Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0194-5.4.95-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0194-5.4.95-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (18 months, 1 week ago) by niro
    File size: 59944 byte(s) 
    -sync kernel patches
    1 diff --git a/Documentation/virt/kvm/api.txt b/Documentation/virt/kvm/api.txt
    2 index a18e996fa54b0..7064efd3b5ea3 100644
    3 --- a/Documentation/virt/kvm/api.txt
    4 +++ b/Documentation/virt/kvm/api.txt
    5 @@ -1132,6 +1132,9 @@ field userspace_addr, which must point at user addressable memory for
    6 the entire memory slot size. Any object may back this memory, including
    7 anonymous memory, ordinary files, and hugetlbfs.
    8
    9 +On architectures that support a form of address tagging, userspace_addr must
    10 +be an untagged address.
    11 +
    12 It is recommended that the lower 21 bits of guest_phys_addr and userspace_addr
    13 be identical. This allows large pages in the guest to be backed by large
    14 pages in the host.
    15 diff --git a/Makefile b/Makefile
    16 index ad1b8dc6e462a..aa3c2e834442e 100644
    17 --- a/Makefile
    18 +++ b/Makefile
    19 @@ -1,7 +1,7 @@
    20 # SPDX-License-Identifier: GPL-2.0
    21 VERSION = 5
    22 PATCHLEVEL = 4
    23 -SUBLEVEL = 94
    24 +SUBLEVEL = 95
    25 EXTRAVERSION =
    26 NAME = Kleptomaniac Octopus
    27
    28 diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
    29 index 1a9a9d98f2848..14d6fec50dee2 100644
    30 --- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
    31 +++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
    32 @@ -273,7 +273,7 @@
    33
    34 /* VDD_AUD_1P8: Audio codec */
    35 reg_aud_1p8v: ldo3 {
    36 - regulator-name = "vdd1p8";
    37 + regulator-name = "vdd1p8a";
    38 regulator-min-microvolt = <1800000>;
    39 regulator-max-microvolt = <1800000>;
    40 regulator-boot-on;
    41 diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
    42 index 6acc8591219a7..eea317b41020d 100644
    43 --- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
    44 +++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
    45 @@ -167,7 +167,7 @@
    46 i2c-gpio,delay-us = <2>; /* ~100 kHz */
    47 #address-cells = <1>;
    48 #size-cells = <0>;
    49 - status = "disabld";
    50 + status = "disabled";
    51 };
    52
    53 i2c_cam: i2c-gpio-cam {
    54 @@ -179,7 +179,7 @@
    55 i2c-gpio,delay-us = <2>; /* ~100 kHz */
    56 #address-cells = <1>;
    57 #size-cells = <0>;
    58 - status = "disabld";
    59 + status = "disabled";
    60 };
    61 };
    62
    63 diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
    64 index 1eabf2d2834be..e06f946b75b96 100644
    65 --- a/arch/arm/mach-imx/suspend-imx6.S
    66 +++ b/arch/arm/mach-imx/suspend-imx6.S
    67 @@ -67,6 +67,7 @@
    68 #define MX6Q_CCM_CCR 0x0
    69
    70 .align 3
    71 + .arm
    72
    73 .macro sync_l2_cache
    74
    75 diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
    76 index aef8f2b00778d..5401a646c8406 100644
    77 --- a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
    78 +++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
    79 @@ -4,11 +4,16 @@
    80 */
    81 usb {
    82 compatible = "simple-bus";
    83 - dma-ranges;
    84 #address-cells = <2>;
    85 #size-cells = <2>;
    86 ranges = <0x0 0x0 0x0 0x68500000 0x0 0x00400000>;
    87
    88 + /*
    89 + * Internally, USB bus to the interconnect can only address up
    90 + * to 40-bit
    91 + */
    92 + dma-ranges = <0 0 0 0 0x100 0x0>;
    93 +
    94 usbphy0: usb-phy@0 {
    95 compatible = "brcm,sr-usb-combo-phy";
    96 reg = <0x0 0x00000000 0x0 0x100>;
    97 diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
    98 index 795d6ca4bbd1f..bd99fa68b7630 100644
    99 --- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
    100 +++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
    101 @@ -103,7 +103,7 @@
    102 reboot {
    103 compatible ="syscon-reboot";
    104 regmap = <&rst>;
    105 - offset = <0xb0>;
    106 + offset = <0>;
    107 mask = <0x02>;
    108 };
    109
    110 diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
    111 index 08e1e7544f823..e32e8bcf94553 100644
    112 --- a/arch/x86/kvm/vmx/nested.c
    113 +++ b/arch/x86/kvm/vmx/nested.c
    114 @@ -5579,11 +5579,14 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
    115 if (is_guest_mode(vcpu)) {
    116 sync_vmcs02_to_vmcs12(vcpu, vmcs12);
    117 sync_vmcs02_to_vmcs12_rare(vcpu, vmcs12);
    118 - } else if (!vmx->nested.need_vmcs12_to_shadow_sync) {
    119 - if (vmx->nested.hv_evmcs)
    120 - copy_enlightened_to_vmcs12(vmx);
    121 - else if (enable_shadow_vmcs)
    122 - copy_shadow_to_vmcs12(vmx);
    123 + } else {
    124 + copy_vmcs02_to_vmcs12_rare(vcpu, get_vmcs12(vcpu));
    125 + if (!vmx->nested.need_vmcs12_to_shadow_sync) {
    126 + if (vmx->nested.hv_evmcs)
    127 + copy_enlightened_to_vmcs12(vmx);
    128 + else if (enable_shadow_vmcs)
    129 + copy_shadow_to_vmcs12(vmx);
    130 + }
    131 }
    132
    133 BUILD_BUG_ON(sizeof(user_vmx_nested_state->vmcs12) < VMCS12_SIZE);
    134 diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
    135 index f8998a7bc7d56..181e352d38de4 100644
    136 --- a/arch/x86/kvm/vmx/pmu_intel.c
    137 +++ b/arch/x86/kvm/vmx/pmu_intel.c
    138 @@ -26,7 +26,7 @@ static struct kvm_event_hw_type_mapping intel_arch_events[] = {
    139 [4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES },
    140 [5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
    141 [6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
    142 - [7] = { 0x00, 0x30, PERF_COUNT_HW_REF_CPU_CYCLES },
    143 + [7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES },
    144 };
    145
    146 /* mapping between fixed pmc index and intel_arch_events array */
    147 @@ -296,7 +296,9 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
    148
    149 pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters,
    150 x86_pmu.num_counters_gp);
    151 + eax.split.bit_width = min_t(int, eax.split.bit_width, x86_pmu.bit_width_gp);
    152 pmu->counter_bitmask[KVM_PMC_GP] = ((u64)1 << eax.split.bit_width) - 1;
    153 + eax.split.mask_length = min_t(int, eax.split.mask_length, x86_pmu.events_mask_len);
    154 pmu->available_event_types = ~entry->ebx &
    155 ((1ull << eax.split.mask_length) - 1);
    156
    157 @@ -306,6 +308,8 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
    158 pmu->nr_arch_fixed_counters =
    159 min_t(int, edx.split.num_counters_fixed,
    160 x86_pmu.num_counters_fixed);
    161 + edx.split.bit_width_fixed = min_t(int,
    162 + edx.split.bit_width_fixed, x86_pmu.bit_width_fixed);
    163 pmu->counter_bitmask[KVM_PMC_FIXED] =
    164 ((u64)1 << edx.split.bit_width_fixed) - 1;
    165 }
    166 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    167 index 72990c3c6faf7..73095d7213993 100644
    168 --- a/arch/x86/kvm/x86.c
    169 +++ b/arch/x86/kvm/x86.c
    170 @@ -102,6 +102,7 @@ static u64 __read_mostly cr4_reserved_bits = CR4_RESERVED_BITS;
    171
    172 static void update_cr8_intercept(struct kvm_vcpu *vcpu);
    173 static void process_nmi(struct kvm_vcpu *vcpu);
    174 +static void process_smi(struct kvm_vcpu *vcpu);
    175 static void enter_smm(struct kvm_vcpu *vcpu);
    176 static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
    177 static void store_regs(struct kvm_vcpu *vcpu);
    178 @@ -3772,6 +3773,10 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
    179 {
    180 process_nmi(vcpu);
    181
    182 +
    183 + if (kvm_check_request(KVM_REQ_SMI, vcpu))
    184 + process_smi(vcpu);
    185 +
    186 /*
    187 * The API doesn't provide the instruction length for software
    188 * exceptions, so don't report them. As long as the guest RIP
    189 diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
    190 index 96869f1538b93..bfca116482b8b 100644
    191 --- a/drivers/acpi/device_sysfs.c
    192 +++ b/drivers/acpi/device_sysfs.c
    193 @@ -251,20 +251,12 @@ int __acpi_device_uevent_modalias(struct acpi_device *adev,
    194 if (add_uevent_var(env, "MODALIAS="))
    195 return -ENOMEM;
    196
    197 - len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
    198 - sizeof(env->buf) - env->buflen);
    199 - if (len < 0)
    200 - return len;
    201 -
    202 - env->buflen += len;
    203 - if (!adev->data.of_compatible)
    204 - return 0;
    205 -
    206 - if (len > 0 && add_uevent_var(env, "MODALIAS="))
    207 - return -ENOMEM;
    208 -
    209 - len = create_of_modalias(adev, &env->buf[env->buflen - 1],
    210 - sizeof(env->buf) - env->buflen);
    211 + if (adev->data.of_compatible)
    212 + len = create_of_modalias(adev, &env->buf[env->buflen - 1],
    213 + sizeof(env->buf) - env->buflen);
    214 + else
    215 + len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
    216 + sizeof(env->buf) - env->buflen);
    217 if (len < 0)
    218 return len;
    219
    220 diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
    221 index a3037fe54c3ab..f068bb5d650eb 100644
    222 --- a/drivers/block/nbd.c
    223 +++ b/drivers/block/nbd.c
    224 @@ -1014,6 +1014,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
    225 if (!sock)
    226 return err;
    227
    228 + /*
    229 + * We need to make sure we don't get any errant requests while we're
    230 + * reallocating the ->socks array.
