commit: 44057bc98202b7cabc4a73afe25403b683bf7cac Author: Arisu Tachibana <alicef <AT> gentoo <DOT> org> AuthorDate: Fri Jul 11 02:28:48 2025 +0000 Commit: Arisu Tachibana <alicef <AT> gentoo <DOT> org> CommitDate: Fri Jul 11 02:28:48 2025 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=44057bc9
Linux patch 6.1.144 Signed-off-by: Arisu Tachibana <alicef <AT> gentoo.org> 0000_README | 4 + 1143_linux-6.1.144.patch | 3487 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3491 insertions(+) diff --git a/0000_README b/0000_README index 2f59f8f6..0c3f9638 100644 --- a/0000_README +++ b/0000_README @@ -615,6 +615,10 @@ Patch: 1142_linux-6.1.143.patch From: https://www.kernel.org Desc: Linux 6.1.143 +Patch: 1143_linux-6.1.144.patch +From: https://www.kernel.org +Desc: Linux 6.1.144 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1143_linux-6.1.144.patch b/1143_linux-6.1.144.patch new file mode 100644 index 00000000..adcd82ae --- /dev/null +++ b/1143_linux-6.1.144.patch @@ -0,0 +1,3487 @@ +diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu +index 1468609052c7a3..97e695efa95995 100644 +--- a/Documentation/ABI/testing/sysfs-devices-system-cpu ++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu +@@ -526,6 +526,7 @@ What: /sys/devices/system/cpu/vulnerabilities + /sys/devices/system/cpu/vulnerabilities/spectre_v1 + /sys/devices/system/cpu/vulnerabilities/spectre_v2 + /sys/devices/system/cpu/vulnerabilities/srbds ++ /sys/devices/system/cpu/vulnerabilities/tsa + /sys/devices/system/cpu/vulnerabilities/tsx_async_abort + Date: January 2018 + Contact: Linux kernel mailing list <[email protected]> +diff --git a/Documentation/ABI/testing/sysfs-driver-ufs b/Documentation/ABI/testing/sysfs-driver-ufs +index 228aa43e14ed5d..70f8c2e9c00d16 100644 +--- a/Documentation/ABI/testing/sysfs-driver-ufs ++++ b/Documentation/ABI/testing/sysfs-driver-ufs +@@ -711,7 +711,7 @@ Description: This file shows the thin provisioning type. This is one of + + The file is read only. + +-What: /sys/class/scsi_device/*/device/unit_descriptor/physical_memory_resourse_count ++What: /sys/class/scsi_device/*/device/unit_descriptor/physical_memory_resource_count + Date: February 2018 + Contact: Stanislav Nijnikov <[email protected]> + Description: This file shows the total physical memory resources. This is +diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst +index c98fd11907cc87..e916dc232b0f0c 100644 +--- a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst ++++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst +@@ -157,9 +157,7 @@ This is achieved by using the otherwise unused and obsolete VERW instruction in + combination with a microcode update. The microcode clears the affected CPU + buffers when the VERW instruction is executed. + +-Kernel reuses the MDS function to invoke the buffer clearing: +- +- mds_clear_cpu_buffers() ++Kernel does the buffer clearing with x86_clear_cpu_buffers(). + + On MDS affected CPUs, the kernel already invokes CPU buffer clear on + kernel/userspace, hypervisor/guest and C-state (idle) transitions. No +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 6938c8cd7a6f62..eaeabff9beff6a 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -6400,6 +6400,19 @@ + If not specified, "default" is used. In this case, + the RNG's choice is left to each individual trust source. + ++ tsa= [X86] Control mitigation for Transient Scheduler ++ Attacks on AMD CPUs. Search the following in your ++ favourite search engine for more details: ++ ++ "Technical guidance for mitigating transient scheduler ++ attacks". ++ ++ off - disable the mitigation ++ on - enable the mitigation (default) ++ user - mitigate only user/kernel transitions ++ vm - mitigate only guest/host transitions ++ ++ + tsc= Disable clocksource stability checks for TSC. + Format: <string> + [x86] reliable: mark tsc clocksource as reliable, this +diff --git a/Makefile b/Makefile +index 14e0e8bf3e74d9..4efcf0614caf4a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 1 +-SUBLEVEL = 143 ++SUBLEVEL = 144 + EXTRAVERSION = + NAME = Curry Ramen + +diff --git a/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi b/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi +index 3d15b8e2a6c1e6..6d78f623e6df5a 100644 +--- a/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi ++++ b/arch/arm64/boot/dts/apple/t8103-jxxx.dtsi +@@ -70,7 +70,7 @@ hpm1: usb-pd@3f { + */ + &port00 { + bus-range = <1 1>; +- wifi0: network@0,0 { ++ wifi0: wifi@0,0 { + compatible = "pci14e4,4425"; + reg = <0x10000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ +diff --git a/arch/powerpc/include/uapi/asm/ioctls.h b/arch/powerpc/include/uapi/asm/ioctls.h +index 2c145da3b774a1..b5211e413829a2 100644 +--- a/arch/powerpc/include/uapi/asm/ioctls.h ++++ b/arch/powerpc/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40147417 /* _IOR('t', 23, struct termio) */ ++#define TCSETA 0x80147418 /* _IOW('t', 24, struct termio) */ ++#define TCSETAW 0x80147419 /* _IOW('t', 25, struct termio) */ ++#define TCSETAF 0x8014741c /* _IOW('t', 28, struct termio) */ + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c +index b3961f1016ea0b..d969f36bf186f2 100644 +--- a/arch/s390/pci/pci_event.c ++++ b/arch/s390/pci/pci_event.c +@@ -98,6 +98,10 @@ static pci_ers_result_t zpci_event_do_error_state_clear(struct pci_dev *pdev, + struct zpci_dev *zdev = to_zpci(pdev); + int rc; + ++ /* The underlying device may have been disabled by the event */ ++ if (!zdev_enabled(zdev)) ++ return PCI_ERS_RESULT_NEED_RESET; ++ + pr_info("%s: Unblocking device access for examination\n", pci_name(pdev)); + rc = zpci_reset_load_store_blocked(zdev); + if (rc) { +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 8e66bb44335124..1da950b1d41ac9 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2586,6 +2586,15 @@ config MITIGATION_ITS + disabled, mitigation cannot be enabled via cmdline. + See <file:Documentation/admin-guide/hw-vuln/indirect-target-selection.rst> + ++config MITIGATION_TSA ++ bool "Mitigate Transient Scheduler Attacks" ++ depends on CPU_SUP_AMD ++ default y ++ help ++ Enable mitigation for Transient Scheduler Attacks. TSA is a hardware ++ security vulnerability on AMD CPUs which can lead to forwarding of ++ invalid info to subsequent instructions and thus can affect their ++ timing and thereby cause a leakage. + endif + + config ARCH_HAS_ADD_PAGES +diff --git a/arch/x86/entry/entry.S b/arch/x86/entry/entry.S +index bda217961172ba..057eeb4eda4e72 100644 +--- a/arch/x86/entry/entry.S ++++ b/arch/x86/entry/entry.S +@@ -31,20 +31,20 @@ EXPORT_SYMBOL_GPL(entry_ibpb); + + /* + * Define the VERW operand that is disguised as entry code so that +- * it can be referenced with KPTI enabled. This ensure VERW can be ++ * it can be referenced with KPTI enabled. This ensures VERW can be + * used late in exit-to-user path after page tables are switched. + */ + .pushsection .entry.text, "ax" + + .align L1_CACHE_BYTES, 0xcc +-SYM_CODE_START_NOALIGN(mds_verw_sel) ++SYM_CODE_START_NOALIGN(x86_verw_sel) + UNWIND_HINT_EMPTY + ANNOTATE_NOENDBR + .word __KERNEL_DS + .align L1_CACHE_BYTES, 0xcc +-SYM_CODE_END(mds_verw_sel); ++SYM_CODE_END(x86_verw_sel); + /* For KVM */ +-EXPORT_SYMBOL_GPL(mds_verw_sel); ++EXPORT_SYMBOL_GPL(x86_verw_sel); + + .popsection + +diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h +index 37639a2d9c34fc..c976bbf909e0c9 100644 +--- a/arch/x86/include/asm/cpu.h ++++ b/arch/x86/include/asm/cpu.h +@@ -98,4 +98,16 @@ extern u64 x86_read_arch_cap_msr(void); + + extern struct cpumask cpus_stop_mask; + ++union zen_patch_rev { ++ struct { ++ __u32 rev : 8, ++ stepping : 4, ++ model : 4, ++ __reserved : 4, ++ ext_model : 4, ++ ext_fam : 8; ++ }; ++ __u32 ucode_rev; ++}; ++ + #endif /* _ASM_X86_CPU_H */ +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 28edef597282e5..1c71f947b426a6 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -430,6 +430,7 @@ + #define X86_FEATURE_SME_COHERENT (19*32+10) /* "" AMD hardware-enforced cache coherency */ + + #define X86_FEATURE_AUTOIBRS (20*32+ 8) /* "" Automatic IBRS */ ++#define X86_FEATURE_VERW_CLEAR (20*32+ 10) /* "" The memory form of VERW mitigates TSA */ + #define X86_FEATURE_SBPB (20*32+27) /* "" Selective Branch Prediction Barrier */ + #define X86_FEATURE_IBPB_BRTYPE (20*32+28) /* "" MSR_PRED_CMD[IBPB] flushes all branch type predictions */ + #define X86_FEATURE_SRSO_NO (20*32+29) /* "" CPU is not affected by SRSO */ +@@ -447,6 +448,10 @@ + #define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4) /* "" Clear branch history at vmexit using SW loop */ + #define X86_FEATURE_INDIRECT_THUNK_ITS (21*32 + 5) /* "" Use thunk for indirect branches in lower half of cacheline */ + ++#define X86_FEATURE_TSA_SQ_NO (21*32+11) /* "" AMD CPU not vulnerable to TSA-SQ */ ++#define X86_FEATURE_TSA_L1_NO (21*32+12) /* "" AMD CPU not vulnerable to TSA-L1 */ ++#define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13) /* "" Clear CPU buffers using VERW before VMRUN */ ++ + /* + * BUG word(s) + */ +@@ -498,4 +503,5 @@ + #define X86_BUG_IBPB_NO_RET X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */ + #define X86_BUG_ITS X86_BUG(1*32 + 5) /* CPU is affected by Indirect Target Selection */ + #define X86_BUG_ITS_NATIVE_ONLY X86_BUG(1*32 + 6) /* CPU is affected by ITS, VMX is not affected */ ++#define X86_BUG_TSA X86_BUG(1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */ + #endif /* _ASM_X86_CPUFEATURES_H */ +diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h +index 7793e52d6237a4..b8ec2be2bbe4cb 100644 +--- a/arch/x86/include/asm/irqflags.h ++++ b/arch/x86/include/asm/irqflags.h +@@ -47,13 +47,13 @@ static __always_inline void native_irq_enable(void) + + static inline __cpuidle void native_safe_halt(void) + { +- mds_idle_clear_cpu_buffers(); ++ x86_idle_clear_cpu_buffers(); + asm volatile("sti; hlt": : :"memory"); + } + + static inline __cpuidle void native_halt(void) + { +- mds_idle_clear_cpu_buffers(); ++ x86_idle_clear_cpu_buffers(); + asm volatile("hlt": : :"memory"); + } + +diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h +index 3a8fdf881313d8..d938792c11d979 100644 +--- a/arch/x86/include/asm/mwait.h ++++ b/arch/x86/include/asm/mwait.h +@@ -44,8 +44,6 @@ static inline void __monitorx(const void *eax, unsigned long ecx, + + static inline void __mwait(unsigned long eax, unsigned long ecx) + { +- mds_idle_clear_cpu_buffers(); +- + /* "mwait %eax, %ecx;" */ + asm volatile(".byte 0x0f, 0x01, 0xc9;" + :: "a" (eax), "c" (ecx)); +@@ -80,7 +78,7 @@ static inline void __mwait(unsigned long eax, unsigned long ecx) + static inline void __mwaitx(unsigned long eax, unsigned long ebx, + unsigned long ecx) + { +- /* No MDS buffer clear as this is AMD/HYGON only */ ++ /* No need for TSA buffer clearing on AMD */ + + /* "mwaitx %eax, %ebx, %ecx;" */ + asm volatile(".byte 0x0f, 0x01, 0xfb;" +@@ -89,7 +87,7 @@ static inline void __mwaitx(unsigned long eax, unsigned long ebx, + + static inline void __sti_mwait(unsigned long eax, unsigned long ecx) + { +- mds_idle_clear_cpu_buffers(); ++ + /* "mwait %eax, %ecx;" */ + asm volatile("sti; .byte 0x0f, 0x01, 0xc9;" + :: "a" (eax), "c" (ecx)); +@@ -107,6 +105,11 @@ static inline void __sti_mwait(unsigned long eax, unsigned long ecx) + */ + static inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx) + { ++ if (need_resched()) ++ return; ++ ++ x86_idle_clear_cpu_buffers(); ++ + if (static_cpu_has_bug(X86_BUG_MONITOR) || !current_set_polling_and_test()) { + if (static_cpu_has_bug(X86_BUG_CLFLUSH_MONITOR)) { + mb(); +@@ -115,9 +118,13 @@ static inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx) + } + + __monitor((void *)¤t_thread_info()->flags, 0, 0); +- if (!need_resched()) +- __mwait(eax, ecx); ++ if (need_resched()) ++ goto out; ++ ++ __mwait(eax, ecx); + } ++ ++out: + current_clr_polling(); + } + +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index cccd5072e09f3d..c77a65a3e5f14a 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -202,27 +202,33 @@ + .endm + + /* +- * Macro to execute VERW instruction that mitigate transient data sampling +- * attacks such as MDS. On affected systems a microcode update overloaded VERW +- * instruction to also clear the CPU buffers. VERW clobbers CFLAGS.ZF. +- * ++ * Macro to execute VERW insns that mitigate transient data sampling ++ * attacks such as MDS or TSA. On affected systems a microcode update ++ * overloaded VERW insns to also clear the CPU buffers. VERW clobbers ++ * CFLAGS.ZF. + * Note: Only the memory operand variant of VERW clears the CPU buffers. + */ +-.macro CLEAR_CPU_BUFFERS +- ALTERNATIVE "jmp .Lskip_verw_\@", "", X86_FEATURE_CLEAR_CPU_BUF ++.macro __CLEAR_CPU_BUFFERS feature ++ ALTERNATIVE "jmp .Lskip_verw_\@", "", \feature + #ifdef CONFIG_X86_64 +- verw mds_verw_sel(%rip) ++ verw x86_verw_sel(%rip) + #else + /* + * In 32bit mode, the memory operand must be a %cs reference. The data + * segments may not be usable (vm86 mode), and the stack segment may not + * be flat (ESPFIX32). + */ +- verw %cs:mds_verw_sel ++ verw %cs:x86_verw_sel + #endif + .Lskip_verw_\@: + .endm + ++#define CLEAR_CPU_BUFFERS \ ++ __CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF ++ ++#define VM_CLEAR_CPU_BUFFERS \ ++ __CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF_VM ++ + #ifdef CONFIG_X86_64 + .macro CLEAR_BRANCH_HISTORY + ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP +@@ -427,24 +433,24 @@ DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp); + DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb); + DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb); + +-DECLARE_STATIC_KEY_FALSE(mds_idle_clear); ++DECLARE_STATIC_KEY_FALSE(cpu_buf_idle_clear); + + DECLARE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush); + + DECLARE_STATIC_KEY_FALSE(mmio_stale_data_clear); + +-extern u16 mds_verw_sel; ++extern u16 x86_verw_sel; + + #include <asm/segment.h> + + /** +- * mds_clear_cpu_buffers - Mitigation for MDS and TAA vulnerability ++ * x86_clear_cpu_buffers - Buffer clearing support for different x86 CPU vulns + * + * This uses the otherwise unused and obsolete VERW instruction in + * combination with microcode which triggers a CPU buffer flush when the + * instruction is