struct file *file_out, loff_t pos_out, u64 len)
 {
 	struct inode *inode_in = file_inode(file_in);
 	struct inode *inode_out = file_inode(file_out);
 	return ret;
 }
+EXPORT_SYMBOL(do_clone_file_range);
+int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
+			 struct file *file_out, loff_t pos_out, u64 len)
+{
+	int ret;
+	file_start_write(file_out);
+	ret = do_clone_file_range(file_in, pos_in, file_out, pos_out, len);
+	file_end_write(file_out);
+	return ret;
+}
 EXPORT_SYMBOL(vfs_clone_file_range);
 /*

fs/xattr.c+13−11

@@ -948,17 +948,19 @@ ssize_t simple_xattr_list(struct inode inode, struct simple_xattrs xattrs, · 947 unmodified lines
948	int err = 0;	948	int err = 0;
949		949
950	#ifdef CONFIG_FS_POSIX_ACL	950	#ifdef CONFIG_FS_POSIX_ACL
951	if (inode->i_acl) {	951	if (IS_POSIXACL(inode)) {
952	err = xattr_list_one(&buffer, &remaining_size,	952	if (inode->i_acl) {
953	XATTR_NAME_POSIX_ACL_ACCESS);	953	err = xattr_list_one(&buffer, &remaining_size,
954	if (err)	954	XATTR_NAME_POSIX_ACL_ACCESS);
955	return err;	955	if (err)
956	}	956	return err;
957	if (inode->i_default_acl) {	957	}
958	err = xattr_list_one(&buffer, &remaining_size,	958	if (inode->i_default_acl) {
959	XATTR_NAME_POSIX_ACL_DEFAULT);	959	err = xattr_list_one(&buffer, &remaining_size,
960	if (err)	960	XATTR_NAME_POSIX_ACL_DEFAULT);
961	return err;	961	if (err)
		962	return err;
		963	}
962	}	964	}
963	#endif	965	#endif
964		966

fs/xfs/libxfs/xfs_attr.c+8−20

 		 */
 		error = xfs_attr3_leaf_to_node(args);
 		if (error)
-			goto out_defer_cancel;
+			return error;
 		error = xfs_defer_finish(&args->trans);
 		if (error)
 			return error;
 			error = xfs_attr3_leaf_to_shortform(bp, args, forkoff);
 			/* bp is gone due to xfs_da_shrink_inode */
 			if (error)
-				goto out_defer_cancel;
+				return error;
 			error = xfs_defer_finish(&args->trans);
 			if (error)
 				return error;
 		error = xfs_attr3_leaf_clearflag(args);
 	}
 	return error;
-out_defer_cancel:
-	xfs_defer_cancel(args->trans);
-	return error;
 }
 /*
 		error = xfs_attr3_leaf_to_shortform(bp, args, forkoff);
 		/* bp is gone due to xfs_da_shrink_inode */
 		if (error)
-			goto out_defer_cancel;
+			return error;
 		error = xfs_defer_finish(&args->trans);
 		if (error)
 			return error;
 	}
 	return 0;
-out_defer_cancel:
-	xfs_defer_cancel(args->trans);
-	return error;
 }
 /*
 			state = NULL;
 			error = xfs_attr3_leaf_to_node(args);
 			if (error)
-				goto out_defer_cancel;
+				goto out;
 			error = xfs_defer_finish(&args->trans);
 			if (error)
 				goto out;
 		 */
 		error = xfs_da3_split(state);
 		if (error)
-			goto out_defer_cancel;
+			goto out;
 		error = xfs_defer_finish(&args->trans);
 		if (error)
 			goto out;
 		if (retval && (state->path.active > 1)) {
 			error = xfs_da3_join(state);
 			if (error)
-				goto out_defer_cancel;
+				goto out;
 			error = xfs_defer_finish(&args->trans);
 			if (error)
 				goto out;
 	if (error)
 		return error;
 	return retval;
-out_defer_cancel:
-	xfs_defer_cancel(args->trans);
-	goto out;
 }
 /*
 	if (retval && (state->path.active > 1)) {
 		error = xfs_da3_join(state);
 		if (error)
-			goto out_defer_cancel;
+			goto out;
 		error = xfs_defer_finish(&args->trans);
 		if (error)
 			goto out;
 			error = xfs_attr3_leaf_to_shortform(bp, args, forkoff);
 			/* bp is gone due to xfs_da_shrink_inode */
 			if (error)
-				goto out_defer_cancel;
+				goto out;
 			error = xfs_defer_finish(&args->trans);
 			if (error)
 				goto out;
 out:
 	xfs_da_state_free(state);
 	return error;
-out_defer_cancel:
-	xfs_defer_cancel(args->trans);
-	goto out;
 }
 /*

fs/xfs/libxfs/xfs_attr_remote.c+2−8

 				  blkcnt, XFS_BMAPI_ATTRFORK, args->total, &map,
 				  &nmap);
 		if (error)
-			goto out_defer_cancel;
+			return error;
 		error = xfs_defer_finish(&args->trans);
 		if (error)
 			return error;
 	}
 	ASSERT(valuelen == 0);
 	return 0;
-out_defer_cancel:
-	xfs_defer_cancel(args->trans);
-	return error;
 }
 /*
 		error = xfs_bunmapi(args->trans, args->dp, lblkno, blkcnt,
 				    XFS_BMAPI_ATTRFORK, 1, &done);
 		if (error)
-			goto out_defer_cancel;
+			return error;
 		error = xfs_defer_finish(&args->trans);
 		if (error)
 			return error;
 			return error;
 	}
 	return 0;
-out_defer_cancel:
-	xfs_defer_cancel(args->trans);
-	return error;
 }

fs/xfs/libxfs/xfs_bmap.c+13−11

 	ASSERT(XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_EXTENTS);
 	/*
-	 * Make space in the inode incore.
+	 * Make space in the inode incore. This needs to be undone if we fail
+	 * to expand the root.
 	 */
 	xfs_iroot_realloc(ip, 1, whichfork);
 	ifp->if_flags |= XFS_IFBROOT;
 	args.minlen = args.maxlen = args.prod = 1;
 	args.wasdel = wasdel;
 	*logflagsp = 0;
-	if ((error = xfs_alloc_vextent(&args))) {
+	error = xfs_alloc_vextent(&args);
-		ASSERT(ifp->if_broot == NULL);
+	if (error)
-		goto err1;
+		goto out_root_realloc;
-	}
 	if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
-		ASSERT(ifp->if_broot == NULL);
 		error = -ENOSPC;
-		goto err1;
+		goto out_root_realloc;
 	}
 	/*
 	 * Allocation can't fail, the space was reserved.
 	 */
 	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, 1L);
 	abp = xfs_btree_get_bufl(mp, tp, args.fsbno, 0);
 	if (!abp) {
-		error = -ENOSPC;
+		error = -EFSCORRUPTED;
-		goto err2;
+		goto out_unreserve_dquot;
 	}
 	/*
 	 * Fill in the child block.
 	 */
 	*logflagsp = XFS_ILOG_CORE | xfs_ilog_fbroot(whichfork);
 	return 0;
-err2:
+out_unreserve_dquot:
 	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, -1L);
-err1:
+out_root_realloc:
 	xfs_iroot_realloc(ip, -1, whichfork);
 	XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
+	ASSERT(ifp->if_broot == NULL);
 	xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
 	return error;

fs/xfs/libxfs/xfs_format.h+2−0

@@ -1016,6 +1016,8 @@ static inline void xfs_dinode_put_rdev(struct xfs_dinode *dip, xfs_dev_t rdev) · 1015 unmodified lines
1016	#define XFS_DIFLAG_EXTSZINHERIT_BIT 12 /* inherit inode extent size */	1016	#define XFS_DIFLAG_EXTSZINHERIT_BIT 12 /* inherit inode extent size */
1017	#define XFS_DIFLAG_NODEFRAG_BIT 13 /* do not reorganize/defragment */	1017	#define XFS_DIFLAG_NODEFRAG_BIT 13 /* do not reorganize/defragment */
1018	#define XFS_DIFLAG_FILESTREAM_BIT 14 /* use filestream allocator */	1018	#define XFS_DIFLAG_FILESTREAM_BIT 14 /* use filestream allocator */
		1019	/* Do not use bit 15, di_flags is legacy and unchanging now */
		1020
1019	#define XFS_DIFLAG_REALTIME (1 << XFS_DIFLAG_REALTIME_BIT)	1021	#define XFS_DIFLAG_REALTIME (1 << XFS_DIFLAG_REALTIME_BIT)
1020	#define XFS_DIFLAG_PREALLOC (1 << XFS_DIFLAG_PREALLOC_BIT)	1022	#define XFS_DIFLAG_PREALLOC (1 << XFS_DIFLAG_PREALLOC_BIT)
1021	#define XFS_DIFLAG_NEWRTBM (1 << XFS_DIFLAG_NEWRTBM_BIT)	1023	#define XFS_DIFLAG_NEWRTBM (1 << XFS_DIFLAG_NEWRTBM_BIT)

fs/xfs/libxfs/xfs_inode_buf.c+30−0

@@ -415,6 +415,31 @@ xfs_dinode_verify_fork( · 414 unmodified lines
415	return NULL;	415	return NULL;
416	}	416	}
417		417
		418	static xfs_failaddr_t
		419	xfs_dinode_verify_forkoff(
		420	struct xfs_dinode *dip,
		421	struct xfs_mount *mp)
		422	{
		423	if (!XFS_DFORK_Q(dip))
		424	return NULL;
		425
		426	switch (dip->di_format) {
		427	case XFS_DINODE_FMT_DEV:
		428	if (dip->di_forkoff != (roundup(sizeof(xfs_dev_t), 8) >> 3))
		429	return __this_address;
		430	break;
		431	case XFS_DINODE_FMT_LOCAL: /* fall through ... */
		432	case XFS_DINODE_FMT_EXTENTS: /* fall through ... */
		433	case XFS_DINODE_FMT_BTREE:
		434	if (dip->di_forkoff >= (XFS_LITINO(mp, dip->di_version) >> 3))
		435	return __this_address;
		436	break;
		437	default:
		438	return __this_address;
		439	}
		440	return NULL;
		441	}
		442
418	xfs_failaddr_t	443	xfs_failaddr_t
419	xfs_dinode_verify(	444	xfs_dinode_verify(
420	struct xfs_mount *mp,	445	struct xfs_mount *mp,
@@ -470,6 +495,11 @@ xfs_dinode_verify( · 49 unmodified lines
470	if (mode && (flags & XFS_DIFLAG_REALTIME) && !mp->m_rtdev_targp)	495	if (mode && (flags & XFS_DIFLAG_REALTIME) && !mp->m_rtdev_targp)
471	return __this_address;	496	return __this_address;
472		497
		498	/* check for illegal values of forkoff */
		499	fa = xfs_dinode_verify_forkoff(dip, mp);
		500	if (fa)
		501	return fa;
		502
473	/* Do we have appropriate data fork formats for the mode? */	503	/* Do we have appropriate data fork formats for the mode? */
474	switch (mode & S_IFMT) {	504	switch (mode & S_IFMT) {
475	case S_IFIFO:	505	case S_IFIFO:

fs/xfs/scrub/alloc.c+0−1

@@ -17,7 +17,6 @@ · 16 unmodified lines
17	#include "xfs_sb.h"	17	#include "xfs_sb.h"
18	#include "xfs_alloc.h"	18	#include "xfs_alloc.h"
19	#include "xfs_rmap.h"	19	#include "xfs_rmap.h"
20	#include "xfs_alloc.h"
21	#include "scrub/xfs_scrub.h"	20	#include "scrub/xfs_scrub.h"
22	#include "scrub/scrub.h"	21	#include "scrub/scrub.h"
23	#include "scrub/common.h"	22	#include "scrub/common.h"

fs/xfs/scrub/inode.c+3−1

 {
 	struct xfs_mount	*mp = sc->mp;
+	/* di_flags are all taken, last bit cannot be used */
 	if (flags & ~XFS_DIFLAG_ANY)
 		goto bad;
 {
 	struct xfs_mount	*mp = sc->mp;
+	/* Unknown di_flags2 could be from a future kernel */
 	if (flags2 & ~XFS_DIFLAG2_ANY)
-		goto bad;
+		xchk_ino_set_warning(sc, ino);
 	/* reflink flag requires reflink feature */
 	if ((flags2 & XFS_DIFLAG2_REFLINK) &&

fs/xfs/xfs_bmap_util.c+7−13

 	struct xfs_iext_cursor	icur;
 	int			error = 0;
-	xfs_ilock(ip, XFS_ILOCK_EXCL);
+	ASSERT(ifp->if_flags & XFS_IFEXTENTS);
-	if (!(ifp->if_flags & XFS_IFEXTENTS)) {
-		error = xfs_iread_extents(NULL, ip, XFS_DATA_FORK);
-		if (error)
-			goto out_unlock;
-	}
+	xfs_ilock(ip, XFS_ILOCK_EXCL);
 	if (!xfs_iext_lookup_extent_before(ip, ifp, &end_fsb, &icur, &got))
 		goto out_unlock;
 					tirec.br_blockcount, &irec,
 					&nimaps, 0);
 			if (error)
-				goto out_defer;
+				goto out;
 			ASSERT(nimaps == 1);
 			ASSERT(tirec.br_startoff == irec.br_startoff);
 			trace_xfs_swap_extent_rmap_remap_piece(ip, &irec);
 			/* Remove the mapping from the donor file. */
 			error = xfs_bmap_unmap_extent(tp, tip, &uirec);
 			if (error)
-				goto out_defer;
+				goto out;
 			/* Remove the mapping from the source file. */
 			error = xfs_bmap_unmap_extent(tp, ip, &irec);
 			if (error)
-				goto out_defer;
+				goto out;
 			/* Map the donor file's blocks into the source file. */
 			error = xfs_bmap_map_extent(tp, ip, &uirec);
 			if (error)
-				goto out_defer;
+				goto out;
 			/* Map the source file's blocks into the donor file. */
 			error = xfs_bmap_map_extent(tp, tip, &irec);
 			if (error)
-				goto out_defer;
+				goto out;
 			error = xfs_defer_finish(tpp);
 			tp = *tpp;
 	tip->i_d.di_flags2 = tip_flags2;
 	return 0;
-out_defer:
-	xfs_defer_cancel(tp);
 out:
 	trace_xfs_swap_extent_rmap_error(ip, error, _RET_IP_);
 	tip->i_d.di_flags2 = tip_flags2;

fs/xfs/xfs_buf_item.c+64−55

 	return rval;
 }
+/*
+ * Drop the buffer log item refcount and take appropriate action. This helper
+ * determines whether the bli must be freed or not, since a decrement to zero
+ * does not necessarily mean the bli is unused.
+ *
+ * Return true if the bli is freed, false otherwise.
+ */
+bool
+xfs_buf_item_put(
+	struct xfs_buf_log_item	*bip)
+{
+	struct xfs_log_item	*lip = &bip->bli_item;
+	bool			aborted;
+	bool			dirty;
+	/* drop the bli ref and return if it wasn't the last one */
+	if (!atomic_dec_and_test(&bip->bli_refcount))
+		return false;
+	/*
+	 * We dropped the last ref and must free the item if clean or aborted.
+	 * If the bli is dirty and non-aborted, the buffer was clean in the
+	 * transaction but still awaiting writeback from previous changes. In
+	 * that case, the bli is freed on buffer writeback completion.
+	 */
+	aborted = test_bit(XFS_LI_ABORTED, &lip->li_flags) ||
+		  XFS_FORCED_SHUTDOWN(lip->li_mountp);
+	dirty = bip->bli_flags & XFS_BLI_DIRTY;
+	if (dirty && !aborted)
+		return false;
+	/*
+	 * The bli is aborted or clean. An aborted item may be in the AIL
+	 * regardless of dirty state.  For example, consider an aborted
+	 * transaction that invalidated a dirty bli and cleared the dirty
+	 * state.
+	 */
+	if (aborted)
+		xfs_trans_ail_remove(lip, SHUTDOWN_LOG_IO_ERROR);
+	xfs_buf_item_relse(bip->bli_buf);
+	return true;
+}
 /*
  * Release the buffer associated with the buf log item.  If there is no dirty
  * logged data associated with the buffer recorded in the buf log item, then
 {
 	struct xfs_buf_log_item	*bip = BUF_ITEM(lip);
 	struct xfs_buf		*bp = bip->bli_buf;
-	bool			aborted;
+	bool			released;
-	bool			hold = !!(bip->bli_flags & XFS_BLI_HOLD);
+	bool			hold = bip->bli_flags & XFS_BLI_HOLD;
-	bool			dirty = !!(bip->bli_flags & XFS_BLI_DIRTY);
+	bool			stale = bip->bli_flags & XFS_BLI_STALE;
 #if defined(DEBUG) || defined(XFS_WARN)
-	bool			ordered = !!(bip->bli_flags & XFS_BLI_ORDERED);
+	bool			ordered = bip->bli_flags & XFS_BLI_ORDERED;
+	bool			dirty = bip->bli_flags & XFS_BLI_DIRTY;
 #endif
-	aborted = test_bit(XFS_LI_ABORTED, &lip->li_flags);
-	/* Clear the buffer's association with this transaction. */
-	bp->b_transp = NULL;
-	/*
-	 * The per-transaction state has been copied above so clear it from the
-	 * bli.
-	 */
-	bip->bli_flags &= ~(XFS_BLI_LOGGED | XFS_BLI_HOLD | XFS_BLI_ORDERED);
-	/*
-	 * If the buf item is marked stale, then don't do anything.  We'll
-	 * unlock the buffer and free the buf item when the buffer is unpinned
-	 * for the last time.
-	 */
-	if (bip->bli_flags & XFS_BLI_STALE) {
-		trace_xfs_buf_item_unlock_stale(bip);
-		ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
-		if (!aborted) {
-			atomic_dec(&bip->bli_refcount);
-			return;
-		}
-	}
 	trace_xfs_buf_item_unlock(bip);
 	/*
-	 * If the buf item isn't tracking any data, free it, otherwise drop the
-	 * reference we hold to it. If we are aborting the transaction, this may
-	 * be the only reference to the buf item, so we free it anyway
-	 * regardless of whether it is dirty or not. A dirty abort implies a
-	 * shutdown, anyway.
-	 *
 	 * The bli dirty state should match whether the blf has logged segments
 	 * except for ordered buffers, where only the bli should be dirty.
 	 */
 	ASSERT((!ordered && dirty == xfs_buf_item_dirty_format(bip)) ||
 	       (ordered && dirty && !xfs_buf_item_dirty_format(bip)));
+	ASSERT(!stale || (bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
 	/*
-	 * Clean buffers, by definition, cannot be in the AIL. However, aborted
+	 * Clear the buffer's association with this transaction and
-	 * buffers may be in the AIL regardless of dirty state. An aborted
+	 * per-transaction state from the bli, which has been copied above.
-	 * transaction that invalidates a buffer already in the AIL may have
-	 * marked it stale and cleared the dirty state, for example.
-	 *
-	 * Therefore if we are aborting a buffer and we've just taken the last
-	 * reference away, we have to check if it is in the AIL before freeing
-	 * it. We need to free it in this case, because an aborted transaction
-	 * has already shut the filesystem down and this is the last chance we
-	 * will have to do so.
 	 */
-	if (atomic_dec_and_test(&bip->bli_refcount)) {
+	bp->b_transp = NULL;
-		if (aborted) {
+	bip->bli_flags &= ~(XFS_BLI_LOGGED | XFS_BLI_HOLD | XFS_BLI_ORDERED);
-			ASSERT(XFS_FORCED_SHUTDOWN(lip->li_mountp));
-			xfs_trans_ail_remove(lip, SHUTDOWN_LOG_IO_ERROR);
-			xfs_buf_item_relse(bp);
-		} else if (!dirty)
-			xfs_buf_item_relse(bp);
-	}
-	if (!hold)
+	/*
-		xfs_buf_relse(bp);
+	 * Unref the item and unlock the buffer unless held or stale. Stale
+	 * buffers remain locked until final unpin unless the bli is freed by
+	 * the unref call. The latter implies shutdown because buffer
+	 * invalidation dirties the bli and transaction.
+	 */
+	released = xfs_buf_item_put(bip);
+	if (hold || (stale && !released))
+		return;
+	ASSERT(!stale || test_bit(XFS_LI_ABORTED, &lip->li_flags));
+	xfs_buf_relse(bp);
 }
 /*

fs/xfs/xfs_buf_item.h+1−0

@@ -51,6 +51,7 @@ struct xfs_buf_log_item { · 50 unmodified lines
51		51
52	int xfs_buf_item_init(struct xfs_buf , struct xfs_mount );	52	int xfs_buf_item_init(struct xfs_buf , struct xfs_mount );
53	void xfs_buf_item_relse(struct xfs_buf *);	53	void xfs_buf_item_relse(struct xfs_buf *);
		54	bool xfs_buf_item_put(struct xfs_buf_log_item *);
54	void xfs_buf_item_log(struct xfs_buf_log_item *, uint, uint);	55	void xfs_buf_item_log(struct xfs_buf_log_item *, uint, uint);
55	bool xfs_buf_item_dirty_format(struct xfs_buf_log_item *);	56	bool xfs_buf_item_dirty_format(struct xfs_buf_log_item *);
56	void xfs_buf_attach_iodone(struct xfs_buf *,	57	void xfs_buf_attach_iodone(struct xfs_buf *,

fs/xfs/xfs_inode.c+1−9

 		error = xfs_bunmapi(tp, ip, first_unmap_block, unmap_len, flags,
 				    XFS_ITRUNC_MAX_EXTENTS, &done);
 		if (error)
-			goto out_bmap_cancel;
+			goto out;
 		/*
 		 * Duplicate the transaction that has the permanent
 out:
 	*tpp = tp;
 	return error;
-out_bmap_cancel:
-	/*
-	 * If the bunmapi call encounters an error, return to the caller where
-	 * the transaction can be properly aborted.  We just need to make sure
-	 * we're not holding any resources that we were not when we came in.
-	 */
-	xfs_defer_cancel(tp);
-	goto out;
 }
 int

fs/xfs/xfs_iops.c+11−1

@@ -471,8 +471,18 @@ xfs_vn_get_link_inline( · 470 unmodified lines
471	struct inode *inode,	471	struct inode *inode,
472	struct delayed_call *done)	472	struct delayed_call *done)
473	{	473	{
		474	char *link;
		475
474	ASSERT(XFS_I(inode)->i_df.if_flags & XFS_IFINLINE);	476	ASSERT(XFS_I(inode)->i_df.if_flags & XFS_IFINLINE);
475	return XFS_I(inode)->i_df.if_u1.if_data;	477
		478	/*
		479	* The VFS crashes on a NULL pointer, so return -EFSCORRUPTED if
		480	* if_data is junk.
		481	*/
		482	link = XFS_I(inode)->i_df.if_u1.if_data;
		483	if (!link)
		484	return ERR_PTR(-EFSCORRUPTED);
		485	return link;
476	}	486	}
477		487
478	STATIC int	488	STATIC int

fs/xfs/xfs_log_recover.c+0−10

@@ -1570,16 +1570,6 @@ xlog_find_zeroed( · 1569 unmodified lines
1570	if (last_cycle != 0) { /* log completely written to */	1570	if (last_cycle != 0) { /* log completely written to */
1571	xlog_put_bp(bp);	1571	xlog_put_bp(bp);
1572	return 0;	1572	return 0;
1573	} else if (first_cycle != 1) {
1574	/*
1575	* If the cycle of the last block is zero, the cycle of
1576	* the first block must be 1. If it's not, maybe we're
1577	* not looking at a log... Bail out.
1578	*/
1579	xfs_warn(log->l_mp,
1580	"Log inconsistent or not a log (last==0, first!=1)");
1581	error = -EINVAL;
1582	goto bp_err;
1583	}	1573	}
1584		1574
1585	/* we have a partially zeroed log */	1575	/* we have a partially zeroed log */