    231 + */
    232 + blk_mq_freeze_queue(nbd->disk->queue);
    233 +
    234 if (!netlink && !nbd->task_setup &&
    235 !test_bit(NBD_RT_BOUND, &config->runtime_flags))
    236 nbd->task_setup = current;
    237 @@ -1052,10 +1058,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
    238 nsock->cookie = 0;
    239 socks[config->num_connections++] = nsock;
    240 atomic_inc(&config->live_connections);
    241 + blk_mq_unfreeze_queue(nbd->disk->queue);
    242
    243 return 0;
    244
    245 put_socket:
    246 + blk_mq_unfreeze_queue(nbd->disk->queue);
    247 sockfd_put(sock);
    248 return err;
    249 }
    250 diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
    251 index ab5482202cfb3..def41e1bd7364 100644
    252 --- a/drivers/block/xen-blkfront.c
    253 +++ b/drivers/block/xen-blkfront.c
    254 @@ -936,7 +936,8 @@ static void blkif_set_queue_limits(struct blkfront_info *info)
    255 if (info->feature_discard) {
    256 blk_queue_flag_set(QUEUE_FLAG_DISCARD, rq);
    257 blk_queue_max_discard_sectors(rq, get_capacity(gd));
    258 - rq->limits.discard_granularity = info->discard_granularity;
    259 + rq->limits.discard_granularity = info->discard_granularity ?:
    260 + info->physical_sector_size;
    261 rq->limits.discard_alignment = info->discard_alignment;
    262 if (info->feature_secdiscard)
    263 blk_queue_flag_set(QUEUE_FLAG_SECERASE, rq);
    264 @@ -2169,19 +2170,12 @@ static void blkfront_closing(struct blkfront_info *info)
    265
    266 static void blkfront_setup_discard(struct blkfront_info *info)
    267 {
    268 - int err;
    269 - unsigned int discard_granularity;
    270 - unsigned int discard_alignment;
    271 -
    272 info->feature_discard = 1;
    273 - err = xenbus_gather(XBT_NIL, info->xbdev->otherend,
    274 - "discard-granularity", "%u", &discard_granularity,
    275 - "discard-alignment", "%u", &discard_alignment,
    276 - NULL);
    277 - if (!err) {
    278 - info->discard_granularity = discard_granularity;
    279 - info->discard_alignment = discard_alignment;
    280 - }
    281 + info->discard_granularity = xenbus_read_unsigned(info->xbdev->otherend,
    282 + "discard-granularity",
    283 + 0);
    284 + info->discard_alignment = xenbus_read_unsigned(info->xbdev->otherend,
    285 + "discard-alignment", 0);
    286 info->feature_secdiscard =
    287 !!xenbus_read_unsigned(info->xbdev->otherend, "discard-secure",
    288 0);
    289 diff --git a/drivers/firmware/imx/Kconfig b/drivers/firmware/imx/Kconfig
    290 index 0dbee32da4c6d..5d995fe64b5ca 100644
    291 --- a/drivers/firmware/imx/Kconfig
    292 +++ b/drivers/firmware/imx/Kconfig
    293 @@ -13,6 +13,7 @@ config IMX_DSP
    294 config IMX_SCU
    295 bool "IMX SCU Protocol driver"
    296 depends on IMX_MBOX
    297 + select SOC_BUS
    298 help
    299 The System Controller Firmware (SCFW) is a low-level system function
    300 which runs on a dedicated Cortex-M core to provide power, clock, and
    301 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
    302 index 126a0eb6e0542..00335a1c02b0e 100644
    303 --- a/drivers/gpu/drm/i915/i915_drv.h
    304 +++ b/drivers/gpu/drm/i915/i915_drv.h
    305 @@ -1894,7 +1894,7 @@ intel_subplatform(const struct intel_runtime_info *info, enum intel_platform p)
    306 {
    307 const unsigned int pi = __platform_mask_index(info, p);
    308
    309 - return info->platform_mask[pi] & INTEL_SUBPLATFORM_BITS;
    310 + return info->platform_mask[pi] & ((1 << INTEL_SUBPLATFORM_BITS) - 1);
    311 }
    312
    313 static __always_inline bool
    314 diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
    315 index 0be4668c780bf..8556804e96efd 100644
    316 --- a/drivers/gpu/drm/nouveau/nouveau_svm.c
    317 +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
    318 @@ -306,6 +306,10 @@ nouveau_svmm_init(struct drm_device *dev, void *data,
    319 struct drm_nouveau_svm_init *args = data;
    320 int ret;
    321
    322 + /* We need to fail if svm is disabled */
    323 + if (!cli->drm->svm)
    324 + return -ENOSYS;
    325 +
    326 /* Allocate tracking for SVM-enabled VMM. */
    327 if (!(svmm = kzalloc(sizeof(*svmm), GFP_KERNEL)))
    328 return -ENOMEM;
    329 diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
    330 index 89ac2f9ae6dd8..e7472f0da59d2 100644
    331 --- a/drivers/infiniband/hw/cxgb4/qp.c
    332 +++ b/drivers/infiniband/hw/cxgb4/qp.c
    333 @@ -2471,7 +2471,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
    334 init_attr->cap.max_send_wr = qhp->attr.sq_num_entries;
    335 init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries;
    336 init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
    337 - init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges;
    338 + init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges;
    339 init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE;
    340 init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0;
    341 return 0;
    342 diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
    343 index 30ac0ba55864e..1b9795743276d 100644
    344 --- a/drivers/iommu/dmar.c
    345 +++ b/drivers/iommu/dmar.c
    346 @@ -1020,8 +1020,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
    347 {
    348 struct intel_iommu *iommu;
    349 u32 ver, sts;
    350 - int agaw = 0;
    351 - int msagaw = 0;
    352 + int agaw = -1;
    353 + int msagaw = -1;
    354 int err;
    355
    356 if (!drhd->reg_base_addr) {
    357 @@ -1046,17 +1046,28 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
    358 }
    359
    360 err = -EINVAL;
    361 - agaw = iommu_calculate_agaw(iommu);
    362 - if (agaw < 0) {
    363 - pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n",
    364 - iommu->seq_id);
    365 - goto err_unmap;
    366 + if (cap_sagaw(iommu->cap) == 0) {
    367 + pr_info("%s: No supported address widths. Not attempting DMA translation.\n",
    368 + iommu->name);
    369 + drhd->ignored = 1;
    370 }
    371 - msagaw = iommu_calculate_max_sagaw(iommu);
    372 - if (msagaw < 0) {
    373 - pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n",
    374 - iommu->seq_id);
    375 - goto err_unmap;
    376 +
    377 + if (!drhd->ignored) {
    378 + agaw = iommu_calculate_agaw(iommu);
    379 + if (agaw < 0) {
    380 + pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n",
    381 + iommu->seq_id);
    382 + drhd->ignored = 1;
    383 + }
    384 + }
    385 + if (!drhd->ignored) {
    386 + msagaw = iommu_calculate_max_sagaw(iommu);
    387 + if (msagaw < 0) {
    388 + pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n",
    389 + iommu->seq_id);
    390 + drhd->ignored = 1;
    391 + agaw = -1;
    392 + }
    393 }
    394 iommu->agaw = agaw;
    395 iommu->msagaw = msagaw;
    396 @@ -1083,7 +1094,12 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
    397
    398 raw_spin_lock_init(&iommu->register_lock);
    399
    400 - if (intel_iommu_enabled) {
    401 + /*
    402 + * This is only for hotplug; at boot time intel_iommu_enabled won't
    403 + * be set yet. When intel_iommu_init() runs, it registers the units
    404 + * present at boot time, then sets intel_iommu_enabled.