executed. + */ +-static __always_inline void mds_clear_cpu_buffers(void) ++static __always_inline void x86_clear_cpu_buffers(void) + { + static const u16 ds = __KERNEL_DS; + +@@ -461,14 +467,15 @@ static __always_inline void mds_clear_cpu_buffers(void) + } + + /** +- * mds_idle_clear_cpu_buffers - Mitigation for MDS vulnerability ++ * x86_idle_clear_cpu_buffers - Buffer clearing support in idle for the MDS ++ * and TSA vulnerabilities. + * + * Clear CPU buffers if the corresponding static key is enabled + */ +-static inline void mds_idle_clear_cpu_buffers(void) ++static __always_inline void x86_idle_clear_cpu_buffers(void) + { +- if (static_branch_likely(&mds_idle_clear)) +- mds_clear_cpu_buffers(); ++ if (static_branch_likely(&cpu_buf_idle_clear)) ++ x86_clear_cpu_buffers(); + } + + #endif /* __ASSEMBLY__ */ +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 9ac93b4ba67b49..3e3679709e9032 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -553,6 +553,61 @@ static void early_init_amd_mc(struct cpuinfo_x86 *c) + #endif + } + ++static bool amd_check_tsa_microcode(void) ++{ ++ struct cpuinfo_x86 *c = &boot_cpu_data; ++ union zen_patch_rev p; ++ u32 min_rev = 0; ++ ++ p.ext_fam = c->x86 - 0xf; ++ p.model = c->x86_model; ++ p.stepping = c->x86_stepping; ++ ++ if (c->x86 == 0x19) { ++ switch (p.ucode_rev >> 8) { ++ case 0xa0011: min_rev = 0x0a0011d7; break; ++ case 0xa0012: min_rev = 0x0a00123b; break; ++ case 0xa0082: min_rev = 0x0a00820d; break; ++ case 0xa1011: min_rev = 0x0a10114c; break; ++ case 0xa1012: min_rev = 0x0a10124c; break; ++ case 0xa1081: min_rev = 0x0a108109; break; ++ case 0xa2010: min_rev = 0x0a20102e; break; ++ case 0xa2012: min_rev = 0x0a201211; break; ++ case 0xa4041: min_rev = 0x0a404108; break; ++ case 0xa5000: min_rev = 0x0a500012; break; ++ case 0xa6012: min_rev = 0x0a60120a; break; ++ case 0xa7041: min_rev = 0x0a704108; break; ++ case 0xa7052: min_rev = 0x0a705208; break; ++ case 0xa7080: min_rev = 0x0a708008; break; ++ case 0xa70c0: min_rev = 0x0a70c008; break; ++ case 0xaa002: min_rev = 0x0aa00216; break; ++ default: ++ pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", ++ __func__, p.ucode_rev, c->microcode); ++ return false; ++ } ++ } ++ ++ if (!min_rev) ++ return false; ++ ++ return c->microcode >= min_rev; ++} ++ ++static void tsa_init(struct cpuinfo_x86 *c) ++{ ++ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) ++ return; ++ ++ if (c->x86 == 0x19) { ++ if (amd_check_tsa_microcode()) ++ setup_force_cpu_cap(X86_FEATURE_VERW_CLEAR); ++ } else { ++ setup_force_cpu_cap(X86_FEATURE_TSA_SQ_NO); ++ setup_force_cpu_cap(X86_FEATURE_TSA_L1_NO); ++ } ++} ++ + static void bsp_init_amd(struct cpuinfo_x86 *c) + { + if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) { +@@ -663,6 +718,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c) + if (!(msr & MSR_K7_HWCR_SMMLOCK)) + goto clear_sev; + ++ ++ tsa_init(c); ++ + return; + + clear_all: +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 766cee7fa9056e..dba5262e150945 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -49,6 +49,7 @@ static void __init l1d_flush_select_mitigation(void); + static void __init gds_select_mitigation(void); + static void __init srso_select_mitigation(void); + static void __init its_select_mitigation(void); ++static void __init tsa_select_mitigation(void); + + /* The base value of the SPEC_CTRL MSR without task-specific bits set */ + u64 x86_spec_ctrl_base; +@@ -121,9 +122,9 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb); + /* Control unconditional IBPB in switch_mm() */ + DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb); + +-/* Control MDS CPU buffer clear before idling (halt, mwait) */ +-DEFINE_STATIC_KEY_FALSE(mds_idle_clear); +-EXPORT_SYMBOL_GPL(mds_idle_clear); ++/* Control CPU buffer clear before idling (halt, mwait) */ ++DEFINE_STATIC_KEY_FALSE(cpu_buf_idle_clear); ++EXPORT_SYMBOL_GPL(cpu_buf_idle_clear); + + /* + * Controls whether l1d flush based mitigations are enabled, +@@ -184,6 +185,7 @@ void __init cpu_select_mitigations(void) + srso_select_mitigation(); + gds_select_mitigation(); + its_select_mitigation(); ++ tsa_select_mitigation(); + } + + /* +@@ -444,7 +446,7 @@ static void __init mmio_select_mitigation(void) + * is required irrespective of SMT state. + */ + if (!(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) +- static_branch_enable(&mds_idle_clear); ++ static_branch_enable(&cpu_buf_idle_clear); + + /* + * Check if the system has the right microcode. +@@ -2028,10 +2030,10 @@ static void update_mds_branch_idle(void) + return; + + if (sched_smt_active()) { +- static_branch_enable(&mds_idle_clear); ++ static_branch_enable(&cpu_buf_idle_clear); + } else if (mmio_mitigation == MMIO_MITIGATION_OFF || + (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) { +- static_branch_disable(&mds_idle_clear); ++ static_branch_disable(&cpu_buf_idle_clear); + } + } + +@@ -2039,6 +2041,94 @@ static void update_mds_branch_idle(void) + #define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n" + #define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n" + ++#undef pr_fmt ++#define pr_fmt(fmt) "Transient Scheduler Attacks: " fmt ++ ++enum tsa_mitigations { ++ TSA_MITIGATION_NONE, ++ TSA_MITIGATION_UCODE_NEEDED, ++ TSA_MITIGATION_USER_KERNEL, ++ TSA_MITIGATION_VM, ++ TSA_MITIGATION_FULL, ++}; ++ ++static const char * const tsa_strings[] = { ++ [TSA_MITIGATION_NONE] = "Vulnerable", ++ [TSA_MITIGATION_UCODE_NEEDED] = "Vulnerable: Clear CPU buffers attempted, no microcode", ++ [TSA_MITIGATION_USER_KERNEL] = "Mitigation: Clear CPU buffers: user/kernel boundary", ++ [TSA_MITIGATION_VM] = "Mitigation: Clear CPU buffers: VM", ++ [TSA_MITIGATION_FULL] = "Mitigation: Clear CPU buffers", ++}; ++ ++static enum tsa_mitigations tsa_mitigation __ro_after_init = ++ IS_ENABLED(CONFIG_MITIGATION_TSA) ? TSA_MITIGATION_FULL : TSA_MITIGATION_NONE; ++ ++static int __init tsa_parse_cmdline(char *str) ++{ ++ if (!str) ++ return -EINVAL; ++ ++ if (!strcmp(str, "off")) ++ tsa_mitigation = TSA_MITIGATION_NONE; ++ else if (!strcmp(str, "on")) ++ tsa_mitigation = TSA_MITIGATION_FULL; ++ else if (!strcmp(str, "user")) ++ tsa_mitigation = TSA_MITIGATION_USER_KERNEL; ++ else if (!strcmp(str, "vm")) ++ tsa_mitigation = TSA_MITIGATION_VM; ++ else ++ pr_err("Ignoring unknown tsa=%s option.\n", str); ++ ++ return 0; ++} ++early_param("tsa", tsa_parse_cmdline); ++ ++static void __init tsa_select_mitigation(void) ++{ ++ if (tsa_mitigation == TSA_MITIGATION_NONE) ++ return; ++ ++ if (cpu_mitigations_off() || !boot_cpu_has_bug(X86_BUG_TSA)) { ++ tsa_mitigation = TSA_MITIGATION_NONE; ++ return; ++ } ++ ++ if (!boot_cpu_has(X86_FEATURE_VERW_CLEAR)) ++ tsa_mitigation = TSA_MITIGATION_UCODE_NEEDED; ++ ++ switch (tsa_mitigation) { ++ case TSA_MITIGATION_USER_KERNEL: ++ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF); ++ break; ++ ++ case TSA_MITIGATION_VM: ++ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM); ++ break; ++ ++ case TSA_MITIGATION_UCODE_NEEDED: ++ if (!boot_cpu_has(X86_FEATURE_HYPERVISOR)) ++ goto out; ++ ++ pr_notice("Forcing mitigation on in a VM\n"); ++ ++ /* ++ * On the off-chance that microcode has been updated ++ * on the host, enable the mitigation in the guest just ++ * in case. ++ */ ++ fallthrough; ++ case TSA_MITIGATION_FULL: ++ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF); ++ setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM); ++ break; ++ default: ++ break; ++ } ++ ++out: ++ pr_info("%s\n", tsa_strings[tsa_mitigation]); ++} ++ + void cpu_bugs_smt_update(void) + { + mutex_lock(&spec_ctrl_mutex); +@@ -2092,6 +2182,24 @@ void cpu_bugs_smt_update(void) + break; + } + ++ switch (tsa_mitigation) { ++ case TSA_MITIGATION_USER_KERNEL: ++ case TSA_MITIGATION_VM: ++ case TSA_MITIGATION_FULL: ++ case TSA_MITIGATION_UCODE_NEEDED: ++ /* ++ * TSA-SQ can potentially lead to info leakage between ++ * SMT threads. ++ */ ++ if (sched_smt_active()) ++ static_branch_enable(&cpu_buf_idle_clear); ++ else ++ static_branch_disable(&cpu_buf_idle_clear); ++ break; ++ case TSA_MITIGATION_NONE: ++ break; ++ } ++ + mutex_unlock(&spec_ctrl_mutex); + } + +@@ -3026,6 +3134,11 @@ static ssize_t srso_show_state(char *buf) + boot_cpu_has(X86_FEATURE_IBPB_BRTYPE) ? "" : ", no microcode"); + } + ++static ssize_t tsa_show_state(char *buf) ++{ ++ return sysfs_emit(buf, "%s\n", tsa_strings[tsa_mitigation]); ++} ++ + static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, + char *buf, unsigned int bug) + { +@@ -3087,6 +3200,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr + case X86_BUG_ITS: + return its_show_state(buf); + ++ case X86_BUG_TSA: ++ return tsa_show_state(buf); ++ + default: + break; + } +@@ -3171,4 +3287,9 @@ ssize_t cpu_show_indirect_target_selection(struct device *dev, struct device_att + { + return cpu_show_common(dev, attr, buf, X86_BUG_ITS); + } ++ ++ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_common(dev, attr, buf, X86_BUG_TSA); ++} + #endif +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 722eac51beae6f..9c849a4160cda7 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1256,6 +1256,8 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { + #define ITS BIT(8) + /* CPU is affected by Indirect Target Selection, but guest-host isolation is not affected */ + #define ITS_NATIVE_ONLY BIT(9) ++/* CPU is affected by Transient Scheduler Attacks */ ++#define TSA BIT(10) + + static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), +@@ -1303,7 +1305,7 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_AMD(0x16, RETBLEED), + VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO), + VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO), +- VULNBL_AMD(0x19, SRSO), ++ VULNBL_AMD(0x19, SRSO | TSA), + {} + }; + +@@ -1508,6 +1510,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) + setup_force_cpu_bug(X86_BUG_ITS_NATIVE_ONLY); + } + ++ if (c->x86_vendor == X86_VENDOR_AMD) { ++ if (!cpu_has(c, X86_FEATURE_TSA_SQ_NO) || ++ !cpu_has(c, X86_FEATURE_TSA_L1_NO)) { ++ if (cpu_matches(cpu_vuln_blacklist, TSA) || ++ /* Enable bug on Zen guests to allow for live migration. */ ++ (cpu_has(c, X86_FEATURE_HYPERVISOR) && cpu_has(c, X86_FEATURE_ZEN))) ++ setup_force_cpu_bug(X86_BUG_TSA); ++ } ++ } ++ + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) + return; + +diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c +index 28c357cf7c75ee..b9e39c9eb274c1 100644 +--- a/arch/x86/kernel/cpu/scattered.c ++++ b/arch/x86/kernel/cpu/scattered.c +@@ -45,6 +45,8 @@ static const struct cpuid_bit cpuid_bits[] = { + { X86_FEATURE_CPB, CPUID_EDX, 9, 0x80000007, 0 }, + { X86_FEATURE_PROC_FEEDBACK, CPUID_EDX, 11, 0x80000007, 0 }, + { X86_FEATURE_MBA, CPUID_EBX, 6, 0x80000008, 0 }, ++ { X86_FEATURE_TSA_SQ_NO, CPUID_ECX, 1, 0x80000021, 0 }, ++ { X86_FEATURE_TSA_L1_NO, CPUID_ECX, 2, 0x80000021, 0 }, + { X86_FEATURE_PERFMON_V2, CPUID_EAX, 0, 0x80000022, 0 }, + { X86_FEATURE_AMD_LBR_V2, CPUID_EAX, 1, 0x80000022, 0 }, + { X86_FEATURE_AMD_LBR_PMC_FREEZE, CPUID_EAX, 2, 0x80000022, 0 }, +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 50fe793498994d..1138b999cb14b2 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -887,6 +887,11 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) + */ + static __cpuidle void mwait_idle(void) + { ++ if (need_resched()) ++ return; ++ ++ x86_idle_clear_cpu_buffers(); ++ + if (!current_set_polling_and_test()) { + if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) { + mb(); /* quirk */ +@@ -895,13 +900,17 @@ static __cpuidle void mwait_idle(void) + } + + __monitor((void *)¤t_thread_info()->flags, 0, 0); +- if (!need_resched()) +- __sti_mwait(0, 0); +- else ++ if (need_resched()) { + raw_local_irq_enable(); ++ goto out; ++ } ++ ++ __sti_mwait(0, 0); + } else { + raw_local_irq_enable(); + } ++ ++out: + __current_clr_polling(); + } + +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 43b1df7ec18357..1bb5e8f6c63e47 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -758,6 +758,12 @@ void kvm_set_cpu_caps(void) + if (cpu_feature_enabled(X86_FEATURE_SRSO_NO)) + kvm_cpu_cap_set(X86_FEATURE_SRSO_NO); + ++ kvm_cpu_cap_mask(CPUID_8000_0021_EAX, F(VERW_CLEAR)); ++ ++ kvm_cpu_cap_init_kvm_defined(CPUID_8000_0021_ECX, ++ F(TSA_SQ_NO) | F(TSA_L1_NO) ++ ); ++ + /* + * Hide RDTSCP and RDPID if either feature is reported as supported but + * probing MSR_TSC_AUX failed. This is purely a sanity check and +@@ -1243,7 +1249,7 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) + entry->eax = entry->ebx = entry->ecx = entry->edx = 0; + break; + case 0x80000021: +- entry->ebx = entry->ecx = entry->edx = 0; ++ entry->ebx = entry->edx = 0; + /* + * Pass down these bits: + * EAX 0 NNDBP, Processor ignores nested data breakpoints +@@ -1259,6 +1265,7 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) + entry->eax |= BIT(2); + if (!static_cpu_has_bug(X86_BUG_NULL_SEG)) + entry->eax |= BIT(6); ++ cpuid_entry_override(entry, CPUID_8000_0021_ECX); + break; + /*Add support for Centaur's CPUID instruction*/ + case 0xC0000000: +diff --git a/arch/x86/kvm/reverse_cpuid.h b/arch/x86/kvm/reverse_cpuid.h +index e43909d6504afb..7fbd24fbf363d5 100644 +--- a/arch/x86/kvm/reverse_cpuid.h ++++ b/arch/x86/kvm/reverse_cpuid.h +@@ -14,6 +14,7 @@ + enum kvm_only_cpuid_leafs { + CPUID_12_EAX = NCAPINTS, + CPUID_7_2_EDX, ++ CPUID_8000_0021_ECX, + NR_KVM_CPU_CAPS, + + NKVMCAPINTS = NR_KVM_CPU_CAPS - NCAPINTS, +@@ -45,6 +46,10 @@ enum kvm_only_cpuid_leafs { + #define KVM_X86_FEATURE_BHI_CTRL KVM_X86_FEATURE(CPUID_7_2_EDX, 4) + #define X86_FEATURE_MCDT_NO KVM_X86_FEATURE(CPUID_7_2_EDX, 5) + ++/* CPUID level 0x80000021 (ECX) */ ++#define KVM_X86_FEATURE_TSA_SQ_NO KVM_X86_FEATURE(CPUID_8000_0021_ECX, 1) ++#define KVM_X86_FEATURE_TSA_L1_NO KVM_X86_FEATURE(CPUID_8000_0021_ECX, 2) ++ + struct cpuid_reg { + u32 function; + u32 index; +@@ -71,6 +76,7 @@ static const struct cpuid_reg reverse_cpuid[] = { + [CPUID_8000_001F_EAX] = {0x8000001f, 0, CPUID_EAX}, + [CPUID_8000_0021_EAX] = {0x80000021, 0, CPUID_EAX}, + [CPUID_7_2_EDX] = { 7, 2, CPUID_EDX}, ++ [CPUID_8000_0021_ECX] = {0x80000021, 0, CPUID_ECX}, + }; + + /* +@@ -107,6 +113,8 @@ static __always_inline u32 __feature_translate(int