fs/xfs/xfs_reflink.c+81−56

@@ -352,6 +352,47 @@ xfs_reflink_convert_cow( · 351 unmodified lines
352	return error;	352	return error;
353	}	353	}
354		354
		355	/*
		356	* Find the extent that maps the given range in the COW fork. Even if the extent
		357	* is not shared we might have a preallocation for it in the COW fork. If so we
		358	* use it that rather than trigger a new allocation.
		359	*/
		360	static int
		361	xfs_find_trim_cow_extent(
		362	struct xfs_inode *ip,
		363	struct xfs_bmbt_irec *imap,
		364	bool *shared,
		365	bool *found)
		366	{
		367	xfs_fileoff_t offset_fsb = imap->br_startoff;
		368	xfs_filblks_t count_fsb = imap->br_blockcount;
		369	struct xfs_iext_cursor icur;
		370	struct xfs_bmbt_irec got;
		371	bool trimmed;
		372
		373	*found = false;
		374
		375	/*
		376	* If we don't find an overlapping extent, trim the range we need to
		377	* allocate to fit the hole we found.
		378	*/
		379	if (!xfs_iext_lookup_extent(ip, ip->i_cowfp, offset_fsb, &icur, &got) \|\|
		380	got.br_startoff > offset_fsb)
		381	return xfs_reflink_trim_around_shared(ip, imap, shared, &trimmed);
		382
		383	*shared = true;
		384	if (isnullstartblock(got.br_startblock)) {
		385	xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
		386	return 0;
		387	}
		388
		389	/* real extent found - no need to allocate */
		390	xfs_trim_extent(&got, offset_fsb, count_fsb);
		391	*imap = got;
		392	*found = true;
		393	return 0;
		394	}
		395
355	/* Allocate all CoW reservations covering a range of blocks in a file. */	396	/* Allocate all CoW reservations covering a range of blocks in a file. */
356	int	397	int
357	xfs_reflink_allocate_cow(	398	xfs_reflink_allocate_cow(
@@ -363,78 +404,64 @@ xfs_reflink_allocate_cow( · 5 unmodified lines
363	struct xfs_mount *mp = ip->i_mount;	404	struct xfs_mount *mp = ip->i_mount;
364	xfs_fileoff_t offset_fsb = imap->br_startoff;	405	xfs_fileoff_t offset_fsb = imap->br_startoff;
365	xfs_filblks_t count_fsb = imap->br_blockcount;	406	xfs_filblks_t count_fsb = imap->br_blockcount;
366	struct xfs_bmbt_irec got;	407	struct xfs_trans *tp;
367	struct xfs_trans *tp = NULL;
368	int nimaps, error = 0;	408	int nimaps, error = 0;
369	bool trimmed;	409	bool found;
370	xfs_filblks_t resaligned;	410	xfs_filblks_t resaligned;
371	xfs_extlen_t resblks = 0;	411	xfs_extlen_t resblks = 0;
372	struct xfs_iext_cursor icur;
373		412
374	retry:
375	ASSERT(xfs_is_reflink_inode(ip));
376	ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));	413	ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
		414	ASSERT(xfs_is_reflink_inode(ip));
377		415
378	/*	416	error = xfs_find_trim_cow_extent(ip, imap, shared, &found);
379	* Even if the extent is not shared we might have a preallocation for	417	if (error \|\| !*shared)
380	* it in the COW fork. If so use it.	418	return error;
381	*/	419	if (found)
382	if (xfs_iext_lookup_extent(ip, ip->i_cowfp, offset_fsb, &icur, &got) &&	420	goto convert;
383	got.br_startoff <= offset_fsb) {
384	*shared = true;
385
386	/* If we have a real allocation in the COW fork we're done. */
387	if (!isnullstartblock(got.br_startblock)) {
388	xfs_trim_extent(&got, offset_fsb, count_fsb);
389	*imap = got;
390	goto convert;
391	}
392		421
393	xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);	422	resaligned = xfs_aligned_fsb_count(imap->br_startoff,
394	} else {	423	imap->br_blockcount, xfs_get_cowextsz_hint(ip));
395	error = xfs_reflink_trim_around_shared(ip, imap, shared, &trimmed);	424	resblks = XFS_DIOSTRAT_SPACE_RES(mp, resaligned);
396	if (error \|\| !*shared)
397	goto out;
398	}
399		425
400	if (!tp) {	426	xfs_iunlock(ip, *lockmode);
401	resaligned = xfs_aligned_fsb_count(imap->br_startoff,	427	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0, 0, &tp);
402	imap->br_blockcount, xfs_get_cowextsz_hint(ip));	428	*lockmode = XFS_ILOCK_EXCL;
403	resblks = XFS_DIOSTRAT_SPACE_RES(mp, resaligned);	429	xfs_ilock(ip, *lockmode);
404		430
405	xfs_iunlock(ip, *lockmode);	431	if (error)
406	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0, 0, &tp);	432	return error;
407	*lockmode = XFS_ILOCK_EXCL;
408	xfs_ilock(ip, *lockmode);
409		433
410	if (error)	434	error = xfs_qm_dqattach_locked(ip, false);
411	return error;	435	if (error)
		436	goto out_trans_cancel;
412		437
413	error = xfs_qm_dqattach_locked(ip, false);	438	/*
414	if (error)	439	* Check for an overlapping extent again now that we dropped the ilock.
415	goto out;	440	*/
416	goto retry;	441	error = xfs_find_trim_cow_extent(ip, imap, shared, &found);
		442	if (error \|\| !*shared)
		443	goto out_trans_cancel;
		444	if (found) {
		445	xfs_trans_cancel(tp);
		446	goto convert;
417	}	447	}
418		448
419	error = xfs_trans_reserve_quota_nblks(tp, ip, resblks, 0,	449	error = xfs_trans_reserve_quota_nblks(tp, ip, resblks, 0,
420	XFS_QMOPT_RES_REGBLKS);	450	XFS_QMOPT_RES_REGBLKS);
421	if (error)	451	if (error)
422	goto out;	452	goto out_trans_cancel;
423		453
424	xfs_trans_ijoin(tp, ip, 0);	454	xfs_trans_ijoin(tp, ip, 0);
425		455
426	nimaps = 1;
427
428	/* Allocate the entire reservation as unwritten blocks. */	456	/* Allocate the entire reservation as unwritten blocks. */
		457	nimaps = 1;
429	error = xfs_bmapi_write(tp, ip, imap->br_startoff, imap->br_blockcount,	458	error = xfs_bmapi_write(tp, ip, imap->br_startoff, imap->br_blockcount,
430	XFS_BMAPI_COWFORK \| XFS_BMAPI_PREALLOC,	459	XFS_BMAPI_COWFORK \| XFS_BMAPI_PREALLOC,
431	resblks, imap, &nimaps);	460	resblks, imap, &nimaps);
432	if (error)	461	if (error)
433	goto out_trans_cancel;	462	goto out_unreserve;
434		463
435	xfs_inode_set_cowblocks_tag(ip);	464	xfs_inode_set_cowblocks_tag(ip);
436
437	/* Finish up. */
438	error = xfs_trans_commit(tp);	465	error = xfs_trans_commit(tp);
439	if (error)	466	if (error)
440	return error;	467	return error;
@@ -447,12 +474,12 @@ retry: · 6 unmodified lines
447	return -ENOSPC;	474	return -ENOSPC;
448	convert:	475	convert:
449	return xfs_reflink_convert_cow_extent(ip, imap, offset_fsb, count_fsb);	476	return xfs_reflink_convert_cow_extent(ip, imap, offset_fsb, count_fsb);
450	out_trans_cancel:	477
		478	out_unreserve:
451	xfs_trans_unreserve_quota_nblks(tp, ip, (long)resblks, 0,	479	xfs_trans_unreserve_quota_nblks(tp, ip, (long)resblks, 0,
452	XFS_QMOPT_RES_REGBLKS);	480	XFS_QMOPT_RES_REGBLKS);
453	out:	481	out_trans_cancel:
454	if (tp)	482	xfs_trans_cancel(tp);
455	xfs_trans_cancel(tp);
456	return error;	483	return error;
457	}	484	}
458		485
@@ -666,14 +693,12 @@ xfs_reflink_end_cow( · 207 unmodified lines
666	if (!del.br_blockcount)	693	if (!del.br_blockcount)
667	goto prev_extent;	694	goto prev_extent;
668		695
669	ASSERT(!isnullstartblock(got.br_startblock));
670
671	/*	696	/*
672	* Don't remap unwritten extents; these are	697	* Only remap real extent that contain data. With AIO
673	* speculatively preallocated CoW extents that have been	698	* speculatively preallocations can leak into the range we
674	* allocated but have not yet been involved in a write.	699	* are called upon, and we need to skip them.
675	*/	700	*/
676	if (got.br_state == XFS_EXT_UNWRITTEN)	701	if (!xfs_bmap_is_real_extent(&got))
677	goto prev_extent;	702	goto prev_extent;
678		703
679	/* Unmap the old blocks in the data fork. */	704	/* Unmap the old blocks in the data fork. */

fs/xfs/xfs_trace.h+0−1

@@ -473,7 +473,6 @@ DEFINE_BUF_ITEM_EVENT(xfs_buf_item_pin); · 472 unmodified lines
473	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unpin);	473	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unpin);
474	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unpin_stale);	474	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unpin_stale);
475	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unlock);	475	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unlock);
476	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unlock_stale);
477	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_committed);	476	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_committed);
478	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_push);	477	DEFINE_BUF_ITEM_EVENT(xfs_buf_item_push);
479	DEFINE_BUF_ITEM_EVENT(xfs_trans_get_buf);	478	DEFINE_BUF_ITEM_EVENT(xfs_trans_get_buf);

fs/xfs/xfs_trans.c+8−2

 	struct xfs_trans	*tp;
 	int			error;
+	/*
+	 * Allocate the handle before we do our freeze accounting and setting up
+	 * GFP_NOFS allocation context so that we avoid lockdep false positives
+	 * by doing GFP_KERNEL allocations inside sb_start_intwrite().
+	 */
+	tp = kmem_zone_zalloc(xfs_trans_zone,
+		(flags & XFS_TRANS_NOFS) ? KM_NOFS : KM_SLEEP);
 	if (!(flags & XFS_TRANS_NO_WRITECOUNT))
 		sb_start_intwrite(mp->m_super);
 		mp->m_super->s_writers.frozen == SB_FREEZE_COMPLETE);
 	atomic_inc(&mp->m_active_trans);
-	tp = kmem_zone_zalloc(xfs_trans_zone,
-		(flags & XFS_TRANS_NOFS) ? KM_NOFS : KM_SLEEP);
 	tp->t_magic = XFS_TRANS_HEADER_MAGIC;
 	tp->t_flags = flags;
 	tp->t_mountp = mp;

fs/xfs/xfs_trans_buf.c+24−75

@@ -322,49 +322,38 @@ xfs_trans_read_buf_map( · 321 unmodified lines
322	}	322	}
323		323
324	/*	324	/*
325	* Release the buffer bp which was previously acquired with one of the	325	* Release a buffer previously joined to the transaction. If the buffer is
326	* xfs_trans_... buffer allocation routines if the buffer has not	326	* modified within this transaction, decrement the recursion count but do not
327	* been modified within this transaction. If the buffer is modified	327	* release the buffer even if the count goes to 0. If the buffer is not modified
328	* within this transaction, do decrement the recursion count but do	328	* within the transaction, decrement the recursion count and release the buffer
329	* not release the buffer even if the count goes to 0. If the buffer is not	329	* if the recursion count goes to 0.
330	* modified within the transaction, decrement the recursion count and
331	* release the buffer if the recursion count goes to 0.
332	*	330	*
333	* If the buffer is to be released and it was not modified before	331	* If the buffer is to be released and it was not already dirty before this
334	* this transaction began, then free the buf_log_item associated with it.	332	* transaction began, then also free the buf_log_item associated with it.
335	*	333	*
336	* If the transaction pointer is NULL, make this just a normal	334	* If the transaction pointer is NULL, this is a normal xfs_buf_relse() call.
337	* brelse() call.
338	*/	335	*/
339	void	336	void
340	xfs_trans_brelse(	337	xfs_trans_brelse(
341	xfs_trans_t *tp,	338	struct xfs_trans *tp,
342	xfs_buf_t *bp)	339	struct xfs_buf *bp)
343	{	340	{
344	struct xfs_buf_log_item *bip;	341	struct xfs_buf_log_item *bip = bp->b_log_item;
345	int freed;
346		342
347	/*	343	ASSERT(bp->b_transp == tp);
348	* Default to a normal brelse() call if the tp is NULL.	344
349	*/	345	if (!tp) {
350	if (tp == NULL) {
351	ASSERT(bp->b_transp == NULL);
352	xfs_buf_relse(bp);	346	xfs_buf_relse(bp);
353	return;	347	return;
354	}	348	}
355		349
356	ASSERT(bp->b_transp == tp);	350	trace_xfs_trans_brelse(bip);
357	bip = bp->b_log_item;
358	ASSERT(bip->bli_item.li_type == XFS_LI_BUF);	351	ASSERT(bip->bli_item.li_type == XFS_LI_BUF);
359	ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
360	ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
361	ASSERT(atomic_read(&bip->bli_refcount) > 0);	352	ASSERT(atomic_read(&bip->bli_refcount) > 0);
362		353
363	trace_xfs_trans_brelse(bip);
364
365	/*	354	/*
366	* If the release is just for a recursive lock,	355	* If the release is for a recursive lookup, then decrement the count
367	* then decrement the count and return.	356	* and return.
368	*/	357	*/
369	if (bip->bli_recur > 0) {	358	if (bip->bli_recur > 0) {
370	bip->bli_recur--;	359	bip->bli_recur--;
@@ -372,64 +361,24 @@ xfs_trans_brelse( · 1 unmodified line
372	}	361	}
373		362
374	/*	363	/*
375	* If the buffer is dirty within this transaction, we can't	364	* If the buffer is invalidated or dirty in this transaction, we can't
376	* release it until we commit.	365	* release it until we commit.
377	*/	366	*/
378	if (test_bit(XFS_LI_DIRTY, &bip->bli_item.li_flags))	367	if (test_bit(XFS_LI_DIRTY, &bip->bli_item.li_flags))
379	return;	368	return;
380
381	/*
382	* If the buffer has been invalidated, then we can't release
383	* it until the transaction commits to disk unless it is re-dirtied
384	* as part of this transaction. This prevents us from pulling
385	* the item from the AIL before we should.
386	*/
387	if (bip->bli_flags & XFS_BLI_STALE)	369	if (bip->bli_flags & XFS_BLI_STALE)
388	return;	370	return;
389		371
390	ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
391
392	/*	372	/*
393	* Free up the log item descriptor tracking the released item.	373	* Unlink the log item from the transaction and clear the hold flag, if
		374	* set. We wouldn't want the next user of the buffer to get confused.
394	*/	375	*/
		376	ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
395	xfs_trans_del_item(&bip->bli_item);	377	xfs_trans_del_item(&bip->bli_item);
		378	bip->bli_flags &= ~XFS_BLI_HOLD;
396		379
397	/*	380	/* drop the reference to the bli */
398	* Clear the hold flag in the buf log item if it is set.	381	xfs_buf_item_put(bip);
399	* We wouldn't want the next user of the buffer to
400	* get confused.
401	*/
402	if (bip->bli_flags & XFS_BLI_HOLD) {
403	bip->bli_flags &= ~XFS_BLI_HOLD;
404	}
405
406	/*
407	* Drop our reference to the buf log item.
408	*/
409	freed = atomic_dec_and_test(&bip->bli_refcount);
410
411	/*
412	* If the buf item is not tracking data in the log, then we must free it
413	* before releasing the buffer back to the free pool.
414	*
415	* If the fs has shutdown and we dropped the last reference, it may fall
416	* on us to release a (possibly dirty) bli if it never made it to the
417	* AIL (e.g., the aborted unpin already happened and didn't release it
418	* due to our reference). Since we're already shutdown and need
419	* ail_lock, just force remove from the AIL and release the bli here.
420	*/
421	if (XFS_FORCED_SHUTDOWN(tp->t_mountp) && freed) {
422	xfs_trans_ail_remove(&bip->bli_item, SHUTDOWN_LOG_IO_ERROR);
423	xfs_buf_item_relse(bp);
424	} else if (!(bip->bli_flags & XFS_BLI_DIRTY)) {
425	/***
426	ASSERT(bp->b_pincount == 0);
427	***/
428	ASSERT(atomic_read(&bip->bli_refcount) == 0);
429	ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags));
430	ASSERT(!(bip->bli_flags & XFS_BLI_INODE_ALLOC_BUF));
431	xfs_buf_item_relse(bp);
432	}
433		382
434	bp->b_transp = NULL;	383	bp->b_transp = NULL;
435	xfs_buf_relse(bp);	384	xfs_buf_relse(bp);

include/drm/drm_client.h+3−2

 	struct drm_file *file;
 };
-int drm_client_new(struct drm_device *dev, struct drm_client_dev *client,
+int drm_client_init(struct drm_device *dev, struct drm_client_dev *client,
-		   const char *name, const struct drm_client_funcs *funcs);
+		    const char *name, const struct drm_client_funcs *funcs);
 void drm_client_release(struct drm_client_dev *client);
+void drm_client_add(struct drm_client_dev *client);
 void drm_client_dev_unregister(struct drm_device *dev);
 void drm_client_dev_hotplug(struct drm_device *dev);

include/linux/fpga/fpga-mgr.h+14−6

 	FPGA_MGR_STATE_OPERATING,
 };
-/*
+/**
- * FPGA Manager flags
+ * DOC: FPGA Manager flags
- * FPGA_MGR_PARTIAL_RECONFIG: do partial reconfiguration if supported
+ *
- * FPGA_MGR_EXTERNAL_CONFIG: FPGA has been configured prior to Linux booting
+ * Flags used in the &fpga_image_info->flags field
- * FPGA_MGR_BITSTREAM_LSB_FIRST: SPI bitstream bit order is LSB first
+ *
- * FPGA_MGR_COMPRESSED_BITSTREAM: FPGA bitstream is compressed
+ * %FPGA_MGR_PARTIAL_RECONFIG: do partial reconfiguration if supported
+ *
+ * %FPGA_MGR_EXTERNAL_CONFIG: FPGA has been configured prior to Linux booting
+ *
+ * %FPGA_MGR_ENCRYPTED_BITSTREAM: indicates bitstream is encrypted
+ *
+ * %FPGA_MGR_BITSTREAM_LSB_FIRST: SPI bitstream bit order is LSB first
+ *
+ * %FPGA_MGR_COMPRESSED_BITSTREAM: FPGA bitstream is compressed
  */
 #define FPGA_MGR_PARTIAL_RECONFIG	BIT(0)
 #define FPGA_MGR_EXTERNAL_CONFIG	BIT(1)

include/linux/fs.h+3−14

 extern int vfs_clone_file_prep_inodes(struct inode *inode_in, loff_t pos_in,
 				      struct inode *inode_out, loff_t pos_out,
 				      u64 *len, bool is_dedupe);
+extern int do_clone_file_range(struct file *file_in, loff_t pos_in,
+			       struct file *file_out, loff_t pos_out, u64 len);
 extern int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
-		struct file *file_out, loff_t pos_out, u64 len);
+				struct file *file_out, loff_t pos_out, u64 len);
 extern int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
 					 struct inode *dest, loff_t destoff,
 					 loff_t len, bool *is_same);
 	__sb_end_write(file_inode(file)->i_sb, SB_FREEZE_WRITE);
 }
-static inline int do_clone_file_range(struct file *file_in, loff_t pos_in,
-				      struct file *file_out, loff_t pos_out,
-				      u64 len)
-{
-	int ret;
-	file_start_write(file_out);
-	ret = vfs_clone_file_range(file_in, pos_in, file_out, pos_out, len);
-	file_end_write(file_out);
-	return ret;
-}
 /*
  * get_write_access() gets write permission for a file.
  * put_write_access() releases this write permission.