    405 + */
    406 + if (intel_iommu_enabled && !drhd->ignored) {
    407 err = iommu_device_sysfs_add(&iommu->iommu, NULL,
    408 intel_iommu_groups,
    409 "%s", iommu->name);
    410 @@ -1098,6 +1114,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
    411 }
    412
    413 drhd->iommu = iommu;
    414 + iommu->drhd = drhd;
    415
    416 return 0;
    417
    418 @@ -1112,7 +1129,7 @@ error:
    419
    420 static void free_iommu(struct intel_iommu *iommu)
    421 {
    422 - if (intel_iommu_enabled) {
    423 + if (intel_iommu_enabled && !iommu->drhd->ignored) {
    424 iommu_device_unregister(&iommu->iommu);
    425 iommu_device_sysfs_remove(&iommu->iommu);
    426 }
    427 diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
    428 index 23963e5cb5d6a..0d59763e40de1 100644
    429 --- a/drivers/leds/led-triggers.c
    430 +++ b/drivers/leds/led-triggers.c
    431 @@ -318,14 +318,15 @@ void led_trigger_event(struct led_trigger *trig,
    432 enum led_brightness brightness)
    433 {
    434 struct led_classdev *led_cdev;
    435 + unsigned long flags;
    436
    437 if (!trig)
    438 return;
    439
    440 - read_lock(&trig->leddev_list_lock);
    441 + read_lock_irqsave(&trig->leddev_list_lock, flags);
    442 list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list)
    443 led_set_brightness(led_cdev, brightness);
    444 - read_unlock(&trig->leddev_list_lock);
    445 + read_unlock_irqrestore(&trig->leddev_list_lock, flags);
    446 }
    447 EXPORT_SYMBOL_GPL(led_trigger_event);
    448
    449 @@ -336,11 +337,12 @@ static void led_trigger_blink_setup(struct led_trigger *trig,
    450 int invert)
    451 {
    452 struct led_classdev *led_cdev;
    453 + unsigned long flags;
    454
    455 if (!trig)
    456 return;
    457
    458 - read_lock(&trig->leddev_list_lock);
    459 + read_lock_irqsave(&trig->leddev_list_lock, flags);
    460 list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list) {
    461 if (oneshot)
    462 led_blink_set_oneshot(led_cdev, delay_on, delay_off,
    463 @@ -348,7 +350,7 @@ static void led_trigger_blink_setup(struct led_trigger *trig,
    464 else
    465 led_blink_set(led_cdev, delay_on, delay_off);
    466 }
    467 - read_unlock(&trig->leddev_list_lock);
    468 + read_unlock_irqrestore(&trig->leddev_list_lock, flags);
    469 }
    470
    471 void led_trigger_blink(struct led_trigger *trig,
    472 diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
    473 index e84f9dccf448a..c4d7e06974d2c 100644
    474 --- a/drivers/media/rc/rc-main.c
    475 +++ b/drivers/media/rc/rc-main.c
    476 @@ -1892,6 +1892,8 @@ int rc_register_device(struct rc_dev *dev)
    477 goto out_raw;
    478 }
    479
    480 + dev->registered = true;
    481 +
    482 rc = device_add(&dev->dev);
    483 if (rc)
    484 goto out_rx_free;
    485 @@ -1901,8 +1903,6 @@ int rc_register_device(struct rc_dev *dev)
    486 dev->device_name ?: "Unspecified device", path ?: "N/A");
    487 kfree(path);
    488
    489 - dev->registered = true;
    490 -
    491 /*
    492 * once the the input device is registered in rc_setup_rx_device,
    493 * userspace can open the input device and rc_open() will be called
    494 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
    495 index 247aeacb3a440..2ae9feb99a07d 100644
    496 --- a/drivers/net/can/dev.c
    497 +++ b/drivers/net/can/dev.c
    498 @@ -1134,7 +1134,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
    499 {
    500 struct can_priv *priv = netdev_priv(dev);
    501 struct can_ctrlmode cm = {.flags = priv->ctrlmode};
    502 - struct can_berr_counter bec;
    503 + struct can_berr_counter bec = { };
    504 enum can_state state = priv->state;
    505
    506 if (priv->do_get_state)
    507 diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
    508 index c952212900fcf..c20dc689698ed 100644
    509 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
    510 +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
    511 @@ -3980,20 +3980,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
    512 goto error_param;
    513
    514 vf = &pf->vf[vf_id];
    515 - vsi = pf->vsi[vf->lan_vsi_idx];
    516
    517 /* When the VF is resetting wait until it is done.
    518 * It can take up to 200 milliseconds,
    519 * but wait for up to 300 milliseconds to be safe.
    520 - * If the VF is indeed in reset, the vsi pointer has
    521 - * to show on the newly loaded vsi under pf->vsi[id].
    522 + * Acquire the VSI pointer only after the VF has been
    523 + * properly initialized.
    524 */
    525 for (i = 0; i < 15; i++) {
    526 - if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
    527 - if (i > 0)
    528 - vsi = pf->vsi[vf->lan_vsi_idx];
    529 + if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states))
    530 break;
    531 - }
    532 msleep(20);
    533 }
    534 if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
    535 @@ -4002,6 +3998,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
    536 ret = -EAGAIN;
    537 goto error_param;
    538 }
    539 + vsi = pf->vsi[vf->lan_vsi_idx];
    540
    541 if (is_multicast_ether_addr(mac)) {
    542 dev_err(&pf->pdev->dev,
    543 diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
    544 index ac98f1d968921..0303eeb760505 100644
    545 --- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
    546 +++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
    547 @@ -1670,12 +1670,18 @@ static int igc_get_link_ksettings(struct net_device *netdev,
    548 cmd->base.phy_address = hw->phy.addr;
    549
    550 /* advertising link modes */
    551 - ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
    552 - ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
    553 - ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
    554 - ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
    555 - ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
    556 - ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full);
    557 + if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
    558 + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
    559 + if (hw->phy.autoneg_advertised & ADVERTISE_10_FULL)
    560 + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
    561 + if (hw->phy.autoneg_advertised & ADVERTISE_100_HALF)
    562 + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
    563 + if (hw->phy.autoneg_advertised & ADVERTISE_100_FULL)
    564 + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
    565 + if (hw->phy.autoneg_advertised & ADVERTISE_1000_FULL)
    566 + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
    567 + if (hw->phy.autoneg_advertised & ADVERTISE_2500_FULL)
    568 + ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full);
    569
    570 /* set autoneg settings */
    571 if (hw->mac.autoneg == 1) {
    572 @@ -1786,6 +1792,12 @@ static int igc_set_link_ksettings(struct net_device *netdev,
    573
    574 ethtool_convert_link_mode_to_legacy_u32(&advertising,
    575 cmd->link_modes.advertising);
    576 + /* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT.
    577 + * We have to check this and convert it to ADVERTISE_2500_FULL
    578 + * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly.
    579 + */
    580 + if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full))
    581 + advertising |= ADVERTISE_2500_FULL;
    582
    583 if (cmd->base.autoneg == AUTONEG_ENABLE) {
    584 hw->mac.autoneg = 1;
    585 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
    586 index ec117e4414250..6495c26d95969 100644
    587 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
    588 +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
    589 @@ -57,6 +57,7 @@
    590 #include "lib/devcom.h"
    591 #include "lib/geneve.h"
    592 #include "diag/en_tc_tracepoint.h"
    593 +#include <asm/div64.h>
    594
    595 struct mlx5_nic_flow_attr {
    596 u32 action;
    597 @@ -1837,8 +1838,8 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
    598 BIT(FLOW_DISSECTOR_KEY_ENC_IP) |
    599 BIT(FLOW_DISSECTOR_KEY_ENC_OPTS))) {
    600 NL_SET_ERR_MSG_MOD(extack, "Unsupported key");
    601 - netdev_warn(priv->netdev, "Unsupported key used: 0x%x\n",
    602 - dissector->used_keys);
    603 + netdev_dbg(priv->netdev, "Unsupported key used: 0x%x\n",
    604 + dissector->used_keys);
    605 return -EOPNOTSUPP;
    606 }
    607
    608 @@ -3943,13 +3944,13 @@ errout:
    609 return err;
    610 }
    611
    612 -static int apply_police_params(struct mlx5e_priv *priv, u32 rate,
    613 +static int apply_police_params(struct mlx5e_priv *priv, u64 rate,
    614 struct netlink_ext_ack *extack)
    615 {
    616 struct mlx5e_rep_priv *rpriv = priv->ppriv;
    617 struct mlx5_eswitch *esw;
    618 + u32 rate_mbps = 0;
    619 u16 vport_num;
    620 - u32 rate_mbps;
    621 int err;
    622
    623 vport_num = rpriv->rep->vport;
    624 @@ -3966,7 +3967,11 @@ static int apply_police_params(struct mlx5e_priv *priv, u32 rate,
    625 * Moreover, if rate is non zero we choose to configure to a minimum of
    626 * 1 mbit/sec.