x86_feature) + KVM_X86_TRANSLATE_FEATURE(SGX2); + KVM_X86_TRANSLATE_FEATURE(RRSBA_CTRL); + KVM_X86_TRANSLATE_FEATURE(BHI_CTRL); ++ KVM_X86_TRANSLATE_FEATURE(TSA_SQ_NO); ++ KVM_X86_TRANSLATE_FEATURE(TSA_L1_NO); + default: + return x86_feature; + } +diff --git a/arch/x86/kvm/svm/vmenter.S b/arch/x86/kvm/svm/vmenter.S +index 5be9a63f09fff2..42824f9b06a25d 100644 +--- a/arch/x86/kvm/svm/vmenter.S ++++ b/arch/x86/kvm/svm/vmenter.S +@@ -166,6 +166,9 @@ SYM_FUNC_START(__svm_vcpu_run) + #endif + mov VCPU_RDI(%_ASM_DI), %_ASM_DI + ++ /* Clobbers EFLAGS.ZF */ ++ VM_CLEAR_CPU_BUFFERS ++ + /* Enter guest mode */ + sti + +@@ -336,6 +339,9 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) + mov SVM_current_vmcb(%_ASM_DI), %_ASM_AX + mov KVM_VMCB_pa(%_ASM_AX), %_ASM_AX + ++ /* Clobbers EFLAGS.ZF */ ++ VM_CLEAR_CPU_BUFFERS ++ + /* Enter guest mode */ + sti + +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 6bd25401bc01e9..fbe26b88f73127 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -7144,7 +7144,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu, + vmx_l1d_flush(vcpu); + else if (static_branch_unlikely(&mmio_stale_data_clear) && + kvm_arch_has_assigned_device(vcpu->kvm)) +- mds_clear_cpu_buffers(); ++ x86_clear_cpu_buffers(); + + vmx_disable_fb_clear(vmx); + +diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c +index 9332bc688713c4..05fd1ec8de14ef 100644 +--- a/drivers/acpi/acpica/dsmethod.c ++++ b/drivers/acpi/acpica/dsmethod.c +@@ -483,6 +483,13 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, + return_ACPI_STATUS(AE_NULL_OBJECT); + } + ++ if (this_walk_state->num_operands < obj_desc->method.param_count) { ++ ACPI_ERROR((AE_INFO, "Missing argument for method [%4.4s]", ++ acpi_ut_get_node_name(method_node))); ++ ++ return_ACPI_STATUS(AE_AML_UNINITIALIZED_ARG); ++ } ++ + /* Init for new method, possibly wait on method mutex */ + + status = +diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c +index 61b4ccf88bf1e6..1ad682d88c866d 100644 +--- a/drivers/ata/libata-acpi.c ++++ b/drivers/ata/libata-acpi.c +@@ -514,15 +514,19 @@ unsigned int ata_acpi_gtm_xfermask(struct ata_device *dev, + EXPORT_SYMBOL_GPL(ata_acpi_gtm_xfermask); + + /** +- * ata_acpi_cbl_80wire - Check for 80 wire cable ++ * ata_acpi_cbl_pata_type - Return PATA cable type + * @ap: Port to check +- * @gtm: GTM data to use + * +- * Return 1 if the @gtm indicates the BIOS selected an 80wire mode. ++ * Return ATA_CBL_PATA* according to the transfer mode selected by BIOS + */ +-int ata_acpi_cbl_80wire(struct ata_port *ap, const struct ata_acpi_gtm *gtm) ++int ata_acpi_cbl_pata_type(struct ata_port *ap) + { + struct ata_device *dev; ++ int ret = ATA_CBL_PATA_UNK; ++ const struct ata_acpi_gtm *gtm = ata_acpi_init_gtm(ap); ++ ++ if (!gtm) ++ return ATA_CBL_PATA40; + + ata_for_each_dev(dev, &ap->link, ENABLED) { + unsigned int xfer_mask, udma_mask; +@@ -530,13 +534,17 @@ int ata_acpi_cbl_80wire(struct ata_port *ap, const struct ata_acpi_gtm *gtm) + xfer_mask = ata_acpi_gtm_xfermask(dev, gtm); + ata_unpack_xfermask(xfer_mask, NULL, NULL, &udma_mask); + +- if (udma_mask & ~ATA_UDMA_MASK_40C) +- return 1; ++ ret = ATA_CBL_PATA40; ++ ++ if (udma_mask & ~ATA_UDMA_MASK_40C) { ++ ret = ATA_CBL_PATA80; ++ break; ++ } + } + +- return 0; ++ return ret; + } +-EXPORT_SYMBOL_GPL(ata_acpi_cbl_80wire); ++EXPORT_SYMBOL_GPL(ata_acpi_cbl_pata_type); + + static void ata_acpi_gtf_to_tf(struct ata_device *dev, + const struct ata_acpi_gtf *gtf, +diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c +index ab47aeb5587f55..13daa69914cbeb 100644 +--- a/drivers/ata/pata_cs5536.c ++++ b/drivers/ata/pata_cs5536.c +@@ -27,7 +27,7 @@ + #include <scsi/scsi_host.h> + #include <linux/dmi.h> + +-#ifdef CONFIG_X86_32 ++#if defined(CONFIG_X86) && defined(CONFIG_X86_32) + #include <asm/msr.h> + static int use_msr; + module_param_named(msr, use_msr, int, 0644); +diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c +index 5e2666b71aaff6..31d39038f020f5 100644 +--- a/drivers/ata/pata_via.c ++++ b/drivers/ata/pata_via.c +@@ -201,11 +201,9 @@ static int via_cable_detect(struct ata_port *ap) { + two drives */ + if (ata66 & (0x10100000 >> (16 * ap->port_no))) + return ATA_CBL_PATA80; ++ + /* Check with ACPI so we can spot BIOS reported SATA bridges */ +- if (ata_acpi_init_gtm(ap) && +- ata_acpi_cbl_80wire(ap, ata_acpi_init_gtm(ap))) +- return ATA_CBL_PATA80; +- return ATA_CBL_PATA40; ++ return ata_acpi_cbl_pata_type(ap); + } + + static int via_pre_reset(struct ata_link *link, unsigned long deadline) +diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c +index 27aff2503765ba..d68c60f357640c 100644 +--- a/drivers/base/cpu.c ++++ b/drivers/base/cpu.c +@@ -601,6 +601,11 @@ ssize_t __weak cpu_show_indirect_target_selection(struct device *dev, + return sysfs_emit(buf, "Not affected\n"); + } + ++ssize_t __weak cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return sysfs_emit(buf, "Not affected\n"); ++} ++ + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); + static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); + static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); +@@ -616,6 +621,7 @@ static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL); + static DEVICE_ATTR(spec_rstack_overflow, 0444, cpu_show_spec_rstack_overflow, NULL); + static DEVICE_ATTR(reg_file_data_sampling, 0444, cpu_show_reg_file_data_sampling, NULL); + static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL); ++static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL); + + static struct attribute *cpu_root_vulnerabilities_attrs[] = { + &dev_attr_meltdown.attr, +@@ -633,6 +639,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { + &dev_attr_spec_rstack_overflow.attr, + &dev_attr_reg_file_data_sampling.attr, + &dev_attr_indirect_target_selection.attr, ++ &dev_attr_tsa.attr, + NULL + }; + +diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h +index 749ae1246f4cf8..d35caa3c69e15e 100644 +--- a/drivers/block/aoe/aoe.h ++++ b/drivers/block/aoe/aoe.h +@@ -80,6 +80,7 @@ enum { + DEVFL_NEWSIZE = (1<<6), /* need to update dev size in block layer */ + DEVFL_FREEING = (1<<7), /* set when device is being cleaned up */ + DEVFL_FREED = (1<<8), /* device has been cleaned up */ ++ DEVFL_DEAD = (1<<9), /* device has timed out of aoe_deadsecs */ + }; + + enum { +diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c +index d1f4ddc576451a..c4c5cf1ec71ba9 100644 +--- a/drivers/block/aoe/aoecmd.c ++++ b/drivers/block/aoe/aoecmd.c +@@ -754,7 +754,7 @@ rexmit_timer(struct timer_list *timer) + + utgts = count_targets(d, NULL); + +- if (d->flags & DEVFL_TKILL) { ++ if (d->flags & (DEVFL_TKILL | DEVFL_DEAD)) { + spin_unlock_irqrestore(&d->lock, flags); + return; + } +@@ -786,7 +786,8 @@ rexmit_timer(struct timer_list *timer) + * to clean up. + */ + list_splice(&flist, &d->factive[0]); +- aoedev_downdev(d); ++ d->flags |= DEVFL_DEAD; ++ queue_work(aoe_wq, &d->work); + goto out; + } + +@@ -898,6 +899,9 @@ aoecmd_sleepwork(struct work_struct *work) + { + struct aoedev *d = container_of(work, struct aoedev, work); + ++ if (d->flags & DEVFL_DEAD) ++ aoedev_downdev(d); ++ + if (d->flags & DEVFL_GDALLOC) + aoeblk_gdalloc(d); + +diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c +index 280679bde3a506..4240e11adfb769 100644 +--- a/drivers/block/aoe/aoedev.c ++++ b/drivers/block/aoe/aoedev.c +@@ -200,8 +200,11 @@ aoedev_downdev(struct aoedev *d) + struct list_head *head, *pos, *nx; + struct request *rq, *rqnext; + int i; ++ unsigned long flags; + +- d->flags &= ~DEVFL_UP; ++ spin_lock_irqsave(&d->lock, flags); ++ d->flags &= ~(DEVFL_UP | DEVFL_DEAD); ++ spin_unlock_irqrestore(&d->lock, flags); + + /* clean out active and to-be-retransmitted buffers */ + for (i = 0; i < NFACTIVE; i++) { +diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c +index 759b4f80baeebc..1339d75900c0bc 100644 +--- a/drivers/dma-buf/dma-resv.c ++++ b/drivers/dma-buf/dma-resv.c +@@ -673,11 +673,13 @@ long dma_resv_wait_timeout(struct dma_resv *obj, enum dma_resv_usage usage, + dma_resv_iter_begin(&cursor, obj, usage); + dma_resv_for_each_fence_unlocked(&cursor, fence) { + +- ret = dma_fence_wait_timeout(fence, intr, ret); +- if (ret <= 0) { +- dma_resv_iter_end(&cursor); +- return ret; +- } ++ ret = dma_fence_wait_timeout(fence, intr, timeout); ++ if (ret <= 0) ++ break; ++ ++ /* Even for zero timeout the return value is 1 */ ++ if (timeout) ++ timeout = ret; + } + dma_resv_iter_end(&cursor); + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c +index 529033b980b203..0816714b1e581f 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c +@@ -188,6 +188,7 @@ struct fimd_context { + u32 i80ifcon; + bool i80_if; + bool suspended; ++ bool dp_clk_enabled; + wait_queue_head_t wait_vsync_queue; + atomic_t wait_vsync_event; + atomic_t win_updated; +@@ -1048,7 +1049,18 @@ static void fimd_dp_clock_enable(struct exynos_drm_clk *clk, bool enable) + struct fimd_context *ctx = container_of(clk, struct fimd_context, + dp_clk); + u32 val = enable ? DP_MIE_CLK_DP_ENABLE : DP_MIE_CLK_DISABLE; ++ ++ if (enable == ctx->dp_clk_enabled) ++ return; ++ ++ if (enable) ++ pm_runtime_resume_and_get(ctx->dev); ++ ++ ctx->dp_clk_enabled = enable; + writel(val, ctx->regs + DP_MIE_CLKCON); ++ ++ if (!enable) ++ pm_runtime_put(ctx->dev); + } + + static const struct exynos_drm_crtc_ops fimd_crtc_ops = { +diff --git a/drivers/gpu/drm/i915/gt/intel_gsc.c b/drivers/gpu/drm/i915/gt/intel_gsc.c +index 7af6db3194ddbf..0f83e1cedf781b 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gsc.c ++++ b/drivers/gpu/drm/i915/gt/intel_gsc.c +@@ -273,7 +273,7 @@ static void gsc_irq_handler(struct intel_gt *gt, unsigned int intf_id) + if (gt->gsc.intf[intf_id].irq < 0) + return; + +- ret = generic_handle_irq(gt->gsc.intf[intf_id].irq); ++ ret = generic_handle_irq_safe(gt->gsc.intf[intf_id].irq); + if (ret) + drm_err_ratelimited(>->i915->drm, "error handling GSC irq: %d\n", ret); + } +diff --git a/drivers/gpu/drm/i915/gt/intel_ring_submission.c b/drivers/gpu/drm/i915/gt/intel_ring_submission.c +index d5d6f1fadcae39..bb62a4b84d4e44 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ring_submission.c ++++ b/drivers/gpu/drm/i915/gt/intel_ring_submission.c +@@ -571,7 +571,6 @@ static int ring_context_alloc(struct intel_context *ce) + /* One ringbuffer to rule them all */ + GEM_BUG_ON(!engine->legacy.ring); + ce->ring = engine->legacy.ring; +- ce->timeline = intel_timeline_get(engine->legacy.timeline); + + GEM_BUG_ON(ce->state); + if (engine->context_size) { +@@ -584,6 +583,8 @@ static int ring_context_alloc(struct intel_context *ce) + ce->state = vma; + } + ++ ce->timeline = intel_timeline_get(engine->legacy.timeline); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/i915/selftests/i915_request.c b/drivers/gpu/drm/i915/selftests/i915_request.c +index a46350c37e9d49..a088fbca97e0c7 100644 +--- a/drivers/gpu/drm/i915/selftests/i915_request.c ++++ b/drivers/gpu/drm/i915/selftests/i915_request.c +@@ -73,8 +73,8 @@ static int igt_add_request(void *arg) + /* Basic preliminary test to create a request and let it loose! */ + + request = mock_request(rcs0(i915)->kernel_context, HZ / 10); +- if (!request) +- return -ENOMEM; ++ if (IS_ERR(request)) ++ return PTR_ERR(request); + + i915_request_add(request); + +@@ -91,8 +91,8 @@ static int igt_wait_request(void *arg) + /* Submit a request, then wait upon it */ + + request = mock_request(rcs0(i915)->kernel_context, T); +- if (!request) +- return -ENOMEM; ++ if (IS_ERR(request)) ++ return PTR_ERR(request); + + i915_request_get(request); + +@@ -160,8 +160,8 @@ static int igt_fence_wait(void *arg) + /* Submit a request, treat it as a fence and wait upon it */ + + request = mock_request(rcs0(i915)->kernel_context, T); +- if (!request) +- return -ENOMEM; ++ if (IS_ERR(request)) ++ return PTR_ERR(request); + + if (dma_fence_wait_timeout(&request->fence, false, T) != -ETIME) { + pr_err("fence wait success before submit (expected timeout)!\n"); +@@ -219,8 +219,8 @@ static int igt_request_rewind(void *arg) + GEM_BUG_ON(IS_ERR(ce)); + request = mock_request(ce, 2 * HZ); + intel_context_put(ce); +- if (!request) { +- err = -ENOMEM; ++ if (IS_ERR(request)) { ++ err = PTR_ERR(request); + goto err_context_0; + } + +@@ -237,8 +237,8 @@ static int igt_request_rewind(void *arg) + GEM_BUG_ON(IS_ERR(ce)); + vip = mock_request(ce, 0); + intel_context_put(ce); +- if (!vip) { +- err = -ENOMEM; ++ if (IS_ERR(vip)) { ++ err = PTR_ERR(vip); + goto err_context_1; + } + +diff --git a/drivers/gpu/drm/i915/selftests/mock_request.c b/drivers/gpu/drm/i915/selftests/mock_request.c +index 09f747228dff57..1b0cf073e9643f 100644 +--- a/drivers/gpu/drm/i915/selftests/mock_request.c ++++ b/drivers/gpu/drm/i915/selftests/mock_request.c +@@ -35,7 +35,7 @@ mock_request(struct intel_context *ce, unsigned long delay) + /* NB the i915->requests slab cache is enlarged to fit mock_request */ + request = intel_context_create_request(ce); + if (IS_ERR(request)) +- return NULL; ++ return request; + + request->mock.delay = delay; + return request; +diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c +index c12a6ac2d38407..572dd662e80957 100644 +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -71,6 +71,15 @@ void __msm_gem_submit_destroy(struct kref *kref) + container_of(kref, struct msm_gem_submit, ref); + unsigned i; + ++ /* ++ * In error paths, we could unref the submit without calling ++ * drm_sched_entity_push_job(), so msm_job_free() will never ++ * get called. Since drm_sched_job_cleanup() will NULL out ++ * s_fence, we can use that to detect this case. ++ */ ++ if (submit->base.s_fence) ++ drm_sched_job_cleanup(&submit->base); ++ + if (submit->fence_id) { + spin_lock(&submit->queue->idr_lock); + idr_remove(&submit->queue->fence_idr, submit->fence_id); +@@ -715,6 +724,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, + struct msm_ringbuffer *ring; + struct msm_submit_post_dep *post_deps = NULL; + struct drm_syncobj **syncobjs_to_reset = NULL; ++ struct sync_file *sync_file = NULL; + int out_fence_fd = -1; + bool has_ww_ticket = false; + unsigned i; +@@ -918,7 +928,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, + } + + if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) { +- struct sync_file *sync_file = sync_file_create(submit->user_fence); ++ sync_file = sync_file_create(submit->user_fence); + if (!sync_file) { + ret = -ENOMEM; + } else { +@@ -949,8 +959,11 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, + out_unlock: + mutex_unlock(&queue->lock); + out_post_unlock: +- if (ret && (out_fence_fd >= 0)) ++ if (ret && (out_fence_fd >= 0)) { + put_unused_fd(out_fence_fd); ++ if (sync_file) ++ fput(sync_file->file); ++ } + + if (!IS_ERR_OR_NULL(submit)) { + msm_gem_submit_put(submit); +diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h +index b74b1351bfc836..a366ea208787df 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.h ++++ b/drivers/gpu/drm/v3d/v3d_drv.h +@@ -62,6 +62,12 @@ struct v3d_perfmon { + u64 values[]; + }; + ++enum v3d_irq { ++ V3D_CORE_IRQ, ++ V3D_HUB_IRQ, ++ V3D_MAX_IRQS, ++}; ++ + struct v3d_dev { + struct drm_device drm; + +@@ -71,6 +77,8 @@ struct v3d_dev { + int ver; + bool single_irq_line; + ++ int irq[V3D_MAX_IRQS]; ++ + void __iomem *hub_regs; + void __iomem *core_regs[3]; + void __iomem *bridge_regs; +diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c +index b8980440d137f2..8b6450a96ebc39 100644 +--- a/drivers/gpu/drm/v3d/v3d_gem.c ++++ b/drivers/gpu/drm/v3d/v3d_gem.c +@@ -119,6 +119,8 @@ v3d_reset(struct v3d_dev *v3d) + if (false) + v3d_idle_axi(v3d, 0); + ++ v3d_irq_disable(v3d); ++ + v3d_idle_gca(v3d); + v3d_reset_v3d(v3d); + +diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c +index b2d59a16869728..641315dbee8b29 100644 +--- a/drivers/gpu/drm/v3d/v3d_irq.c ++++ b/drivers/gpu/drm/v3d/v3d_irq.c +@@ -215,7 +215,7 @@ v3d_hub_irq(int irq, void *arg) + int + v3d_irq_init(struct v3d_dev *v3d) + { +- int irq1, ret, core; ++ int irq, ret, core; + + INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); + +@@ -226,17 +226,24 @@ v3d_irq_init(struct v3d_dev *v3d) + V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); + V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); + +- irq1 = platform_get_irq_optional(v3d_to_pdev(v3d), 1); +- if (irq1 == -EPROBE_DEFER) +- return irq1; +- if (irq1 > 0) { +- ret = devm_request_irq(v3d->drm.dev, irq1, ++ irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1); ++ if (irq == -EPROBE_DEFER) ++ return irq; ++ if (irq > 0) { ++ v3d->irq[V3D_CORE_IRQ] = irq; ++ ++ ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], + v3d_irq, IRQF_SHARED, + "v3d_core0", v3d); + if (ret) + goto fail; +- ret = devm_request_irq(v3d->drm.dev, +- platform_get_irq(v3d_to_pdev(v3d), 0), ++ ++ irq = platform_get_irq(v3d_to_pdev(v3d), 0); ++ if (irq < 0) ++ return irq; ++ v3d->irq[V3D_HUB_IRQ] = irq; ++ ++ ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], + v3d_hub_irq, IRQF_SHARED, + "v3d_hub", v3d); + if (ret) +@@ -244,8 +251,12 @@ v3d_irq_init(struct v3d_dev *v3d) + } else { + v3d->single_irq_line = true; + +- ret = devm_request_irq(v3d->drm.dev, +- platform_get_irq(v3d_to_pdev(v3d), 0), ++ irq = platform_get_irq(v3d_to_pdev(v3d), 0); ++ if (irq < 0) ++ return irq; ++ v3d->irq[V3D_CORE_IRQ] = irq; ++ ++ ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], + v3d_irq, IRQF_SHARED, + "v3d", v3d); + if (ret) +@@ -286,6 +297,12 @@ v3d_irq_disable(struct v3d_dev *v3d) + V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); + V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + ++ /* Finish any interrupt handler still in flight. */ ++ for (int i = 0; i < V3D_MAX_IRQS; i++) { ++ if (v3d->irq[i]) ++ synchronize_irq(v3d->irq[i]); ++ } ++ + /* Clear any pending interrupts we might have left. */ + for (core = 0; core < v3d->cores; core++) + V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 948d547690c64b..a09e610d740cf5 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -298,6 +298,7 @@ static int amd_i2c_dw_xfer_quirk(struct i2c_adapter *adap, struct i2c_msg *msgs, + + dev->msgs = msgs; + dev->msgs_num = num_msgs; ++ dev->msg_write_idx = 0; + i2c_dw_xfer_init(dev); + i2c_dw_disable_int(dev); + +diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c +index 9915504ad1e182..39f71312e57a26 100644 +--- a/drivers/infiniband/hw/mlx5/counters.c ++++ b/drivers/infiniband/hw/mlx5/counters.c +@@ -308,7 +308,7 @@ static int do_get_hw_stats(struct ib_device *ibdev, + */ + goto done; + } +- ret = mlx5_lag_query_cong_counters(dev->mdev, ++ ret = mlx5_lag_query_cong_counters(mdev, + stats->value + + cnts->num_q_counters, + cnts->num_cong_counters, +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 7013ce20549bdc..cc126e62643a02 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1914,6 +1914,7 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, + /* Level1 is valid for future use, no need to free */ + return -ENOMEM; + ++ INIT_LIST_HEAD(&obj_event->obj_sub_list); + err = xa_insert(&event->object_ids, + key_level2, + obj_event, +@@ -1922,7 +1923,6 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, + kfree(obj_event); + return err; + } +- INIT_LIST_HEAD(&obj_event->obj_sub_list); + } + + return 0; +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index d05f220fdeee35..63e332f5237333 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -44,6 +44,12 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { + 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, + MMC_QUIRK_NO_UHS_DDR50_TUNING, EXT_CSD_REV_ANY), + ++ /* ++ * Some SD cards reports discard support while they don't ++ */ ++ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd, ++ MMC_QUIRK_BROKEN_SD_DISCARD), ++ + END_FIXUP + }; + +@@ -147,12 +153,6 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { + MMC_FIXUP("Q2J54A", CID_MANFID_MICRON, 0x014e, add_quirk_mmc, + MMC_QUIRK_TRIM_BROKEN | MMC_QUIRK_BROKEN_CACHE_FLUSH), + +- /* +- * Some SD cards reports discard support while they don't +- */ +- MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd, +- MMC_QUIRK_BROKEN_SD_DISCARD), +- + END_FIXUP + }; + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 04f6b8037e59b8..a766e34402cb88 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -756,12 +756,18 @@ static inline void msdc_dma_setup(struct msdc_host *host, struct msdc_dma *dma, + static void msdc_prepare_data(struct msdc_host *host, struct mmc_data *data) + { + if (!(data->host_cookie & MSDC_PREPARE_FLAG)) { +- data->host_cookie |= MSDC_PREPARE_FLAG; + data->sg_count = dma_map_sg(host->dev, data->sg, data->sg_len, + mmc_get_dma_dir(data)); ++ if (data->sg_count) ++ data->host_cookie |= MSDC_PREPARE_FLAG; + } + } + ++static bool msdc_data_prepared(struct mmc_data *data) ++{ ++ return data->host_cookie & MSDC_PREPARE_FLAG; ++} ++ + static void msdc_unprepare_data(struct msdc_host *host, struct mmc_data *data) + { + if (data->host_cookie & MSDC_ASYNC_FLAG) +@@ -1322,8 +1328,19 @@ static void msdc_ops_request(struct mmc_host *mmc, struct mmc_request *mrq) + WARN_ON(host->mrq); + host->mrq = mrq; + +- if (mrq->data) ++ if (mrq->data) { + msdc_prepare_data(host, mrq->data); ++ if (!msdc_data_prepared(mrq->data)) { ++ host->mrq = NULL; ++ /* ++ * Failed to prepare DMA area, fail fast before ++ * starting any commands. ++ */ ++ mrq->cmd->error = -ENOSPC; ++ mmc_request_done(mmc_from_priv(host), mrq); ++ return; ++ } ++ } + + /* if SBC is required, we have HW option and SW option. + * if HW option is enabled, and SBC does not have "special" flags, +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 6822a3249286c4..536d21028a116d 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2049,15 +2049,10 @@ void sdhci_set_clock(struct sdhci_host *host, unsigned int clock) + + host->mmc->actual_clock = 0; + +- clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL); +- if (clk & SDHCI_CLOCK_CARD_EN) +- sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, +- SDHCI_CLOCK_CONTROL); ++ sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); + +- if (clock == 0) { +- sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); ++ if (clock == 0) + return; +- } + + clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock); + sdhci_enable_clk(host, clk); +diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h +index 901482d5e73f72..9dd3cdd4ca20e7 100644 +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -820,4 +820,20 @@ void sdhci_switch_external_dma(struct sdhci_host *host, bool en); + void sdhci_set_data_timeout_irq(struct sdhci_host *host, bool enable); + void __sdhci_set_timeout(struct sdhci_host *host, struct mmc_command *cmd); + ++#if defined(CONFIG_DYNAMIC_DEBUG) || \ ++ (defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE)) ++#define SDHCI_DBG_ANYWAY 0 ++#elif defined(DEBUG) ++#define SDHCI_DBG_ANYWAY 1 ++#else ++#define SDHCI_DBG_ANYWAY 0 ++#endif ++ ++#define sdhci_dbg_dumpregs(host, fmt) \ ++do { \ ++ DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ ++ if (DYNAMIC_DEBUG_BRANCH(descriptor) || SDHCI_DBG_ANYWAY) \ ++ sdhci_dumpregs(host); \ ++} while (0) ++ + #endif /* __SDHCI_HW_H */ +diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c +index dacd9c0e8b202c..80e9646d205037 100644 +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -1314,6 +1314,7 @@ static void spinand_cleanup(struct spinand_device *spinand) + { + struct nand_device *nand = spinand_to_nand(spinand); + ++ nanddev_ecc_engine_cleanup(nand); + nanddev_cleanup(nand); + spinand_manufacturer_cleanup(spinand); + kfree(spinand->databuf); +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +index 466273b22f0a4d..893a52b2262b6e 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +@@ -1357,6 +1357,8 @@ + #define MDIO_VEND2_CTRL1_SS13 BIT(13) + #endif + ++#define XGBE_VEND2_MAC_AUTO_SW BIT(9) ++ + /* MDIO mask values */ + #define XGBE_AN_CL73_INT_CMPLT BIT(0) + #define XGBE_AN_CL73_INC_LINK BIT(1) +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 60be836b294bbe..19fed56b6ee3fd 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -363,6 +363,10 @@ static void xgbe_an37_set(struct xgbe_prv_data *pdata, bool enable, + reg |= MDIO_VEND2_CTRL1_AN_RESTART; + + XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_CTRL1, reg); ++ ++ reg = XMDIO_READ(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL); ++ reg |= XGBE_VEND2_MAC_AUTO_SW; ++ XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL, reg); + } + + static void xgbe_an37_restart(struct xgbe_prv_data *pdata) +@@ -991,6 +995,11 @@ static void xgbe_an37_init(struct xgbe_prv_data *pdata) + + netif_dbg(pdata, link, pdata->netdev, "CL37 AN (%s) initialized\n", + (pdata->an_mode == XGBE_AN_MODE_CL37) ? "BaseX" : "SGMII"); ++ ++ reg = XMDIO_READ(pdata, MDIO_MMD_AN, MDIO_CTRL1); ++ reg &= ~MDIO_AN_CTRL1_ENABLE; ++ XMDIO_WRITE(pdata, MDIO_MMD_AN, MDIO_CTRL1, reg); ++ + } + + static void xgbe_an73_init(struct xgbe_prv_data *pdata) +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h +index b17c7d1dc4b002..f3ba76530b67be 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -292,11 +292,11 @@ + #define XGBE_LINK_TIMEOUT 5 + #define XGBE_KR_TRAINING_WAIT_ITER 50 + +-#define XGBE_SGMII_AN_LINK_STATUS BIT(1) ++#define XGBE_SGMII_AN_LINK_DUPLEX BIT(1) + #define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3)) + #define XGBE_SGMII_AN_LINK_SPEED_100 0x04 + #define XGBE_SGMII_AN_LINK_SPEED_1000 0x08 +-#define XGBE_SGMII_AN_LINK_DUPLEX BIT(4) ++#define XGBE_SGMII_AN_LINK_STATUS BIT(4) + + /* ECC correctable error notification window (seconds) */ + #define XGBE_ECC_LIMIT 60 +diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c +index 02aa6fd8ebc2d4..4ed165702d58eb 100644 +--- a/drivers/net/ethernet/atheros/atlx/atl1.c ++++ b/drivers/net/ethernet/atheros/atlx/atl1.c +@@ -1861,14 +1861,21 @@ static u16 atl1_alloc_rx_buffers(struct atl1_adapter *adapter) + break; + } + +- buffer_info->alloced = 1; +- buffer_info->skb = skb; +- buffer_info->length = (u16) adapter->rx_buffer_len; + page = virt_to_page(skb->data); + offset = offset_in_page(skb->data); + buffer_info->dma = dma_map_page(&pdev->dev, page, offset, + adapter->rx_buffer_len, + DMA_FROM_DEVICE); ++ if (dma_mapping_error(&pdev->dev, buffer_info->dma)) { ++ kfree_skb(skb); ++ adapter->soft_stats.rx_dropped++; ++ break; ++ } ++ ++ buffer_info->alloced = 1; ++ buffer_info->skb = skb; ++ buffer_info->length = (u16)adapter->rx_buffer_len; ++ + rfd_desc->buffer_addr = cpu_to_le64(buffer_info->dma); + rfd_desc->buf_len = cpu_to_le16(adapter->rx_buffer_len); + rfd_desc->coalese = 0; +@@ -2183,8 +2190,8 @@ static int atl1_tx_csum(struct atl1_adapter *adapter, struct sk_buff *skb, + return 0; + } + +-static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, +- struct tx_packet_desc *ptpd) ++static bool atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, ++ struct tx_packet_desc *ptpd) + { + struct atl1_tpd_ring *tpd_ring = &adapter->tpd_ring; + struct atl1_buffer *buffer_info; +@@ -2194,6 +2201,7 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + unsigned int nr_frags; + unsigned int f; + int retval; ++ u16 first_mapped; + u16 next_to_use; + u16 data_len; + u8 hdr_len; +@@ -2201,6 +2209,7 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + buf_len -= skb->data_len; + nr_frags = skb_shinfo(skb)->nr_frags; + next_to_use = atomic_read(&tpd_ring->next_to_use); ++ first_mapped = next_to_use; + buffer_info = &tpd_ring->buffer_info[next_to_use]; + BUG_ON(buffer_info->skb); + /* put skb in last TPD */ +@@ -2216,6 +2225,8 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + buffer_info->dma = dma_map_page(&adapter->pdev->dev, page, + offset, hdr_len, + DMA_TO_DEVICE); ++ if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) ++ goto dma_err; + + if (++next_to_use == tpd_ring->count) + next_to_use = 0; +@@ -2242,6 +2253,9 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + page, offset, + buffer_info->length, + DMA_TO_DEVICE); ++ if (dma_mapping_error(&adapter->pdev->dev, ++ buffer_info->dma)) ++ goto dma_err; + if (++next_to_use == tpd_ring->count) + next_to_use = 0; + } +@@ -2254,6 +2268,8 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + buffer_info->dma = dma_map_page(&adapter->pdev->dev, page, + offset, buf_len, + DMA_TO_DEVICE); ++ if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) ++ goto dma_err; + if (++next_to_use == tpd_ring->count) + next_to_use = 0; + } +@@ -2277,6 +2293,9 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + buffer_info->dma = skb_frag_dma_map(&adapter->pdev->dev, + frag, i * ATL1_MAX_TX_BUF_LEN, + buffer_info->length, DMA_TO_DEVICE); ++ if (dma_mapping_error(&adapter->pdev->dev, ++ buffer_info->dma)) ++ goto dma_err; + + if (++next_to_use == tpd_ring->count) + next_to_use = 0; +@@ -2285,6 +2304,22 @@ static void atl1_tx_map(struct atl1_adapter *adapter, struct sk_buff *skb, + + /* last tpd's buffer-info */ + buffer_info->skb = skb; ++ ++ return true; ++ ++ dma_err: ++ while (first_mapped != next_to_use) { ++ buffer_info = &tpd_ring->buffer_info[first_mapped]; ++ dma_unmap_page(&adapter->pdev->dev, ++ buffer_info->dma, ++ buffer_info->length, ++ DMA_TO_DEVICE); ++ buffer_info->dma = 0; ++ ++ if (++first_mapped == tpd_ring->count) ++ first_mapped = 0; ++ } ++ return false; + } + + static void atl1_tx_queue(struct atl1_adapter *adapter, u16 count, +@@ -2355,10 +2390,8 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb, + + len = skb_headlen(skb); + +- if (unlikely(skb->len <= 0)) { +- dev_kfree_skb_any(skb); +- return NETDEV_TX_OK; +- } ++ if (unlikely(skb->len <= 0)) ++ goto drop_packet; + + nr_frags = skb_shinfo(skb)->nr_frags; + for (f = 0; f < nr_frags; f++) { +@@ -2371,10 +2404,9 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb, + if (mss) { + if (skb->protocol == htons(ETH_P_IP)) { + proto_hdr_len = skb_tcp_all_headers(skb); +- if (unlikely(proto_hdr_len > len)) { +- dev_kfree_skb_any(skb); +- return NETDEV_TX_OK; +- } ++ if (unlikely(proto_hdr_len > len)) ++ goto drop_packet; ++ + /* need additional TPD ? */ + if (proto_hdr_len != len) + count += (len - proto_hdr_len + +@@ -2406,23 +2438,26 @@ static netdev_tx_t atl1_xmit_frame(struct sk_buff *skb, + } + + tso = atl1_tso(adapter, skb, ptpd); +- if (tso < 0) { +- dev_kfree_skb_any(skb); +- return NETDEV_TX_OK; +- } ++ if (tso < 0) ++ goto drop_packet; + + if (!tso) { + ret_val = atl1_tx_csum(adapter, skb, ptpd); +- if (ret_val < 0) { +- dev_kfree_skb_any(skb); +- return NETDEV_TX_OK; +- } ++ if (ret_val < 0) ++ goto drop_packet; + } + +- atl1_tx_map(adapter, skb, ptpd); ++ if (!atl1_tx_map(adapter, skb, ptpd)) ++ goto drop_packet; ++ + atl1_tx_queue(adapter, count, ptpd); + atl1_update_mailbox(adapter); + return NETDEV_TX_OK; ++ ++drop_packet: ++ adapter->soft_stats.tx_errors++; ++ dev_kfree_skb_any(skb); ++ return NETDEV_TX_OK; + } + + static int atl1_rings_clean(struct napi_struct *napi, int budget) +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 2065c26f394db8..c76a91f85dac4e 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -2058,10 +2058,10 @@ static int enic_change_mtu(struct net_device *netdev, int new_mtu) + if (enic_is_dynamic(enic) || enic_is_sriov_vf(enic)) + return -EOPNOTSUPP; + +- if (netdev->mtu > enic->port_mtu) ++ if (new_mtu > enic->port_mtu) + netdev_warn(netdev, + "interface MTU (%d) set higher than port MTU (%d)\n", +- netdev->mtu, enic->port_mtu); ++ new_mtu, enic->port_mtu); + + return _enic_change_mtu(netdev, new_mtu); + } +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index bbbe7c5b5d35af..5ef117c9d0ecac 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -3729,6 +3729,7 @@ static int dpaa2_eth_setup_rx_flow(struct dpaa2_eth_priv *priv, + MEM_TYPE_PAGE_ORDER0, NULL); + if (err) { + dev_err(dev, "xdp_rxq_info_reg_mem_model failed\n"); ++ xdp_rxq_info_unreg(&fq->channel->xdp_rxq); + return err; + } + +@@ -4221,17 +4222,25 @@ static int dpaa2_eth_bind_dpni(struct dpaa2_eth_priv *priv) + return -EINVAL; + } + if (err) +- return err; ++ goto out; + } + + err = dpni_get_qdid(priv->mc_io, 0, priv->mc_token, + DPNI_QUEUE_TX, &priv->tx_qdid); + if (err) { + dev_err(dev, "dpni_get_qdid() failed\n"); +- return err; ++ goto out; + } + + return 0; ++ ++out: ++ while (i--) { ++ if (priv->fq[i].type == DPAA2_RX_FQ && ++ xdp_rxq_info_is_reg(&priv->fq[i].channel->xdp_rxq)) ++ xdp_rxq_info_unreg(&priv->fq[i].channel->xdp_rxq); ++ } ++ return err; + } + + /* Allocate rings for storing incoming frame descriptors */ +@@ -4588,6 +4597,17 @@ static void dpaa2_eth_del_ch_napi(struct dpaa2_eth_priv *priv) + } + } + ++static void dpaa2_eth_free_rx_xdp_rxq(struct dpaa2_eth_priv *priv) ++{ ++ int i; ++ ++ for (i = 0; i < priv->num_fqs; i++) { ++ if (priv->fq[i].type == DPAA2_RX_FQ && ++ xdp_rxq_info_is_reg(&priv->fq[i].channel->xdp_rxq)) ++ xdp_rxq_info_unreg(&priv->fq[i].channel->xdp_rxq); ++ } ++} ++ + static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev) + { + struct device *dev; +@@ -4786,6 +4806,7 @@ static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev) + free_percpu(priv->percpu_stats); + err_alloc_percpu_stats: + dpaa2_eth_del_ch_napi(priv); ++ dpaa2_eth_free_rx_xdp_rxq(priv); + err_bind: + dpaa2_eth_free_dpbp(priv); + err_dpbp_setup: +@@ -4840,6 +4861,7 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) + free_percpu(priv->percpu_extras); + + dpaa2_eth_del_ch_napi(priv); ++ dpaa2_eth_free_rx_xdp_rxq(priv); + dpaa2_eth_free_dpbp(priv); + dpaa2_eth_free_dpio(priv); + dpaa2_eth_free_dpni(priv); +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 082f78beeb4ed6..ca3fd02708102e 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -6553,6 +6553,10 @@ static int igc_probe(struct pci_dev *pdev, + adapter->port_num = hw->bus.func; + adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE); + ++ /* Disable ASPM L1.2 on I226 devices to avoid packet loss */ ++ if (igc_is_device_id_i226(hw)) ++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2); ++ + err = pci_save_state(pdev); + if (err) + goto err_ioremap; +@@ -6920,6 +6924,9 @@ static int __maybe_unused igc_resume(struct device *dev) + pci_enable_wake(pdev, PCI_D3hot, 0); + pci_enable_wake(pdev, PCI_D3cold, 0); + ++ if (igc_is_device_id_i226(hw)) ++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L1_2); ++ + if (igc_init_interrupt_scheme(adapter, true)) { + netdev_err(netdev, "Unable to allocate memory for queues\n"); + return -ENOMEM; +@@ -7035,6 +7042,9 @@ static pci_ers_result_t igc_io_slot_reset(struct pci_dev *pdev) + pci_enable_wake(pdev, PCI_D3hot, 0); + pci_enable_wake(pdev, PCI_D3cold, 0); + ++ if (igc_is_device_id_i226(hw)) ++ pci_disable_link_state_locked(pdev, PCIE_LINK_STATE_L1_2); ++ + /* In case of PCI error, adapter loses its HW address + * so we should re-assign it here. + */ +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 4bbf011d53e69a..2b38cb4fdaeb8b 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -3336,7 +3336,7 @@ static int niu_rbr_add_page(struct niu *np, struct rx_ring_info *rp, + + addr = np->ops->map_page(np->device, page, 0, + PAGE_SIZE, DMA_FROM_DEVICE); +- if (!addr) { ++ if (np->ops->mapping_error(np->device, addr)) { + __free_page(page); + return -ENOMEM; + } +@@ -6672,6 +6672,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, + len = skb_headlen(skb); + mapping = np->ops->map_single(np->device, skb->data, + len, DMA_TO_DEVICE); ++ if (np->ops->mapping_error(np->device, mapping)) ++ goto out_drop; + + prod = rp->prod; + +@@ -6713,6 +6715,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, + mapping = np->ops->map_page(np->device, skb_frag_page(frag), + skb_frag_off(frag), len, + DMA_TO_DEVICE); ++ if (np->ops->mapping_error(np->device, mapping)) ++ goto out_unmap; + + rp->tx_buffs[prod].skb = NULL; + rp->tx_buffs[prod].mapping = mapping; +@@ -6737,6 +6741,19 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb, + out: + return NETDEV_TX_OK; + ++out_unmap: ++ while (i--) { ++ const skb_frag_t *frag; ++ ++ prod = PREVIOUS_TX(rp, prod); ++ frag = &skb_shinfo(skb)->frags[i]; ++ np->ops->unmap_page(np->device, rp->tx_buffs[prod].mapping, ++ skb_frag_size(frag), DMA_TO_DEVICE); ++ } ++ ++ np->ops->unmap_single(np->device, rp->tx_buffs[rp->prod].mapping, ++ skb_headlen(skb), DMA_TO_DEVICE); ++ + out_drop: + rp->tx_errors++; + kfree_skb(skb); +@@ -9636,6 +9653,11 @@ static void niu_pci_unmap_single(struct device *dev, u64 dma_address, + dma_unmap_single(dev, dma_address, size, direction); + } + ++static int niu_pci_mapping_error(struct device *dev, u64 addr) ++{ ++ return dma_mapping_error(dev, addr); ++} ++ + static const struct niu_ops niu_pci_ops = { + .alloc_coherent = niu_pci_alloc_coherent, + .free_coherent = niu_pci_free_coherent, +@@ -9643,6 +9665,7 @@ static const struct niu_ops niu_pci_ops = { + .unmap_page = niu_pci_unmap_page, + .map_single = niu_pci_map_single, + .unmap_single = niu_pci_unmap_single, ++ .mapping_error = niu_pci_mapping_error, + }; + + static void niu_driver_version(void) +@@ -10009,6 +10032,11 @@ static void niu_phys_unmap_single(struct device *dev, u64 dma_address, + /* Nothing to do. */ + } + ++static int niu_phys_mapping_error(struct device *dev, u64 dma_address) ++{ ++ return false; ++} ++ + static const struct niu_ops niu_phys_ops = { + .alloc_coherent = niu_phys_alloc_coherent, + .free_coherent = niu_phys_free_coherent, +@@ -10016,6 +10044,7 @@ static const struct niu_ops niu_phys_ops = { + .unmap_page = niu_phys_unmap_page, + .map_single = niu_phys_map_single, + .unmap_single = niu_phys_unmap_single, ++ .mapping_error = niu_phys_mapping_error, + }; + + static int niu_of_probe(struct platform_device *op) +diff --git a/drivers/net/ethernet/sun/niu.h b/drivers/net/ethernet/sun/niu.h +index 04c215f91fc08e..0b169c08b0f2d1 100644 +--- a/drivers/net/ethernet/sun/niu.h ++++ b/drivers/net/ethernet/sun/niu.h +@@ -2879,6 +2879,9 @@ struct tx_ring_info { + #define NEXT_TX(tp, index) \ + (((index) + 1) < (tp)->pending ? ((index) + 1) : 0) + ++#define PREVIOUS_TX(tp, index) \ ++ (((index) - 1) >= 0 ? ((index) - 1) : (((tp)->pending) - 1)) ++ + static inline u32 niu_tx_avail(struct tx_ring_info *tp) + { + return (tp->pending - +@@ -3140,6 +3143,7 @@ struct niu_ops { + enum dma_data_direction direction); + void (*unmap_single)(struct device *dev, u64 dma_address, + size_t size, enum dma_data_direction direction); ++ int (*mapping_error)(struct device *dev, u64 dma_address); + }; + + struct niu_link_config { +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index feff1265cad6fb..0f1c9009d793eb 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -4231,8 +4231,6 @@ static void lan78xx_disconnect(struct usb_interface *intf) + + set_bit(EVENT_DEV_DISCONNECT, &dev->flags); + +- netif_napi_del(&dev->napi); +- + udev = interface_to_usbdev(intf); + net = dev->net; + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 11aa0a7d54cd7d..1b4cf8eb7e1365 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -440,6 +440,26 @@ static unsigned int mergeable_ctx_to_truesize(void *mrg_ctx) + return (unsigned long)mrg_ctx & ((1 << MRG_CTX_HEADER_SHIFT) - 1); + } + ++static int check_mergeable_len(struct net_device *dev, void *mrg_ctx, ++ unsigned int len) ++{ ++ unsigned int headroom, tailroom, room, truesize; ++ ++ truesize = mergeable_ctx_to_truesize(mrg_ctx); ++ headroom = mergeable_ctx_to_headroom(mrg_ctx); ++ tailroom = headroom ? sizeof(struct skb_shared_info) : 0; ++ room = SKB_DATA_ALIGN(headroom + tailroom); ++ ++ if (len > truesize - room) { ++ pr_debug("%s: rx error: len %u exceeds truesize %lu\n", ++ dev->name, len, (unsigned long)(truesize - room)); ++ DEV_STATS_INC(dev, rx_length_errors); ++ return -1; ++ } ++ ++ return 0; ++} ++ + /* Called from bottom half context */ + static struct sk_buff *page_to_skb(struct virtnet_info *vi, + struct receive_queue *rq, +@@ -719,7 +739,8 @@ static unsigned int virtnet_get_headroom(struct virtnet_info *vi) + * across multiple buffers (num_buf > 1), and we make sure buffers + * have enough headroom. + */ +-static struct page *xdp_linearize_page(struct receive_queue *rq, ++static struct page *xdp_linearize_page(struct net_device *dev, ++ struct receive_queue *rq, + u16 *num_buf, + struct page *p, + int offset, +@@ -739,18 +760,27 @@ static struct page *xdp_linearize_page(struct receive_queue *rq, + memcpy(page_address(page) + page_off, page_address(p) + offset, *len); + page_off += *len; + ++ /* Only mergeable mode can go inside this while loop. In small mode, ++ * *num_buf == 1, so it cannot go inside. ++ */ + while (--*num_buf) { + unsigned int buflen; + void *buf; ++ void *ctx; + int off; + +- buf = virtqueue_get_buf(rq->vq, &buflen); ++ buf = virtqueue_get_buf_ctx(rq->vq, &buflen, &ctx); + if (unlikely(!buf)) + goto err_buf; + + p = virt_to_head_page(buf); + off = buf - page_address(p); + ++ if (check_mergeable_len(dev, ctx, buflen)) { ++ put_page(p); ++ goto err_buf; ++ } ++ + /* guard against a misconfigured or uncooperative backend that + * is sending packet larger than the MTU. + */ +@@ -831,7 +861,7 @@ static struct sk_buff *receive_small(struct net_device *dev, + headroom = vi->hdr_len + header_offset; + buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) + + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); +- xdp_page = xdp_linearize_page(rq, &num_buf, page, ++ xdp_page = xdp_linearize_page(dev, rq, &num_buf, page, + offset, header_offset, + &tlen); + if (!xdp_page) +@@ -1006,7 +1036,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, + if (unlikely(num_buf > 1 || + headroom < virtnet_get_headroom(vi))) { + /* linearize data for XDP */ +- xdp_page = xdp_linearize_page(rq, &num_buf, ++ xdp_page = xdp_linearize_page(dev, rq, &num_buf, + page, offset, + VIRTIO_XDP_HEADROOM, + &len); +diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c +index af98e871199d31..5a9e93fd1ef42a 100644 +--- a/drivers/net/wireless/ath/ath6kl/bmi.c ++++ b/drivers/net/wireless/ath/ath6kl/bmi.c +@@ -87,7 +87,9 @@ int ath6kl_bmi_get_target_info(struct ath6kl *ar, + * We need to do some backwards compatibility to make this work. + */ + if (le32_to_cpu(targ_info->byte_count) != sizeof(*targ_info)) { +- WARN_ON(1); ++ ath6kl_err("mismatched byte count %d vs. expected %zd\n", ++ le32_to_cpu(targ_info->byte_count), ++ sizeof(*targ_info)); + return -EINVAL; + } + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index 9925a6d94affcc..d8565490e48702 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -253,7 +253,8 @@ static int mlxbf_tmfifo_alloc_vrings(struct mlxbf_tmfifo *fifo, + vring->align = SMP_CACHE_BYTES; + vring->index = i; + vring->vdev_id = tm_vdev->vdev.id.device; +- vring->drop_desc.len = VRING_DROP_DESC_MAX_LEN; ++ vring->drop_desc.len = cpu_to_virtio32(&tm_vdev->vdev, ++ VRING_DROP_DESC_MAX_LEN); + dev = &tm_vdev->vdev.dev; + + size = vring_size(vring->num, vring->align); +diff --git a/drivers/platform/mellanox/mlxreg-lc.c b/drivers/platform/mellanox/mlxreg-lc.c +index 8d833836a6d322..74e9d78ff01efe 100644 +--- a/drivers/platform/mellanox/mlxreg-lc.c ++++ b/drivers/platform/mellanox/mlxreg-lc.c +@@ -688,7 +688,7 @@ static int mlxreg_lc_completion_notify(void *handle, struct i2c_adapter *parent, + if (regval & mlxreg_lc->data->mask) { + mlxreg_lc->state |= MLXREG_LC_SYNCED; + mlxreg_lc_state_update_locked(mlxreg_lc, MLXREG_LC_SYNCED, 1); +- if (mlxreg_lc->state & ~MLXREG_LC_POWERED) { ++ if (!