include/linux/hugetlb.h+14−0

@@ -140,6 +140,8 @@ pte_t huge_pte_alloc(struct mm_struct mm, · 139 unmodified lines
140	pte_t huge_pte_offset(struct mm_struct mm,	140	pte_t huge_pte_offset(struct mm_struct mm,
141	unsigned long addr, unsigned long sz);	141	unsigned long addr, unsigned long sz);
142	int huge_pmd_unshare(struct mm_struct mm, unsigned long addr, pte_t *ptep);	142	int huge_pmd_unshare(struct mm_struct mm, unsigned long addr, pte_t *ptep);
		143	void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
		144	unsigned long start, unsigned long end);
143	struct page follow_huge_addr(struct mm_struct mm, unsigned long address,	145	struct page follow_huge_addr(struct mm_struct mm, unsigned long address,
144	int write);	146	int write);
145	struct page follow_huge_pd(struct vm_area_struct vma,	147	struct page follow_huge_pd(struct vm_area_struct vma,
@@ -170,6 +172,18 @@ static inline unsigned long hugetlb_total_pages(void) · 24 unmodified lines
170	return 0;	172	return 0;
171	}	173	}
172		174
		175	static inline int huge_pmd_unshare(struct mm_struct mm, unsigned long addr,
		176	pte_t *ptep)
		177	{
		178	return 0;
		179	}
		180
		181	static inline void adjust_range_if_pmd_sharing_possible(
		182	struct vm_area_struct *vma,
		183	unsigned long start, unsigned long end)
		184	{
		185	}
		186
173	#define follow_hugetlb_page(m,v,p,vs,a,b,i,w,n) ({ BUG(); 0; })	187	#define follow_hugetlb_page(m,v,p,vs,a,b,i,w,n) ({ BUG(); 0; })
174	#define follow_huge_addr(mm, addr, write) ERR_PTR(-EINVAL)	188	#define follow_huge_addr(mm, addr, write) ERR_PTR(-EINVAL)
175	#define copy_hugetlb_page_range(src, dst, vma) ({ BUG(); 0; })	189	#define copy_hugetlb_page_range(src, dst, vma) ({ BUG(); 0; })

include/linux/mlx5/transobj.h+2−0

@@ -90,6 +90,8 @@ struct mlx5_hairpin { · 89 unmodified lines
90		90
91	u32 *rqn;	91	u32 *rqn;
92	u32 *sqn;	92	u32 *sqn;
		93
		94	bool peer_gone;
93	};	95	};
94		96
95	struct mlx5_hairpin *	97	struct mlx5_hairpin *

include/linux/mm.h+6−0

 	return vma;
 }
+static inline bool range_in_vma(struct vm_area_struct *vma,
+				unsigned long start, unsigned long end)
+{
+	return (vma && vma->vm_start <= start && end <= vma->vm_end);
+}
 #ifdef CONFIG_MMU
 pgprot_t vm_get_page_prot(unsigned long vm_flags);
 void vma_set_page_prot(struct vm_area_struct *vma);

include/linux/mmzone.h+0−6

 #ifdef CONFIG_NUMA_BALANCING
 	/* Lock serializing the migrate rate limiting window */
 	spinlock_t numabalancing_migrate_lock;
-	/* Rate limiting time interval */
-	unsigned long numabalancing_migrate_next_window;
-	/* Number of pages migrated during the rate limiting time interval */
-	unsigned long numabalancing_migrate_nr_pages;
 #endif
 	/*
 	 * This is a per-node reserve of pages that are not available

include/linux/netdevice.h+3−0

  *			switch driver and used to set the phys state of the
  *			switch port.
  *
+ *	@wol_enabled:	Wake-on-LAN is enabled
+ *
  *	FIXME: cleanup struct net_device such that network protocol info
  *	moves out.
  */
 	struct lock_class_key	*qdisc_tx_busylock;
 	struct lock_class_key	*qdisc_running_key;
 	bool			proto_down;
+	unsigned		wol_enabled:1;
 };
 #define to_net_dev(d) container_of(d, struct net_device, dev)

include/linux/netfilter.h+2−0

 		break;
 	case NFPROTO_ARP:
 #ifdef CONFIG_NETFILTER_FAMILY_ARP
+		if (WARN_ON_ONCE(hook >= ARRAY_SIZE(net->nf.hooks_arp)))
+			break;
 		hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
 #endif
 		break;

include/linux/serial_sci.h+1−0

@@ -36,6 +36,7 @@ enum { · 35 unmodified lines
36	SCIx_SH4_SCIF_FIFODATA_REGTYPE,	36	SCIx_SH4_SCIF_FIFODATA_REGTYPE,
37	SCIx_SH7705_SCIF_REGTYPE,	37	SCIx_SH7705_SCIF_REGTYPE,
38	SCIx_HSCIF_REGTYPE,	38	SCIx_HSCIF_REGTYPE,
		39	SCIx_RZ_SCIFA_REGTYPE,
39		40
40	SCIx_NR_REGTYPES,	41	SCIx_NR_REGTYPES,
41	};	42	};

include/linux/virtio_net.h+18−0

@@ -5,6 +5,24 @@ · 4 unmodified lines
5	#include <linux/if_vlan.h>	5	#include <linux/if_vlan.h>
6	#include <uapi/linux/virtio_net.h>	6	#include <uapi/linux/virtio_net.h>
7		7
		8	static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
		9	const struct virtio_net_hdr *hdr)
		10	{
		11	switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		12	case VIRTIO_NET_HDR_GSO_TCPV4:
		13	case VIRTIO_NET_HDR_GSO_UDP:
		14	skb->protocol = cpu_to_be16(ETH_P_IP);
		15	break;
		16	case VIRTIO_NET_HDR_GSO_TCPV6:
		17	skb->protocol = cpu_to_be16(ETH_P_IPV6);
		18	break;
		19	default:
		20	return -EINVAL;
		21	}
		22
		23	return 0;
		24	}
		25
8	static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,	26	static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
9	const struct virtio_net_hdr *hdr,	27	const struct virtio_net_hdr *hdr,
10	bool little_endian)	28	bool little_endian)

include/media/v4l2-fh.h+4−0

  * @prio: priority of the file handler, as defined by &enum v4l2_priority
  *
  * @wait: event' s wait queue
+ * @subscribe_lock: serialise changes to the subscribed list; guarantee that
+ *		    the add and del event callbacks are orderly called
  * @subscribed: list of subscribed events
  * @available: list of events waiting to be dequeued
  * @navailable: number of available events at @available list
  * @sequence: event sequence number
+ *
  * @m2m_ctx: pointer to &struct v4l2_m2m_ctx
  */
 struct v4l2_fh {
 	/* Events */
 	wait_queue_head_t	wait;
+	struct mutex		subscribe_lock;
 	struct list_head	subscribed;
 	struct list_head	available;
 	unsigned int		navailable;

include/net/bonding.h+1−6

 	int mode;
 };
-struct netdev_notify_work {
-	struct delayed_work	work;
-	struct net_device	*dev;
-	struct netdev_bonding_info bonding_info;
-};
 struct slave {
 	struct net_device *dev; /* first - useful for panic debug */
 	struct bonding *bond; /* our master */
 #ifdef CONFIG_NET_POLL_CONTROLLER
 	struct netpoll *np;
 #endif
+	struct delayed_work notify_work;
 	struct kobject kobj;
 	struct rtnl_link_stats64 slave_stats;
 };

include/net/cfg80211.h+0−2

  *
  * @alpha2: the ISO/IEC 3166 alpha2 wmm rule to be queried.
  * @freq: the freqency(in MHz) to be queried.
- * @ptr: pointer where the regdb wmm data is to be stored (or %NULL if
- *	irrelevant). This can be used later for deduplication.
  * @rule: pointer to store the wmm rule from the regulatory db.
  *
  * Self-managed wireless drivers can use this function to  query

include/net/inet_sock.h+0−6

 	return sk->sk_bound_dev_if;
 }
-static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq)
-{
-	return rcu_dereference_check(ireq->ireq_opt,
-				     refcount_read(&ireq->req.rsk_refcnt) > 0);
-}
 struct inet_cork {
 	unsigned int		flags;
 	__be32			addr;

include/net/netlink.h+1−1

@@ -153,7 +153,7 @@ · 152 unmodified lines
153	* nla_find() find attribute in stream of attributes	153	* nla_find() find attribute in stream of attributes
154	* nla_find_nested() find attribute in nested attributes	154	* nla_find_nested() find attribute in nested attributes
155	* nla_parse() parse and validate stream of attrs	155	* nla_parse() parse and validate stream of attrs
156	* nla_parse_nested() parse nested attribuets	156	* nla_parse_nested() parse nested attributes
157	* nla_for_each_attr() loop over all attributes	157	* nla_for_each_attr() loop over all attributes
158	* nla_for_each_nested() loop over the nested attributes	158	* nla_for_each_nested() loop over the nested attributes
159	*=========================================================================	159	*=========================================================================

include/trace/events/migrate.h+0−27

@@ -70,33 +70,6 @@ TRACE_EVENT(mm_migrate_pages, · 69 unmodified lines
70	__print_symbolic(__entry->mode, MIGRATE_MODE),	70	__print_symbolic(__entry->mode, MIGRATE_MODE),
71	__print_symbolic(__entry->reason, MIGRATE_REASON))	71	__print_symbolic(__entry->reason, MIGRATE_REASON))
72	);	72	);
73
74	TRACE_EVENT(mm_numa_migrate_ratelimit,
75
76	TP_PROTO(struct task_struct *p, int dst_nid, unsigned long nr_pages),
77
78	TP_ARGS(p, dst_nid, nr_pages),
79
80	TP_STRUCT__entry(
81	__array( char, comm, TASK_COMM_LEN)
82	__field( pid_t, pid)
83	__field( int, dst_nid)
84	__field( unsigned long, nr_pages)
85	),
86
87	TP_fast_assign(
88	memcpy(__entry->comm, p->comm, TASK_COMM_LEN);
89	__entry->pid = p->pid;
90	__entry->dst_nid = dst_nid;
91	__entry->nr_pages = nr_pages;
92	),
93
94	TP_printk("comm=%s pid=%d dst_nid=%d nr_pages=%lu",
95	__entry->comm,
96	__entry->pid,
97	__entry->dst_nid,
98	__entry->nr_pages)
99	);
100	#endif /* _TRACE_MIGRATE_H */	73	#endif /* _TRACE_MIGRATE_H */
101		74
102	/* This part must be outside protection */	75	/* This part must be outside protection */

include/trace/events/rxrpc.h+1−3

 	rxrpc_peer_new,
 	rxrpc_peer_processing,
 	rxrpc_peer_put,
-	rxrpc_peer_queued_error,
 };
 enum rxrpc_conn_trace {
 	EM(rxrpc_peer_got,			"GOT") \
 	EM(rxrpc_peer_new,			"NEW") \
 	EM(rxrpc_peer_processing,		"PRO") \
-	EM(rxrpc_peer_put,			"PUT") \
+	E_(rxrpc_peer_put,			"PUT")
-	E_(rxrpc_peer_queued_error,		"QER")
 #define rxrpc_conn_traces \
 	EM(rxrpc_conn_got,			"GOT") \

include/uapi/asm-generic/hugetlb_encode.h+2−0

 #define HUGETLB_FLAG_ENCODE_2MB		(21 << HUGETLB_FLAG_ENCODE_SHIFT)
 #define HUGETLB_FLAG_ENCODE_8MB		(23 << HUGETLB_FLAG_ENCODE_SHIFT)
 #define HUGETLB_FLAG_ENCODE_16MB	(24 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_32MB	(25 << HUGETLB_FLAG_ENCODE_SHIFT)
 #define HUGETLB_FLAG_ENCODE_256MB	(28 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_512MB	(29 << HUGETLB_FLAG_ENCODE_SHIFT)
 #define HUGETLB_FLAG_ENCODE_1GB		(30 << HUGETLB_FLAG_ENCODE_SHIFT)
 #define HUGETLB_FLAG_ENCODE_2GB		(31 << HUGETLB_FLAG_ENCODE_SHIFT)
 #define HUGETLB_FLAG_ENCODE_16GB	(34 << HUGETLB_FLAG_ENCODE_SHIFT)

include/uapi/linux/memfd.h+2−0

 #define MFD_HUGE_2MB	HUGETLB_FLAG_ENCODE_2MB
 #define MFD_HUGE_8MB	HUGETLB_FLAG_ENCODE_8MB
 #define MFD_HUGE_16MB	HUGETLB_FLAG_ENCODE_16MB
+#define MFD_HUGE_32MB	HUGETLB_FLAG_ENCODE_32MB
 #define MFD_HUGE_256MB	HUGETLB_FLAG_ENCODE_256MB
+#define MFD_HUGE_512MB	HUGETLB_FLAG_ENCODE_512MB
 #define MFD_HUGE_1GB	HUGETLB_FLAG_ENCODE_1GB
 #define MFD_HUGE_2GB	HUGETLB_FLAG_ENCODE_2GB
 #define MFD_HUGE_16GB	HUGETLB_FLAG_ENCODE_16GB

include/uapi/linux/mman.h+2−0

 #define MAP_HUGE_2MB	HUGETLB_FLAG_ENCODE_2MB
 #define MAP_HUGE_8MB	HUGETLB_FLAG_ENCODE_8MB
 #define MAP_HUGE_16MB	HUGETLB_FLAG_ENCODE_16MB
+#define MAP_HUGE_32MB	HUGETLB_FLAG_ENCODE_32MB
 #define MAP_HUGE_256MB	HUGETLB_FLAG_ENCODE_256MB
+#define MAP_HUGE_512MB	HUGETLB_FLAG_ENCODE_512MB
 #define MAP_HUGE_1GB	HUGETLB_FLAG_ENCODE_1GB
 #define MAP_HUGE_2GB	HUGETLB_FLAG_ENCODE_2GB
 #define MAP_HUGE_16GB	HUGETLB_FLAG_ENCODE_16GB

include/uapi/linux/shm.h+2−0

 #define SHM_HUGE_2MB	HUGETLB_FLAG_ENCODE_2MB
 #define SHM_HUGE_8MB	HUGETLB_FLAG_ENCODE_8MB
 #define SHM_HUGE_16MB	HUGETLB_FLAG_ENCODE_16MB
+#define SHM_HUGE_32MB	HUGETLB_FLAG_ENCODE_32MB
 #define SHM_HUGE_256MB	HUGETLB_FLAG_ENCODE_256MB
+#define SHM_HUGE_512MB	HUGETLB_FLAG_ENCODE_512MB
 #define SHM_HUGE_1GB	HUGETLB_FLAG_ENCODE_1GB
 #define SHM_HUGE_2GB	HUGETLB_FLAG_ENCODE_2GB
 #define SHM_HUGE_16GB	HUGETLB_FLAG_ENCODE_16GB

ipc/shm.c+1−1

@@ -206,7 +206,7 @@ err: · 205 unmodified lines
206	* Callers of shm_lock() must validate the status of the returned ipc	206	* Callers of shm_lock() must validate the status of the returned ipc
207	* object pointer and error out as appropriate.	207	* object pointer and error out as appropriate.
208	*/	208	*/
209	return (void *)ipcp;	209	return ERR_CAST(ipcp);
210	}	210	}
211		211
212	static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)	212	static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)

kernel/bpf/local_storage.c+4−1

 	struct bpf_cgroup_storage *storage;
 	struct bpf_storage_buffer *new;
-	if (flags & BPF_NOEXIST)
+	if (flags != BPF_ANY && flags != BPF_EXIST)
 		return -EINVAL;
 	storage = cgroup_storage_lookup((struct bpf_cgroup_storage_map *)map,
 	if (attr->key_size != sizeof(struct bpf_cgroup_storage_key))
 		return ERR_PTR(-EINVAL);
+	if (attr->value_size == 0)
+		return ERR_PTR(-EINVAL);
 	if (attr->value_size > PAGE_SIZE)
 		return ERR_PTR(-E2BIG);

kernel/bpf/verifier.c+9−1

 	u64 umin_val, umax_val;
 	u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
+	if (insn_bitness == 32) {
+		/* Relevant for 32-bit RSH: Information can propagate towards
+		 * LSB, so it isn't sufficient to only truncate the output to
+		 * 32 bits.
+		 */
+		coerce_reg_to_size(dst_reg, 4);
+		coerce_reg_to_size(&src_reg, 4);
+	}
 	smin_val = src_reg.smin_value;
 	smax_val = src_reg.smax_value;
 	umin_val = src_reg.umin_value;
 	if (BPF_CLASS(insn->code) != BPF_ALU64) {
 		/* 32-bit ALU ops are (32,32)->32 */
 		coerce_reg_to_size(dst_reg, 4);
-		coerce_reg_to_size(&src_reg, 4);
 	}
 	__reg_deduce_bounds(dst_reg);

kernel/events/core.c+4−7

 			goto unlock;
 		list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
+			if (event->cpu != smp_processor_id())
+				continue;
 			if (event->attr.type != PERF_TYPE_TRACEPOINT)
 				continue;
 			if (event->attr.config != entry->type)
 	if (pmu->task_ctx_nr > perf_invalid_context)
 		return;
-	mutex_lock(&pmus_lock);
 	free_percpu(pmu->pmu_cpu_context);
-	mutex_unlock(&pmus_lock);
 }
 /*
 void perf_pmu_unregister(struct pmu *pmu)
 {
-	int remove_device;
 	mutex_lock(&pmus_lock);
-	remove_device = pmu_bus_running;
 	list_del_rcu(&pmu->entry);
-	mutex_unlock(&pmus_lock);
 	/*
 	 * We dereference the pmu list under both SRCU and regular RCU, so
 	free_percpu(pmu->pmu_disable_count);
 	if (pmu->type >= PERF_TYPE_MAX)
 		idr_remove(&pmu_idr, pmu->type);
-	if (remove_device) {
+	if (pmu_bus_running) {
 		if (pmu->nr_addr_filters)
 			device_remove_file(pmu->dev, &dev_attr_nr_addr_filters);
 		device_del(pmu->dev);
 		put_device(pmu->dev);
 	}
 	free_pmu_context(pmu);
+	mutex_unlock(&pmus_lock);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);

kernel/locking/test-ww_mutex.c+6−4

 {
 	struct test_cycle *cycle = container_of(work, typeof(*cycle), work);
 	struct ww_acquire_ctx ctx;
-	int err;
+	int err, erra = 0;
 	ww_acquire_init(&ctx, &ww_class);
 	ww_mutex_lock(&cycle->a_mutex, &ctx);
 	err = ww_mutex_lock(cycle->b_mutex, &ctx);
 	if (err == -EDEADLK) {
+		err = 0;
 		ww_mutex_unlock(&cycle->a_mutex);
 		ww_mutex_lock_slow(cycle->b_mutex, &ctx);
-		err = ww_mutex_lock(&cycle->a_mutex, &ctx);
+		erra = ww_mutex_lock(&cycle->a_mutex, &ctx);
 	}
 	if (!err)
 		ww_mutex_unlock(cycle->b_mutex);
-	ww_mutex_unlock(&cycle->a_mutex);
+	if (!erra)
+		ww_mutex_unlock(&cycle->a_mutex);
 	ww_acquire_fini(&ctx);
-	cycle->result = err;
+	cycle->result = err ?: erra;
 }
 static int __test_cycle(unsigned int nthreads)

kernel/sched/core.c+1−1

@@ -1167,7 +1167,7 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu) · 1166 unmodified lines
1167		1167
1168	if (task_cpu(p) != new_cpu) {	1168	if (task_cpu(p) != new_cpu) {
1169	if (p->sched_class->migrate_task_rq)	1169	if (p->sched_class->migrate_task_rq)
1170	p->sched_class->migrate_task_rq(p);	1170	p->sched_class->migrate_task_rq(p, new_cpu);
1171	p->se.nr_migrations++;	1171	p->se.nr_migrations++;
1172	rseq_migrate(p);	1172	rseq_migrate(p);
1173	perf_event_task_migrate(p);	1173	perf_event_task_migrate(p);

kernel/sched/deadline.c+1−1

@@ -1607,7 +1607,7 @@ out: · 1606 unmodified lines
1607	return cpu;	1607	return cpu;
1608	}	1608	}
1609		1609
1610	static void migrate_task_rq_dl(struct task_struct *p)	1610	static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused)
1611	{	1611	{
1612	struct rq *rq;	1612	struct rq *rq;
1613		1613

kernel/sched/fair.c+91−13

 	int last_cpupid, this_cpupid;
 	this_cpupid = cpu_pid_to_cpupid(dst_cpu, current->pid);
+	last_cpupid = page_cpupid_xchg_last(page, this_cpupid);
+	/*
+	 * Allow first faults or private faults to migrate immediately early in
+	 * the lifetime of a task. The magic number 4 is based on waiting for
+	 * two full passes of the "multi-stage node selection" test that is
+	 * executed below.
+	 */
+	if ((p->numa_preferred_nid == -1 || p->numa_scan_seq <= 4) &&
+	    (cpupid_pid_unset(last_cpupid) || cpupid_match_pid(p, last_cpupid)))
+		return true;
 	/*
 	 * Multi-stage node selection is used in conjunction with a periodic
 	 * This quadric squishes small probabilities, making it less likely we
 	 * act on an unlikely task<->page relation.
 	 */
-	last_cpupid = page_cpupid_xchg_last(page, this_cpupid);
 	if (!cpupid_pid_unset(last_cpupid) &&
 				cpupid_to_nid(last_cpupid) != dst_nid)
 		return false;
 static void task_numa_assign(struct task_numa_env *env,
 			     struct task_struct *p, long imp)
 {
+	struct rq *rq = cpu_rq(env->dst_cpu);
+	/* Bail out if run-queue part of active NUMA balance. */
+	if (xchg(&rq->numa_migrate_on, 1))
+		return;
+	/*
+	 * Clear previous best_cpu/rq numa-migrate flag, since task now
+	 * found a better CPU to move/swap.
+	 */
+	if (env->best_cpu != -1) {
+		rq = cpu_rq(env->best_cpu);
+		WRITE_ONCE(rq->numa_migrate_on, 0);
+	}
 	if (env->best_task)
 		put_task_struct(env->best_task);
 	if (p)
 	return (imb > old_imb);
 }
+/*
+ * Maximum NUMA importance can be 1998 (2*999);
+ * SMALLIMP @ 30 would be close to 1998/64.
+ * Used to deter task migration.
+ */
+#define SMALLIMP	30
 /*
  * This checks if the overall compute and NUMA accesses of the system would
  * be improved if the source tasks was migrated to the target dst_cpu taking
 	long moveimp = imp;
 	int dist = env->dist;
+	if (READ_ONCE(dst_rq->numa_migrate_on))
+		return;
 	rcu_read_lock();
 	cur = task_rcu_dereference(&dst_rq->curr);
 	if (cur && ((cur->flags & PF_EXITING) || is_idle_task(cur)))
 		goto unlock;
 	if (!cur) {
-		if (maymove || imp > env->best_imp)
+		if (maymove && moveimp >= env->best_imp)
 			goto assign;
 		else
 			goto unlock;
 			       task_weight(cur, env->dst_nid, dist);
 	}
-	if (imp <= env->best_imp)
-		goto unlock;
 	if (maymove && moveimp > imp && moveimp > env->best_imp) {
-		imp = moveimp - 1;
+		imp = moveimp;
 		cur = NULL;
 		goto assign;
 	}
+	/*
+	 * If the NUMA importance is less than SMALLIMP,
+	 * task migration might only result in ping pong
+	 * of tasks and also hurt performance due to cache
+	 * misses.
+	 */
+	if (imp < SMALLIMP || imp <= env->best_imp + SMALLIMP / 2)
+		goto unlock;
 	/*
 	 * In the overloaded case, try and keep the load balanced.
 	 */
 		.best_cpu = -1,
 	};
 	struct sched_domain *sd;
+	struct rq *best_rq;
 	unsigned long taskweight, groupweight;
 	int nid, ret, dist;
 	long taskimp, groupimp;
 	if (env.best_cpu == -1)
 		return -EAGAIN;
-	/*
+	best_rq = cpu_rq(env.best_cpu);
-	 * Reset the scan period if the task is being rescheduled on an
-	 * alternative node to recheck if the tasks is now properly placed.
-	 */
-	p->numa_scan_period = task_scan_start(p);
 	if (env.best_task == NULL) {
 		ret = migrate_task_to(p, env.best_cpu);
+		WRITE_ONCE(best_rq->numa_migrate_on, 0);
 		if (ret != 0)
 			trace_sched_stick_numa(p, env.src_cpu, env.best_cpu);
 		return ret;
 	}
 	ret = migrate_swap(p, env.best_task, env.best_cpu, env.src_cpu);
+	WRITE_ONCE(best_rq->numa_migrate_on, 0);
 	if (ret != 0)
 		trace_sched_stick_numa(p, env.src_cpu, task_cpu(env.best_task));
 	}
 }
+static void update_scan_period(struct task_struct *p, int new_cpu)
+{
+	int src_nid = cpu_to_node(task_cpu(p));
+	int dst_nid = cpu_to_node(new_cpu);
+	if (!static_branch_likely(&sched_numa_balancing))
+		return;
+	if (!p->mm || !p->numa_faults || (p->flags & PF_EXITING))
+		return;
+	if (src_nid == dst_nid)
+		return;
+	/*
+	 * Allow resets if faults have been trapped before one scan
+	 * has completed. This is most likely due to a new task that
+	 * is pulled cross-node due to wakeups or load balancing.
+	 */
+	if (p->numa_scan_seq) {
+		/*
+		 * Avoid scan adjustments if moving to the preferred
+		 * node or if the task was not previously running on
+		 * the preferred node.
+		 */
+		if (dst_nid == p->numa_preferred_nid ||
+		    (p->numa_preferred_nid != -1 && src_nid != p->numa_preferred_nid))
+			return;
+	}
+	p->numa_scan_period = task_scan_start(p);
+}
 #else
 static void task_tick_numa(struct rq *rq, struct task_struct *curr)
 {
 {
 }
+static inline void update_scan_period(struct task_struct *p, int new_cpu)
+{
+}
 #endif /* CONFIG_NUMA_BALANCING */
 static void
  * cfs_rq_of(p) references at time of call are still valid and identify the
  * previous CPU. The caller guarantees p->pi_lock or task_rq(p)->lock is held.
  */
-static void migrate_task_rq_fair(struct task_struct *p)
+static void migrate_task_rq_fair(struct task_struct *p, int new_cpu)
 {
 	/*
 	 * As blocked tasks retain absolute vruntime the migration needs to
 	/* We have migrated, no longer consider this task hot */
 	p->se.exec_start = 0;
+	update_scan_period(p, new_cpu);
 }
 static void task_dead_fair(struct task_struct *p)

kernel/sched/sched.h+2−1

 #ifdef CONFIG_NUMA_BALANCING
 	unsigned int		nr_numa_running;
 	unsigned int		nr_preferred_running;
+	unsigned int		numa_migrate_on;
 #endif
 	#define CPU_LOAD_IDX_MAX 5
 	unsigned long		cpu_load[CPU_LOAD_IDX_MAX];
 #ifdef CONFIG_SMP
 	int  (*select_task_rq)(struct task_struct *p, int task_cpu, int sd_flag, int flags);
-	void (*migrate_task_rq)(struct task_struct *p);
+	void (*migrate_task_rq)(struct task_struct *p, int new_cpu);
 	void (*task_woken)(struct rq *this_rq, struct task_struct *task);

lib/xz/xz_crc32.c+0−1

@@ -15,7 +15,6 @@ · 14 unmodified lines
15	* but they are bigger and use more memory for the lookup table.	15	* but they are bigger and use more memory for the lookup table.
16	*/	16	*/
17		17
18	#include <linux/crc32poly.h>
19	#include "xz_private.h"	18	#include "xz_private.h"
20		19
21	/*	20	/*

lib/xz/xz_private.h+4−0

 #	endif
 #endif
+#ifndef CRC32_POLY_LE
+#define CRC32_POLY_LE 0xedb88320
+#endif
 /*
  * Allocate memory for LZMA2 decoder. xz_dec_lzma2_reset() must be used
  * before calling xz_dec_lzma2_run().