    627 */
    628 - rate_mbps = rate ? max_t(u32, (rate * 8 + 500000) / 1000000, 1) : 0;
    629 + if (rate) {
    630 + rate = (rate * BITS_PER_BYTE) + 500000;
    631 + rate_mbps = max_t(u32, do_div(rate, 1000000), 1);
    632 + }
    633 +
    634 err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps);
    635 if (err)
    636 NL_SET_ERR_MSG_MOD(extack, "failed applying action to hardware");
    637 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    638 index 2eceb72f0f647..4944c40436f08 100644
    639 --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    640 +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    641 @@ -1068,6 +1068,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
    642 destroy_ft:
    643 root->cmds->destroy_flow_table(root, ft);
    644 free_ft:
    645 + rhltable_destroy(&ft->fgs_hash);
    646 kfree(ft);
    647 unlock_root:
    648 mutex_unlock(&root->chain_lock);
    649 diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
    650 index 606fee99221b8..0eb894b7c0bda 100644
    651 --- a/drivers/net/team/team.c
    652 +++ b/drivers/net/team/team.c
    653 @@ -991,7 +991,8 @@ static void __team_compute_features(struct team *team)
    654 unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
    655 IFF_XMIT_DST_RELEASE_PERM;
    656
    657 - list_for_each_entry(port, &team->port_list, list) {
    658 + rcu_read_lock();
    659 + list_for_each_entry_rcu(port, &team->port_list, list) {
    660 vlan_features = netdev_increment_features(vlan_features,
    661 port->dev->vlan_features,
    662 TEAM_VLAN_FEATURES);
    663 @@ -1005,6 +1006,7 @@ static void __team_compute_features(struct team *team)
    664 if (port->dev->hard_header_len > max_hard_header_len)
    665 max_hard_header_len = port->dev->hard_header_len;
    666 }
    667 + rcu_read_unlock();
    668
    669 team->dev->vlan_features = vlan_features;
    670 team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
    671 @@ -1020,9 +1022,7 @@ static void __team_compute_features(struct team *team)
    672
    673 static void team_compute_features(struct team *team)
    674 {
    675 - mutex_lock(&team->lock);
    676 __team_compute_features(team);
    677 - mutex_unlock(&team->lock);
    678 netdev_change_features(team->dev);
    679 }
    680
    681 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    682 index b0d748a614a9e..72a3a5dc51319 100644
    683 --- a/drivers/net/usb/qmi_wwan.c
    684 +++ b/drivers/net/usb/qmi_wwan.c
    685 @@ -1347,6 +1347,7 @@ static const struct usb_device_id products[] = {
    686 {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */
    687 {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */
    688 {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */
    689 + {QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */
    690 {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */
    691 {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */
    692 {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */
    693 diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
    694 index ef5a8ecabc60a..0581f082301e0 100644
    695 --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
    696 +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
    697 @@ -2183,7 +2183,8 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
    698
    699 while (offs < dwords) {
    700 /* limit the time we spin here under lock to 1/2s */
    701 - ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
    702 + unsigned long end = jiffies + HZ / 2;
    703 + bool resched = false;
    704
    705 if (iwl_trans_grab_nic_access(trans, &flags)) {
    706 iwl_write32(trans, HBUS_TARG_MEM_RADDR,
    707 @@ -2194,14 +2195,15 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
    708 HBUS_TARG_MEM_RDAT);
    709 offs++;
    710
    711 - /* calling ktime_get is expensive so
    712 - * do it once in 128 reads
    713 - */
    714 - if (offs % 128 == 0 && ktime_after(ktime_get(),
    715 - timeout))
    716 + if (time_after(jiffies, end)) {
    717 + resched = true;
    718 break;
    719 + }
    720 }
    721 iwl_trans_release_nic_access(trans, &flags);
    722 +
    723 + if (resched)
    724 + cond_resched();
    725 } else {
    726 return -EBUSY;
    727 }
    728 diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
    729 index f6a0454abe044..6f2172be7b66a 100644
    730 --- a/drivers/net/wireless/mediatek/mt7601u/dma.c
    731 +++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
    732 @@ -152,8 +152,7 @@ mt7601u_rx_process_entry(struct mt7601u_dev *dev, struct mt7601u_dma_buf_rx *e)
    733
    734 if (new_p) {
    735 /* we have one extra ref from the allocator */
    736 - __free_pages(e->p, MT_RX_ORDER);
    737 -
    738 + put_page(e->p);
    739 e->p = new_p;
    740 }
    741 }
    742 @@ -310,7 +309,6 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
    743 }
    744
    745 e = &q->e[q->end];
    746 - e->skb = skb;
    747 usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len,
    748 mt7601u_complete_tx, q);
    749 ret = usb_submit_urb(e->urb, GFP_ATOMIC);
    750 @@ -328,6 +326,7 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
    751
    752 q->end = (q->end + 1) % q->entries;
    753 q->used++;
    754 + e->skb = skb;
    755
    756 if (q->used >= q->entries)
    757 ieee80211_stop_queue(dev->hw, skb_get_queue_mapping(skb));
    758 diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
    759 index 3968f89f7855a..0ac0bd4c65c4c 100644
    760 --- a/drivers/nvme/host/multipath.c
    761 +++ b/drivers/nvme/host/multipath.c
    762 @@ -233,7 +233,7 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head,
    763 }
    764
    765 for (ns = nvme_next_ns(head, old);
    766 - ns != old;
    767 + ns && ns != old;
    768 ns = nvme_next_ns(head, ns)) {
    769 if (nvme_path_is_disabled(ns))
    770 continue;
    771 diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
    772 index be2520cc010be..7dc72cb718b0e 100644
    773 --- a/drivers/s390/crypto/vfio_ap_drv.c
    774 +++ b/drivers/s390/crypto/vfio_ap_drv.c
    775 @@ -71,15 +71,11 @@ static int vfio_ap_queue_dev_probe(struct ap_device *apdev)
    776 static void vfio_ap_queue_dev_remove(struct ap_device *apdev)
    777 {
    778 struct vfio_ap_queue *q;
    779 - int apid, apqi;
    780
    781 mutex_lock(&matrix_dev->lock);
    782 q = dev_get_drvdata(&apdev->device);
    783 + vfio_ap_mdev_reset_queue(q, 1);
    784 dev_set_drvdata(&apdev->device, NULL);
    785 - apid = AP_QID_CARD(q->apqn);
    786 - apqi = AP_QID_QUEUE(q->apqn);
    787 - vfio_ap_mdev_reset_queue(apid, apqi, 1);
    788 - vfio_ap_irq_disable(q);
    789 kfree(q);
    790 mutex_unlock(&matrix_dev->lock);
    791 }
    792 diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
    793 index 5c0f53c6dde75..790b0b2b36272 100644
    794 --- a/drivers/s390/crypto/vfio_ap_ops.c
    795 +++ b/drivers/s390/crypto/vfio_ap_ops.c
    796 @@ -25,6 +25,7 @@
    797 #define VFIO_AP_MDEV_NAME_HWVIRT "VFIO AP Passthrough Device"
    798
    799 static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev);
    800 +static struct vfio_ap_queue *vfio_ap_find_queue(int apqn);
    801
    802 static int match_apqn(struct device *dev, const void *data)
    803 {
    804 @@ -49,20 +50,15 @@ static struct vfio_ap_queue *vfio_ap_get_queue(
    805 int apqn)
    806 {
    807 struct vfio_ap_queue *q;
    808 - struct device *dev;
    809
    810 if (!test_bit_inv(AP_QID_CARD(apqn), matrix_mdev->matrix.apm))
    811 return NULL;
    812 if (!test_bit_inv(AP_QID_QUEUE(apqn), matrix_mdev->matrix.aqm))
    813 return NULL;
    814
    815 - dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
    816 - &apqn, match_apqn);
    817 - if (!dev)
    818 - return NULL;
    819 - q = dev_get_drvdata(dev);
    820 - q->matrix_mdev = matrix_mdev;
    821 - put_device(dev);
    822 + q = vfio_ap_find_queue(apqn);
    823 + if (q)
    824 + q->matrix_mdev = matrix_mdev;
    825
    826 return q;
    827 }
    828 @@ -119,13 +115,18 @@ static void vfio_ap_wait_for_irqclear(int apqn)
    829 */
    830 static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q)
    831 {
    832 - if (q->saved_isc != VFIO_AP_ISC_INVALID && q->matrix_mdev)
    833 + if (!q)
    834 + return;
    835 + if (q->saved_isc != VFIO_AP_ISC_INVALID &&
    836 + !WARN_ON(!(q->matrix_mdev && q->matrix_mdev->kvm))) {
    837 kvm_s390_gisc_unregister(q->matrix_mdev->kvm, q->saved_isc);
    838 - if (q->saved_pfn && q->matrix_mdev)
    839 + q->saved_isc = VFIO_AP_ISC_INVALID;
    840 + }
    841 + if (q->saved_pfn && !WARN_ON(!q->matrix_mdev)) {
    842 vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev),
    843 &q->saved_pfn, 1);
    844 - q->saved_pfn = 0;
    845 - q->saved_isc = VFIO_AP_ISC_INVALID;
    846 + q->saved_pfn = 0;
    847 + }
    848 }
    849
    850 /**
    851 @@ -144,7 +145,7 @@ static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q)
    852 * Returns if ap_aqic function failed with invalid, deconfigured or
    853 * checkstopped AP.