(mlxreg_lc->state & MLXREG_LC_POWERED)) { + err = mlxreg_lc_power_on_off(mlxreg_lc, 1); + if (err) + goto mlxreg_lc_regmap_power_on_off_fail; +diff --git a/drivers/platform/mellanox/nvsw-sn2201.c b/drivers/platform/mellanox/nvsw-sn2201.c +index f53baf7e78e746..03fbbbe1c8756d 100644 +--- a/drivers/platform/mellanox/nvsw-sn2201.c ++++ b/drivers/platform/mellanox/nvsw-sn2201.c +@@ -1084,7 +1084,7 @@ static int nvsw_sn2201_i2c_completion_notify(void *handle, int id) + if (!nvsw_sn2201->main_mux_devs->adapter) { + err = -ENODEV; + dev_err(nvsw_sn2201->dev, "Failed to get adapter for bus %d\n", +- nvsw_sn2201->cpld_devs->nr); ++ nvsw_sn2201->main_mux_devs->nr); + goto i2c_get_adapter_main_fail; + } + +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h b/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h +index 3ad33a094588c6..817ee7ba07ca08 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/dell-wmi-sysman.h +@@ -89,6 +89,11 @@ extern struct wmi_sysman_priv wmi_priv; + + enum { ENUM, INT, STR, PO }; + ++#define ENUM_MIN_ELEMENTS 8 ++#define INT_MIN_ELEMENTS 9 ++#define STR_MIN_ELEMENTS 8 ++#define PO_MIN_ELEMENTS 4 ++ + enum { + ATTR_NAME, + DISPL_NAME_LANG_CODE, +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c +index 8cc212c8526683..fc2f58b4cbc6ef 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c +@@ -23,9 +23,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a + obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_ENUMERATION_ATTRIBUTE_GUID); + if (!obj) + return -EIO; +- if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { ++ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < ENUM_MIN_ELEMENTS || ++ obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { + kfree(obj); +- return -EINVAL; ++ return -EIO; + } + ret = snprintf(buf, PAGE_SIZE, "%s\n", obj->package.elements[CURRENT_VAL].string.pointer); + kfree(obj); +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c +index 951e75b538fad4..73524806423914 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/int-attributes.c +@@ -25,9 +25,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a + obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_INTEGER_ATTRIBUTE_GUID); + if (!obj) + return -EIO; +- if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_INTEGER) { ++ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < INT_MIN_ELEMENTS || ++ obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_INTEGER) { + kfree(obj); +- return -EINVAL; ++ return -EIO; + } + ret = snprintf(buf, PAGE_SIZE, "%lld\n", obj->package.elements[CURRENT_VAL].integer.value); + kfree(obj); +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c +index d8f1bf5e58a0f4..3167e06d416ede 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c +@@ -26,9 +26,10 @@ static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr + obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_PASSOBJ_ATTRIBUTE_GUID); + if (!obj) + return -EIO; +- if (obj->package.elements[IS_PASS_SET].type != ACPI_TYPE_INTEGER) { ++ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < PO_MIN_ELEMENTS || ++ obj->package.elements[IS_PASS_SET].type != ACPI_TYPE_INTEGER) { + kfree(obj); +- return -EINVAL; ++ return -EIO; + } + ret = snprintf(buf, PAGE_SIZE, "%lld\n", obj->package.elements[IS_PASS_SET].integer.value); + kfree(obj); +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c +index c392f0ecf8b55b..0d2c74f8d1aad7 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/string-attributes.c +@@ -25,9 +25,10 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a + obj = get_wmiobj_pointer(instance_id, DELL_WMI_BIOS_STRING_ATTRIBUTE_GUID); + if (!obj) + return -EIO; +- if (obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { ++ if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < STR_MIN_ELEMENTS || ++ obj->package.elements[CURRENT_VAL].type != ACPI_TYPE_STRING) { + kfree(obj); +- return -EINVAL; ++ return -EIO; + } + ret = snprintf(buf, PAGE_SIZE, "%s\n", obj->package.elements[CURRENT_VAL].string.pointer); + kfree(obj); +diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c +index 3ef90211c51a63..fb5eb4342c6ed3 100644 +--- a/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c ++++ b/drivers/platform/x86/dell/dell-wmi-sysman/sysman.c +@@ -411,10 +411,10 @@ static int init_bios_attributes(int attr_type, const char *guid) + return retval; + + switch (attr_type) { +- case ENUM: min_elements = 8; break; +- case INT: min_elements = 9; break; +- case STR: min_elements = 8; break; +- case PO: min_elements = 4; break; ++ case ENUM: min_elements = ENUM_MIN_ELEMENTS; break; ++ case INT: min_elements = INT_MIN_ELEMENTS; break; ++ case STR: min_elements = STR_MIN_ELEMENTS; break; ++ case PO: min_elements = PO_MIN_ELEMENTS; break; + default: + pr_err("Error: Unknown attr_type: %d\n", attr_type); + return -EINVAL; +@@ -605,7 +605,7 @@ static int __init sysman_init(void) + release_attributes_data(); + + err_destroy_classdev: +- device_destroy(fw_attr_class, MKDEV(0, 0)); ++ device_unregister(wmi_priv.class_dev); + + err_unregister_class: + fw_attributes_class_put(); +@@ -622,7 +622,7 @@ static int __init sysman_init(void) + static void __exit sysman_exit(void) + { + release_attributes_data(); +- device_destroy(fw_attr_class, MKDEV(0, 0)); ++ device_unregister(wmi_priv.class_dev); + fw_attributes_class_put(); + exit_bios_attr_set_interface(); + exit_bios_attr_pass_interface(); +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 6641f934f15bfb..e7605bc97f2b08 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1208,19 +1208,22 @@ static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd); + /* ---- Initialisation --------------------------------------------------------- */ + static void tlmi_release_attr(void) + { ++ struct kobject *pos, *n; + int i; + + /* Attribute structures */ + for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { + if (tlmi_priv.setting[i]) { + sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); +- kobject_put(&tlmi_priv.setting[i]->kobj); + } + } + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); + if (tlmi_priv.can_debug_cmd && debug_support) + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); + ++ list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry) ++ kobject_put(pos); ++ + kset_unregister(tlmi_priv.attribute_kset); + + /* Free up any saved signatures */ +@@ -1229,19 +1232,17 @@ static void tlmi_release_attr(void) + + /* Authentication structures */ + sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_admin->kobj); + sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_power->kobj); + + if (tlmi_priv.opcode_support) { + sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_system->kobj); + sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_hdd->kobj); + sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_nvme->kobj); + } + ++ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry) ++ kobject_put(pos); ++ + kset_unregister(tlmi_priv.authentication_kset); + } + +@@ -1285,6 +1286,14 @@ static int tlmi_sysfs_init(void) + goto fail_device_created; + } + ++ tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, ++ &tlmi_priv.class_dev->kobj); ++ if (!tlmi_priv.authentication_kset) { ++ kset_unregister(tlmi_priv.attribute_kset); ++ ret = -ENOMEM; ++ goto fail_device_created; ++ } ++ + for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { + /* Check if index is a valid setting - skip if it isn't */ + if (!tlmi_priv.setting[i]) +@@ -1301,8 +1310,8 @@ static int tlmi_sysfs_init(void) + + /* Build attribute */ + tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; +- ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, +- "%s", tlmi_priv.setting[i]->display_name); ++ ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype, ++ NULL, "%s", tlmi_priv.setting[i]->display_name); + if (ret) + goto fail_create_attr; + +@@ -1322,14 +1331,9 @@ static int tlmi_sysfs_init(void) + } + + /* Create authentication entries */ +- tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, +- &tlmi_priv.class_dev->kobj); +- if (!tlmi_priv.authentication_kset) { +- ret = -ENOMEM; +- goto fail_create_attr; +- } + tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "Admin"); + if (ret) + goto fail_create_attr; + +@@ -1338,7 +1342,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "Power-on"); + if (ret) + goto fail_create_attr; + +@@ -1348,7 +1353,8 @@ static int tlmi_sysfs_init(void) + + if (tlmi_priv.opcode_support) { + tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "System"); + if (ret) + goto fail_create_attr; + +@@ -1357,7 +1363,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "HDD"); + if (ret) + goto fail_create_attr; + +@@ -1366,7 +1373,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "NVMe"); + if (ret) + goto fail_create_attr; + +@@ -1380,7 +1388,7 @@ static int tlmi_sysfs_init(void) + fail_create_attr: + tlmi_release_attr(); + fail_device_created: +- device_destroy(fw_attr_class, MKDEV(0, 0)); ++ device_unregister(tlmi_priv.class_dev); + fail_class_created: + fw_attributes_class_put(); + return ret; +@@ -1404,8 +1412,6 @@ static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type, + new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; + new_pwd->index = 0; + +- kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); +- + return new_pwd; + } + +@@ -1510,7 +1516,6 @@ static int tlmi_analyze(void) + if (setting->possible_values) + strreplace(setting->possible_values, ',', ';'); + +- kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); + tlmi_priv.setting[i] = setting; + kfree(item); + } +@@ -1602,7 +1607,7 @@ static int tlmi_analyze(void) + static void tlmi_remove(struct wmi_device *wdev) + { + tlmi_release_attr(); +- device_destroy(fw_attr_class, MKDEV(0, 0)); ++ device_unregister(tlmi_priv.class_dev); + fw_attributes_class_put(); + } + +diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c +index 95e61a2f43f5d1..b34671eb49b52d 100644 +--- a/drivers/regulator/gpio-regulator.c ++++ b/drivers/regulator/gpio-regulator.c +@@ -260,8 +260,10 @@ static int gpio_regulator_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- drvdata->gpiods = devm_kzalloc(dev, sizeof(struct gpio_desc *), +- GFP_KERNEL); ++ drvdata->gpiods = devm_kcalloc(dev, config->ngpios, ++ sizeof(struct gpio_desc *), GFP_KERNEL); ++ if (!drvdata->gpiods) ++ return -ENOMEM; + + if (config->input_supply) { + drvdata->desc.supply_name = devm_kstrdup(&pdev->dev, +@@ -274,8 +276,6 @@ static int gpio_regulator_probe(struct platform_device *pdev) + } + } + +- if (!drvdata->gpiods) +- return -ENOMEM; + for (i = 0; i < config->ngpios; i++) { + drvdata->gpiods[i] = devm_gpiod_get_index(dev, + NULL, +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 5f43773900d182..1442c629d0d550 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -697,8 +697,12 @@ static irqreturn_t cmos_interrupt(int irq, void *p) + { + u8 irqstat; + u8 rtc_control; ++ unsigned long flags; + +- spin_lock(&rtc_lock); ++ /* We cannot use spin_lock() here, as cmos_interrupt() is also called ++ * in a non-irq context. ++ */ ++ spin_lock_irqsave(&rtc_lock, flags); + + /* When the HPET interrupt handler calls us, the interrupt + * status is passed as arg1 instead of the irq number. But +@@ -732,7 +736,7 @@ static irqreturn_t cmos_interrupt(int irq, void *p) + hpet_mask_rtc_irq_bit(RTC_AIE); + CMOS_READ(RTC_INTR_FLAGS); + } +- spin_unlock(&rtc_lock); ++ spin_unlock_irqrestore(&rtc_lock, flags); + + if (is_intr(irqstat)) { + rtc_update_irq(p, 1, irqstat); +@@ -1289,9 +1293,7 @@ static void cmos_check_wkalrm(struct device *dev) + * ACK the rtc irq here + */ + if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) { +- local_irq_disable(); + cmos_interrupt(0, (void *)cmos->rtc); +- local_irq_enable(); + return; + } + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 1fd9485985f2e5..77b23d9dcb3c6e 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -2147,7 +2147,7 @@ qla24xx_get_port_database(scsi_qla_host_t *vha, u16 nport_handle, + + pdb_dma = dma_map_single(&vha->hw->pdev->dev, pdb, + sizeof(*pdb), DMA_FROM_DEVICE); +- if (!pdb_dma) { ++ if (dma_mapping_error(&vha->hw->pdev->dev, pdb_dma)) { + ql_log(ql_log_warn, vha, 0x1116, "Failed to map dma buffer.