mm/gup_benchmark.c+2−1

@@ -19,7 +19,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd, · 18 unmodified lines
19	struct gup_benchmark *gup)	19	struct gup_benchmark *gup)
20	{	20	{
21	ktime_t start_time, end_time;	21	ktime_t start_time, end_time;
22	unsigned long i, nr, nr_pages, addr, next;	22	unsigned long i, nr_pages, addr, next;
		23	int nr;
23	struct page **pages;	24	struct page **pages;
24		25
25	nr_pages = gup->size / PAGE_SIZE;	26	nr_pages = gup->size / PAGE_SIZE;

mm/huge_memory.c+1−1

@@ -2931,7 +2931,7 @@ void remove_migration_pmd(struct page_vma_mapped_walk pvmw, struct page new) · 2930 unmodified lines
2931	else	2931	else
2932	page_add_file_rmap(new, true);	2932	page_add_file_rmap(new, true);
2933	set_pmd_at(mm, mmun_start, pvmw->pmd, pmde);	2933	set_pmd_at(mm, mmun_start, pvmw->pmd, pmde);
2934	if (vma->vm_flags & VM_LOCKED)	2934	if ((vma->vm_flags & VM_LOCKED) && !PageDoubleMap(new))
2935	mlock_vma_page(new);	2935	mlock_vma_page(new);
2936	update_mmu_cache_pmd(vma, address, pvmw->pmd);	2936	update_mmu_cache_pmd(vma, address, pvmw->pmd);
2937	}	2937	}

mm/hugetlb.c+79−11

 	struct page *page;
 	struct hstate *h = hstate_vma(vma);
 	unsigned long sz = huge_page_size(h);
-	const unsigned long mmun_start = start;	/* For mmu_notifiers */
+	unsigned long mmun_start = start;	/* For mmu_notifiers */
-	const unsigned long mmun_end   = end;	/* For mmu_notifiers */
+	unsigned long mmun_end   = end;		/* For mmu_notifiers */
 	WARN_ON(!is_vm_hugetlb_page(vma));
 	BUG_ON(start & ~huge_page_mask(h));
 	 */
 	tlb_remove_check_page_size_change(tlb, sz);
 	tlb_start_vma(tlb, vma);
+	/*
+	 * If sharing possible, alert mmu notifiers of worst case.
+	 */
+	adjust_range_if_pmd_sharing_possible(vma, &mmun_start, &mmun_end);
 	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
 	address = start;
 	for (; address < end; address += sz) {
 		ptl = huge_pte_lock(h, mm, ptep);
 		if (huge_pmd_unshare(mm, &address, ptep)) {
 			spin_unlock(ptl);
+			/*
+			 * We just unmapped a page of PMDs by clearing a PUD.
+			 * The caller's TLB flush range should cover this area.
+			 */
 			continue;
 		}
 {
 	struct mm_struct *mm;
 	struct mmu_gather tlb;
+	unsigned long tlb_start = start;
+	unsigned long tlb_end = end;
+	/*
+	 * If shared PMDs were possibly used within this vma range, adjust
+	 * start/end for worst case tlb flushing.
+	 * Note that we can not be sure if PMDs are shared until we try to
+	 * unmap pages.  However, we want to make sure TLB flushing covers
+	 * the largest possible range.
+	 */
+	adjust_range_if_pmd_sharing_possible(vma, &tlb_start, &tlb_end);
 	mm = vma->vm_mm;
-	tlb_gather_mmu(&tlb, mm, start, end);
+	tlb_gather_mmu(&tlb, mm, tlb_start, tlb_end);
 	__unmap_hugepage_range(&tlb, vma, start, end, ref_page);
-	tlb_finish_mmu(&tlb, start, end);
+	tlb_finish_mmu(&tlb, tlb_start, tlb_end);
 }
 /*
 	pte_t pte;
 	struct hstate *h = hstate_vma(vma);
 	unsigned long pages = 0;
+	unsigned long f_start = start;
+	unsigned long f_end = end;
+	bool shared_pmd = false;
+	/*
+	 * In the case of shared PMDs, the area to flush could be beyond
+	 * start/end.  Set f_start/f_end to cover the maximum possible
+	 * range if PMD sharing is possible.
+	 */
+	adjust_range_if_pmd_sharing_possible(vma, &f_start, &f_end);
 	BUG_ON(address >= end);
-	flush_cache_range(vma, address, end);
+	flush_cache_range(vma, f_start, f_end);
-	mmu_notifier_invalidate_range_start(mm, start, end);
+	mmu_notifier_invalidate_range_start(mm, f_start, f_end);
 	i_mmap_lock_write(vma->vm_file->f_mapping);
 	for (; address < end; address += huge_page_size(h)) {
 		spinlock_t *ptl;
 		if (huge_pmd_unshare(mm, &address, ptep)) {
 			pages++;
 			spin_unlock(ptl);
+			shared_pmd = true;
 			continue;
 		}
 		pte = huge_ptep_get(ptep);
 	 * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare
 	 * may have cleared our pud entry and done put_page on the page table:
 	 * once we release i_mmap_rwsem, another task can do the final put_page
-	 * and that page table be reused and filled with junk.
+	 * and that page table be reused and filled with junk.  If we actually
+	 * did unshare a page of pmds, flush the range corresponding to the pud.
 	 */
-	flush_hugetlb_tlb_range(vma, start, end);
+	if (shared_pmd)
+		flush_hugetlb_tlb_range(vma, f_start, f_end);
+	else
+		flush_hugetlb_tlb_range(vma, start, end);
 	/*
 	 * No need to call mmu_notifier_invalidate_range() we are downgrading
 	 * page table protection not changing it to point to a new page.
 	 * See Documentation/vm/mmu_notifier.rst
 	 */
 	i_mmap_unlock_write(vma->vm_file->f_mapping);
-	mmu_notifier_invalidate_range_end(mm, start, end);
+	mmu_notifier_invalidate_range_end(mm, f_start, f_end);
 	return pages << h->order;
 }
 	/*
 	 * check on proper vm_flags and page table alignment
 	 */
-	if (vma->vm_flags & VM_MAYSHARE &&
+	if (vma->vm_flags & VM_MAYSHARE && range_in_vma(vma, base, end))
-	    vma->vm_start <= base && end <= vma->vm_end)
 		return true;
 	return false;
 }
+/*
+ * Determine if start,end range within vma could be mapped by shared pmd.
+ * If yes, adjust start and end to cover range associated with possible
+ * shared pmd mappings.
+ */
+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+				unsigned long *start, unsigned long *end)
+{
+	unsigned long check_addr = *start;
+	if (!(vma->vm_flags & VM_MAYSHARE))
+		return;
+	for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) {
+		unsigned long a_start = check_addr & PUD_MASK;
+		unsigned long a_end = a_start + PUD_SIZE;
+		/*
+		 * If sharing is possible, adjust start/end if necessary.
+		 */
+		if (range_in_vma(vma, a_start, a_end)) {
+			if (a_start < *start)
+				*start = a_start;
+			if (a_end > *end)
+				*end = a_end;
+		}
+	}
+}
 /*
  * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
  * and returns the corresponding pte. While this is not necessary for the
 {
 	return 0;
 }
+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+				unsigned long *start, unsigned long *end)
+{
+}
 #define want_pmd_share()	(0)
 #endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */

mm/madvise.c+1−1

@@ -96,7 +96,7 @@ static long madvise_behavior(struct vm_area_struct *vma, · 95 unmodified lines
96	new_flags \|= VM_DONTDUMP;	96	new_flags \|= VM_DONTDUMP;
97	break;	97	break;
98	case MADV_DODUMP:	98	case MADV_DODUMP:
99	if (new_flags & VM_SPECIAL) {	99	if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) {
100	error = -EINVAL;	100	error = -EINVAL;
101	goto out;	101	goto out;
102	}	102	}

mm/migrate.c+4−58

@@ -275,6 +275,9 @@ static bool remove_migration_pte(struct page page, struct vm_area_struct vma, · 274 unmodified lines
275	if (vma->vm_flags & VM_LOCKED && !PageTransCompound(new))	275	if (vma->vm_flags & VM_LOCKED && !PageTransCompound(new))
276	mlock_vma_page(new);	276	mlock_vma_page(new);
277		277
		278	if (PageTransHuge(page) && PageMlocked(page))
		279	clear_page_mlock(page);
		280
278	/* No need to invalidate - it was non-present before */	281	/* No need to invalidate - it was non-present before */
279	update_mmu_cache(vma, pvmw.address, pvmw.pte);	282	update_mmu_cache(vma, pvmw.address, pvmw.pte);
280	}	283	}
@@ -1411,7 +1414,7 @@ retry: · 1130 unmodified lines
1411	* we encounter them after the rest of the list	1414	* we encounter them after the rest of the list
1412	* is processed.	1415	* is processed.
1413	*/	1416	*/
1414	if (PageTransHuge(page)) {	1417	if (PageTransHuge(page) && !PageHuge(page)) {
1415	lock_page(page);	1418	lock_page(page);
1416	rc = split_huge_page_to_list(page, from);	1419	rc = split_huge_page_to_list(page, from);
1417	unlock_page(page);	1420	unlock_page(page);
@@ -1855,46 +1858,6 @@ static struct page alloc_misplaced_dst_page(struct page page, · 437 unmodified lines
1855	return newpage;	1858	return newpage;
1856	}	1859	}
1857		1860
1858	/*
1859	* page migration rate limiting control.
1860	* Do not migrate more than @pages_to_migrate in a @migrate_interval_millisecs
1861	* window of time. Default here says do not migrate more than 1280M per second.
1862	*/
1863	static unsigned int migrate_interval_millisecs __read_mostly = 100;
1864	static unsigned int ratelimit_pages __read_mostly = 128 << (20 - PAGE_SHIFT);
1865
1866	/* Returns true if the node is migrate rate-limited after the update */
1867	static bool numamigrate_update_ratelimit(pg_data_t *pgdat,
1868	unsigned long nr_pages)
1869	{
1870	/*
1871	* Rate-limit the amount of data that is being migrated to a node.
1872	* Optimal placement is no good if the memory bus is saturated and
1873	* all the time is being spent migrating!
1874	*/
1875	if (time_after(jiffies, pgdat->numabalancing_migrate_next_window)) {
1876	spin_lock(&pgdat->numabalancing_migrate_lock);
1877	pgdat->numabalancing_migrate_nr_pages = 0;
1878	pgdat->numabalancing_migrate_next_window = jiffies +
1879	msecs_to_jiffies(migrate_interval_millisecs);
1880	spin_unlock(&pgdat->numabalancing_migrate_lock);
1881	}
1882	if (pgdat->numabalancing_migrate_nr_pages > ratelimit_pages) {
1883	trace_mm_numa_migrate_ratelimit(current, pgdat->node_id,
1884	nr_pages);
1885	return true;
1886	}
1887
1888	/*
1889	* This is an unlocked non-atomic update so errors are possible.
1890	* The consequences are failing to migrate when we potentiall should
1891	* have which is not severe enough to warrant locking. If it is ever
1892	* a problem, it can be converted to a per-cpu counter.
1893	*/
1894	pgdat->numabalancing_migrate_nr_pages += nr_pages;
1895	return false;
1896	}
1897
1898	static int numamigrate_isolate_page(pg_data_t pgdat, struct page page)	1861	static int numamigrate_isolate_page(pg_data_t pgdat, struct page page)
1899	{	1862	{
1900	int page_lru;	1863	int page_lru;
@@ -1967,14 +1930,6 @@ int migrate_misplaced_page(struct page page, struct vm_area_struct vma, · 66 unmodified lines
1967	if (page_is_file_cache(page) && PageDirty(page))	1930	if (page_is_file_cache(page) && PageDirty(page))
1968	goto out;	1931	goto out;
1969		1932
1970	/*
1971	* Rate-limit the amount of data that is being migrated to a node.
1972	* Optimal placement is no good if the memory bus is saturated and
1973	* all the time is being spent migrating!
1974	*/
1975	if (numamigrate_update_ratelimit(pgdat, 1))
1976	goto out;
1977
1978	isolated = numamigrate_isolate_page(pgdat, page);	1933	isolated = numamigrate_isolate_page(pgdat, page);
1979	if (!isolated)	1934	if (!isolated)
1980	goto out;	1935	goto out;
@@ -2021,14 +1976,6 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm, · 40 unmodified lines
2021	unsigned long mmun_start = address & HPAGE_PMD_MASK;	1976	unsigned long mmun_start = address & HPAGE_PMD_MASK;
2022	unsigned long mmun_end = mmun_start + HPAGE_PMD_SIZE;	1977	unsigned long mmun_end = mmun_start + HPAGE_PMD_SIZE;
2023		1978
2024	/*
2025	* Rate-limit the amount of data that is being migrated to a node.
2026	* Optimal placement is no good if the memory bus is saturated and
2027	* all the time is being spent migrating!
2028	*/
2029	if (numamigrate_update_ratelimit(pgdat, HPAGE_PMD_NR))
2030	goto out_dropref;
2031
2032	new_page = alloc_pages_node(node,	1979	new_page = alloc_pages_node(node,
2033	(GFP_TRANSHUGE_LIGHT \| __GFP_THISNODE),	1980	(GFP_TRANSHUGE_LIGHT \| __GFP_THISNODE),
2034	HPAGE_PMD_ORDER);	1981	HPAGE_PMD_ORDER);
@@ -2125,7 +2072,6 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm, · 90 unmodified lines
2125		2072
2126	out_fail:	2073	out_fail:
2127	count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);	2074	count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
2128	out_dropref:
2129	ptl = pmd_lock(mm, pmd);	2075	ptl = pmd_lock(mm, pmd);
2130	if (pmd_same(*pmd, entry)) {	2076	if (pmd_same(*pmd, entry)) {
2131	entry = pmd_modify(entry, vma->vm_page_prot);	2077	entry = pmd_modify(entry, vma->vm_page_prot);

mm/page_alloc.c+0−2

 static void pgdat_init_numabalancing(struct pglist_data *pgdat)
 {
 	spin_lock_init(&pgdat->numabalancing_migrate_lock);
-	pgdat->numabalancing_migrate_nr_pages = 0;
-	pgdat->numabalancing_migrate_next_window = jiffies;
 }
 #else
 static void pgdat_init_numabalancing(struct pglist_data *pgdat) {}

mm/rmap.c+39−3

@@ -1362,11 +1362,21 @@ static bool try_to_unmap_one(struct page page, struct vm_area_struct vma, · 1361 unmodified lines
1362	}	1362	}
1363		1363
1364	/*	1364	/*
1365	* We have to assume the worse case ie pmd for invalidation. Note that	1365	* For THP, we have to assume the worse case ie pmd for invalidation.
1366	* the page can not be free in this function as call of try_to_unmap()	1366	* For hugetlb, it could be much worse if we need to do pud
1367	* must hold a reference on the page.	1367	* invalidation in the case of pmd sharing.
		1368	*
		1369	* Note that the page can not be free in this function as call of
		1370	* try_to_unmap() must hold a reference on the page.
1368	*/	1371	*/
1369	end = min(vma->vm_end, start + (PAGE_SIZE << compound_order(page)));	1372	end = min(vma->vm_end, start + (PAGE_SIZE << compound_order(page)));
		1373	if (PageHuge(page)) {
		1374	/*
		1375	* If sharing is possible, start and end will be adjusted
		1376	* accordingly.
		1377	*/
		1378	adjust_range_if_pmd_sharing_possible(vma, &start, &end);
		1379	}
1370	mmu_notifier_invalidate_range_start(vma->vm_mm, start, end);	1380	mmu_notifier_invalidate_range_start(vma->vm_mm, start, end);
1371		1381
1372	while (page_vma_mapped_walk(&pvmw)) {	1382	while (page_vma_mapped_walk(&pvmw)) {
@@ -1409,6 +1419,32 @@ static bool try_to_unmap_one(struct page page, struct vm_area_struct vma, · 36 unmodified lines
1409	subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);	1419	subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
1410	address = pvmw.address;	1420	address = pvmw.address;
1411		1421
		1422	if (PageHuge(page)) {
		1423	if (huge_pmd_unshare(mm, &address, pvmw.pte)) {
		1424	/*
		1425	* huge_pmd_unshare unmapped an entire PMD
		1426	* page. There is no way of knowing exactly
		1427	* which PMDs may be cached for this mm, so
		1428	* we must flush them all. start/end were
		1429	* already adjusted above to cover this range.
		1430	*/
		1431	flush_cache_range(vma, start, end);
		1432	flush_tlb_range(vma, start, end);
		1433	mmu_notifier_invalidate_range(mm, start, end);
		1434
		1435	/*
		1436	* The ref count of the PMD page was dropped
		1437	* which is part of the way map counting
		1438	* is done for shared PMDs. Return 'true'
		1439	* here. When there is no other sharing,
		1440	* huge_pmd_unshare returns false and we will
		1441	* unmap the actual page and drop map count
		1442	* to zero.
		1443	*/
		1444	page_vma_mapped_walk_done(&pvmw);
		1445	break;
		1446	}
		1447	}
1412		1448
1413	if (IS_ENABLED(CONFIG_MIGRATION) &&	1449	if (IS_ENABLED(CONFIG_MIGRATION) &&
1414	(flags & TTU_MIGRATION) &&	1450	(flags & TTU_MIGRATION) &&

mm/vmscan.c+3−4

 			struct mem_cgroup *memcg, int priority)
 {
 	struct memcg_shrinker_map *map;
-	unsigned long freed = 0;
+	unsigned long ret, freed = 0;
-	int ret, i;
+	int i;
 	if (!memcg_kmem_enabled() || !mem_cgroup_online(memcg))
 		return 0;
 				 struct mem_cgroup *memcg,
 				 int priority)
 {
+	unsigned long ret, freed = 0;
 	struct shrinker *shrinker;
-	unsigned long freed = 0;
-	int ret;
 	if (!mem_cgroup_is_root(memcg))
 		return shrink_slab_memcg(gfp_mask, nid, memcg, priority);

mm/vmstat.c+3−1

 #ifdef CONFIG_SMP
 	"nr_tlb_remote_flush",
 	"nr_tlb_remote_flush_received",
+#else
+	"", /* nr_tlb_remote_flush */
+	"", /* nr_tlb_remote_flush_received */
 #endif /* CONFIG_SMP */
 	"nr_tlb_local_flush_all",
 	"nr_tlb_local_flush_one",
 #ifdef CONFIG_DEBUG_VM_VMACACHE
 	"vmacache_find_calls",
 	"vmacache_find_hits",
-	"vmacache_full_flushes",
 #endif
 #ifdef CONFIG_SWAP
 	"swap_ra",

net/bluetooth/mgmt.c+2−5

@@ -2434,9 +2434,8 @@ static int unpair_device(struct sock sk, struct hci_dev hdev, void *data, · 2433 unmodified lines
2434	/* LE address type */	2434	/* LE address type */
2435	addr_type = le_addr_type(cp->addr.type);	2435	addr_type = le_addr_type(cp->addr.type);
2436		2436
2437	hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);	2437	/* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2438		2438	err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2439	err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2440	if (err < 0) {	2439	if (err < 0) {
2441	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,	2440	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2442	MGMT_STATUS_NOT_PAIRED, &rp,	2441	MGMT_STATUS_NOT_PAIRED, &rp,
@@ -2450,8 +2449,6 @@ static int unpair_device(struct sock sk, struct hci_dev hdev, void *data, · 7 unmodified lines
2450	goto done;	2449	goto done;
2451	}	2450	}
2452		2451
2453	/* Abort any ongoing SMP pairing */
2454	smp_cancel_pairing(conn);
2455		2452
2456	/* Defer clearing up the connection parameters until closing to	2453	/* Defer clearing up the connection parameters until closing to
2457	* give a chance of keeping them if a repairing happens.	2454	* give a chance of keeping them if a repairing happens.

net/bluetooth/smp.c+25−4

 	return ret;
 }
-void smp_cancel_pairing(struct hci_conn *hcon)
+int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
+				  u8 addr_type)
 {
-	struct l2cap_conn *conn = hcon->l2cap_data;
+	struct hci_conn *hcon;
+	struct l2cap_conn *conn;
 	struct l2cap_chan *chan;
 	struct smp_chan *smp;
+	int err;
+	err = hci_remove_ltk(hdev, bdaddr, addr_type);
+	hci_remove_irk(hdev, bdaddr, addr_type);
+	hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type);
+	if (!hcon)
+		goto done;
+	conn = hcon->l2cap_data;
 	if (!conn)
-		return;
+		goto done;
 	chan = conn->smp;
 	if (!chan)
-		return;
+		goto done;
 	l2cap_chan_lock(chan);
 	smp = chan->data;
 	if (smp) {
+		/* Set keys to NULL to make sure smp_failure() does not try to
+		 * remove and free already invalidated rcu list entries. */
+		smp->ltk = NULL;
+		smp->slave_ltk = NULL;
+		smp->remote_irk = NULL;
 		if (test_bit(SMP_FLAG_COMPLETE, &smp->flags))
 			smp_failure(conn, 0);
 		else
 			smp_failure(conn, SMP_UNSPECIFIED);
+		err = 0;
 	}
 	l2cap_chan_unlock(chan);
+done:
+	return err;
 }
 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)

net/bluetooth/smp.h+2−1

@@ -181,7 +181,8 @@ enum smp_key_pref { · 180 unmodified lines
181	};	181	};
182		182
183	/* SMP Commands */	183	/* SMP Commands */
184	void smp_cancel_pairing(struct hci_conn *hcon);	184	int smp_cancel_and_remove_pairing(struct hci_dev hdev, bdaddr_t bdaddr,
		185	u8 addr_type);
185	bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,	186	bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
186	enum smp_key_pref key_pref);	187	enum smp_key_pref key_pref);
187	int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);	188	int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);

net/bpfilter/bpfilter_kern.c+2−2

@@ -59,7 +59,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname, · 58 unmodified lines
59	req.is_set = is_set;	59	req.is_set = is_set;
60	req.pid = current->pid;	60	req.pid = current->pid;
61	req.cmd = optname;	61	req.cmd = optname;
62	req.addr = (long)optval;	62	req.addr = (long __force __user)optval;
63	req.len = optlen;	63	req.len = optlen;
64	mutex_lock(&bpfilter_lock);	64	mutex_lock(&bpfilter_lock);
65	if (!info.pid)	65	if (!info.pid)
@@ -98,7 +98,7 @@ static int __init load_umh(void) · 32 unmodified lines
98	pr_info("Loaded bpfilter_umh pid %d\n", info.pid);	98	pr_info("Loaded bpfilter_umh pid %d\n", info.pid);
99		99
100	/* health check that usermode process started correctly */	100	/* health check that usermode process started correctly */
101	if (__bpfilter_process_sockopt(NULL, 0, 0, 0, 0) != 0) {	101	if (__bpfilter_process_sockopt(NULL, 0, NULL, 0, 0) != 0) {
102	stop_umh();	102	stop_umh();
103	return -EFAULT;	103	return -EFAULT;
104	}	104	}

net/bridge/br_netfilter_hooks.c+2−1

 				   struct sk_buff *skb,
 				   const struct nf_hook_state *state)
 {
-	if (skb->nf_bridge && !skb->nf_bridge->in_prerouting) {
+	if (skb->nf_bridge && !skb->nf_bridge->in_prerouting &&
+	    !netif_is_l3_master(skb->dev)) {
 		state->okfn(state->net, state->sk, skb);
 		return NF_STOLEN;
 	}

net/core/ethtool.c+8−1

 static int ethtool_set_wol(struct net_device *dev, char __user *useraddr)
 {
 	struct ethtool_wolinfo wol;
+	int ret;
 	if (!dev->ethtool_ops->set_wol)
 		return -EOPNOTSUPP;
 	if (copy_from_user(&wol, useraddr, sizeof(wol)))
 		return -EFAULT;
-	return dev->ethtool_ops->set_wol(dev, &wol);
+	ret = dev->ethtool_ops->set_wol(dev, &wol);
+	if (ret)
+		return ret;
+	dev->wol_enabled = !!wol.wolopts;
+	return 0;
 }
 static int ethtool_get_eee(struct net_device *dev, char __user *useraddr)

net/core/netpoll.c+3−19

 	}
 }
-/*
- * Check whether delayed processing was scheduled for our NIC. If so,
- * we attempt to grab the poll lock and use ->poll() to pump the card.
- * If this fails, either we've recursed in ->poll() or it's already
- * running on another CPU.
- *
- * Note: we don't mask interrupts with this lock because we're using
- * trylock here and interrupts are already disabled in the softirq
- * case. Further, we test the poll_owner to avoid recursion on UP
- * systems where the lock doesn't exist.
- */
 static void poll_one_napi(struct napi_struct *napi)
 {
-	int work = 0;
+	int work;
-	/* net_rx_action's ->poll() invocations and our's are
-	 * synchronized by this test which is only made while
-	 * holding the napi->poll_lock.
-	 */
-	if (!test_bit(NAPI_STATE_SCHED, &napi->state))
-		return;
 	/* If we set this bit but see that it has already been set,
 	 * that indicates that napi has been disabled and we need
 	/* It is up to the caller to keep npinfo alive. */
 	struct netpoll_info *npinfo;
+	rcu_read_lock_bh();
 	lockdep_assert_irqs_disabled();
 	npinfo = rcu_dereference_bh(np->dev->npinfo);
 		skb_queue_tail(&npinfo->txq, skb);
 		schedule_delayed_work(&npinfo->tx_work,0);
 	}
+	rcu_read_unlock_bh();
 }
 EXPORT_SYMBOL(netpoll_send_skb_on_dev);

net/core/rtnetlink.c+28−13

 		if (tb[IFLA_IF_NETNSID]) {
 			netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
 			tgt_net = get_target_net(skb->sk, netnsid);
-			if (IS_ERR(tgt_net)) {
+			if (IS_ERR(tgt_net))
-				tgt_net = net;
+				return PTR_ERR(tgt_net);
-				netnsid = -1;
-			}
 		}
 		if (tb[IFLA_EXT_MASK])
 	else if (ops->get_num_rx_queues)
 		num_rx_queues = ops->get_num_rx_queues();
+	if (num_tx_queues < 1 || num_tx_queues > 4096)
+		return ERR_PTR(-EINVAL);
+	if (num_rx_queues < 1 || num_rx_queues > 4096)
+		return ERR_PTR(-EINVAL);
 	dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type,
 			       ops->setup, num_tx_queues, num_rx_queues);
 	if (!dev)
 	int err = 0;
 	int fidx = 0;
-	err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+	/* A hack to preserve kernel<->userspace interface.
-			  IFLA_MAX, ifla_policy, NULL);
+	 * Before Linux v4.12 this code accepted ndmsg since iproute2 v3.3.0.
-	if (err < 0) {
+	 * However, ndmsg is shorter than ifinfomsg thus nlmsg_parse() bails.
-		return -EINVAL;
+	 * So, check for ndmsg with an optional u32 attribute (not used here).
-	} else if (err == 0) {
+	 * Fortunately these sizes don't conflict with the size of ifinfomsg
-		if (tb[IFLA_MASTER])
+	 * with an optional attribute.
-			br_idx = nla_get_u32(tb[IFLA_MASTER]);
+	 */
-	}
+	if (nlmsg_len(cb->nlh) != sizeof(struct ndmsg) &&
+	    (nlmsg_len(cb->nlh) != sizeof(struct ndmsg) +
+	     nla_attr_size(sizeof(u32)))) {
+		err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+				  IFLA_MAX, ifla_policy, NULL);
+		if (err < 0) {
+			return -EINVAL;
+		} else if (err == 0) {
+			if (tb[IFLA_MASTER])
+				br_idx = nla_get_u32(tb[IFLA_MASTER]);
+		}
-	brport_idx = ifm->ifi_index;
+		brport_idx = ifm->ifi_index;
+	}
 	if (br_idx) {
 		br_dev = __dev_get_by_index(net, br_idx);

net/dccp/input.c+3−1

 	if (sk->sk_state == DCCP_LISTEN) {
 		if (dh->dccph_type == DCCP_PKT_REQUEST) {
 			/* It is possible that we process SYN packets from backlog,
-			 * so we need to make sure to disable BH right there.
+			 * so we need to make sure to disable BH and RCU right there.
 			 */
+			rcu_read_lock();
 			local_bh_disable();
 			acceptable = inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) >= 0;
 			local_bh_enable();
+			rcu_read_unlock();
 			if (!acceptable)
 				return 1;
 			consume_skb(skb);

net/dccp/ipv4.c+3−1

 		dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->ir_loc_addr,
 							      ireq->ir_rmt_addr);
+		rcu_read_lock();
 		err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
 					    ireq->ir_rmt_addr,
-					    ireq_opt_deref(ireq));
+					    rcu_dereference(ireq->ireq_opt));
+		rcu_read_unlock();
 		err = net_xmit_eval(err);
 	}

net/ipv4/inet_connection_sock.c+4−1

 	struct ip_options_rcu *opt;
 	struct rtable *rt;
-	opt = ireq_opt_deref(ireq);
+	rcu_read_lock();
+	opt = rcu_dereference(ireq->ireq_opt);
 	flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
 			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
 		goto no_route;
 	if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
 		goto route_err;
+	rcu_read_unlock();
 	return &rt->dst;
 route_err:
 	ip_rt_put(rt);
 no_route:
+	rcu_read_unlock();
 	__IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
 	return NULL;
 }

net/ipv4/ip_sockglue.c+1−2

 static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 {
 	struct sockaddr_in sin;
-	const struct iphdr *iph = ip_hdr(skb);
 	__be16 *ports;
 	int end;
 	ports = (__be16 *)skb_transport_header(skb);
 	sin.sin_family = AF_INET;
-	sin.sin_addr.s_addr = iph->daddr;
+	sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
 	sin.sin_port = ports[1];
 	memset(sin.sin_zero, 0, sizeof(sin.sin_zero));

net/ipv4/sysctl_net_ipv4.c+4−2

 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 static int comp_sack_nr_max = 255;
+static u32 u32_max_div_HZ = UINT_MAX / HZ;
 /* obsolete */
 static int sysctl_tcp_low_latency __read_mostly;
 	{
 		.procname	= "tcp_probe_interval",
 		.data		= &init_net.ipv4.sysctl_tcp_probe_interval,
-		.maxlen		= sizeof(int),
+		.maxlen		= sizeof(u32),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_douintvec_minmax,
+		.extra2		= &u32_max_div_HZ,
 	},
 	{
 		.procname	= "igmp_link_local_mcast_reports",

net/ipv4/tcp_input.c+3−1

 			if (th->fin)
 				goto discard;
 			/* It is possible that we process SYN packets from backlog,
-			 * so we need to make sure to disable BH right there.
+			 * so we need to make sure to disable BH and RCU right there.
 			 */
+			rcu_read_lock();
 			local_bh_disable();
 			acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0;
 			local_bh_enable();
+			rcu_read_unlock();
 			if (!acceptable)
 				return 1;

net/ipv4/tcp_ipv4.c+3−1

 	if (skb) {
 		__tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr);
+		rcu_read_lock();
 		err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
 					    ireq->ir_rmt_addr,
-					    ireq_opt_deref(ireq));
+					    rcu_dereference(ireq->ireq_opt));
+		rcu_read_unlock();
 		err = net_xmit_eval(err);
 	}

net/ipv4/xfrm4_input.c+1−0

@@ -67,6 +67,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) · 66 unmodified lines
67		67
68	if (xo && (xo->flags & XFRM_GRO)) {	68	if (xo && (xo->flags & XFRM_GRO)) {
69	skb_mac_header_rebuild(skb);	69	skb_mac_header_rebuild(skb);
		70	skb_reset_transport_header(skb);
70	return 0;	71	return 0;
71	}	72	}
72		73

net/ipv4/xfrm4_mode_transport.c+1−3

 static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
 	int ihl = skb->data - skb_transport_header(skb);
-	struct xfrm_offload *xo = xfrm_offload(skb);
 	if (skb->transport_header != skb->network_header) {
 		memmove(skb_transport_header(skb),
 		skb->network_header = skb->transport_header;
 	}
 	ip_hdr(skb)->tot_len = htons(skb->len + ihl);
-	if (!xo || !(xo->flags & XFRM_GRO))
+	skb_reset_transport_header(skb);
-		skb_reset_transport_header(skb);
 	return 0;
 }

net/ipv6/raw.c+20−9

 	skb->priority = sk->sk_priority;
 	skb->mark = sk->sk_mark;
 	skb->tstamp = sockc->transmit_time;
-	skb_dst_set(skb, &rt->dst);
-	*dstp = NULL;
 	skb_put(skb, length);
 	skb_reset_network_header(skb);
 	skb->transport_header = skb->network_header;
 	err = memcpy_from_msg(iph, msg, length);
-	if (err)
+	if (err) {
-		goto error_fault;
+		err = -EFAULT;
+		kfree_skb(skb);
+		goto error;
+	}
+	skb_dst_set(skb, &rt->dst);
+	*dstp = NULL;
 	/* if egress device is enslaved to an L3 master device pass the
 	 * skb to its handler for processing
 	if (unlikely(!skb))
 		return 0;
+	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
+	 * in the error path. Since skb has been freed, the dst could
+	 * have been queued for deletion.
+	 */
+	rcu_read_lock();
 	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
 	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk, skb,
 		      NULL, rt->dst.dev, dst_output);
 	if (err > 0)
 		err = net_xmit_errno(err);
-	if (err)
+	if (err) {
-		goto error;
+		IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
+		rcu_read_unlock();
+		goto error_check;
+	}
+	rcu_read_unlock();
 out:
 	return 0;
-error_fault:
-	err = -EFAULT;
-	kfree_skb(skb);
 error:
 	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
+error_check:
 	if (err == -ENOBUFS && !np->recverr)
 		err = 0;
 	return err;

net/ipv6/route.c+0−5

 	if (!nh)
 		return -ENOMEM;
 	nh->fib6_info = rt;
-	err = ip6_convert_metrics(net, rt, r_cfg);
-	if (err) {
-		kfree(nh);
-		return err;
-	}
 	memcpy(&nh->r_cfg, r_cfg, sizeof(*r_cfg));
 	list_add_tail(&nh->next, rt6_nh_list);

net/ipv6/xfrm6_input.c+1−0

@@ -59,6 +59,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async) · 58 unmodified lines
59		59
60	if (xo && (xo->flags & XFRM_GRO)) {	60	if (xo && (xo->flags & XFRM_GRO)) {
61	skb_mac_header_rebuild(skb);	61	skb_mac_header_rebuild(skb);
		62	skb_reset_transport_header(skb);
62	return -1;	63	return -1;
63	}	64	}
64		65

net/ipv6/xfrm6_mode_transport.c+1−3

 static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
 	int ihl = skb->data - skb_transport_header(skb);
-	struct xfrm_offload *xo = xfrm_offload(skb);
 	if (skb->transport_header != skb->network_header) {
 		memmove(skb_transport_header(skb),
 	}
 	ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
 					   sizeof(struct ipv6hdr));
-	if (!xo || !(xo->flags & XFRM_GRO))
+	skb_reset_transport_header(skb);
-		skb_reset_transport_header(skb);
 	return 0;
 }

net/ipv6/xfrm6_output.c+2−0

 	if (toobig && xfrm6_local_dontfrag(skb)) {
 		xfrm6_local_rxpmtu(skb, mtu);
+		kfree_skb(skb);
 		return -EMSGSIZE;
 	} else if (!skb->ignore_df && toobig && skb->sk) {
 		xfrm_local_error(skb, mtu);
+		kfree_skb(skb);
 		return -EMSGSIZE;
 	}

net/mac80211/cfg.c+1−1

@@ -427,7 +427,7 @@ static int ieee80211_add_key(struct wiphy wiphy, struct net_device dev, · 426 unmodified lines
427	case NL80211_IFTYPE_AP:	427	case NL80211_IFTYPE_AP:
428	case NL80211_IFTYPE_AP_VLAN:	428	case NL80211_IFTYPE_AP_VLAN:
429	/* Keys without a station are used for TX only */	429	/* Keys without a station are used for TX only */
430	if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))	430	if (sta && test_sta_flag(sta, WLAN_STA_MFP))
431	key->conf.flags \|= IEEE80211_KEY_FLAG_RX_MGMT;	431	key->conf.flags \|= IEEE80211_KEY_FLAG_RX_MGMT;
432	break;	432	break;
433	case NL80211_IFTYPE_ADHOC:	433	case NL80211_IFTYPE_ADHOC:

net/mac80211/iface.c+2−1

@@ -1756,7 +1756,8 @@ int ieee80211_if_add(struct ieee80211_local local, const char name, · 1755 unmodified lines
1756		1756
1757	if (local->ops->wake_tx_queue &&	1757	if (local->ops->wake_tx_queue &&
1758	type != NL80211_IFTYPE_AP_VLAN &&	1758	type != NL80211_IFTYPE_AP_VLAN &&
1759	type != NL80211_IFTYPE_MONITOR)	1759	(type != NL80211_IFTYPE_MONITOR \|\|
		1760	(params->flags & MONITOR_FLAG_ACTIVE)))
1760	txq_size += sizeof(struct txq_info) +	1761	txq_size += sizeof(struct txq_info) +
1761	local->hw.txq_data_size;	1762	local->hw.txq_data_size;
1762		1763

net/mac80211/mesh.h+2−1

 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_init(void);
 void ieee80211s_update_metric(struct ieee80211_local *local,
-			      struct sta_info *sta, struct sk_buff *skb);
+			      struct sta_info *sta,
+			      struct ieee80211_tx_status *st);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_teardown_sdata(struct ieee80211_sub_if_data *sdata);
 int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);

net/mac80211/mesh_hwmp.c+3−6

 }
 void ieee80211s_update_metric(struct ieee80211_local *local,
-		struct sta_info *sta, struct sk_buff *skb)
+			      struct sta_info *sta,
+			      struct ieee80211_tx_status *st)
 {
-	struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
+	struct ieee80211_tx_info *txinfo = st->info;
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 	int failed;
-	if (!ieee80211_is_data(hdr->frame_control))
-		return;
 	failed = !(txinfo->flags & IEEE80211_TX_STAT_ACK);
 	/* moving average, scaled to 100.

net/mac80211/status.c+5−6

 	if (!skb)
 		return;
-	if (dropped) {
-		dev_kfree_skb_any(skb);
-		return;
-	}
 	if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
 		u64 cookie = IEEE80211_SKB_CB(skb)->ack.cookie;
 		struct ieee80211_sub_if_data *sdata;
 		}
 		rcu_read_unlock();
+		dev_kfree_skb_any(skb);
+	} else if (dropped) {
 		dev_kfree_skb_any(skb);
 	} else {
 		/* consumes skb */
 		rate_control_tx_status(local, sband, status);
 		if (ieee80211_vif_is_mesh(&sta->sdata->vif))
-			ieee80211s_update_metric(local, sta, skb);
+			ieee80211s_update_metric(local, sta, status);
 		if (!(info->flags & IEEE80211_TX_CTL_INJECTED) && acked)
 			ieee80211_frame_acked(sta, skb);
 		}
 		rate_control_tx_status(local, sband, status);
+		if (ieee80211_vif_is_mesh(&sta->sdata->vif))
+			ieee80211s_update_metric(local, sta, status);
 	}
 	if (acked || noack_success) {

net/mac80211/tdls.c+4−4

 #include "ieee80211_i.h"
 #include "driver-ops.h"
 #include "rate.h"
+#include "wme.h"
 /* give usermode some time for retries in setting up the TDLS session */
 #define TDLS_PEER_SETUP_TIMEOUT	(15 * HZ)
 	switch (action_code) {
 	case WLAN_TDLS_SETUP_REQUEST:
 	case WLAN_TDLS_SETUP_RESPONSE:
-		skb_set_queue_mapping(skb, IEEE80211_AC_BK);
+		skb->priority = 256 + 2;
-		skb->priority = 2;
 		break;
 	default:
-		skb_set_queue_mapping(skb, IEEE80211_AC_VI);
+		skb->priority = 256 + 5;
-		skb->priority = 5;
 		break;
 	}
+	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
 	/*
 	 * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.

net/mac80211/tx.c+5−1

 {
 	struct ieee80211_local *local = tx->local;
 	struct ieee80211_if_managed *ifmgd;
+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	/* driver doesn't support power save */
 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS))
 	if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
 		return TX_CONTINUE;
+	if (unlikely(info->flags & IEEE80211_TX_INTFL_OFFCHAN_TX_OK))
+		return TX_CONTINUE;
 	ifmgd = &tx->sdata->u.mgd;
 	/*
 			sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
 	if (invoke_tx_handlers_early(&tx))
-		return false;
+		return true;
 	if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb))
 		return true;

net/netfilter/nf_conntrack_proto_tcp.c+2−2

@@ -1213,8 +1213,8 @@ static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = { · 1212 unmodified lines
1213	#define TCP_NLATTR_SIZE ( \	1213	#define TCP_NLATTR_SIZE ( \
1214	NLA_ALIGN(NLA_HDRLEN + 1) + \	1214	NLA_ALIGN(NLA_HDRLEN + 1) + \
1215	NLA_ALIGN(NLA_HDRLEN + 1) + \	1215	NLA_ALIGN(NLA_HDRLEN + 1) + \
1216	NLA_ALIGN(NLA_HDRLEN + sizeof(sizeof(struct nf_ct_tcp_flags))) + \	1216	NLA_ALIGN(NLA_HDRLEN + sizeof(struct nf_ct_tcp_flags)) + \
1217	NLA_ALIGN(NLA_HDRLEN + sizeof(sizeof(struct nf_ct_tcp_flags))))	1217	NLA_ALIGN(NLA_HDRLEN + sizeof(struct nf_ct_tcp_flags)))
1218		1218
1219	static int nlattr_to_tcp(struct nlattr cda[], struct nf_conn ct)	1219	static int nlattr_to_tcp(struct nlattr cda[], struct nf_conn ct)
1220	{	1220	{

net/netfilter/nft_osf.c+1−1

@@ -49,7 +49,7 @@ static int nft_osf_init(const struct nft_ctx *ctx, · 48 unmodified lines
49		49
50	priv->dreg = nft_parse_register(tb[NFTA_OSF_DREG]);	50	priv->dreg = nft_parse_register(tb[NFTA_OSF_DREG]);
51	err = nft_validate_register_store(ctx, priv->dreg, NULL,	51	err = nft_validate_register_store(ctx, priv->dreg, NULL,
52	NFTA_DATA_VALUE, NFT_OSF_MAXGENRELEN);	52	NFT_DATA_VALUE, NFT_OSF_MAXGENRELEN);
53	if (err < 0)	53	if (err < 0)
54	return err;	54	return err;
55		55

net/netfilter/nft_set_rbtree.c+14−14

 static void nft_rbtree_gc(struct work_struct *work)
 {
+	struct nft_rbtree_elem *rbe, *rbe_end = NULL, *rbe_prev = NULL;
 	struct nft_set_gc_batch *gcb = NULL;
-	struct rb_node *node, *prev = NULL;
-	struct nft_rbtree_elem *rbe;
 	struct nft_rbtree *priv;
+	struct rb_node *node;
 	struct nft_set *set;
-	int i;
 	priv = container_of(work, struct nft_rbtree, gc_work.work);
 	set  = nft_set_container_of(priv);
 		rbe = rb_entry(node, struct nft_rbtree_elem, node);
 		if (nft_rbtree_interval_end(rbe)) {
-			prev = node;
+			rbe_end = rbe;
 			continue;
 		}
 		if (!nft_set_elem_expired(&rbe->ext))
 		if (nft_set_elem_mark_busy(&rbe->ext))
 			continue;
+		if (rbe_prev) {
+			rb_erase(&rbe_prev->node, &priv->root);
+			rbe_prev = NULL;
+		}
 		gcb = nft_set_gc_batch_check(set, gcb, GFP_ATOMIC);
 		if (!gcb)
 			break;
 		atomic_dec(&set->nelems);
 		nft_set_gc_batch_add(gcb, rbe);
+		rbe_prev = rbe;
-		if (prev) {
+		if (rbe_end) {
-			rbe = rb_entry(prev, struct nft_rbtree_elem, node);
 			atomic_dec(&set->nelems);
-			nft_set_gc_batch_add(gcb, rbe);
+			nft_set_gc_batch_add(gcb, rbe_end);
-			prev = NULL;
+			rb_erase(&rbe_end->node, &priv->root);
+			rbe_end = NULL;
 		}
 		node = rb_next(node);
 		if (!node)
 			break;
 	}
-	if (gcb) {
+	if (rbe_prev)
-		for (i = 0; i < gcb->head.cnt; i++) {
+		rb_erase(&rbe_prev->node, &priv->root);
-			rbe = gcb->elems[i];
-			rb_erase(&rbe->node, &priv->root);
-		}
-	}
 	write_seqcount_end(&priv->count);
 	write_unlock_bh(&priv->lock);

net/netfilter/xt_socket.c+2−2

@@ -56,7 +56,7 @@ socket_match(const struct sk_buff skb, struct xt_action_param par, · 55 unmodified lines
56	struct sk_buff pskb = (struct sk_buff )skb;	56	struct sk_buff pskb = (struct sk_buff )skb;
57	struct sock *sk = skb->sk;	57	struct sock *sk = skb->sk;
58		58
59	if (!net_eq(xt_net(par), sock_net(sk)))	59	if (sk && !net_eq(xt_net(par), sock_net(sk)))
60	sk = NULL;	60	sk = NULL;
61		61
62	if (!sk)	62	if (!sk)
@@ -117,7 +117,7 @@ socket_mt6_v1_v2_v3(const struct sk_buff skb, struct xt_action_param par) · 54 unmodified lines
117	struct sk_buff pskb = (struct sk_buff )skb;	117	struct sk_buff pskb = (struct sk_buff )skb;
118	struct sock *sk = skb->sk;	118	struct sock *sk = skb->sk;
119		119
120	if (!net_eq(xt_net(par), sock_net(sk)))	120	if (sk && !net_eq(xt_net(par), sock_net(sk)))
121	sk = NULL;	121	sk = NULL;
122		122
123	if (!sk)	123	if (!sk)

net/openvswitch/conntrack.c+6−4

 	rcu_assign_pointer(help->helper, helper);
 	info->helper = helper;
+	if (info->nat)
+		request_module("ip_nat_%s", name);
 	return 0;
 }
 		OVS_NLERR(log, "Failed to allocate conntrack template");
 		return -ENOMEM;
 	}
-	__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
-	nf_conntrack_get(&ct_info.ct->ct_general);
 	if (helper) {
 		err = ovs_ct_add_helper(&ct_info, helper, key, log);
 		if (err)
 	if (err)
 		goto err_free_ct;
+	__set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
+	nf_conntrack_get(&ct_info.ct->ct_general);
 	return 0;
 err_free_ct:
 	__ovs_ct_free_action(&ct_info);

net/packet/af_packet.c+7−4

 			}
 		}
-		if (po->has_vnet_hdr && virtio_net_hdr_to_skb(skb, vnet_hdr,
+		if (po->has_vnet_hdr) {
-							      vio_le())) {
+			if (virtio_net_hdr_to_skb(skb, vnet_hdr, vio_le())) {
-			tp_len = -EINVAL;
+				tp_len = -EINVAL;
-			goto tpacket_error;
+				goto tpacket_error;
+			}
+			virtio_net_hdr_set_proto(skb, vnet_hdr);
 		}
 		skb->destructor = tpacket_destruct_skb;
 		if (err)
 			goto out_free;
 		len += sizeof(vnet_hdr);
+		virtio_net_hdr_set_proto(skb, &vnet_hdr);
 	}
 	skb_probe_transport_header(skb, reserve);

net/rxrpc/ar-internal.h+19−17

 struct rxrpc_connection;
 /*
- * Mark applied to socket buffers.
+ * Mark applied to socket buffers in skb->mark.  skb->priority is used
+ * to pass supplementary information.
  */
 enum rxrpc_skb_mark {
-	RXRPC_SKB_MARK_DATA,		/* data message */
+	RXRPC_SKB_MARK_REJECT_BUSY,	/* Reject with BUSY */
-	RXRPC_SKB_MARK_FINAL_ACK,	/* final ACK received message */
+	RXRPC_SKB_MARK_REJECT_ABORT,	/* Reject with ABORT (code in skb->priority) */
-	RXRPC_SKB_MARK_BUSY,		/* server busy message */
-	RXRPC_SKB_MARK_REMOTE_ABORT,	/* remote abort message */
-	RXRPC_SKB_MARK_LOCAL_ABORT,	/* local abort message */
-	RXRPC_SKB_MARK_NET_ERROR,	/* network error message */
-	RXRPC_SKB_MARK_LOCAL_ERROR,	/* local error message */
-	RXRPC_SKB_MARK_NEW_CALL,	/* local error message */
 };
 /*
 	struct hlist_node	hash_link;
 	struct rxrpc_local	*local;
 	struct hlist_head	error_targets;	/* targets for net error distribution */
-	struct work_struct	error_distributor;
 	struct rb_root		service_conns;	/* Service connections */
 	struct list_head	keepalive_link;	/* Link in net->peer_keepalive[] */
 	time64_t		last_tx_at;	/* Last time packet sent here */
 	unsigned int		maxdata;	/* data size (MTU - hdrsize) */
 	unsigned short		hdrsize;	/* header size (IP + UDP + RxRPC) */
 	int			debug_id;	/* debug ID for printks */
-	int			error_report;	/* Net (+0) or local (+1000000) to distribute */
-#define RXRPC_LOCAL_ERROR_OFFSET 1000000
 	struct sockaddr_rxrpc	srx;		/* remote address */
 	/* calculated RTT cache */
 	u8			out_clientflag;	/* RXRPC_CLIENT_INITIATED if we are client */
 };
+static inline bool rxrpc_to_server(const struct rxrpc_skb_priv *sp)
+{
+	return sp->hdr.flags & RXRPC_CLIENT_INITIATED;
+}
+static inline bool rxrpc_to_client(const struct rxrpc_skb_priv *sp)
+{
+	return !rxrpc_to_server(sp);
+}
 /*
  * Flags in call->flags.
  */
 int rxrpc_service_prealloc(struct rxrpc_sock *, gfp_t);
 void rxrpc_discard_prealloc(struct rxrpc_sock *);
 struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *,
+					   struct rxrpc_sock *,
+					   struct rxrpc_peer *,
 					   struct rxrpc_connection *,
 					   struct sk_buff *);
 void rxrpc_accept_incoming_calls(struct rxrpc_local *);
 struct rxrpc_connection *rxrpc_alloc_connection(gfp_t);
 struct rxrpc_connection *rxrpc_find_connection_rcu(struct rxrpc_local *,
-						   struct sk_buff *);
+						   struct sk_buff *,
+						   struct rxrpc_peer **);
 void __rxrpc_disconnect_call(struct rxrpc_connection *, struct rxrpc_call *);
 void rxrpc_disconnect_call(struct rxrpc_call *);
 void rxrpc_kill_connection(struct rxrpc_connection *);
  * peer_event.c
  */
 void rxrpc_error_report(struct sock *);
-void rxrpc_peer_error_distributor(struct work_struct *);
 void rxrpc_peer_add_rtt(struct rxrpc_call *, enum rxrpc_rtt_rx_trace,
 			rxrpc_serial_t, rxrpc_serial_t, ktime_t, ktime_t);
 void rxrpc_peer_keepalive_worker(struct work_struct *);
 struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *,
 				     struct sockaddr_rxrpc *, gfp_t);
 struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *, gfp_t);
-struct rxrpc_peer *rxrpc_lookup_incoming_peer(struct rxrpc_local *,
+void rxrpc_new_incoming_peer(struct rxrpc_local *, struct rxrpc_peer *);
-					      struct rxrpc_peer *);
 void rxrpc_destroy_all_peers(struct rxrpc_net *);
 struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
 struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
 void rxrpc_put_peer(struct rxrpc_peer *);
-void __rxrpc_queue_peer_error(struct rxrpc_peer *);
 /*
  * proc.c

net/rxrpc/call_accept.c+14−31

  */
 static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx,
 						    struct rxrpc_local *local,
+						    struct rxrpc_peer *peer,
 						    struct rxrpc_connection *conn,
 						    struct sk_buff *skb)
 {
 	struct rxrpc_backlog *b = rx->backlog;
-	struct rxrpc_peer *peer, *xpeer;
 	struct rxrpc_call *call;
 	unsigned short call_head, conn_head, peer_head;
 	unsigned short call_tail, conn_tail, peer_tail;
 		return NULL;
 	if (!conn) {
-		/* No connection.  We're going to need a peer to start off
+		if (peer && !rxrpc_get_peer_maybe(peer))
-		 * with.  If one doesn't yet exist, use a spare from the
+			peer = NULL;
-		 * preallocation set.  We dump the address into the spare in
+		if (!peer) {
-		 * anticipation - and to save on stack space.
+			peer = b->peer_backlog[peer_tail];
-		 */
+			if (rxrpc_extract_addr_from_skb(local, &peer->srx, skb) < 0)
-		xpeer = b->peer_backlog[peer_tail];
+				return NULL;
-		if (rxrpc_extract_addr_from_skb(local, &xpeer->srx, skb) < 0)
-			return NULL;
-		peer = rxrpc_lookup_incoming_peer(local, xpeer);
-		if (peer == xpeer) {
 			b->peer_backlog[peer_tail] = NULL;
 			smp_store_release(&b->peer_backlog_tail,
 					  (peer_tail + 1) &
 					  (RXRPC_BACKLOG_MAX - 1));
+			rxrpc_new_incoming_peer(local, peer);
 		}
 		/* Now allocate and set up the connection */
  * The call is returned with the user access mutex held.
  */
 struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local,
+					   struct rxrpc_sock *rx,
+					   struct rxrpc_peer *peer,
 					   struct rxrpc_connection *conn,
 					   struct sk_buff *skb)
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-	struct rxrpc_sock *rx;
 	struct rxrpc_call *call;
-	u16 service_id = sp->hdr.serviceId;
 	_enter("");
-	/* Get the socket providing the service */
-	rx = rcu_dereference(local->service);
-	if (rx && (service_id == rx->srx.srx_service ||
-		   service_id == rx->second_service))
-		goto found_service;
-	trace_rxrpc_abort(0, "INV", sp->hdr.cid, sp->hdr.callNumber, sp->hdr.seq,
-			  RX_INVALID_OPERATION, EOPNOTSUPP);
-	skb->mark = RXRPC_SKB_MARK_LOCAL_ABORT;
-	skb->priority = RX_INVALID_OPERATION;
-	_leave(" = NULL [service]");
-	return NULL;
-found_service:
 	spin_lock(&rx->incoming_lock);
 	if (rx->sk.sk_state == RXRPC_SERVER_LISTEN_DISABLED ||
 	    rx->sk.sk_state == RXRPC_CLOSE) {
 		trace_rxrpc_abort(0, "CLS", sp->hdr.cid, sp->hdr.callNumber,
 				  sp->hdr.seq, RX_INVALID_OPERATION, ESHUTDOWN);
-		skb->mark = RXRPC_SKB_MARK_LOCAL_ABORT;
+		skb->mark = RXRPC_SKB_MARK_REJECT_ABORT;
 		skb->priority = RX_INVALID_OPERATION;
 		_leave(" = NULL [close]");
 		call = NULL;
 		goto out;
 	}
-	call = rxrpc_alloc_incoming_call(rx, local, conn, skb);
+	call = rxrpc_alloc_incoming_call(rx, local, peer, conn, skb);
 	if (!call) {
-		skb->mark = RXRPC_SKB_MARK_BUSY;
+		skb->mark = RXRPC_SKB_MARK_REJECT_BUSY;
 		_leave(" = NULL [busy]");
 		call = NULL;
 		goto out;

net/rxrpc/call_object.c+1−1

@@ -400,7 +400,7 @@ void rxrpc_incoming_call(struct rxrpc_sock *rx, · 399 unmodified lines
400	rcu_assign_pointer(conn->channels[chan].call, call);	400	rcu_assign_pointer(conn->channels[chan].call, call);
401		401
402	spin_lock(&conn->params.peer->lock);	402	spin_lock(&conn->params.peer->lock);
403	hlist_add_head(&call->error_link, &conn->params.peer->error_targets);	403	hlist_add_head_rcu(&call->error_link, &conn->params.peer->error_targets);
404	spin_unlock(&conn->params.peer->lock);	404	spin_unlock(&conn->params.peer->lock);
405		405
406	_net("CALL incoming %d on CONN %d", call->debug_id, call->conn->debug_id);	406	_net("CALL incoming %d on CONN %d", call->debug_id, call->conn->debug_id);

net/rxrpc/conn_client.c+2−2

@@ -710,8 +710,8 @@ int rxrpc_connect_call(struct rxrpc_call *call, · 709 unmodified lines
710	}	710	}
711		711
712	spin_lock_bh(&call->conn->params.peer->lock);	712	spin_lock_bh(&call->conn->params.peer->lock);
713	hlist_add_head(&call->error_link,	713	hlist_add_head_rcu(&call->error_link,
714	&call->conn->params.peer->error_targets);	714	&call->conn->params.peer->error_targets);
715	spin_unlock_bh(&call->conn->params.peer->lock);	715	spin_unlock_bh(&call->conn->params.peer->lock);
716		716
717	out:	717	out:

net/rxrpc/conn_object.c+8−6

  * If successful, a pointer to the connection is returned, but no ref is taken.
  * NULL is returned if there is no match.
  *
+ * When searching for a service call, if we find a peer but no connection, we
+ * return that through *_peer in case we need to create a new service call.
+ *
  * The caller must be holding the RCU read lock.
  */
 struct rxrpc_connection *rxrpc_find_connection_rcu(struct rxrpc_local *local,
-						   struct sk_buff *skb)
+						   struct sk_buff *skb,
+						   struct rxrpc_peer **_peer)
 {
 	struct rxrpc_connection *conn;
 	struct rxrpc_conn_proto k;
 	if (rxrpc_extract_addr_from_skb(local, &srx, skb) < 0)
 		goto not_found;
-	k.epoch	= sp->hdr.epoch;
-	k.cid	= sp->hdr.cid & RXRPC_CIDMASK;
 	/* We may have to handle mixing IPv4 and IPv6 */
 	if (srx.transport.family != local->srx.transport.family) {
 		pr_warn_ratelimited("AF_RXRPC: Protocol mismatch %u not %u\n",
 	k.epoch	= sp->hdr.epoch;
 	k.cid	= sp->hdr.cid & RXRPC_CIDMASK;
-	if (sp->hdr.flags & RXRPC_CLIENT_INITIATED) {
+	if (rxrpc_to_server(sp)) {
 		/* We need to look up service connections by the full protocol
 		 * parameter set.  We look up the peer first as an intermediate
 		 * step and then the connection from the peer's tree.
 		peer = rxrpc_lookup_peer_rcu(local, &srx);
 		if (!peer)
 			goto not_found;
+		*_peer = peer;
 		conn = rxrpc_find_service_conn_rcu(peer, skb);
 		if (!conn || atomic_read(&conn->usage) == 0)
 			goto not_found;
 	call->peer->cong_cwnd = call->cong_cwnd;
 	spin_lock_bh(&conn->params.peer->lock);
-	hlist_del_init(&call->error_link);
+	hlist_del_rcu(&call->error_link);
 	spin_unlock_bh(&conn->params.peer->lock);
 	if (rxrpc_is_client_call(call))

net/rxrpc/input.c+64−26

 		if (!skb)
 			continue;
+		sent_at = skb->tstamp;
+		smp_rmb(); /* Read timestamp before serial. */
 		sp = rxrpc_skb(skb);
 		if (sp->hdr.serial != orig_serial)
 			continue;
-		smp_rmb();
-		sent_at = skb->tstamp;
 		goto found;
 	}
 	return;
 found:
 {
 	struct rxrpc_connection *conn;
 	struct rxrpc_channel *chan;
-	struct rxrpc_call *call;
+	struct rxrpc_call *call = NULL;
 	struct rxrpc_skb_priv *sp;
 	struct rxrpc_local *local = udp_sk->sk_user_data;
+	struct rxrpc_peer *peer = NULL;
+	struct rxrpc_sock *rx = NULL;
 	struct sk_buff *skb;
 	unsigned int channel;
-	int ret, skew;
+	int ret, skew = 0;
 	_enter("%p", udp_sk);
 		return;
 	}
+	if (skb->tstamp == 0)
+		skb->tstamp = ktime_get_real();
 	rxrpc_new_skb(skb, rxrpc_skb_rx_received);
 	_net("recv skb %p", skb);
 	trace_rxrpc_rx_packet(sp);
-	_net("Rx RxRPC %s ep=%x call=%x:%x",
-	     sp->hdr.flags & RXRPC_CLIENT_INITIATED ? "ToServer" : "ToClient",
-	     sp->hdr.epoch, sp->hdr.cid, sp->hdr.callNumber);
-	if (sp->hdr.type >= RXRPC_N_PACKET_TYPES ||
-	    !((RXRPC_SUPPORTED_PACKET_TYPES >> sp->hdr.type) & 1)) {
-		_proto("Rx Bad Packet Type %u", sp->hdr.type);
-		goto bad_message;
-	}
 	switch (sp->hdr.type) {
 	case RXRPC_PACKET_TYPE_VERSION:
-		if (!(sp->hdr.flags & RXRPC_CLIENT_INITIATED))
+		if (rxrpc_to_client(sp))
 			goto discard;
 		rxrpc_post_packet_to_local(local, skb);
 		goto out;
 	case RXRPC_PACKET_TYPE_BUSY:
-		if (sp->hdr.flags & RXRPC_CLIENT_INITIATED)
+		if (rxrpc_to_server(sp))
 			goto discard;
 		/* Fall through */
+	case RXRPC_PACKET_TYPE_ACK:
+	case RXRPC_PACKET_TYPE_ACKALL:
+		if (sp->hdr.callNumber == 0)
+			goto bad_message;
+		/* Fall through */
+	case RXRPC_PACKET_TYPE_ABORT:
+		break;
 	case RXRPC_PACKET_TYPE_DATA:
-		if (sp->hdr.callNumber == 0)
+		if (sp->hdr.callNumber == 0 ||
+		    sp->hdr.seq == 0)
 			goto bad_message;
 		if (sp->hdr.flags & RXRPC_JUMBO_PACKET &&
 		    !rxrpc_validate_jumbo(skb))
 			goto bad_message;
 		break;
+	case RXRPC_PACKET_TYPE_CHALLENGE:
+		if (rxrpc_to_server(sp))
+			goto discard;
+		break;
+	case RXRPC_PACKET_TYPE_RESPONSE:
+		if (rxrpc_to_client(sp))
+			goto discard;
+		break;
 		/* Packet types 9-11 should just be ignored. */
 	case RXRPC_PACKET_TYPE_PARAMS:
 	case RXRPC_PACKET_TYPE_10:
 	case RXRPC_PACKET_TYPE_11:
 		goto discard;
+	default:
+		_proto("Rx Bad Packet Type %u", sp->hdr.type);
+		goto bad_message;
 	}
+	if (sp->hdr.serviceId == 0)
+		goto bad_message;
 	rcu_read_lock();
-	conn = rxrpc_find_connection_rcu(local, skb);
+	if (rxrpc_to_server(sp)) {
+		/* Weed out packets to services we're not offering.  Packets
+		 * that would begin a call are explicitly rejected and the rest
+		 * are just discarded.
+		 */
+		rx = rcu_dereference(local->service);
+		if (!rx || (sp->hdr.serviceId != rx->srx.srx_service &&
+			    sp->hdr.serviceId != rx->second_service)) {
+			if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
+			    sp->hdr.seq == 1)
+				goto unsupported_service;
+			goto discard_unlock;
+		}
+	}
+	conn = rxrpc_find_connection_rcu(local, skb, &peer);
 	if (conn) {
 		if (sp->hdr.securityIndex != conn->security_ix)
 			goto wrong_security;
 		call = rcu_dereference(chan->call);
 		if (sp->hdr.callNumber > chan->call_id) {
-			if (!(sp->hdr.flags & RXRPC_CLIENT_INITIATED)) {
+			if (rxrpc_to_client(sp)) {
 				rcu_read_unlock();
 				goto reject_packet;
 			}
 			if (!test_bit(RXRPC_CALL_RX_HEARD, &call->flags))
 				set_bit(RXRPC_CALL_RX_HEARD, &call->flags);
 		}
-	} else {
-		skew = 0;
-		call = NULL;
 	}
 	if (!call || atomic_read(&call->usage) == 0) {
-		if (!(sp->hdr.type & RXRPC_CLIENT_INITIATED) ||
+		if (rxrpc_to_client(sp) ||
-		    sp->hdr.callNumber == 0 ||
 		    sp->hdr.type != RXRPC_PACKET_TYPE_DATA)
 			goto bad_message_unlock;
 		if (sp->hdr.seq != 1)
 			goto discard_unlock;
-		call = rxrpc_new_incoming_call(local, conn, skb);
+		call = rxrpc_new_incoming_call(local, rx, peer, conn, skb);
 		if (!call) {
 			rcu_read_unlock();
 			goto reject_packet;
 	skb->priority = RXKADINCONSISTENCY;
 	goto post_abort;
+unsupported_service:
+	rcu_read_unlock();
+	trace_rxrpc_abort(0, "INV", sp->hdr.cid, sp->hdr.callNumber, sp->hdr.seq,
+			  RX_INVALID_OPERATION, EOPNOTSUPP);
+	skb->priority = RX_INVALID_OPERATION;
+	goto post_abort;
 reupgrade:
 	rcu_read_unlock();
 	trace_rxrpc_abort(0, "UPG", sp->hdr.cid, sp->hdr.callNumber, sp->hdr.seq,
 protocol_error:
 	skb->priority = RX_PROTOCOL_ERROR;
 post_abort:
-	skb->mark = RXRPC_SKB_MARK_LOCAL_ABORT;
+	skb->mark = RXRPC_SKB_MARK_REJECT_ABORT;
 reject_packet:
 	trace_rxrpc_rx_done(skb->mark, skb->priority);
 	rxrpc_reject_packet(local, skb);

net/rxrpc/local_object.c+22−10

 	}
 	switch (local->srx.transport.family) {
-	case AF_INET:
+	case AF_INET6:
-		/* we want to receive ICMP errors */
+		/* we want to receive ICMPv6 errors */
 		opt = 1;
-		ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
+		ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR,
 					(char *) &opt, sizeof(opt));
 		if (ret < 0) {
 			_debug("setsockopt failed");
 		}
 		/* we want to set the don't fragment bit */
-		opt = IP_PMTUDISC_DO;
+		opt = IPV6_PMTUDISC_DO;
-		ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
+		ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
 					(char *) &opt, sizeof(opt));
 		if (ret < 0) {
 			_debug("setsockopt failed");
 			goto error;
 		}
-		break;
-	case AF_INET6:
+		/* Fall through and set IPv4 options too otherwise we don't get
+		 * errors from IPv4 packets sent through the IPv6 socket.
+		 */
+	case AF_INET:
 		/* we want to receive ICMP errors */
 		opt = 1;
-		ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR,
+		ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
 					(char *) &opt, sizeof(opt));
 		if (ret < 0) {
 			_debug("setsockopt failed");
 		}
 		/* we want to set the don't fragment bit */
-		opt = IPV6_PMTUDISC_DO;
+		opt = IP_PMTUDISC_DO;
-		ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
+		ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
 					(char *) &opt, sizeof(opt));
 		if (ret < 0) {
 			_debug("setsockopt failed");
 			goto error;
 		}
+		/* We want receive timestamps. */
+		opt = 1;
+		ret = kernel_setsockopt(local->socket, SOL_SOCKET, SO_TIMESTAMPNS,
+					(char *)&opt, sizeof(opt));
+		if (ret < 0) {
+			_debug("setsockopt failed");
+			goto error;
+		}
 		break;
 	default:

net/rxrpc/output.c+36−18

 	struct kvec iov[2];
 	rxrpc_serial_t serial;
 	rxrpc_seq_t hard_ack, top;
-	ktime_t now;
 	size_t len, n;
 	int ret;
 	u8 reason;
 		/* We need to stick a time in before we send the packet in case
 		 * the reply gets back before kernel_sendmsg() completes - but
 		 * asking UDP to send the packet can take a relatively long
-		 * time, so we update the time after, on the assumption that
+		 * time.
-		 * the packet transmission is more likely to happen towards the
-		 * end of the kernel_sendmsg() call.
 		 */
 		call->ping_time = ktime_get_real();
 		set_bit(RXRPC_CALL_PINGING, &call->flags);
 	}
 	ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
-	now = ktime_get_real();
-	if (ping)
-		call->ping_time = now;
 	conn->params.peer->last_tx_at = ktime_get_seconds();
 	if (ret < 0)
 		trace_rxrpc_tx_fail(call->debug_id, serial, ret,
 	/* If our RTT cache needs working on, request an ACK.  Also request
 	 * ACKs if a DATA packet appears to have been lost.
+	 *
+	 * However, we mustn't request an ACK on the last reply packet of a
+	 * service call, lest OpenAFS incorrectly send us an ACK with some
+	 * soft-ACKs in it and then never follow up with a proper hard ACK.
 	 */
-	if (!(sp->hdr.flags & RXRPC_LAST_PACKET) &&
+	if ((!(sp->hdr.flags & RXRPC_LAST_PACKET) ||
+	     rxrpc_to_server(sp)
+	     ) &&
 	    (test_and_clear_bit(RXRPC_CALL_EV_ACK_LOST, &call->events) ||
 	     retrans ||
 	     call->cong_mode == RXRPC_CALL_SLOW_START ||
 		goto send_fragmentable;
 	down_read(&conn->params.local->defrag_sem);
+	sp->hdr.serial = serial;
+	smp_wmb(); /* Set serial before timestamp */
+	skb->tstamp = ktime_get_real();
 	/* send the packet by UDP
 	 * - returns -EMSGSIZE if UDP would have to fragment the packet
 	 *   to go out of the interface
 	trace_rxrpc_tx_data(call, sp->hdr.seq, serial, whdr.flags,
 			    retrans, lost);
 	if (ret >= 0) {
-		ktime_t now = ktime_get_real();
-		skb->tstamp = now;
-		smp_wmb();
-		sp->hdr.serial = serial;
 		if (whdr.flags & RXRPC_REQUEST_ACK) {
-			call->peer->rtt_last_req = now;
+			call->peer->rtt_last_req = skb->tstamp;
 			trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_data, serial);
 			if (call->peer->rtt_usage > 1) {
 				unsigned long nowj = jiffies, ack_lost_at;
 	down_write(&conn->params.local->defrag_sem);
+	sp->hdr.serial = serial;
+	smp_wmb(); /* Set serial before timestamp */
+	skb->tstamp = ktime_get_real();
 	switch (conn->params.local->srx.transport.family) {
 	case AF_INET:
 		opt = IP_PMTUDISC_DONT;
 	struct kvec iov[2];
 	size_t size;
 	__be32 code;
-	int ret;
+	int ret, ioc;
 	_enter("%d", local->debug_id);
 	iov[0].iov_len = sizeof(whdr);
 	iov[1].iov_base = &code;
 	iov[1].iov_len = sizeof(code);
-	size = sizeof(whdr) + sizeof(code);
 	msg.msg_name = &srx.transport;
 	msg.msg_control = NULL;
 	msg.msg_flags = 0;
 	memset(&whdr, 0, sizeof(whdr));
-	whdr.type = RXRPC_PACKET_TYPE_ABORT;
 	while ((skb = skb_dequeue(&local->reject_queue))) {
 		rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
 		sp = rxrpc_skb(skb);
+		switch (skb->mark) {
+		case RXRPC_SKB_MARK_REJECT_BUSY:
+			whdr.type = RXRPC_PACKET_TYPE_BUSY;
+			size = sizeof(whdr);
+			ioc = 1;
+			break;
+		case RXRPC_SKB_MARK_REJECT_ABORT:
+			whdr.type = RXRPC_PACKET_TYPE_ABORT;
+			code = htonl(skb->priority);
+			size = sizeof(whdr) + sizeof(code);
+			ioc = 2;
+			break;
+		default:
+			rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+			continue;
+		}
 		if (rxrpc_extract_addr_from_skb(local, &srx, skb) == 0) {
 			msg.msg_namelen = srx.transport_len;
-			code = htonl(skb->priority);
 			whdr.epoch	= htonl(sp->hdr.epoch);
 			whdr.cid	= htonl(sp->hdr.cid);
 			whdr.callNumber	= htonl(sp->hdr.callNumber);

net/rxrpc/peer_event.c+11−35

@@ -23,6 +23,8 @@ · 22 unmodified lines
23	#include "ar-internal.h"	23	#include "ar-internal.h"
24		24
25	static void rxrpc_store_error(struct rxrpc_peer , struct sock_exterr_skb );	25	static void rxrpc_store_error(struct rxrpc_peer , struct sock_exterr_skb );
		26	static void rxrpc_distribute_error(struct rxrpc_peer *, int,
		27	enum rxrpc_call_completion);
26		28
27	/*	29	/*
28	* Find the peer associated with an ICMP packet.	30	* Find the peer associated with an ICMP packet.
@@ -194,8 +196,6 @@ void rxrpc_error_report(struct sock *sk) · 165 unmodified lines
194	rcu_read_unlock();	196	rcu_read_unlock();
195	rxrpc_free_skb(skb, rxrpc_skb_rx_freed);	197	rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
196		198
197	/* The ref we obtained is passed off to the work item */
198	__rxrpc_queue_peer_error(peer);
199	_leave("");	199	_leave("");
200	}	200	}
201		201
@@ -205,6 +205,7 @@ void rxrpc_error_report(struct sock *sk) · 3 unmodified lines
205	static void rxrpc_store_error(struct rxrpc_peer *peer,	205	static void rxrpc_store_error(struct rxrpc_peer *peer,
206	struct sock_exterr_skb *serr)	206	struct sock_exterr_skb *serr)
207	{	207	{
		208	enum rxrpc_call_completion compl = RXRPC_CALL_NETWORK_ERROR;
208	struct sock_extended_err *ee;	209	struct sock_extended_err *ee;
209	int err;	210	int err;
210		211
@@ -255,7 +256,7 @@ static void rxrpc_store_error(struct rxrpc_peer *peer, · 44 unmodified lines
255	case SO_EE_ORIGIN_NONE:	256	case SO_EE_ORIGIN_NONE:
256	case SO_EE_ORIGIN_LOCAL:	257	case SO_EE_ORIGIN_LOCAL:
257	_proto("Rx Received local error { error=%d }", err);	258	_proto("Rx Received local error { error=%d }", err);
258	err += RXRPC_LOCAL_ERROR_OFFSET;	259	compl = RXRPC_CALL_LOCAL_ERROR;
259	break;	260	break;
260		261
261	case SO_EE_ORIGIN_ICMP6:	262	case SO_EE_ORIGIN_ICMP6:
@@ -264,48 +265,23 @@ static void rxrpc_store_error(struct rxrpc_peer *peer, · 2 unmodified lines
264	break;	265	break;
265	}	266	}
266		267
267	peer->error_report = err;	268	rxrpc_distribute_error(peer, err, compl);
268	}	269	}
269		270
270	/*	271	/*
271	* Distribute an error that occurred on a peer	272	* Distribute an error that occurred on a peer.
272	*/	273	*/
273	void rxrpc_peer_error_distributor(struct work_struct *work)	274	static void rxrpc_distribute_error(struct rxrpc_peer *peer, int error,
		275	enum rxrpc_call_completion compl)
274	{	276	{
275	struct rxrpc_peer *peer =
276	container_of(work, struct rxrpc_peer, error_distributor);
277	struct rxrpc_call *call;	277	struct rxrpc_call *call;
278	enum rxrpc_call_completion compl;
279	int error;
280
281	_enter("");
282
283	error = READ_ONCE(peer->error_report);
284	if (error < RXRPC_LOCAL_ERROR_OFFSET) {
285	compl = RXRPC_CALL_NETWORK_ERROR;
286	} else {
287	compl = RXRPC_CALL_LOCAL_ERROR;
288	error -= RXRPC_LOCAL_ERROR_OFFSET;
289	}
290		278
291	_debug("ISSUE ERROR %s %d", rxrpc_call_completions[compl], error);	279	hlist_for_each_entry_rcu(call, &peer->error_targets, error_link) {
292
293	spin_lock_bh(&peer->lock);
294
295	while (!hlist_empty(&peer->error_targets)) {
296	call = hlist_entry(peer->error_targets.first,
297	struct rxrpc_call, error_link);
298	hlist_del_init(&call->error_link);
299	rxrpc_see_call(call);	280	rxrpc_see_call(call);
300		281	if (call->state < RXRPC_CALL_COMPLETE &&
301	if (rxrpc_set_call_completion(call, compl, 0, -error))	282	rxrpc_set_call_completion(call, compl, 0, -error))
302	rxrpc_notify_socket(call);	283	rxrpc_notify_socket(call);
303	}	284	}
304
305	spin_unlock_bh(&peer->lock);
306
307	rxrpc_put_peer(peer);
308	_leave("");
309	}	285	}
310		286
311	/*	287	/*

net/rxrpc/peer_object.c+11−41

@@ -124,11 +124,9 @@ static struct rxrpc_peer *__rxrpc_lookup_peer_rcu( · 123 unmodified lines
124	struct rxrpc_net *rxnet = local->rxnet;	124	struct rxrpc_net *rxnet = local->rxnet;
125		125
126	hash_for_each_possible_rcu(rxnet->peer_hash, peer, hash_link, hash_key) {	126	hash_for_each_possible_rcu(rxnet->peer_hash, peer, hash_link, hash_key) {
127	if (rxrpc_peer_cmp_key(peer, local, srx, hash_key) == 0) {	127	if (rxrpc_peer_cmp_key(peer, local, srx, hash_key) == 0 &&
128	if (atomic_read(&peer->usage) == 0)	128	atomic_read(&peer->usage) > 0)
129	return NULL;
130	return peer;	129	return peer;
131	}
132	}	130	}
133		131
134	return NULL;	132	return NULL;
@@ -222,8 +220,6 @@ struct rxrpc_peer rxrpc_alloc_peer(struct rxrpc_local local, gfp_t gfp) · 87 unmodified lines
222	atomic_set(&peer->usage, 1);	220	atomic_set(&peer->usage, 1);
223	peer->local = local;	221	peer->local = local;
224	INIT_HLIST_HEAD(&peer->error_targets);	222	INIT_HLIST_HEAD(&peer->error_targets);
225	INIT_WORK(&peer->error_distributor,
226	&rxrpc_peer_error_distributor);
227	peer->service_conns = RB_ROOT;	223	peer->service_conns = RB_ROOT;
228	seqlock_init(&peer->service_conn_lock);	224	seqlock_init(&peer->service_conn_lock);
229	spin_lock_init(&peer->lock);	225	spin_lock_init(&peer->lock);
@@ -299,34 +295,23 @@ static struct rxrpc_peer rxrpc_create_peer(struct rxrpc_local local, · 69 unmodified lines
299	}	295	}
300		296
301	/*	297	/*
302	* Set up a new incoming peer. The address is prestored in the preallocated	298	* Set up a new incoming peer. There shouldn't be any other matching peers
303	* peer.	299	* since we've already done a search in the list from the non-reentrant context
		300	* (the data_ready handler) that is the only place we can add new peers.
304	*/	301	*/
305	struct rxrpc_peer rxrpc_lookup_incoming_peer(struct rxrpc_local local,	302	void rxrpc_new_incoming_peer(struct rxrpc_local local, struct rxrpc_peer peer)
306	struct rxrpc_peer *prealloc)
307	{	303	{
308	struct rxrpc_peer *peer;
309	struct rxrpc_net *rxnet = local->rxnet;	304	struct rxrpc_net *rxnet = local->rxnet;
310	unsigned long hash_key;	305	unsigned long hash_key;
311		306
312	hash_key = rxrpc_peer_hash_key(local, &prealloc->srx);	307	hash_key = rxrpc_peer_hash_key(local, &peer->srx);
313	prealloc->local = local;	308	peer->local = local;
314	rxrpc_init_peer(prealloc, hash_key);	309	rxrpc_init_peer(peer, hash_key);
315		310
316	spin_lock(&rxnet->peer_hash_lock);	311	spin_lock(&rxnet->peer_hash_lock);
317		312	hash_add_rcu(rxnet->peer_hash, &peer->hash_link, hash_key);
318	/* Need to check that we aren't racing with someone else */	313	list_add_tail(&peer->keepalive_link, &rxnet->peer_keepalive_new);
319	peer = __rxrpc_lookup_peer_rcu(local, &prealloc->srx, hash_key);
320	if (peer && !rxrpc_get_peer_maybe(peer))
321	peer = NULL;
322	if (!peer) {
323	peer = prealloc;
324	hash_add_rcu(rxnet->peer_hash, &peer->hash_link, hash_key);
325	list_add_tail(&peer->keepalive_link, &rxnet->peer_keepalive_new);
326	}
327
328	spin_unlock(&rxnet->peer_hash_lock);	314	spin_unlock(&rxnet->peer_hash_lock);
329	return peer;
330	}	315	}
331		316
332	/*	317	/*
@@ -415,21 +400,6 @@ struct rxrpc_peer rxrpc_get_peer_maybe(struct rxrpc_peer peer) · 82 unmodified lines
415	return peer;	400	return peer;
416	}	401	}
417		402
418	/*
419	* Queue a peer record. This passes the caller's ref to the workqueue.
420	*/
421	void __rxrpc_queue_peer_error(struct rxrpc_peer *peer)
422	{
423	const void *here = __builtin_return_address(0);
424	int n;
425
426	n = atomic_read(&peer->usage);
427	if (rxrpc_queue_work(&peer->error_distributor))
428	trace_rxrpc_peer(peer, rxrpc_peer_queued_error, n, here);
429	else
430	rxrpc_put_peer(peer);
431	}
432
433	/*	403	/*
434	* Discard a peer record.	404	* Discard a peer record.
435	*/	405	*/

net/rxrpc/protocol.h+0−15

@@ -50,7 +50,6 @@ struct rxrpc_wire_header { · 49 unmodified lines
50	#define RXRPC_PACKET_TYPE_10 10 /* Ignored */	50	#define RXRPC_PACKET_TYPE_10 10 /* Ignored */
51	#define RXRPC_PACKET_TYPE_11 11 /* Ignored */	51	#define RXRPC_PACKET_TYPE_11 11 /* Ignored */
52	#define RXRPC_PACKET_TYPE_VERSION 13 /* version string request */	52	#define RXRPC_PACKET_TYPE_VERSION 13 /* version string request */
53	#define RXRPC_N_PACKET_TYPES 14 /* number of packet types (incl type 0) */
54		53
55	uint8_t flags; /* packet flags */	54	uint8_t flags; /* packet flags */
56	#define RXRPC_CLIENT_INITIATED 0x01 /* signifies a packet generated by a client */	55	#define RXRPC_CLIENT_INITIATED 0x01 /* signifies a packet generated by a client */
@@ -72,20 +71,6 @@ struct rxrpc_wire_header { · 15 unmodified lines
72		71
73	} __packed;	72	} __packed;
74		73
75	#define RXRPC_SUPPORTED_PACKET_TYPES ( \
76	(1 << RXRPC_PACKET_TYPE_DATA) \| \
77	(1 << RXRPC_PACKET_TYPE_ACK) \| \
78	(1 << RXRPC_PACKET_TYPE_BUSY) \| \
79	(1 << RXRPC_PACKET_TYPE_ABORT) \| \
80	(1 << RXRPC_PACKET_TYPE_ACKALL) \| \
81	(1 << RXRPC_PACKET_TYPE_CHALLENGE) \| \
82	(1 << RXRPC_PACKET_TYPE_RESPONSE) \| \
83	/(1 << RXRPC_PACKET_TYPE_DEBUG) \| / \
84	(1 << RXRPC_PACKET_TYPE_PARAMS) \| \
85	(1 << RXRPC_PACKET_TYPE_10) \| \
86	(1 << RXRPC_PACKET_TYPE_11) \| \
87	(1 << RXRPC_PACKET_TYPE_VERSION))
88
89	/*****************************************************************************/	74	/*****************************************************************************/
90	/*	75	/*
91	* jumbo packet secondary header	76	* jumbo packet secondary header

net/sched/act_ipt.c+1−1

@@ -135,7 +135,7 @@ static int __tcf_ipt_init(struct net net, unsigned int id, struct nlattr nla, · 134 unmodified lines
135	}	135	}
136		136
137	td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);	137	td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
138	if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) {	138	if (nla_len(tb[TCA_IPT_TARG]) != td->u.target_size) {
139	if (exists)	139	if (exists)
140	tcf_idr_release(*a, bind);	140	tcf_idr_release(*a, bind);
141	else	141	else

net/sched/sch_api.c+20−4

  * Delete/get qdisc.
  */
+const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+	[TCA_KIND]		= { .type = NLA_STRING },
+	[TCA_OPTIONS]		= { .type = NLA_NESTED },
+	[TCA_RATE]		= { .type = NLA_BINARY,
+				    .len = sizeof(struct tc_estimator) },
+	[TCA_STAB]		= { .type = NLA_NESTED },
+	[TCA_DUMP_INVISIBLE]	= { .type = NLA_FLAG },
+	[TCA_CHAIN]		= { .type = NLA_U32 },
+	[TCA_INGRESS_BLOCK]	= { .type = NLA_U32 },
+	[TCA_EGRESS_BLOCK]	= { .type = NLA_U32 },
+};
 static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
 			struct netlink_ext_ack *extack)
 {
 	    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
 		return -EPERM;
-	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
+	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
+			  extack);
 	if (err < 0)
 		return err;
 replay:
 	/* Reinit, just in case something touches this. */
-	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
+	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
+			  extack);
 	if (err < 0)
 		return err;
 	idx = 0;
 	ASSERT_RTNL();
-	err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX, NULL, NULL);
+	err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX,
+			  rtm_tca_policy, NULL);
 	if (err < 0)
 		return err;
 	    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
 		return -EPERM;
-	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
+	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
+			  extack);
 	if (err < 0)
 		return err;

net/sctp/outqueue.c+1−1

@@ -1048,7 +1048,7 @@ static void sctp_outq_flush_data(struct sctp_flush_ctx *ctx, · 1047 unmodified lines
1048	if (!ctx->packet \|\| !ctx->packet->has_cookie_echo)	1048	if (!ctx->packet \|\| !ctx->packet->has_cookie_echo)
1049	return;	1049	return;
1050		1050
1051	/* fallthru */	1051	/* fall through */
1052	case SCTP_STATE_ESTABLISHED:	1052	case SCTP_STATE_ESTABLISHED:
1053	case SCTP_STATE_SHUTDOWN_PENDING:	1053	case SCTP_STATE_SHUTDOWN_PENDING:
1054	case SCTP_STATE_SHUTDOWN_RECEIVED:	1054	case SCTP_STATE_SHUTDOWN_RECEIVED:

net/tipc/bearer.c+7−5

 	switch (evt) {
 	case NETDEV_CHANGE:
-		if (netif_carrier_ok(dev))
+		if (netif_carrier_ok(dev) && netif_oper_up(dev)) {
+			test_and_set_bit_lock(0, &b->up);
 			break;
-		/* else: fall through */
+		}
-	case NETDEV_UP:
+		/* fall through */
-		test_and_set_bit_lock(0, &b->up);
-		break;
 	case NETDEV_GOING_DOWN:
 		clear_bit_unlock(0, &b->up);
 		tipc_reset_bearer(net, b);
 		break;
+	case NETDEV_UP:
+		test_and_set_bit_lock(0, &b->up);
+		break;
 	case NETDEV_CHANGEMTU:
 		if (tipc_mtu_bad(dev, 0)) {
 			bearer_disable(net, b);

net/tipc/link.c+44−1

@@ -410,6 +410,11 @@ char tipc_link_name(struct tipc_link l) · 409 unmodified lines
410	return l->name;	410	return l->name;
411	}	411	}
412		412
		413	u32 tipc_link_state(struct tipc_link *l)
		414	{
		415	return l->state;
		416	}
		417
413	/**	418	/**
414	* tipc_link_create - create a new link	419	* tipc_link_create - create a new link
415	* @n: pointer to associated node	420	* @n: pointer to associated node
@@ -841,9 +846,14 @@ void tipc_link_reset(struct tipc_link *l) · 425 unmodified lines
841	l->in_session = false;	846	l->in_session = false;
842	l->session++;	847	l->session++;
843	l->mtu = l->advertised_mtu;	848	l->mtu = l->advertised_mtu;
		849	spin_lock_bh(&l->wakeupq.lock);
		850	spin_lock_bh(&l->inputq->lock);
		851	skb_queue_splice_init(&l->wakeupq, l->inputq);
		852	spin_unlock_bh(&l->inputq->lock);
		853	spin_unlock_bh(&l->wakeupq.lock);
		854
844	__skb_queue_purge(&l->transmq);	855	__skb_queue_purge(&l->transmq);
845	__skb_queue_purge(&l->deferdq);	856	__skb_queue_purge(&l->deferdq);
846	skb_queue_splice_init(&l->wakeupq, l->inputq);
847	__skb_queue_purge(&l->backlogq);	857	__skb_queue_purge(&l->backlogq);
848	l->backlog[TIPC_LOW_IMPORTANCE].len = 0;	858	l->backlog[TIPC_LOW_IMPORTANCE].len = 0;
849	l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;	859	l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;
@@ -1380,6 +1390,36 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe, · 530 unmodified lines
1380	__skb_queue_tail(xmitq, skb);	1390	__skb_queue_tail(xmitq, skb);
1381	}	1391	}
1382		1392
		1393	void tipc_link_create_dummy_tnl_msg(struct tipc_link *l,
		1394	struct sk_buff_head *xmitq)
		1395	{
		1396	u32 onode = tipc_own_addr(l->net);
		1397	struct tipc_msg hdr, ihdr;
		1398	struct sk_buff_head tnlq;
		1399	struct sk_buff *skb;
		1400	u32 dnode = l->addr;
		1401
		1402	skb_queue_head_init(&tnlq);
		1403	skb = tipc_msg_create(TUNNEL_PROTOCOL, FAILOVER_MSG,
		1404	INT_H_SIZE, BASIC_H_SIZE,
		1405	dnode, onode, 0, 0, 0);
		1406	if (!skb) {
		1407	pr_warn("%sunable to create tunnel packet\n", link_co_err);
		1408	return;
		1409	}
		1410
		1411	hdr = buf_msg(skb);
		1412	msg_set_msgcnt(hdr, 1);
		1413	msg_set_bearer_id(hdr, l->peer_bearer_id);
		1414
		1415	ihdr = (struct tipc_msg *)msg_data(hdr);
		1416	tipc_msg_init(onode, ihdr, TIPC_LOW_IMPORTANCE, TIPC_DIRECT_MSG,
		1417	BASIC_H_SIZE, dnode);
		1418	msg_set_errcode(ihdr, TIPC_ERR_NO_PORT);
		1419	__skb_queue_tail(&tnlq, skb);
		1420	tipc_link_xmit(l, &tnlq, xmitq);
		1421	}
		1422
1383	/* tipc_link_tnl_prepare(): prepare and return a list of tunnel packets	1423	/* tipc_link_tnl_prepare(): prepare and return a list of tunnel packets
1384	* with contents of the link's transmit and backlog queues.	1424	* with contents of the link's transmit and backlog queues.
1385	*/	1425	*/
@@ -1476,6 +1516,9 @@ bool tipc_link_validate_msg(struct tipc_link l, struct tipc_msg hdr) · 90 unmodified lines
1476	return false;	1516	return false;
1477	if (session != curr_session)	1517	if (session != curr_session)
1478	return false;	1518	return false;
		1519	/* Extra sanity check */
		1520	if (!link_is_up(l) && msg_ack(hdr))
		1521	return false;
1479	if (!(l->peer_caps & TIPC_LINK_PROTO_SEQNO))	1522	if (!(l->peer_caps & TIPC_LINK_PROTO_SEQNO))
1480	return true;	1523	return true;
1481	/* Accept only STATE with new sequence number */	1524	/* Accept only STATE with new sequence number */

net/tipc/link.h+3−0

 			 struct tipc_link **link);
 void tipc_link_tnl_prepare(struct tipc_link *l, struct tipc_link *tnl,
 			   int mtyp, struct sk_buff_head *xmitq);
+void tipc_link_create_dummy_tnl_msg(struct tipc_link *tnl,
+				    struct sk_buff_head *xmitq);
 void tipc_link_build_reset_msg(struct tipc_link *l, struct sk_buff_head *xmitq);
 int tipc_link_fsm_evt(struct tipc_link *l, int evt);
 bool tipc_link_is_up(struct tipc_link *l);
 u16 tipc_link_acked(struct tipc_link *l);
 u32 tipc_link_id(struct tipc_link *l);
 char *tipc_link_name(struct tipc_link *l);
+u32 tipc_link_state(struct tipc_link *l);
 char tipc_link_plane(struct tipc_link *l);
 int tipc_link_prio(struct tipc_link *l);
 int tipc_link_window(struct tipc_link *l);

net/tipc/node.c+13−1

 	int action_flags;
 	struct list_head list;
 	int state;
+	bool failover_sent;
 	u16 sync_point;
 	int link_cnt;
 	u16 working_links;
 		*slot0 = bearer_id;
 		*slot1 = bearer_id;
 		tipc_node_fsm_evt(n, SELF_ESTABL_CONTACT_EVT);
+		n->failover_sent = false;
 		n->action_flags |= TIPC_NOTIFY_NODE_UP;
 		tipc_link_set_active(nl, true);
 		tipc_bcast_add_peer(n->net, nl, xmitq);
 	bool reset = true;
 	char *if_name;
 	unsigned long intv;
+	u16 session;
 	*dupl_addr = false;
 	*respond = false;
 			goto exit;
 		if_name = strchr(b->name, ':') + 1;
+		get_random_bytes(&session, sizeof(u16));
 		if (!tipc_link_create(net, if_name, b->identity, b->tolerance,
 				      b->net_plane, b->mtu, b->priority,
-				      b->window, mod(tipc_net(net)->random),
+				      b->window, session,
 				      tipc_own_addr(net), addr, peer_id,
 				      n->capabilities,
 				      tipc_bc_sndlink(n->net), n->bc_entry.link,
 			tipc_skb_queue_splice_tail_init(tipc_link_inputq(pl),
 							tipc_link_inputq(l));
 		}
+		/* If parallel link was already down, and this happened before
+		 * the tunnel link came up, FAILOVER was never sent. Ensure that
+		 * FAILOVER is sent to get peer out of NODE_FAILINGOVER state.
+		 */
+		if (n->state != NODE_FAILINGOVER && !n->failover_sent) {
+			tipc_link_create_dummy_tnl_msg(l, xmitq);
+			n->failover_sent = true;
+		}
 		/* If pkts arrive out of order, use lowest calculated syncpt */
 		if (less(syncpt, n->sync_point))
 			n->sync_point = syncpt;

net/tipc/socket.c+3−1

 	/* Handle implicit connection setup */
 	if (unlikely(dest)) {
 		rc = __tipc_sendmsg(sock, m, dlen);
-		if (dlen && (dlen == rc))
+		if (dlen && dlen == rc) {
+			tsk->peer_caps = tipc_node_get_capabilities(net, dnode);
 			tsk->snt_unacked = tsk_inc(tsk, dlen + msg_hdr_sz(hdr));
+		}
 		return rc;
 	}

net/wireless/nl80211.c+15−5

 			return false;
 		/* check availability */
+		ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
 		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
 			mcs[ridx] |= rbit;
 		else
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	s32 last, low, high;
 	u32 hyst;
-	int i, n;
+	int i, n, low_index;
 	int err;
 	/* RSSI reporting disabled? */
 		if (last < wdev->cqm_config->rssi_thresholds[i])
 			break;
-	low = i > 0 ?
+	low_index = i - 1;
-		(wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
+	if (low_index >= 0) {
-	high = i < n ?
+		low_index = array_index_nospec(low_index, n);
-		(wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
+		low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
+	} else {
+		low = S32_MIN;
+	}
+	if (i < n) {
+		i = array_index_nospec(i, n);
+		high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
+	} else {
+		high = S32_MAX;
+	}
 	return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
 }

net/wireless/reg.c+5−3

 {
 	struct wiphy *wiphy = NULL;
 	enum reg_request_treatment treatment;
+	enum nl80211_reg_initiator initiator = reg_request->initiator;
 	if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
 		wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
-	switch (reg_request->initiator) {
+	switch (initiator) {
 	case NL80211_REGDOM_SET_BY_CORE:
 		treatment = reg_process_hint_core(reg_request);
 		break;
 		treatment = reg_process_hint_country_ie(wiphy, reg_request);
 		break;
 	default:
-		WARN(1, "invalid initiator %d\n", reg_request->initiator);
+		WARN(1, "invalid initiator %d\n", initiator);
 		goto out_free;
 	}
 	 */
 	if (treatment == REG_REQ_ALREADY_SET && wiphy &&
 	    wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
-		wiphy_update_regulatory(wiphy, reg_request->initiator);
+		wiphy_update_regulatory(wiphy, initiator);
 		wiphy_all_share_dfs_chan_state(wiphy);
 		reg_check_channels();
 	}
 	request->alpha2[0] = alpha2[0];
 	request->alpha2[1] = alpha2[1];
 	request->initiator = NL80211_REGDOM_SET_BY_CORE;
+	request->wiphy_idx = WIPHY_IDX_INVALID;
 	queue_regulatory_request(request);

net/wireless/scan.c+49−9

 	return NULL;
 }
+/*
+ * Update RX channel information based on the available frame payload
+ * information. This is mainly for the 2.4 GHz band where frames can be received
+ * from neighboring channels and the Beacon frames use the DSSS Parameter Set
+ * element to indicate the current (transmitting) channel, but this might also
+ * be needed on other bands if RX frequency does not match with the actual
+ * operating channel of a BSS.
+ */
 static struct ieee80211_channel *
 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
-			 struct ieee80211_channel *channel)
+			 struct ieee80211_channel *channel,
+			 enum nl80211_bss_scan_width scan_width)
 {
 	const u8 *tmp;
 	u32 freq;
 	int channel_number = -1;
+	struct ieee80211_channel *alt_channel;
 	tmp = cfg80211_find_ie(WLAN_EID_DS_PARAMS, ie, ielen);
 	if (tmp && tmp[1] == 1) {
 		}
 	}
-	if (channel_number < 0)
+	if (channel_number < 0) {
+		/* No channel information in frame payload */
 		return channel;
+	}
 	freq = ieee80211_channel_to_frequency(channel_number, channel->band);
-	channel = ieee80211_get_channel(wiphy, freq);
+	alt_channel = ieee80211_get_channel(wiphy, freq);
-	if (!channel)
+	if (!alt_channel) {
-		return NULL;
+		if (channel->band == NL80211_BAND_2GHZ) {
-	if (channel->flags & IEEE80211_CHAN_DISABLED)
+			/*
+			 * Better not allow unexpected channels when that could
+			 * be going beyond the 1-11 range (e.g., discovering
+			 * BSS on channel 12 when radio is configured for
+			 * channel 11.
+			 */
+			return NULL;
+		}
+		/* No match for the payload channel number - ignore it */
+		return channel;
+	}
+	if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
+	    scan_width == NL80211_BSS_CHAN_WIDTH_5) {
+		/*
+		 * Ignore channel number in 5 and 10 MHz channels where there
+		 * may not be an n:1 or 1:n mapping between frequencies and
+		 * channel numbers.
+		 */
+		return channel;
+	}
+	/*
+	 * Use the channel determined through the payload channel number
+	 * instead of the RX channel reported by the driver.
+	 */
+	if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
 		return NULL;
-	return channel;
+	return alt_channel;
 }
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 		    (data->signal < 0 || data->signal > 100)))
 		return NULL;
-	channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan);
+	channel = cfg80211_get_bss_channel(wiphy, ie, ielen, data->chan,
+					   data->scan_width);
 	if (!channel)
 		return NULL;
 		return NULL;
 	channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
-					   ielen, data->chan);
+					   ielen, data->chan, data->scan_width);
 	if (!channel)
 		return NULL;

net/wireless/wext-compat.c+10−4

 	if (err)
 		return err;
-	if (!(sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)))
+	if (!(sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE))) {
-		return -EOPNOTSUPP;
+		err = -EOPNOTSUPP;
+		goto free;
+	}
 	rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
-	return 0;
+free:
+	cfg80211_sinfo_release_content(&sinfo);
+	return err;
 }
 /* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 	/* we are under RTNL - globally locked - so can use static structs */
 	static struct iw_statistics wstats;
-	static struct station_info sinfo;
+	static struct station_info sinfo = {};
 	u8 bssid[ETH_ALEN];
 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)
 	if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED))
 		wstats.discard.retries = sinfo.tx_failed;
+	cfg80211_sinfo_release_content(&sinfo);
 	return &wstats;
 }

net/xfrm/xfrm_input.c+1−0

@@ -458,6 +458,7 @@ resume: · 457 unmodified lines
458	XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);	458	XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
459	goto drop;	459	goto drop;
460	}	460	}
		461	crypto_done = false;
461	} while (!err);	462	} while (!err);
462		463
463	err = xfrm_rcv_cb(skb, family, x->type->proto, 0);	464	err = xfrm_rcv_cb(skb, family, x->type->proto, 0);

net/xfrm/xfrm_output.c+4−0

 		spin_unlock_bh(&x->lock);
 		skb_dst_force(skb);
+		if (!skb_dst(skb)) {
+			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
+			goto error_nolock;
+		}
 		if (xfrm_offload(skb)) {
 			x->type_offload->encap(x, skb);

net/xfrm/xfrm_policy.c+4−0

 	}
 	skb_dst_force(skb);
+	if (!skb_dst(skb)) {
+		XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
+		return 0;
+	}
 	dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, XFRM_LOOKUP_QUEUE);
 	if (IS_ERR(dst)) {

net/xfrm/xfrm_user.c+15−0

 	err = -EINVAL;
 	switch (p->family) {
 	case AF_INET:
+		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+			goto out;
 		break;
 	case AF_INET6:
 #if IS_ENABLED(CONFIG_IPV6)
+		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+			goto out;
 		break;
 #else
 		err = -EAFNOSUPPORT;
 	switch (p->sel.family) {
 	case AF_INET:
+		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+			return -EINVAL;
 		break;
 	case AF_INET6:
 #if IS_ENABLED(CONFIG_IPV6)
+		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+			return -EINVAL;
 		break;
 #else
 		return  -EAFNOSUPPORT;
 		    (ut[i].family != prev_family))
 			return -EINVAL;
+		if (ut[i].mode >= XFRM_MODE_MAX)
+			return -EINVAL;
 		prev_family = ut[i].family;
 		switch (ut[i].family) {

sound/hda/hdac_i915.c+3−1

 	if (!acomp->ops) {
 		request_module("i915");
 		/* 10s timeout */
-		wait_for_completion_timeout(&bind_complete, 10 * 1000);
+		wait_for_completion_timeout(&bind_complete,
+					    msecs_to_jiffies(10 * 1000));
 	}
 	if (!acomp->ops) {
+		dev_info(bus->dev, "couldn't bind with audio component\n");
 		snd_hdac_acomp_exit(bus);
 		return -ENODEV;
 	}

sound/pci/hda/patch_realtek.c+1−0

@@ -6409,6 +6409,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { · 6408 unmodified lines
6409	SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),	6409	SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
6410	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),	6410	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
6411	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),	6411	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
		6412	SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
6412	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),	6413	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
6413	SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),	6414	SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
6414	SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),	6415	SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),

tools/hv/hv_fcopy_daemon.c+1−0

@@ -234,6 +234,7 @@ int main(int argc, char *argv[]) · 233 unmodified lines
234	break;	234	break;
235		235
236	default:	236	default:
		237	error = HV_E_FAIL;
237	syslog(LOG_ERR, "Unknown operation: %d",	238	syslog(LOG_ERR, "Unknown operation: %d",
238	buffer.hdr.operation);	239	buffer.hdr.operation);
239		240

tools/kvm/kvm_stat/kvm_stat+1−1

@@ -1325,7 +1325,7 @@ class Tui(object): · 1324 unmodified lines
1325	msg = ''	1325	msg = ''
1326	while True:	1326	while True:
1327	self.screen.erase()	1327	self.screen.erase()
1328	self.screen.addstr(0, 0, 'Set update interval (defaults to %fs).' %	1328	self.screen.addstr(0, 0, 'Set update interval (defaults to %.1fs).' %
1329	DELAY_DEFAULT, curses.A_BOLD)	1329	DELAY_DEFAULT, curses.A_BOLD)
1330	self.screen.addstr(4, 0, msg)	1330	self.screen.addstr(4, 0, msg)
1331	self.screen.addstr(2, 0, 'Change delay from %.1fs to ' %	1331	self.screen.addstr(2, 0, 'Change delay from %.1fs to ' %

tools/testing/selftests/rseq/param_test.c+10−9

 			printf(fmt, ## __VA_ARGS__);	\
 	} while (0)
-#if defined(__x86_64__) || defined(__i386__)
+#ifdef __i386__
 #define INJECT_ASM_REG	"eax"
 #define RSEQ_INJECT_CLOBBER \
 	, INJECT_ASM_REG
-#ifdef __i386__
 #define RSEQ_INJECT_ASM(n) \
 	"mov asm_loop_cnt_" #n ", %%" INJECT_ASM_REG "\n\t" \
 	"test %%" INJECT_ASM_REG ",%%" INJECT_ASM_REG "\n\t" \
 #elif defined(__x86_64__)
+#define INJECT_ASM_REG_P	"rax"
+#define INJECT_ASM_REG		"eax"
+#define RSEQ_INJECT_CLOBBER \
+	, INJECT_ASM_REG_P \
+	, INJECT_ASM_REG
 #define RSEQ_INJECT_ASM(n) \
-	"lea asm_loop_cnt_" #n "(%%rip), %%" INJECT_ASM_REG "\n\t" \
+	"lea asm_loop_cnt_" #n "(%%rip), %%" INJECT_ASM_REG_P "\n\t" \
-	"mov (%%" INJECT_ASM_REG "), %%" INJECT_ASM_REG "\n\t" \
+	"mov (%%" INJECT_ASM_REG_P "), %%" INJECT_ASM_REG "\n\t" \
 	"test %%" INJECT_ASM_REG ",%%" INJECT_ASM_REG "\n\t" \
 	"jz 333f\n\t" \
 	"222:\n\t" \
 	"jnz 222b\n\t" \
 	"333:\n\t"
-#else
-#error "Unsupported architecture"
-#endif
 #elif defined(__s390__)
 #define RSEQ_INJECT_INPUT \

tools/testing/selftests/x86/test_vdso.c+172−0

@@ -17,6 +17,7 @@ · 16 unmodified lines
17	#include <errno.h>	17	#include <errno.h>
18	#include <sched.h>	18	#include <sched.h>
19	#include <stdbool.h>	19	#include <stdbool.h>
		20	#include <limits.h>
20		21
21	#ifndef SYS_getcpu	22	#ifndef SYS_getcpu
22	# ifdef __x86_64__	23	# ifdef __x86_64__
@@ -31,6 +32,14 @@ · 8 unmodified lines
31		32
32	int nerrs = 0;	33	int nerrs = 0;
33		34
		35	typedef int (vgettime_t)(clockid_t, struct timespec );
		36
		37	vgettime_t vdso_clock_gettime;
		38
		39	typedef long (vgtod_t)(struct timeval tv, struct timezone *tz);
		40
		41	vgtod_t vdso_gettimeofday;
		42
34	typedef long (getcpu_t)(unsigned , unsigned , void );	43	typedef long (getcpu_t)(unsigned , unsigned , void );
35		44
36	getcpu_t vgetcpu;	45	getcpu_t vgetcpu;
@@ -95,6 +104,15 @@ static void fill_function_pointers() · 58 unmodified lines
95	printf("Warning: failed to find getcpu in vDSO\n");	104	printf("Warning: failed to find getcpu in vDSO\n");
96		105
97	vgetcpu = (getcpu_t) vsyscall_getcpu();	106	vgetcpu = (getcpu_t) vsyscall_getcpu();
		107
		108	vdso_clock_gettime = (vgettime_t)dlsym(vdso, "__vdso_clock_gettime");
		109	if (!vdso_clock_gettime)
		110	printf("Warning: failed to find clock_gettime in vDSO\n");
		111
		112	vdso_gettimeofday = (vgtod_t)dlsym(vdso, "__vdso_gettimeofday");
		113	if (!vdso_gettimeofday)
		114	printf("Warning: failed to find gettimeofday in vDSO\n");
		115
98	}	116	}
99		117
100	static long sys_getcpu(unsigned * cpu, unsigned * node,	118	static long sys_getcpu(unsigned * cpu, unsigned * node,
@@ -103,6 +121,16 @@ static long sys_getcpu(unsigned * cpu, unsigned * node, · 2 unmodified lines
103	return syscall(__NR_getcpu, cpu, node, cache);	121	return syscall(__NR_getcpu, cpu, node, cache);
104	}	122	}
105		123
		124	static inline int sys_clock_gettime(clockid_t id, struct timespec *ts)
		125	{
		126	return syscall(__NR_clock_gettime, id, ts);
		127	}
		128
		129	static inline int sys_gettimeofday(struct timeval tv, struct timezone tz)
		130	{
		131	return syscall(__NR_gettimeofday, tv, tz);
		132	}
		133
106	static void test_getcpu(void)	134	static void test_getcpu(void)
107	{	135	{
108	printf("[RUN]\tTesting getcpu...\n");	136	printf("[RUN]\tTesting getcpu...\n");
@@ -155,10 +183,154 @@ static void test_getcpu(void) · 46 unmodified lines
155	}	183	}
156	}	184	}
157		185
		186	static bool ts_leq(const struct timespec a, const struct timespec b)
		187	{
		188	if (a->tv_sec != b->tv_sec)
		189	return a->tv_sec < b->tv_sec;
		190	else
		191	return a->tv_nsec <= b->tv_nsec;
		192	}
		193
		194	static bool tv_leq(const struct timeval a, const struct timeval b)
		195	{
		196	if (a->tv_sec != b->tv_sec)
		197	return a->tv_sec < b->tv_sec;
		198	else
		199	return a->tv_usec <= b->tv_usec;
		200	}
		201
		202	static char const * const clocknames[] = {
		203	[0] = "CLOCK_REALTIME",
		204	[1] = "CLOCK_MONOTONIC",
		205	[2] = "CLOCK_PROCESS_CPUTIME_ID",
		206	[3] = "CLOCK_THREAD_CPUTIME_ID",
		207	[4] = "CLOCK_MONOTONIC_RAW",
		208	[5] = "CLOCK_REALTIME_COARSE",
		209	[6] = "CLOCK_MONOTONIC_COARSE",
		210	[7] = "CLOCK_BOOTTIME",
		211	[8] = "CLOCK_REALTIME_ALARM",
		212	[9] = "CLOCK_BOOTTIME_ALARM",
		213	[10] = "CLOCK_SGI_CYCLE",
		214	[11] = "CLOCK_TAI",
		215	};
		216
		217	static void test_one_clock_gettime(int clock, const char *name)
		218	{
		219	struct timespec start, vdso, end;
		220	int vdso_ret, end_ret;
		221
		222	printf("[RUN]\tTesting clock_gettime for clock %s (%d)...\n", name, clock);
		223
		224	if (sys_clock_gettime(clock, &start) < 0) {
		225	if (errno == EINVAL) {
		226	vdso_ret = vdso_clock_gettime(clock, &vdso);
		227	if (vdso_ret == -EINVAL) {
		228	printf("[OK]\tNo such clock.\n");
		229	} else {
		230	printf("[FAIL]\tNo such clock, but __vdso_clock_gettime returned %d\n", vdso_ret);
		231	nerrs++;
		232	}
		233	} else {
		234	printf("[WARN]\t clock_gettime(%d) syscall returned error %d\n", clock, errno);
		235	}
		236	return;
		237	}
		238
		239	vdso_ret = vdso_clock_gettime(clock, &vdso);
		240	end_ret = sys_clock_gettime(clock, &end);
		241
		242	if (vdso_ret != 0 \|\| end_ret != 0) {
		243	printf("[FAIL]\tvDSO returned %d, syscall errno=%d\n",
		244	vdso_ret, errno);
		245	nerrs++;
		246	return;
		247	}
		248
		249	printf("\t%llu.%09ld %llu.%09ld %llu.%09ld\n",
		250	(unsigned long long)start.tv_sec, start.tv_nsec,
		251	(unsigned long long)vdso.tv_sec, vdso.tv_nsec,
		252	(unsigned long long)end.tv_sec, end.tv_nsec);
		253
		254	if (!ts_leq(&start, &vdso) \|\| !ts_leq(&vdso, &end)) {
		255	printf("[FAIL]\tTimes are out of sequence\n");
		256	nerrs++;
		257	}
		258	}
		259
		260	static void test_clock_gettime(void)
		261	{
		262	for (int clock = 0; clock < sizeof(clocknames) / sizeof(clocknames[0]);
		263	clock++) {
		264	test_one_clock_gettime(clock, clocknames[clock]);
		265	}
		266
		267	/* Also test some invalid clock ids */
		268	test_one_clock_gettime(-1, "invalid");
		269	test_one_clock_gettime(INT_MIN, "invalid");
		270	test_one_clock_gettime(INT_MAX, "invalid");
		271	}
		272
		273	static void test_gettimeofday(void)
		274	{
		275	struct timeval start, vdso, end;
		276	struct timezone sys_tz, vdso_tz;
		277	int vdso_ret, end_ret;
		278
		279	if (!vdso_gettimeofday)
		280	return;
		281
		282	printf("[RUN]\tTesting gettimeofday...\n");
		283
		284	if (sys_gettimeofday(&start, &sys_tz) < 0) {
		285	printf("[FAIL]\tsys_gettimeofday failed (%d)\n", errno);
		286	nerrs++;
		287	return;
		288	}
		289
		290	vdso_ret = vdso_gettimeofday(&vdso, &vdso_tz);
		291	end_ret = sys_gettimeofday(&end, NULL);
		292
		293	if (vdso_ret != 0 \|\| end_ret != 0) {
		294	printf("[FAIL]\tvDSO returned %d, syscall errno=%d\n",
		295	vdso_ret, errno);
		296	nerrs++;
		297	return;
		298	}
		299
		300	printf("\t%llu.%06ld %llu.%06ld %llu.%06ld\n",
		301	(unsigned long long)start.tv_sec, start.tv_usec,
		302	(unsigned long long)vdso.tv_sec, vdso.tv_usec,
		303	(unsigned long long)end.tv_sec, end.tv_usec);
		304
		305	if (!tv_leq(&start, &vdso) \|\| !tv_leq(&vdso, &end)) {
		306	printf("[FAIL]\tTimes are out of sequence\n");
		307	nerrs++;
		308	}
		309
		310	if (sys_tz.tz_minuteswest == vdso_tz.tz_minuteswest &&
		311	sys_tz.tz_dsttime == vdso_tz.tz_dsttime) {
		312	printf("[OK]\ttimezones match: minuteswest=%d, dsttime=%d\n",
		313	sys_tz.tz_minuteswest, sys_tz.tz_dsttime);
		314	} else {
		315	printf("[FAIL]\ttimezones do not match\n");
		316	nerrs++;
		317	}
		318
		319	/* And make sure that passing NULL for tz doesn't crash. */
		320	vdso_gettimeofday(&vdso, NULL);
		321	}
		322
158	int main(int argc, char **argv)	323	int main(int argc, char **argv)
159	{	324	{
160	fill_function_pointers();	325	fill_function_pointers();
161		326
		327	test_clock_gettime();
		328	test_gettimeofday();
		329
		330	/*
		331	* Test getcpu() last so that, if something goes wrong setting affinity,
		332	* we still run the other tests.
		333	*/
162	test_getcpu();	334	test_getcpu();
163		335
164	return nerrs ? 1 : 0;	336	return nerrs ? 1 : 0;