    854 */
    855 -struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
    856 +static struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
    857 {
    858 struct ap_qirq_ctrl aqic_gisa = {};
    859 struct ap_queue_status status;
    860 @@ -1114,48 +1115,70 @@ static int vfio_ap_mdev_group_notifier(struct notifier_block *nb,
    861 return NOTIFY_OK;
    862 }
    863
    864 -static void vfio_ap_irq_disable_apqn(int apqn)
    865 +static struct vfio_ap_queue *vfio_ap_find_queue(int apqn)
    866 {
    867 struct device *dev;
    868 - struct vfio_ap_queue *q;
    869 + struct vfio_ap_queue *q = NULL;
    870
    871 dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
    872 &apqn, match_apqn);
    873 if (dev) {
    874 q = dev_get_drvdata(dev);
    875 - vfio_ap_irq_disable(q);
    876 put_device(dev);
    877 }
    878 +
    879 + return q;
    880 }
    881
    882 -int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
    883 +int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q,
    884 unsigned int retry)
    885 {
    886 struct ap_queue_status status;
    887 + int ret;
    888 int retry2 = 2;
    889 - int apqn = AP_MKQID(apid, apqi);
    890
    891 - do {
    892 - status = ap_zapq(apqn);
    893 - switch (status.response_code) {
    894 - case AP_RESPONSE_NORMAL:
    895 - while (!status.queue_empty && retry2--) {
    896 - msleep(20);
    897 - status = ap_tapq(apqn, NULL);
    898 - }
    899 - WARN_ON_ONCE(retry2 <= 0);
    900 - return 0;
    901 - case AP_RESPONSE_RESET_IN_PROGRESS:
    902 - case AP_RESPONSE_BUSY:
    903 + if (!q)
    904 + return 0;
    905 +
    906 +retry_zapq:
    907 + status = ap_zapq(q->apqn);
    908 + switch (status.response_code) {
    909 + case AP_RESPONSE_NORMAL:
    910 + ret = 0;
    911 + break;
    912 + case AP_RESPONSE_RESET_IN_PROGRESS:
    913 + if (retry--) {
    914 msleep(20);
    915 - break;
    916 - default:
    917 - /* things are really broken, give up */
    918 - return -EIO;
    919 + goto retry_zapq;
    920 }
    921 - } while (retry--);
    922 + ret = -EBUSY;
    923 + break;
    924 + case AP_RESPONSE_Q_NOT_AVAIL:
    925 + case AP_RESPONSE_DECONFIGURED:
    926 + case AP_RESPONSE_CHECKSTOPPED:
    927 + WARN_ON_ONCE(status.irq_enabled);
    928 + ret = -EBUSY;
    929 + goto free_resources;
    930 + default:
    931 + /* things are really broken, give up */
    932 + WARN(true, "PQAP/ZAPQ completed with invalid rc (%x)\n",
    933 + status.response_code);
    934 + return -EIO;
    935 + }
    936 +
    937 + /* wait for the reset to take effect */
    938 + while (retry2--) {
    939 + if (status.queue_empty && !status.irq_enabled)
    940 + break;
    941 + msleep(20);
    942 + status = ap_tapq(q->apqn, NULL);
    943 + }
    944 + WARN_ON_ONCE(retry2 <= 0);
    945
    946 - return -EBUSY;
    947 +free_resources:
    948 + vfio_ap_free_aqic_resources(q);
    949 +
    950 + return ret;
    951 }
    952
    953 static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
    954 @@ -1163,13 +1186,15 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
    955 int ret;
    956 int rc = 0;
    957 unsigned long apid, apqi;
    958 + struct vfio_ap_queue *q;
    959 struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev);
    960
    961 for_each_set_bit_inv(apid, matrix_mdev->matrix.apm,
    962 matrix_mdev->matrix.apm_max + 1) {
    963 for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm,
    964 matrix_mdev->matrix.aqm_max + 1) {
    965 - ret = vfio_ap_mdev_reset_queue(apid, apqi, 1);
    966 + q = vfio_ap_find_queue(AP_MKQID(apid, apqi));
    967 + ret = vfio_ap_mdev_reset_queue(q, 1);
    968 /*
    969 * Regardless whether a queue turns out to be busy, or
    970 * is not operational, we need to continue resetting
    971 @@ -1177,7 +1202,6 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
    972 */
    973 if (ret)
    974 rc = ret;
    975 - vfio_ap_irq_disable_apqn(AP_MKQID(apid, apqi));
    976 }
    977 }
    978
    979 diff --git a/drivers/s390/crypto/vfio_ap_private.h b/drivers/s390/crypto/vfio_ap_private.h
    980 index f46dde56b4644..28e9d99897682 100644
    981 --- a/drivers/s390/crypto/vfio_ap_private.h
    982 +++ b/drivers/s390/crypto/vfio_ap_private.h
    983 @@ -88,11 +88,6 @@ struct ap_matrix_mdev {
    984 struct mdev_device *mdev;
    985 };
    986
    987 -extern int vfio_ap_mdev_register(void);
    988 -extern void vfio_ap_mdev_unregister(void);
    989 -int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
    990 - unsigned int retry);
    991 -
    992 struct vfio_ap_queue {
    993 struct ap_matrix_mdev *matrix_mdev;
    994 unsigned long saved_pfn;
    995 @@ -100,5 +95,10 @@ struct vfio_ap_queue {
    996 #define VFIO_AP_ISC_INVALID 0xff
    997 unsigned char saved_isc;
    998 };
    999 -struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q);
    1000 +
    1001 +int vfio_ap_mdev_register(void);
    1002 +void vfio_ap_mdev_unregister(void);
    1003 +int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q,
    1004 + unsigned int retry);
    1005 +
    1006 #endif /* _VFIO_AP_PRIVATE_H_ */
    1007 diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c
    1008 index 096a83cf0caf3..4b4174597150d 100644
    1009 --- a/drivers/soc/atmel/soc.c
    1010 +++ b/drivers/soc/atmel/soc.c
    1011 @@ -264,8 +264,21 @@ struct soc_device * __init at91_soc_init(const struct at91_soc *socs)
    1012 return soc_dev;
    1013 }
    1014
    1015 +static const struct of_device_id at91_soc_allowed_list[] __initconst = {
    1016 + { .compatible = "atmel,at91rm9200", },
    1017 + { .compatible = "atmel,at91sam9", },
    1018 + { .compatible = "atmel,sama5", },
    1019 + { .compatible = "atmel,samv7", },
    1020 + { }
    1021 +};
    1022 +
    1023 static int __init atmel_soc_device_init(void)
    1024 {
    1025 + struct device_node *np = of_find_node_by_path("/");
    1026 +
    1027 + if (!of_match_node(at91_soc_allowed_list, np))
    1028 + return 0;
    1029 +
    1030 at91_soc_init(socs);
    1031
    1032 return 0;
    1033 diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
    1034 index aadedec3bfe7b..ea79482ebda46 100644
    1035 --- a/drivers/tee/optee/call.c
    1036 +++ b/drivers/tee/optee/call.c
    1037 @@ -7,6 +7,7 @@
    1038 #include <linux/err.h>
    1039 #include <linux/errno.h>
    1040 #include <linux/mm.h>
    1041 +#include <linux/sched.h>
    1042 #include <linux/slab.h>
    1043 #include <linux/tee_drv.h>
    1044 #include <linux/types.h>
    1045 @@ -148,7 +149,8 @@ u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg)
    1046 */
    1047 optee_cq_wait_for_completion(&optee->call_queue, &w);
    1048 } else if (OPTEE_SMC_RETURN_IS_RPC(res.a0)) {
    1049 - might_sleep();
    1050 + if (need_resched())
    1051 + cond_resched();
    1052 param.a0 = res.a0;
    1053 param.a1 = res.a1;
    1054 param.a2 = res.a2;
    1055 diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
    1056 index 14ccf13ab8fa1..786494bb7f20b 100644
    1057 --- a/drivers/xen/xenbus/xenbus_probe.c
    1058 +++ b/drivers/xen/xenbus/xenbus_probe.c
    1059 @@ -714,6 +714,23 @@ static bool xs_hvm_defer_init_for_callback(void)
    1060 #endif
    1061 }
    1062
    1063 +static int xenbus_probe_thread(void *unused)
    1064 +{
    1065 + DEFINE_WAIT(w);
    1066 +
    1067 + /*
    1068 + * We actually just want to wait for *any* trigger of xb_waitq,
    1069 + * and run xenbus_probe() the moment it occurs.
    1070 + */
    1071 + prepare_to_wait(&xb_waitq, &w, TASK_INTERRUPTIBLE);
    1072 + schedule();
    1073 + finish_wait(&xb_waitq, &w);
    1074 +
    1075 + DPRINTK("probing");
    1076 + xenbus_probe();
    1077 + return 0;
    1078 +}
    1079 +
    1080 static int __init xenbus_probe_initcall(void)
    1081 {
    1082 /*
    1083 @@ -725,6 +742,20 @@ static int __init xenbus_probe_initcall(void)
    1084 !xs_hvm_defer_init_for_callback()))
    1085 xenbus_probe();
    1086
    1087 + /*
    1088 + * For XS_LOCAL, spawn a thread which will wait for xenstored
    1089 + * or a xenstore-stubdom to be started, then probe. It will be
    1090 + * triggered when communication starts happening, by waiting
    1091 + * on xb_waitq.
    1092 + */
    1093 + if (xen_store_domain_type == XS_LOCAL) {
    1094 + struct task_struct *probe_task;
    1095 +
    1096 + probe_task = kthread_run(xenbus_probe_thread, NULL,
    1097 + "xenbus_probe");
    1098 + if (IS_ERR(probe_task))
    1099 + return PTR_ERR(probe_task);
    1100 + }
    1101 return 0;
    1102 }
    1103 device_initcall(xenbus_probe_initcall);
    1104 diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
    1105 index 59e7a2ad440fc..a32f23981f60f 100644
    1106 --- a/fs/btrfs/block-group.c
    1107 +++ b/fs/btrfs/block-group.c
    1108 @@ -640,7 +640,15 @@ static noinline void caching_thread(struct btrfs_work *work)
    1109 mutex_lock(&caching_ctl->mutex);
    1110 down_read(&fs_info->commit_root_sem);
    1111
    1112 - if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE))
    1113 + /*
    1114 + * If we are in the transaction that populated the free space tree we
    1115 + * can't actually cache from the free space tree as our commit root and
    1116 + * real root are the same, so we could change the contents of the blocks
    1117 + * while caching. Instead do the slow caching in this case, and after
    1118 + * the transaction has committed we will be safe.