\n"); + return QLA_MEMORY_ALLOC_FAILED; + } +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 3f2f9734ee42ef..2925823a494a62 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -3420,6 +3420,8 @@ static int qla4xxx_alloc_pdu(struct iscsi_task *task, uint8_t opcode) + task_data->data_dma = dma_map_single(&ha->pdev->dev, task->data, + task->data_count, + DMA_TO_DEVICE); ++ if (dma_mapping_error(&ha->pdev->dev, task_data->data_dma)) ++ return -ENOMEM; + } + + DEBUG2(ql4_printk(KERN_INFO, ha, "%s: MaxRecvLen %u, iscsi hrd %d\n", +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 5374c6d44519ab..3a33156f52740f 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -964,11 +964,20 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE) { + status = dspi_dma_xfer(dspi); + } else { ++ /* ++ * Reinitialize the completion before transferring data ++ * to avoid the case where it might remain in the done ++ * state due to a spurious interrupt from a previous ++ * transfer. This could falsely signal that the current ++ * transfer has completed. ++ */ ++ if (dspi->irq) ++ reinit_completion(&dspi->xfer_done); ++ + dspi_fifo_write(dspi); + + if (dspi->irq) { + wait_for_completion(&dspi->xfer_done); +- reinit_completion(&dspi->xfer_done); + } else { + do { + status = dspi_poll(dspi); +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c +index 1493b1d01194fc..a355661e820278 100644 +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -1841,7 +1841,9 @@ core_scsi3_decode_spec_i_port( + } + + kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); +- core_scsi3_lunacl_undepend_item(dest_se_deve); ++ ++ if (dest_se_deve) ++ core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (is_local) + continue; +diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c +index 17e38979b82239..ff30e2d22d906d 100644 +--- a/drivers/ufs/core/ufs-sysfs.c ++++ b/drivers/ufs/core/ufs-sysfs.c +@@ -1262,7 +1262,7 @@ UFS_UNIT_DESC_PARAM(logical_block_size, _LOGICAL_BLK_SIZE, 1); + UFS_UNIT_DESC_PARAM(logical_block_count, _LOGICAL_BLK_COUNT, 8); + UFS_UNIT_DESC_PARAM(erase_block_size, _ERASE_BLK_SIZE, 4); + UFS_UNIT_DESC_PARAM(provisioning_type, _PROVISIONING_TYPE, 1); +-UFS_UNIT_DESC_PARAM(physical_memory_resourse_count, _PHY_MEM_RSRC_CNT, 8); ++UFS_UNIT_DESC_PARAM(physical_memory_resource_count, _PHY_MEM_RSRC_CNT, 8); + UFS_UNIT_DESC_PARAM(context_capabilities, _CTX_CAPABILITIES, 2); + UFS_UNIT_DESC_PARAM(large_unit_granularity, _LARGE_UNIT_SIZE_M1, 1); + UFS_UNIT_DESC_PARAM(hpb_lu_max_active_regions, _HPB_LU_MAX_ACTIVE_RGNS, 2); +@@ -1282,7 +1282,7 @@ static struct attribute *ufs_sysfs_unit_descriptor[] = { + &dev_attr_logical_block_count.attr, + &dev_attr_erase_block_size.attr, + &dev_attr_provisioning_type.attr, +- &dev_attr_physical_memory_resourse_count.attr, ++ &dev_attr_physical_memory_resource_count.attr, + &dev_attr_context_capabilities.attr, + &dev_attr_large_unit_granularity.attr, + &dev_attr_hpb_lu_max_active_regions.attr, +diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c +index 6247584cb93913..c9ad4280f4ba23 100644 +--- a/drivers/usb/cdns3/cdnsp-ring.c ++++ b/drivers/usb/cdns3/cdnsp-ring.c +@@ -772,7 +772,9 @@ static int cdnsp_update_port_id(struct cdnsp_device *pdev, u32 port_id) + } + + if (port_id != old_port) { +- cdnsp_disable_slot(pdev); ++ if (pdev->slot_id) ++ cdnsp_disable_slot(pdev); ++ + pdev->active_port = port; + cdnsp_enable_slot(pdev); + } +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index c979ecd0169a2d..46db600fdd824e 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -227,7 +227,8 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech HD Webcam C270 */ +- { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME | ++ USB_QUIRK_NO_LPM}, + + /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */ + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, +diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c +index 0f8f08f60ceb29..4346a316c77ab0 100644 +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -639,6 +639,10 @@ static void xhci_dbc_stop(struct xhci_dbc *dbc) + case DS_DISABLED: + return; + case DS_CONFIGURED: ++ spin_lock(&dbc->lock); ++ xhci_dbc_flush_requests(dbc); ++ spin_unlock(&dbc->lock); ++ + if (dbc->driver->disconnect) + dbc->driver->disconnect(dbc); + break; +diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c +index 6dd7e8c8eed087..daf021daaa7e00 100644 +--- a/drivers/usb/host/xhci-dbgtty.c ++++ b/drivers/usb/host/xhci-dbgtty.c +@@ -586,6 +586,7 @@ int dbc_tty_init(void) + dbc_tty_driver->type = TTY_DRIVER_TYPE_SERIAL; + dbc_tty_driver->subtype = SERIAL_TYPE_NORMAL; + dbc_tty_driver->init_termios = tty_std_termios; ++ dbc_tty_driver->init_termios.c_lflag &= ~ECHO; + dbc_tty_driver->init_termios.c_cflag = + B9600 | CS8 | CREAD | HUPCL | CLOCAL; + dbc_tty_driver->init_termios.c_ispeed = 9600; +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 59f1cb68e65796..6704bd76e157eb 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -351,7 +351,8 @@ static int xhci_plat_probe(struct platform_device *pdev) + } + + usb3_hcd = xhci_get_usb3_hcd(xhci); +- if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4) ++ if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4 && ++ !(xhci->quirks & XHCI_BROKEN_STREAMS)) + usb3_hcd->can_do_streams = 1; + + if (xhci->shared_hcd) { +diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c +index 26e0e72f4f166e..89897902968923 100644 +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -321,8 +321,7 @@ static int dp_altmode_vdm(struct typec_altmode *alt, + case CMDT_RSP_NAK: + switch (cmd) { + case DP_CMD_STATUS_UPDATE: +- if (typec_altmode_exit(alt)) +- dev_err(&dp->alt->dev, "Exit Mode Failed!\n"); ++ dp->state = DP_STATE_EXIT; + break; + case DP_CMD_CONFIGURE: + dp->data.conf = 0; +@@ -525,7 +524,7 @@ static ssize_t pin_assignment_show(struct device *dev, + + assignments = get_current_pin_assignments(dp); + +- for (i = 0; assignments; assignments >>= 1, i++) { ++ for (i = 0; assignments && i < DP_PIN_ASSIGN_MAX; assignments >>= 1, i++) { + if (assignments & 1) { + if (i == cur) + len += sprintf(buf + len, "[%s] ", +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index f7f97cd3cdf061..5ecc2f3dc3a993 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4856,7 +4856,6 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry) + struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info; + int err = 0; + struct btrfs_trans_handle *trans; +- u64 last_unlink_trans; + struct fscrypt_name fname; + + if (inode->i_size > BTRFS_EMPTY_DIR_SIZE) +@@ -4891,8 +4890,6 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry) + if (err) + goto out; + +- last_unlink_trans = BTRFS_I(inode)->last_unlink_trans; +- + /* now the directory is empty */ + err = btrfs_unlink_inode(trans, BTRFS_I(dir), BTRFS_I(d_inode(dentry)), + &fname.disk_name); +@@ -4909,8 +4906,8 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry) + * 5) mkdir foo + * 6) fsync foo or some file inside foo + */ +- if (last_unlink_trans >= trans->transid) +- BTRFS_I(dir)->last_unlink_trans = last_unlink_trans; ++ if (BTRFS_I(inode)->last_unlink_trans >= trans->transid) ++ btrfs_record_snapshot_destroy(trans, BTRFS_I(dir)); + } + out: + btrfs_end_transaction(trans); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index fdc432b3352a9d..982dc92bdf1df3 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1085,7 +1085,9 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, + search_key.type = BTRFS_INODE_REF_KEY; + search_key.offset = parent_objectid; + ret = btrfs_search_slot(NULL, root, &search_key, path, 0, 0); +- if (ret == 0) { ++ if (ret < 0) { ++ return ret; ++ } else if (ret == 0) { + struct btrfs_inode_ref *victim_ref; + unsigned long ptr; + unsigned long ptr_end; +@@ -1158,13 +1160,13 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, + struct fscrypt_str victim_name; + + extref = (struct btrfs_inode_extref *)(base + cur_offset); ++ victim_name.len = btrfs_inode_extref_name_len(leaf, extref); + + if (btrfs_inode_extref_parent(leaf, extref) != parent_objectid) + goto next; + + ret = read_alloc_one_name(leaf, &extref->name, +- btrfs_inode_extref_name_len(leaf, extref), +- &victim_name); ++ victim_name.len, &victim_name); + if (ret) + return ret; + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 07e5ea64dcd687..aa55b5df065bcc 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1096,6 +1096,7 @@ static void ff_layout_reset_read(struct nfs_pgio_header *hdr) + } + + static int ff_layout_async_handle_error_v4(struct rpc_task *task, ++ u32 op_status, + struct nfs4_state *state, + struct nfs_client *clp, + struct pnfs_layout_segment *lseg, +@@ -1106,32 +1107,42 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); + struct nfs4_slot_table *tbl = &clp->cl_session->fc_slot_table; + +- switch (task->tk_status) { +- case -NFS4ERR_BADSESSION: +- case -NFS4ERR_BADSLOT: +- case -NFS4ERR_BAD_HIGH_SLOT: +- case -NFS4ERR_DEADSESSION: +- case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION: +- case -NFS4ERR_SEQ_FALSE_RETRY: +- case -NFS4ERR_SEQ_MISORDERED: ++ switch (op_status) { ++ case NFS4_OK: ++ case NFS4ERR_NXIO: ++ break; ++ case NFSERR_PERM: ++ if (!task->tk_xprt) ++ break; ++ xprt_force_disconnect(task->tk_xprt); ++ goto out_retry; ++ case NFS4ERR_BADSESSION: ++ case NFS4ERR_BADSLOT: ++ case NFS4ERR_BAD_HIGH_SLOT: ++ case NFS4ERR_DEADSESSION: ++ case NFS4ERR_CONN_NOT_BOUND_TO_SESSION: ++ case NFS4ERR_SEQ_FALSE_RETRY: ++ case NFS4ERR_SEQ_MISORDERED: + dprintk("%s ERROR %d, Reset session. Exchangeid " + "flags 0x%x\n", __func__, task->tk_status, + clp->cl_exchange_flags); + nfs4_schedule_session_recovery(clp->cl_session, task->tk_status); +- break; +- case -NFS4ERR_DELAY: +- case -NFS4ERR_GRACE: ++ goto out_retry; ++ case NFS4ERR_DELAY: ++ nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); ++ fallthrough; ++ case NFS4ERR_GRACE: + rpc_delay(task, FF_LAYOUT_POLL_RETRY_MAX); +- break; +- case -NFS4ERR_RETRY_UNCACHED_REP: +- break; ++ goto out_retry; ++ case NFS4ERR_RETRY_UNCACHED_REP: ++ goto out_retry; + /* Invalidate Layout errors */ +- case -NFS4ERR_PNFS_NO_LAYOUT: +- case -ESTALE: /* mapped NFS4ERR_STALE */ +- case -EBADHANDLE: /* mapped NFS4ERR_BADHANDLE */ +- case -EISDIR: /* mapped NFS4ERR_ISDIR */ +- case -NFS4ERR_FHEXPIRED: +- case -NFS4ERR_WRONG_TYPE: ++ case NFS4ERR_PNFS_NO_LAYOUT: ++ case NFS4ERR_STALE: ++ case NFS4ERR_BADHANDLE: ++ case NFS4ERR_ISDIR: ++ case NFS4ERR_FHEXPIRED: ++ case NFS4ERR_WRONG_TYPE: + dprintk("%s Invalid layout error %d\n", __func__, + task->tk_status); + /* +@@ -1144,6 +1155,11 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + pnfs_destroy_layout(NFS_I(inode)); + rpc_wake_up(&tbl->slot_tbl_waitq); + goto reset; ++ default: ++ break; ++ } ++ ++ switch (task->tk_status) { + /* RPC connection errors */ + case -ECONNREFUSED: + case -EHOSTDOWN: +@@ -1159,26 +1175,56 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + nfs4_delete_deviceid(devid->ld, devid->nfs_client, + &devid->deviceid); + rpc_wake_up(&tbl->slot_tbl_waitq); +- fallthrough; ++ break; + default: +- if (ff_layout_avoid_mds_available_ds(lseg)) +- return -NFS4ERR_RESET_TO_PNFS; +-reset: +- dprintk("%s Retry through MDS. Error %d\n", __func__, +- task->tk_status); +- return -NFS4ERR_RESET_TO_MDS; ++ break; + } ++ ++ if (ff_layout_avoid_mds_available_ds(lseg)) ++ return -NFS4ERR_RESET_TO_PNFS; ++reset: ++ dprintk("%s Retry through MDS. Error %d\n", __func__, ++ task->tk_status); ++ return -NFS4ERR_RESET_TO_MDS; ++ ++out_retry: + task->tk_status = 0; + return -EAGAIN; + } + + /* Retry all errors through either pNFS or MDS except for -EJUKEBOX */ + static int ff_layout_async_handle_error_v3(struct rpc_task *task, ++ u32 op_status, ++ struct nfs_client *clp, + struct pnfs_layout_segment *lseg, + u32 idx) + { + struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); + ++ switch (op_status) { ++ case NFS_OK: ++ case NFSERR_NXIO: ++ break; ++ case NFSERR_PERM: ++ if (!task->tk_xprt) ++ break; ++ xprt_force_disconnect(task->tk_xprt); ++ goto out_retry; ++ case NFSERR_ACCES: ++ case NFSERR_BADHANDLE: ++ case NFSERR_FBIG: ++ case NFSERR_IO: ++ case NFSERR_NOSPC: ++ case NFSERR_ROFS: ++ case NFSERR_STALE: ++ goto out_reset_to_pnfs; ++ case NFSERR_JUKEBOX: ++ nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY); ++ goto out_retry; ++ default: ++ break; ++ } ++ + switch (task->tk_status) { + /* File access problems. Don't mark the device as unavailable */ + case -EACCES: +@@ -1197,6 +1243,7 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, + nfs4_delete_deviceid(devid->ld, devid->nfs_client, + &devid->deviceid); + } ++out_reset_to_pnfs: + /* FIXME: Need to prevent infinite looping here. */ + return -NFS4ERR_RESET_TO_PNFS; + out_retry: +@@ -1207,6 +1254,7 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, + } + + static int ff_layout_async_handle_error(struct rpc_task *task, ++ u32 op_status, + struct nfs4_state *state, + struct nfs_client *clp, + struct pnfs_layout_segment *lseg, +@@ -1225,10 +1273,11 @@ static int ff_layout_async_handle_error(struct rpc_task *task, + + switch (vers) { + case 3: +- return ff_layout_async_handle_error_v3(task, lseg, idx); +- case 4: +- return ff_layout_async_handle_error_v4(task, state, clp, ++ return ff_layout_async_handle_error_v3(task, op_status, clp, + lseg, idx); ++ case 4: ++ return ff_layout_async_handle_error_v4(task, op_status, state, ++ clp, lseg, idx); + default: + /* should never happen */ + WARN_ON_ONCE(1); +@@ -1281,6 +1330,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg, + switch (status) { + case NFS4ERR_DELAY: + case NFS4ERR_GRACE: ++ case NFS4ERR_PERM: + break; + case NFS4ERR_NXIO: + ff_layout_mark_ds_unreachable(lseg, idx); +@@ -1313,7 +1363,8 @@ static int ff_layout_read_done_cb(struct rpc_task *task, + trace_ff_layout_read_error(hdr); + } + +- err = ff_layout_async_handle_error(task, hdr->args.context->state, ++ err = ff_layout_async_handle_error(task, hdr->res.op_status, ++ hdr->args.context->state, + hdr->ds_clp, hdr->lseg, + hdr->pgio_mirror_idx); + +@@ -1483,7 +1534,8 @@ static int ff_layout_write_done_cb(struct rpc_task *task, + trace_ff_layout_write_error(hdr); + } + +- err = ff_layout_async_handle_error(task, hdr->args.context->state, ++ err = ff_layout_async_handle_error(task, hdr->res.op_status, ++ hdr->args.context->state, + hdr->ds_clp, hdr->lseg, + hdr->pgio_mirror_idx); + +@@ -1529,8 +1581,9 @@ static int ff_layout_commit_done_cb(struct rpc_task *task, + trace_ff_layout_commit_error(data); + } + +- err = ff_layout_async_handle_error(task, NULL, data->ds_clp, +- data->lseg, data->ds_commit_index); ++ err = ff_layout_async_handle_error(task, data->res.op_status, ++ NULL, data->ds_clp, data->lseg, ++ data->ds_commit_index); + + trace_nfs4_pnfs_commit_ds(data, err); + switch (err) { +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index e774cfc85eeedb..627410be2e884c 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -2431,15 +2431,26 @@ EXPORT_SYMBOL_GPL(nfs_net_id); + static int nfs_net_init(struct net *net) + { + struct nfs_net *nn = net_generic(net, nfs_net_id); ++ int err; + + nfs_clients_init(net); + + if (!rpc_proc_register(net, &nn->rpcstats)) { +- nfs_clients_exit(net); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto err_proc_rpc; + } + +- return nfs_fs_proc_net_init(net); ++ err = nfs_fs_proc_net_init(net); ++ if (err) ++ goto err_proc_nfs; ++ ++ return 0; ++ ++err_proc_nfs: ++ rpc_proc_unregister(net, "nfs"); ++err_proc_rpc: ++ nfs_clients_exit(net); ++ return err; + } + + static void nfs_net_exit(struct net *net) +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index fe0ddbce3bcb25..7f48e0d870bdbb 