    1119 + */
    1120 + if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) &&
    1121 + !(test_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags)))
    1122 ret = load_free_space_tree(caching_ctl);
    1123 else
    1124 ret = load_extent_tree_free(caching_ctl);
    1125 diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
    1126 index 27128164fac97..cda5534d3d0e3 100644
    1127 --- a/fs/btrfs/ctree.h
    1128 +++ b/fs/btrfs/ctree.h
    1129 @@ -136,6 +136,9 @@ enum {
    1130 BTRFS_FS_STATE_DEV_REPLACING,
    1131 /* The btrfs_fs_info created for self-tests */
    1132 BTRFS_FS_STATE_DUMMY_FS_INFO,
    1133 +
    1134 + /* Indicate that we can't trust the free space tree for caching yet */
    1135 + BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED,
    1136 };
    1137
    1138 #define BTRFS_BACKREF_REV_MAX 256
    1139 diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
    1140 index 48a03f5240f59..dfabbbfc94ccb 100644
    1141 --- a/fs/btrfs/free-space-tree.c
    1142 +++ b/fs/btrfs/free-space-tree.c
    1143 @@ -1149,6 +1149,7 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
    1144 return PTR_ERR(trans);
    1145
    1146 set_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
    1147 + set_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
    1148 free_space_root = btrfs_create_tree(trans,
    1149 BTRFS_FREE_SPACE_TREE_OBJECTID);
    1150 if (IS_ERR(free_space_root)) {
    1151 @@ -1170,11 +1171,18 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
    1152 btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE);
    1153 btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID);
    1154 clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
    1155 + ret = btrfs_commit_transaction(trans);
    1156
    1157 - return btrfs_commit_transaction(trans);
    1158 + /*
    1159 + * Now that we've committed the transaction any reading of our commit
    1160 + * root will be safe, so we can cache from the free space tree now.
    1161 + */
    1162 + clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
    1163 + return ret;
    1164
    1165 abort:
    1166 clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
    1167 + clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
    1168 btrfs_abort_transaction(trans, ret);
    1169 btrfs_end_transaction(trans);
    1170 return ret;
    1171 diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
    1172 index 4232f956bdac0..ca1d98f274d12 100644
    1173 --- a/fs/nfs/pnfs.c
    1174 +++ b/fs/nfs/pnfs.c
    1175 @@ -2388,6 +2388,7 @@ out_forget:
    1176 spin_unlock(&ino->i_lock);
    1177 lseg->pls_layout = lo;
    1178 NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
    1179 + pnfs_free_lseg_list(&free_me);
    1180 return ERR_PTR(-EAGAIN);
    1181 }
    1182
    1183 diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
    1184 index 6b559d25a84ee..88ac8edf44e31 100644
    1185 --- a/include/linux/intel-iommu.h
    1186 +++ b/include/linux/intel-iommu.h
    1187 @@ -556,6 +556,8 @@ struct intel_iommu {
    1188 struct iommu_device iommu; /* IOMMU core code handle */
    1189 int node;
    1190 u32 flags; /* Software defined flags */
    1191 +
    1192 + struct dmar_drhd_unit *drhd;
    1193 };
    1194
    1195 /* PCI domain-device relationship */
    1196 diff --git a/include/net/tcp.h b/include/net/tcp.h
    1197 index 377179283c46c..4b38ba101b9b7 100644
    1198 --- a/include/net/tcp.h
    1199 +++ b/include/net/tcp.h
    1200 @@ -2030,7 +2030,7 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb);
    1201 void tcp_newreno_mark_lost(struct sock *sk, bool snd_una_advanced);
    1202 extern s32 tcp_rack_skb_timeout(struct tcp_sock *tp, struct sk_buff *skb,
    1203 u32 reo_wnd);
    1204 -extern void tcp_rack_mark_lost(struct sock *sk);
    1205 +extern bool tcp_rack_mark_lost(struct sock *sk);
    1206 extern void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq,
    1207 u64 xmit_time);
    1208 extern void tcp_rack_reo_timeout(struct sock *sk);
    1209 diff --git a/include/uapi/linux/icmpv6.h b/include/uapi/linux/icmpv6.h
    1210 index 2622b5a3e6163..9a31ea2ad1cfc 100644
    1211 --- a/include/uapi/linux/icmpv6.h
    1212 +++ b/include/uapi/linux/icmpv6.h
    1213 @@ -137,6 +137,7 @@ struct icmp6hdr {
    1214 #define ICMPV6_HDR_FIELD 0
    1215 #define ICMPV6_UNK_NEXTHDR 1
    1216 #define ICMPV6_UNK_OPTION 2
    1217 +#define ICMPV6_HDR_INCOMP 3
    1218
    1219 /*
    1220 * constants for (set|get)sockopt
    1221 diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
    1222 index 15d70a90b50dc..d65b0fc8fb48b 100644
    1223 --- a/kernel/kexec_core.c
    1224 +++ b/kernel/kexec_core.c
    1225 @@ -1129,7 +1129,6 @@ int kernel_kexec(void)
    1226
    1227 #ifdef CONFIG_KEXEC_JUMP
    1228 if (kexec_image->preserve_context) {
    1229 - lock_system_sleep();
    1230 pm_prepare_console();
    1231 error = freeze_processes();
    1232 if (error) {
    1233 @@ -1192,7 +1191,6 @@ int kernel_kexec(void)
    1234 thaw_processes();
    1235 Restore_console:
    1236 pm_restore_console();
    1237 - unlock_system_sleep();
    1238 }
    1239 #endif
    1240
    1241 diff --git a/kernel/power/swap.c b/kernel/power/swap.c
    1242 index ca0fcb5ced714..0516c422206d8 100644
    1243 --- a/kernel/power/swap.c
    1244 +++ b/kernel/power/swap.c
    1245 @@ -489,10 +489,10 @@ static int swap_writer_finish(struct swap_map_handle *handle,
    1246 unsigned int flags, int error)
    1247 {
    1248 if (!error) {
    1249 - flush_swap_writer(handle);
    1250 pr_info("S");
    1251 error = mark_swapfiles(handle, flags);
    1252 pr_cont("|\n");
    1253 + flush_swap_writer(handle);
    1254 }
    1255
    1256 if (error)
    1257 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    1258 index 7411a43134629..26305aa88651f 100644
    1259 --- a/net/ipv4/tcp_input.c
    1260 +++ b/net/ipv4/tcp_input.c
    1261 @@ -2764,7 +2764,8 @@ static void tcp_identify_packet_loss(struct sock *sk, int *ack_flag)
    1262 } else if (tcp_is_rack(sk)) {
    1263 u32 prior_retrans = tp->retrans_out;
    1264
    1265 - tcp_rack_mark_lost(sk);
    1266 + if (tcp_rack_mark_lost(sk))
    1267 + *ack_flag &= ~FLAG_SET_XMIT_TIMER;
    1268 if (prior_retrans > tp->retrans_out)
    1269 *ack_flag |= FLAG_LOST_RETRANS;
    1270 }
    1271 @@ -3713,9 +3714,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
    1272
    1273 if (tp->tlp_high_seq)
    1274 tcp_process_tlp_ack(sk, ack, flag);
    1275 - /* If needed, reset TLP/RTO timer; RACK may later override this. */
    1276 - if (flag & FLAG_SET_XMIT_TIMER)
    1277 - tcp_set_xmit_timer(sk);
    1278
    1279 if (tcp_ack_is_dubious(sk, flag)) {
    1280 if (!(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP))) {
    1281 @@ -3728,6 +3726,10 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
    1282 &rexmit);
    1283 }
    1284
    1285 + /* If needed, reset TLP/RTO timer when RACK doesn't set. */
    1286 + if (flag & FLAG_SET_XMIT_TIMER)
    1287 + tcp_set_xmit_timer(sk);
    1288 +
    1289 if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
    1290 sk_dst_confirm(sk);
    1291
    1292 diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
    1293 index fdb715bdd2d11..8757bb6cb1d93 100644
    1294 --- a/net/ipv4/tcp_recovery.c
    1295 +++ b/net/ipv4/tcp_recovery.c
    1296 @@ -110,13 +110,13 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
    1297 }
    1298 }
    1299
    1300 -void tcp_rack_mark_lost(struct sock *sk)
    1301 +bool tcp_rack_mark_lost(struct sock *sk)
    1302 {
    1303 struct tcp_sock *tp = tcp_sk(sk);
    1304 u32 timeout;
    1305
    1306 if (!tp->rack.advanced)
    1307 - return;
    1308 + return false;
    1309
    1310 /* Reset the advanced flag to avoid unnecessary queue scanning */
    1311 tp->rack.advanced = 0;
    1312 @@ -126,6 +126,7 @@ void tcp_rack_mark_lost(struct sock *sk)
    1313 inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT,
    1314 timeout, inet_csk(sk)->icsk_rto);
    1315 }
    1316 + return !!timeout;
    1317 }
    1318
    1319 /* Record the most recently (re)sent time among the (s)acked packets
    1320 diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
    1321 index 7d3a3894f785c..e9bb89131e02a 100644
    1322 --- a/net/ipv6/icmp.c
    1323 +++ b/net/ipv6/icmp.c
    1324 @@ -158,7 +158,13 @@ static bool is_ineligible(const struct sk_buff *skb)
    1325 tp = skb_header_pointer(skb,
    1326 ptr+offsetof(struct icmp6hdr, icmp6_type),
    1327 sizeof(_type), &_type);
    1328 - if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
    1329 +
    1330 + /* Based on RFC 8200, Section 4.5 Fragment Header, return
    1331 + * false if this is a fragment packet with no icmp header info.
    1332 + */
    1333 + if (!tp && frag_off != 0)
    1334 + return false;
    1335 + else if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
    1336 return true;
    1337 }
    1338 return false;
    1339 diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
    1340 index 1f5d4d196dcce..c8cf1bbad74a2 100644
    1341 --- a/net/ipv6/reassembly.c
    1342 +++ b/net/ipv6/reassembly.c
    1343 @@ -42,6 +42,8 @@
    1344 #include <linux/skbuff.h>
    1345 #include <linux/slab.h>
    1346 #include <linux/export.h>
    1347 +#include <linux/tcp.h>
    1348 +#include <linux/udp.h>
    1349
    1350 #include <net/sock.h>
    1351 #include <net/snmp.h>
    1352 @@ -322,7 +324,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
    1353 struct frag_queue *fq;
    1354 const struct ipv6hdr *hdr = ipv6_hdr(skb);
    1355 struct net *net = dev_net(skb_dst(skb)->dev);
    1356 - int iif;
    1357 + __be16 frag_off;
    1358 + int iif, offset;
    1359 + u8 nexthdr;
    1360
    1361 if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
    1362 goto fail_hdr;
    1363 @@ -351,6 +355,33 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
    1364 return 1;
    1365 }
    1366
    1367 + /* RFC 8200, Section 4.5 Fragment Header:
    1368 + * If the first fragment does not include all headers through an
    1369 + * Upper-Layer header, then that fragment should be discarded and
    1370 + * an ICMP Parameter Problem, Code 3, message should be sent to
    1371 + * the source of the fragment, with the Pointer field set to zero.
    1372 + */
    1373 + nexthdr = hdr->nexthdr;
    1374 + offset = ipv6_skip_exthdr(skb, skb_transport_offset(skb), &nexthdr, &frag_off);
    1375 + if (offset >= 0) {
    1376 + /* Check some common protocols' header */
    1377 + if (nexthdr == IPPROTO_TCP)
    1378 + offset += sizeof(struct tcphdr);
    1379 + else if (nexthdr == IPPROTO_UDP)
    1380 + offset += sizeof(struct udphdr);
    1381 + else if (nexthdr == IPPROTO_ICMPV6)
    1382 + offset += sizeof(struct icmp6hdr);
    1383 + else
    1384 + offset += 1;
    1385 +
    1386 + if (!(frag_off & htons(IP6_OFFSET)) && offset > skb->len) {
    1387 + __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
    1388 + IPSTATS_MIB_INHDRERRORS);
    1389 + icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0);
    1390 + return -1;
    1391 + }
    1392 + }
    1393 +
    1394 iif = skb->dev ? skb->dev->ifindex : 0;
    1395 fq = fq_find(net, fhdr->identification, hdr, iif);
    1396 if (fq) {
    1397 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
    1398 index 05406e9c05b32..268f1d8f440ba 100644
    1399 --- a/net/mac80211/ieee80211_i.h
    1400 +++ b/net/mac80211/ieee80211_i.h
    1401 @@ -1061,6 +1061,7 @@ enum queue_stop_reason {
    1402 IEEE80211_QUEUE_STOP_REASON_FLUSH,
    1403 IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN,
    1404 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID,
    1405 + IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE,
    1406
    1407 IEEE80211_QUEUE_STOP_REASONS,
    1408 };
    1409 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
    1410 index af8b09214786d..6089b09ec13b6 100644
    1411 --- a/net/mac80211/iface.c
    1412 +++ b/net/mac80211/iface.c
    1413 @@ -1537,6 +1537,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
    1414 if (ret)
    1415 return ret;
    1416
    1417 + ieee80211_stop_vif_queues(local, sdata,
    1418 + IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
    1419 + synchronize_net();
    1420 +
    1421 ieee80211_do_stop(sdata, false);
    1422
    1423 ieee80211_teardown_sdata(sdata);
    1424 @@ -1557,6 +1561,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
    1425 err = ieee80211_do_open(&sdata->wdev, false);
    1426 WARN(err, "type change: do_open returned %d", err);
    1427
    1428 + ieee80211_wake_vif_queues(local, sdata,
    1429 + IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
    1430 return ret;
    1431 }
    1432
    1433 diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
    1434 index 60236cc316d03..95415d2b81c93 100644
    1435 --- a/net/netfilter/nft_dynset.c
    1436 +++ b/net/netfilter/nft_dynset.c
    1437 @@ -233,8 +233,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
    1438 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPR,
    1439 priv->expr->ops->size);
    1440 if (set->flags & NFT_SET_TIMEOUT) {
    1441 - if (timeout || set->timeout)
    1442 + if (timeout || set->timeout) {
    1443 + nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT);
    1444 nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION);
    1445 + }
    1446 }
    1447
    1448 priv->timeout = timeout;
    1449 diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
    1450 index 4170acc2dc282..99b06a16b8086 100644
    1451 --- a/net/nfc/netlink.c
    1452 +++ b/net/nfc/netlink.c
    1453 @@ -860,6 +860,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info)
    1454
    1455 if (!dev->polling) {
    1456 device_unlock(&dev->dev);
    1457 + nfc_put_device(dev);
    1458 return -EINVAL;
    1459 }
    1460
    1461 diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
    1462 index b5c867fe32324..23d5e56306a4c 100644
    1463 --- a/net/nfc/rawsock.c
    1464 +++ b/net/nfc/rawsock.c
    1465 @@ -105,7 +105,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
    1466 if (addr->target_idx > dev->target_next_idx - 1 ||
    1467 addr->target_idx < dev->target_next_idx - dev->n_targets) {
    1468 rc = -EINVAL;
    1469 - goto error;
    1470 + goto put_dev;
    1471 }
    1472
    1473 rc = nfc_activate_target(dev, addr->target_idx, addr->nfc_protocol);
    1474 diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
    1475 index 032ed76c0166d..55fb3744552de 100644
    1476 --- a/net/rxrpc/call_accept.c
    1477 +++ b/net/rxrpc/call_accept.c
    1478 @@ -207,6 +207,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
    1479 tail = b->peer_backlog_tail;
    1480 while (CIRC_CNT(head, tail, size) > 0) {
    1481 struct rxrpc_peer *peer = b->peer_backlog[tail];
    1482 + rxrpc_put_local(peer->local);
    1483 kfree(peer);
    1484 tail = (tail + 1) & (size - 1);
    1485 }
    1486 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
    1487 index 69102fda9ebd4..76a80a41615be 100644
    1488 --- a/net/wireless/wext-core.c
    1489 +++ b/net/wireless/wext-core.c
    1490 @@ -896,8 +896,9 @@ out:
    1491 int call_commit_handler(struct net_device *dev)
    1492 {
    1493 #ifdef CONFIG_WIRELESS_EXT
    1494 - if ((netif_running(dev)) &&
    1495 - (dev->wireless_handlers->standard[0] != NULL))
    1496 + if (netif_running(dev) &&
    1497 + dev->wireless_handlers &&
    1498 + dev->wireless_handlers->standard[0])
    1499 /* Call the commit handler on the driver */
    1500 return dev->wireless_handlers->standard[0](dev, NULL,
    1501 NULL, NULL);
    1502 diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
    1503 index 7a84745477919..e120df0a6da13 100644
    1504 --- a/net/xfrm/xfrm_input.c
    1505 +++ b/net/xfrm/xfrm_input.c
    1506 @@ -656,7 +656,7 @@ resume:
    1507 /* only the first xfrm gets the encap type */
    1508 encap_type = 0;
    1509
    1510 - if (async && x->repl->recheck(x, skb, seq)) {
    1511 + if (x->repl->recheck(x, skb, seq)) {
    1512 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
    1513 goto drop_unlock;
    1514 }
    1515 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
    1516 index 2917711ff8ab6..32c8163427970 100644
    1517 --- a/net/xfrm/xfrm_policy.c
    1518 +++ b/net/xfrm/xfrm_policy.c
    1519 @@ -790,15 +790,22 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a,
    1520 const xfrm_address_t *b,
    1521 u8 prefixlen, u16 family)
    1522 {
    1523 + u32 ma, mb, mask;
    1524 unsigned int pdw, pbi;
    1525 int delta = 0;
    1526
    1527 switch (family) {
    1528 case AF_INET:
    1529 - if (sizeof(long) == 4 && prefixlen == 0)
    1530 - return ntohl(a->a4) - ntohl(b->a4);
    1531 - return (ntohl(a->a4) & ((~0UL << (32 - prefixlen)))) -
    1532 - (ntohl(b->a4) & ((~0UL << (32 - prefixlen))));
    1533 + if (prefixlen == 0)
    1534 + return 0;
    1535 + mask = ~0U << (32 - prefixlen);
    1536 + ma = ntohl(a->a4) & mask;
    1537 + mb = ntohl(b->a4) & mask;
    1538 + if (ma < mb)
    1539 + delta = -1;
    1540 + else if (ma > mb)
    1541 + delta = 1;
    1542 + break;
    1543 case AF_INET6:
    1544 pdw = prefixlen >> 5;
    1545 pbi = prefixlen & 0x1f;
    1546 @@ -809,10 +816,13 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a,
    1547 return delta;
    1548 }
    1549 if (pbi) {
    1550 - u32 mask = ~0u << (32 - pbi);
    1551 -
    1552 - delta = (ntohl(a->a6[pdw]) & mask) -
    1553 - (ntohl(b->a6[pdw]) & mask);
    1554 + mask = ~0U << (32 - pbi);
    1555 + ma = ntohl(a->a6[pdw]) & mask;
    1556 + mb = ntohl(b->a6[pdw]) & mask;
    1557 + if (ma < mb)
    1558 + delta = -1;
    1559 + else if (ma > mb)
    1560 + delta = 1;
    1561 }
    1562 break;
    1563 default:
    1564 @@ -3065,8 +3075,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
    1565 xflo.flags = flags;
    1566
    1567 /* To accelerate a bit... */
    1568 - if ((dst_orig->flags & DST_NOXFRM) ||
    1569 - !net->xfrm.policy_count[XFRM_POLICY_OUT])
    1570 + if (!if_id && ((dst_orig->flags & DST_NOXFRM) ||
    1571 + !net->xfrm.policy_count[XFRM_POLICY_OUT]))
    1572 goto nopol;
    1573
    1574 xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
    1575 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1576 index 8adbe45a54c11..f548bd48bf729 100644
    1577 --- a/sound/pci/hda/patch_realtek.c
    1578 +++ b/sound/pci/hda/patch_realtek.c
    1579 @@ -7907,6 +7907,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    1580 SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
    1581 SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
    1582 SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE),
    1583 + SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE),
    1584 SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
    1585 SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
    1586 SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
    1587 diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
    1588 index 834367dd54e1b..a5c1a2c4eae4e 100644
    1589 --- a/sound/pci/hda/patch_via.c
    1590 +++ b/sound/pci/hda/patch_via.c
    1591 @@ -1043,7 +1043,7 @@ static const struct hda_fixup via_fixups[] = {
    1592 static const struct snd_pci_quirk vt2002p_fixups[] = {
    1593 SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
    1594 SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
    1595 - SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", VIA_FIXUP_POWER_SAVE),
    1596 + SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE),
    1597 {}
    1598 };
    1599
    1600 diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
    1601 index aa5833001fde5..2cb719893324a 100644
    1602 --- a/sound/soc/intel/skylake/skl-topology.c
    1603 +++ b/sound/soc/intel/skylake/skl-topology.c
    1604 @@ -3619,15 +3619,16 @@ static void skl_tplg_complete(struct snd_soc_component *component)
    1605
    1606 list_for_each_entry(dobj, &component->dobj_list, list) {
    1607 struct snd_kcontrol *kcontrol = dobj->control.kcontrol;
    1608 - struct soc_enum *se =
    1609 - (struct soc_enum *)kcontrol->private_value;
    1610 - char **texts = dobj->control.dtexts;
    1611 + struct soc_enum *se;
    1612 + char **texts;
    1613 char chan_text[4];
    1614
    1615 - if (dobj->type != SND_SOC_DOBJ_ENUM ||
    1616 - dobj->control.kcontrol->put !=
    1617 - skl_tplg_multi_config_set_dmic)
    1618 + if (dobj->type != SND_SOC_DOBJ_ENUM || !kcontrol ||
    1619 + kcontrol->put != skl_tplg_multi_config_set_dmic)
    1620 continue;
    1621 +
    1622 + se = (struct soc_enum *)kcontrol->private_value;
    1623 + texts = dobj->control.dtexts;
    1624 sprintf(chan_text, "c%d", mach->mach_params.dmic_num);
    1625
    1626 for (i = 0; i < se->items; i++) {
    1627 diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
    1628 index 0100f123484e6..c367609433bfc 100644
    1629 --- a/sound/soc/soc-topology.c
    1630 +++ b/sound/soc/soc-topology.c
    1631 @@ -982,7 +982,7 @@ static int soc_tplg_denum_create_values(struct soc_enum *se,
    1632 return -EINVAL;
    1633
    1634 se->dobj.control.dvalues = kzalloc(le32_to_cpu(ec->items) *
    1635 - sizeof(u32),
    1636 + sizeof(*se->dobj.control.dvalues),
    1637 GFP_KERNEL);
    1638 if (!se->dobj.control.dvalues)
    1639 return -ENOMEM;
    1640 diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
    1641 index cf3d26c233e8e..7fcc42bc076fa 100755
    1642 --- a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
    1643 +++ b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
    1644 @@ -197,7 +197,7 @@ multipath4_test()
    1645 t0_rp12=$(link_stats_tx_packets_get $rp12)
    1646 t0_rp13=$(link_stats_tx_packets_get $rp13)
    1647
    1648 - ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
    1649 + ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
    1650 -d 1msec -t udp "sp=1024,dp=0-32768"
    1651
    1652 t1_rp12=$(link_stats_tx_packets_get $rp12)
    1653 diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh
    1654 index 79a2099279621..464821c587a5e 100755
    1655 --- a/tools/testing/selftests/net/forwarding/router_multipath.sh
    1656 +++ b/tools/testing/selftests/net/forwarding/router_multipath.sh
    1657 @@ -178,7 +178,7 @@ multipath4_test()
    1658 t0_rp12=$(link_stats_tx_packets_get $rp12)
    1659 t0_rp13=$(link_stats_tx_packets_get $rp13)
    1660
    1661 - ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
    1662 + ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
    1663 -d 1msec -t udp "sp=1024,dp=0-32768"
    1664
    1665 t1_rp12=$(link_stats_tx_packets_get $rp12)
    1666 diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
    1667 index 7a1bf94c5bd38..bdf450eaf60cf 100755
    1668 --- a/tools/testing/selftests/net/xfrm_policy.sh
    1669 +++ b/tools/testing/selftests/net/xfrm_policy.sh
    1670 @@ -202,7 +202,7 @@ check_xfrm() {
    1671 # 1: iptables -m policy rule count != 0
    1672 rval=$1
    1673 ip=$2
    1674 - lret=0
    1675 + local lret=0
    1676
    1677 ip netns exec ns1 ping -q -c 1 10.0.2.$ip > /dev/null
    1678
    1679 @@ -287,6 +287,47 @@ check_hthresh_repeat()
    1680 return 0
    1681 }
    1682
    1683 +# insert non-overlapping policies in a random order and check that
    1684 +# all of them can be fetched using the traffic selectors.
    1685 +check_random_order()
    1686 +{
    1687 + local ns=$1
    1688 + local log=$2
    1689 +
    1690 + for i in $(seq 100); do
    1691 + ip -net $ns xfrm policy flush
    1692 + for j in $(seq 0 16 255 | sort -R); do
    1693 + ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
    1694 + done
    1695 + for j in $(seq 0 16 255); do
    1696 + if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
    1697 + echo "FAIL: $log" 1>&2
    1698 + return 1
    1699 + fi
    1700 + done
    1701 + done
    1702 +
    1703 + for i in $(seq 100); do
    1704 + ip -net $ns xfrm policy flush
    1705 + for j in $(seq 0 16 255 | sort -R); do
    1706 + local addr=$(printf "e000:0000:%02x00::/56" $j)
    1707 + ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
    1708 + done
    1709 + for j in $(seq 0 16 255); do
    1710 + local addr=$(printf "e000:0000:%02x00::/56" $j)
    1711 + if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
    1712 + echo "FAIL: $log" 1>&2
    1713 + return 1
    1714 + fi
    1715 + done
    1716 + done
    1717 +
    1718 + ip -net $ns xfrm policy flush
    1719 +
    1720 + echo "PASS: $log"
    1721 + return 0
    1722 +}
    1723 +
    1724 #check for needed privileges
    1725 if [ "$(id -u)" -ne 0 ];then
    1726 echo "SKIP: Need root privileges"
    1727 @@ -438,6 +479,8 @@ check_exceptions "exceptions and block policies after htresh change to normal"
    1728
    1729 check_hthresh_repeat "policies with repeated htresh change"
    1730
    1731 +check_random_order ns3 "policies inserted in random order"
    1732 +
    1733 for i in 1 2 3 4;do ip netns del ns$i;done
    1734
    1735 exit $ret
    1736 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
    1737 index 8f3b40ec02b77..f25b5043cbcae 100644
    1738 --- a/virt/kvm/kvm_main.c
    1739 +++ b/virt/kvm/kvm_main.c
    1740 @@ -1017,6 +1017,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1741 /* We can read the guest memory with __xxx_user() later on. */
    1742 if ((id < KVM_USER_MEM_SLOTS) &&
    1743 ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
    1744 + (mem->userspace_addr != untagged_addr(mem->userspace_addr)) ||
    1745 !access_ok((void __user *)(unsigned long)mem->userspace_addr,
    1746 mem->memory_size)))
    1747 goto out;