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1930,8 +1930,10 @@ static void nfs_layoutget_begin(struct pnfs_layout_hdr *lo) + static void nfs_layoutget_end(struct pnfs_layout_hdr *lo) + { + if (atomic_dec_and_test(&lo->plh_outstanding) && +- test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) ++ test_and_clear_bit(NFS_LAYOUT_DRAIN, &lo->plh_flags)) { ++ smp_mb__after_atomic(); + wake_up_bit(&lo->plh_flags, NFS_LAYOUT_DRAIN); ++ } + } + + static bool pnfs_is_first_layoutget(struct pnfs_layout_hdr *lo) +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 9c5aa646b8cc8b..6df50ff6d91847 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -678,6 +678,7 @@ struct TCP_Server_Info { + __le32 session_key_id; /* retrieved from negotiate response and send in session setup request */ + struct session_key session_key; + unsigned long lstrp; /* when we got last response from this server */ ++ unsigned long neg_start; /* when negotiate started (jiffies) */ + struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */ + #define CIFS_NEGFLAVOR_UNENCAP 1 /* wct == 17, but no ext_sec */ + #define CIFS_NEGFLAVOR_EXTENDED 2 /* wct == 17, ext_sec bit set */ +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 6486e514686f06..c3480e84f5c622 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -689,12 +689,12 @@ server_unresponsive(struct TCP_Server_Info *server) + /* + * If we're in the process of mounting a share or reconnecting a session + * and the server abruptly shut down (e.g. socket wasn't closed, packet +- * had been ACK'ed but no SMB response), don't wait longer than 20s to +- * negotiate protocol. ++ * had been ACK'ed but no SMB response), don't wait longer than 20s from ++ * when negotiate actually started. + */ + spin_lock(&server->srv_lock); + if (server->tcpStatus == CifsInNegotiate && +- time_after(jiffies, server->lstrp + 20 * HZ)) { ++ time_after(jiffies, server->neg_start + 20 * HZ)) { + spin_unlock(&server->srv_lock); + cifs_reconnect(server, false); + return true; +@@ -4219,6 +4219,7 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, + + server->lstrp = jiffies; + server->tcpStatus = CifsInNegotiate; ++ server->neg_start = jiffies; + spin_unlock(&server->srv_lock); + + rc = server->ops->negotiate(xid, ses, server); +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index 186e0e0f2e40c5..3d3ceccf822450 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -78,6 +78,7 @@ extern ssize_t cpu_show_reg_file_data_sampling(struct device *dev, + struct device_attribute *attr, char *buf); + extern ssize_t cpu_show_indirect_target_selection(struct device *dev, + struct device_attribute *attr, char *buf); ++extern ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf); + + extern __printf(4, 5) + struct device *cpu_device_create(struct device *parent, void *drvdata, +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 6645259be1438d..363462d3f07739 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -1293,7 +1293,7 @@ int ata_acpi_stm(struct ata_port *ap, const struct ata_acpi_gtm *stm); + int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *stm); + unsigned int ata_acpi_gtm_xfermask(struct ata_device *dev, + const struct ata_acpi_gtm *gtm); +-int ata_acpi_cbl_80wire(struct ata_port *ap, const struct ata_acpi_gtm *gtm); ++int ata_acpi_cbl_pata_type(struct ata_port *ap); + #else + static inline const struct ata_acpi_gtm *ata_acpi_init_gtm(struct ata_port *ap) + { +@@ -1318,10 +1318,9 @@ static inline unsigned int ata_acpi_gtm_xfermask(struct ata_device *dev, + return 0; + } + +-static inline int ata_acpi_cbl_80wire(struct ata_port *ap, +- const struct ata_acpi_gtm *gtm) ++static inline int ata_acpi_cbl_pata_type(struct ata_port *ap) + { +- return 0; ++ return ATA_CBL_PATA40; + } + #endif + +diff --git a/include/linux/usb/typec_dp.h b/include/linux/usb/typec_dp.h +index 8d09c2f0a9b807..c3f08af20295ca 100644 +--- a/include/linux/usb/typec_dp.h ++++ b/include/linux/usb/typec_dp.h +@@ -56,6 +56,7 @@ enum { + DP_PIN_ASSIGN_D, + DP_PIN_ASSIGN_E, + DP_PIN_ASSIGN_F, /* Not supported after v1.0b */ ++ DP_PIN_ASSIGN_MAX, + }; + + /* DisplayPort alt mode specific commands */ +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index dd6e15ca63b0c0..38ab28a53e108a 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -2827,6 +2827,10 @@ void call_rcu(struct rcu_head *head, rcu_callback_t func) + /* Misaligned rcu_head! */ + WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1)); + ++ /* Avoid NULL dereference if callback is NULL. */ ++ if (WARN_ON_ONCE(!func)) ++ return; ++ + if (debug_rcu_head_queue(head)) { + /* + * Probable double call_rcu(), so leak the callback. +diff --git a/lib/test_objagg.c b/lib/test_objagg.c +index c0c957c5063541..c0f7bb53db8d5c 100644 +--- a/lib/test_objagg.c ++++ b/lib/test_objagg.c +@@ -899,8 +899,10 @@ static int check_expect_hints_stats(struct objagg_hints *objagg_hints, + int err; + + stats = objagg_hints_stats_get(objagg_hints); +- if (IS_ERR(stats)) ++ if (IS_ERR(stats)) { ++ *errmsg = "objagg_hints_stats_get() failed."; + return PTR_ERR(stats); ++ } + err = __check_expect_stats(stats, expect_stats, errmsg); + objagg_stats_put(stats); + return err; +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index bb4420cbc096ba..c1e018eaa6f4c4 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1966,13 +1966,10 @@ static int hci_clear_adv_sets_sync(struct hci_dev *hdev, struct sock *sk) + static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force) + { + struct adv_info *adv, *n; +- int err = 0; + + if (ext_adv_capable(hdev)) + /* Remove all existing sets */ +- err = hci_clear_adv_sets_sync(hdev, sk); +- if (ext_adv_capable(hdev)) +- return err; ++ return hci_clear_adv_sets_sync(hdev, sk); + + /* This is safe as long as there is no command send while the lock is + * held. +@@ -2000,13 +1997,11 @@ static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force) + static int hci_remove_adv_sync(struct hci_dev *hdev, u8 instance, + struct sock *sk) + { +- int err = 0; ++ int err; + + /* If we use extended advertising, instance has to be removed first. */ + if (ext_adv_capable(hdev)) +- err = hci_remove_ext_adv_instance_sync(hdev, instance, sk); +- if (ext_adv_capable(hdev)) +- return err; ++ return hci_remove_ext_adv_instance_sync(hdev, instance, sk); + + /* This is safe as long as there is no command send while the lock is + * held. +@@ -2105,16 +2100,13 @@ int hci_read_tx_power_sync(struct hci_dev *hdev, __le16 handle, u8 type) + int hci_disable_advertising_sync(struct hci_dev *hdev) + { + u8 enable = 0x00; +- int err = 0; + + /* If controller is not advertising we are done. */ + if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) + return 0; + + if (ext_adv_capable(hdev)) +- err = hci_disable_ext_adv_instance_sync(hdev, 0x00); +- if (ext_adv_capable(hdev)) +- return err; ++ return hci_disable_ext_adv_instance_sync(hdev, 0x00); + + return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, + sizeof(enable), &enable, HCI_CMD_TIMEOUT); +@@ -2482,6 +2474,10 @@ static int hci_pause_advertising_sync(struct hci_dev *hdev) + int err; + int old_state; + ++ /* If controller is not advertising we are done. */ ++ if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) ++ return 0; ++ + /* If already been paused there is nothing to do. */ + if (hdev->advertising_paused) + return 0; +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 08bb78ba988d8d..919e1bae2b2694 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -1085,7 +1085,8 @@ static int mesh_send_done_sync(struct hci_dev *hdev, void *data) + struct mgmt_mesh_tx *mesh_tx; + + hci_dev_clear_flag(hdev, HCI_MESH_SENDING); +- hci_disable_advertising_sync(hdev); ++ if (list_empty(&hdev->adv_instances)) ++ hci_disable_advertising_sync(hdev); + mesh_tx = mgmt_mesh_next(hdev, NULL); + + if (mesh_tx) +@@ -2223,6 +2224,9 @@ static int set_mesh_sync(struct hci_dev *hdev, void *data) + else + hci_dev_clear_flag(hdev, HCI_MESH); + ++ hdev->le_scan_interval = __le16_to_cpu(cp->period); ++ hdev->le_scan_window = __le16_to_cpu(cp->window); ++ + len -= sizeof(*cp); + + /* If filters don't fit, forward all adv pkts */ +@@ -2237,6 +2241,7 @@ static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + { + struct mgmt_cp_set_mesh *cp = data; + struct mgmt_pending_cmd *cmd; ++ __u16 period, window; + int err = 0; + + bt_dev_dbg(hdev, "sock %p", sk); +@@ -2250,6 +2255,23 @@ static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, + MGMT_STATUS_INVALID_PARAMS); + ++ /* Keep allowed ranges in sync with set_scan_params() */ ++ period = __le16_to_cpu(cp->period); ++ ++ if (period < 0x0004 || period > 0x4000) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, ++ MGMT_STATUS_INVALID_PARAMS); ++ ++ window = __le16_to_cpu(cp->window); ++ ++ if (window < 0x0004 || window > 0x4000) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, ++ MGMT_STATUS_INVALID_PARAMS); ++ ++ if (window > period) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, ++ MGMT_STATUS_INVALID_PARAMS); ++ + hci_dev_lock(hdev); + + cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); +@@ -6607,6 +6629,7 @@ static int set_scan_params(struct sock *sk, struct hci_dev *hdev, + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, + MGMT_STATUS_NOT_SUPPORTED); + ++ /* Keep allowed ranges in sync with set_mesh() */ + interval = __le16_to_cpu(cp->interval); + + if (interval < 0x0004 || interval > 0x4000) +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index b6077a97af1dc3..8c9267acb227bc 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -4336,6 +4336,10 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + if (!multicast && + !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) + return false; ++ /* reject invalid/our STA address */ ++ if (!is_valid_ether_addr(hdr->addr2) || ++ ether_addr_equal(sdata->dev->dev_addr, hdr->addr2)) ++ return false; + if (!rx->sta) { + int rate_idx; + if (status->encoding != RX_ENC_LEGACY) +diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c +index fee772b4637c88..a7054546f52dfa 100644 +--- a/net/rose/rose_route.c ++++ b/net/rose/rose_route.c +@@ -497,22 +497,15 @@ void rose_rt_device_down(struct net_device *dev) + t = rose_node; + rose_node = rose_node->next; + +- for (i = 0; i < t->count; i++) { ++ for (i = t->count - 1; i >= 0; i--) { + if (t->neighbour[i] != s) + continue; + + t->count--; + +- switch (i) { +- case 0: +- t->neighbour[0] = t->neighbour[1]; +- fallthrough; +- case 1: +- t->neighbour[1] = t->neighbour[2]; +- break; +- case 2: +- break; +- } ++ memmove(&t->neighbour[i], &t->neighbour[i + 1], ++ sizeof(t->neighbour[0]) * ++ (t->count - i)); + } + + if (t->count <= 0) +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index c395e7a98232d5..7c5df62421bbd2 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -776,15 +776,12 @@ static u32 qdisc_alloc_handle(struct net_device *dev) + + void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) + { +- bool qdisc_is_offloaded = sch->flags & TCQ_F_OFFLOADED; + const struct Qdisc_class_ops *cops; + unsigned long cl; + u32 parentid; + bool notify; + int drops; + +- if (n == 0 && len == 0) +- return; + drops = max_t(int, n, 0); + rcu_read_lock(); + while ((parentid = sch->parent)) { +@@ -793,17 +790,8 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) + + if (sch->flags & TCQ_F_NOPARENT) + break; +- /* Notify parent qdisc only if child qdisc becomes empty. +- * +- * If child was empty even before update then backlog +- * counter is screwed and we skip notification because +- * parent class is already passive. +- * +- * If the original child was offloaded then it is allowed +- * to be seem as empty, so the parent is notified anyway. +- */ +- notify = !sch->q.qlen && !WARN_ON_ONCE(!n && +- !qdisc_is_offloaded); ++ /* Notify parent qdisc only if child qdisc becomes empty. */ ++ notify = !sch->q.qlen; + /* TODO: perform the search on a per txq basis */ + sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid)); + if (sch == NULL) { +@@ -812,6 +800,9 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) + } + cops = sch->ops->cl_ops; + if (notify && cops->qlen_notify) { ++ /* Note that qlen_notify must be idempotent as it may get called ++ * multiple times. ++ */ + cl = cops->find(sch, parentid); + cops->qlen_notify(sch, cl); + } +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 36eb16a40745d2..95f34dffe3c228 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -119,6 +119,8 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + u16 proto, + struct vmci_handle handle) + { ++ memset(pkt, 0, sizeof(*pkt)); ++ + /* We register the stream control handler as an any cid handle so we + * must always send from a source address of VMADDR_CID_ANY + */ +@@ -131,8 +133,6 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt, + pkt->type = type; + pkt->src_port = src->svm_port; + pkt->dst_port = dst->svm_port; +- memset(&pkt->proto, 0, sizeof(pkt->proto)); +- memset(&pkt->_reserved2, 0, sizeof(pkt->_reserved2)); + + switch (pkt->type) { + case VMCI_TRANSPORT_PACKET_TYPE_INVALID: +diff --git a/sound/isa/sb/sb16_main.c b/sound/isa/sb/sb16_main.c +index a9b87e159b2d11..1497a7822eee68 100644 +--- a/sound/isa/sb/sb16_main.c ++++ b/sound/isa/sb/sb16_main.c +@@ -703,6 +703,9 @@ static int snd_sb16_dma_control_put(struct snd_kcontrol *kcontrol, struct snd_ct + unsigned char nval, oval; + int change; + ++ if (chip->mode & (SB_MODE_PLAYBACK | SB_MODE_CAPTURE)) ++ return -EBUSY; ++ + nval = ucontrol->value.enumerated.item[0]; + if (nval > 2) + return -EINVAL; +@@ -711,6 +714,10 @@ static int snd_sb16_dma_control_put(struct snd_kcontrol *kcontrol, struct snd_ct + change = nval != oval; + snd_sb16_set_dma_mode(chip, nval); + spin_unlock_irqrestore(&chip->reg_lock, flags); ++ if (change) { ++ snd_dma_disable(chip->dma8); ++ snd_dma_disable(chip->dma16); ++ } + return change; + } + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 30f28f33a52ca5..ecf4f4c0e6967c 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -451,6 +451,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16z-n000"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Victus by HP Gaming Laptop 15-fb2xxx"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = {
