commit: b18dd2e6aa98a9e8d8484a4cb5a7d6efc041be5d Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed May 26 12:07:17 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed May 26 12:07:17 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b18dd2e6
Linux patch 5.10.40 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1039_linux-5.10.40.patch | 3700 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3704 insertions(+) diff --git a/0000_README b/0000_README index 824db67..27b8de0 100644 --- a/0000_README +++ b/0000_README @@ -199,6 +199,10 @@ Patch: 1038_linux-5.10.39.patch From: http://www.kernel.org Desc: Linux 5.10.39 +Patch: 1039_linux-5.10.40.patch +From: http://www.kernel.org +Desc: Linux 5.10.40 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1039_linux-5.10.40.patch b/1039_linux-5.10.40.patch new file mode 100644 index 0000000..05aa3e0 --- /dev/null +++ b/1039_linux-5.10.40.patch @@ -0,0 +1,3700 @@ +diff --git a/Documentation/powerpc/syscall64-abi.rst b/Documentation/powerpc/syscall64-abi.rst +index cf9b2857c72aa..d8242049bdcb5 100644 +--- a/Documentation/powerpc/syscall64-abi.rst ++++ b/Documentation/powerpc/syscall64-abi.rst +@@ -96,6 +96,16 @@ auxiliary vector. + + scv 0 syscalls will always behave as PPC_FEATURE2_HTM_NOSC. + ++ptrace ++------ ++When ptracing system calls (PTRACE_SYSCALL), the pt_regs.trap value contains ++the system call type that can be used to distinguish between sc and scv 0 ++system calls, and the different register conventions can be accounted for. ++ ++If the value of (pt_regs.trap & 0xfff0) is 0xc00 then the system call was ++performed with the sc instruction, if it is 0x3000 then the system call was ++performed with the scv 0 instruction. ++ + vsyscall + ======== + +diff --git a/Makefile b/Makefile +index 38b703568da45..42c915ccc5b80 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 39 ++SUBLEVEL = 40 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c +index 2416a9f915330..c6f9e7b9f7cb2 100644 +--- a/arch/openrisc/kernel/setup.c ++++ b/arch/openrisc/kernel/setup.c +@@ -278,6 +278,8 @@ void calibrate_delay(void) + pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n", + loops_per_jiffy / (500000 / HZ), + (loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy); ++ ++ of_node_put(cpu); + } + + void __init setup_arch(char **cmdline_p) +diff --git a/arch/openrisc/mm/init.c b/arch/openrisc/mm/init.c +index 8348feaaf46e5..5e88c351e6a45 100644 +--- a/arch/openrisc/mm/init.c ++++ b/arch/openrisc/mm/init.c +@@ -76,7 +76,6 @@ static void __init map_ram(void) + /* These mark extents of read-only kernel pages... + * ...from vmlinux.lds.S + */ +- struct memblock_region *region; + + v = PAGE_OFFSET; + +@@ -122,7 +121,7 @@ static void __init map_ram(void) + } + + printk(KERN_INFO "%s: Memory: 0x%x-0x%x\n", __func__, +- region->base, region->base + region->size); ++ start, end); + } + } + +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index c1fbccb043903..3e8e19f5746c7 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -437,6 +437,9 @@ + */ + long plpar_hcall_norets(unsigned long opcode, ...); + ++/* Variant which does not do hcall tracing */ ++long plpar_hcall_norets_notrace(unsigned long opcode, ...); ++ + /** + * plpar_hcall: - Make a pseries hypervisor call + * @opcode: The hypervisor call to make. +diff --git a/arch/powerpc/include/asm/paravirt.h b/arch/powerpc/include/asm/paravirt.h +index 9362c94fe3aa0..588bfb9a0579c 100644 +--- a/arch/powerpc/include/asm/paravirt.h ++++ b/arch/powerpc/include/asm/paravirt.h +@@ -24,19 +24,35 @@ static inline u32 yield_count_of(int cpu) + return be32_to_cpu(yield_count); + } + ++/* ++ * Spinlock code confers and prods, so don't trace the hcalls because the ++ * tracing code takes spinlocks which can cause recursion deadlocks. ++ * ++ * These calls are made while the lock is not held: the lock slowpath yields if ++ * it can not acquire the lock, and unlock slow path might prod if a waiter has ++ * yielded). So this may not be a problem for simple spin locks because the ++ * tracing does not technically recurse on the lock, but we avoid it anyway. ++ * ++ * However the queued spin lock contended path is more strictly ordered: the ++ * H_CONFER hcall is made after the task has queued itself on the lock, so then ++ * recursing on that lock will cause the task to then queue up again behind the ++ * first instance (or worse: queued spinlocks use tricks that assume a context ++ * never waits on more than one spinlock, so such recursion may cause random ++ * corruption in the lock code). ++ */ + static inline void yield_to_preempted(int cpu, u32 yield_count) + { +- plpar_hcall_norets(H_CONFER, get_hard_smp_processor_id(cpu), yield_count); ++ plpar_hcall_norets_notrace(H_CONFER, get_hard_smp_processor_id(cpu), yield_count); + } + + static inline void prod_cpu(int cpu) + { +- plpar_hcall_norets(H_PROD, get_hard_smp_processor_id(cpu)); ++ plpar_hcall_norets_notrace(H_PROD, get_hard_smp_processor_id(cpu)); + } + + static inline void yield_to_any(void) + { +- plpar_hcall_norets(H_CONFER, -1, 0); ++ plpar_hcall_norets_notrace(H_CONFER, -1, 0); + } + #else + static inline bool is_shared_processor(void) +diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h +index d6f262df4f346..a7e7688f57eca 100644 +--- a/arch/powerpc/include/asm/ptrace.h ++++ b/arch/powerpc/include/asm/ptrace.h +@@ -19,6 +19,7 @@ + #ifndef _ASM_POWERPC_PTRACE_H + #define _ASM_POWERPC_PTRACE_H + ++#include <linux/err.h> + #include <uapi/asm/ptrace.h> + #include <asm/asm-const.h> + +@@ -144,25 +145,6 @@ extern unsigned long profile_pc(struct pt_regs *regs); + long do_syscall_trace_enter(struct pt_regs *regs); + void do_syscall_trace_leave(struct pt_regs *regs); + +-#define kernel_stack_pointer(regs) ((regs)->gpr[1]) +-static inline int is_syscall_success(struct pt_regs *regs) +-{ +- return !(regs->ccr & 0x10000000); +-} +- +-static inline long regs_return_value(struct pt_regs *regs) +-{ +- if (is_syscall_success(regs)) +- return regs->gpr[3]; +- else +- return -regs->gpr[3]; +-} +- +-static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) +-{ +- regs->gpr[3] = rc; +-} +- + #ifdef __powerpc64__ + #define user_mode(regs) ((((regs)->msr) >> MSR_PR_LG) & 0x1) + #else +@@ -245,6 +227,31 @@ static inline void set_trap_norestart(struct pt_regs *regs) + regs->trap |= 0x10; + } + ++#define kernel_stack_pointer(regs) ((regs)->gpr[1]) ++static inline int is_syscall_success(struct pt_regs *regs) ++{ ++ if (trap_is_scv(regs)) ++ return !IS_ERR_VALUE((unsigned long)regs->gpr[3]); ++ else ++ return !(regs->ccr & 0x10000000); ++} ++ ++static inline long regs_return_value(struct pt_regs *regs) ++{ ++ if (trap_is_scv(regs)) ++ return regs->gpr[3]; ++ ++ if (is_syscall_success(regs)) ++ return regs->gpr[3]; ++ else ++ return -regs->gpr[3]; ++} ++ ++static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) ++{ ++ regs->gpr[3] = rc; ++} ++ + #define arch_has_single_step() (1) + #define arch_has_block_step() (true) + #define ARCH_HAS_USER_SINGLE_STEP_REPORT +diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h +index fd1b518eed17c..ba0f88f3a30da 100644 +--- a/arch/powerpc/include/asm/syscall.h ++++ b/arch/powerpc/include/asm/syscall.h +@@ -41,11 +41,17 @@ static inline void syscall_rollback(struct task_struct *task, + static inline long syscall_get_error(struct task_struct *task, + struct pt_regs *regs) + { +- /* +- * If the system call failed, +- * regs->gpr[3] contains a positive ERRORCODE. +- */ +- return (regs->ccr & 0x10000000UL) ? -regs->gpr[3] : 0; ++ if (trap_is_scv(regs)) { ++ unsigned long error = regs->gpr[3]; ++ ++ return IS_ERR_VALUE(error) ? error : 0; ++ } else { ++ /* ++ * If the system call failed, ++ * regs->gpr[3] contains a positive ERRORCODE. ++ */ ++ return (regs->ccr & 0x10000000UL) ? -regs->gpr[3] : 0; ++ } + } + + static inline long syscall_get_return_value(struct task_struct *task, +@@ -58,18 +64,22 @@ static inline void syscall_set_return_value(struct task_struct *task, + struct pt_regs *regs, + int error, long val) + { +- /* +- * In the general case it's not obvious that we must deal with CCR +- * here, as the syscall exit path will also do that for us. However +- * there are some places, eg. the signal code, which check ccr to +- * decide if the value in r3 is actually an error. +- */ +- if (error) { +- regs->ccr |= 0x10000000L; +- regs->gpr[3] = error; ++ if (trap_is_scv(regs)) { ++ regs->gpr[3] = (long) error ?: val; + } else { +- regs->ccr &= ~0x10000000L; +- regs->gpr[3] = val; ++ /* ++ * In the general case it's not obvious that we must deal with ++ * CCR here, as the syscall exit path will also do that for us. ++ * However there are some places, eg. the signal code, which ++ * check ccr to decide if the value in r3 is actually an error. ++ */ ++ if (error) { ++ regs->ccr |= 0x10000000L; ++ regs->gpr[3] = error; ++ } else { ++ regs->ccr &= ~0x10000000L; ++ regs->gpr[3] = val; ++ } + } + } + +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 3b871ecb3a921..3f8426bccd168 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -368,11 +368,11 @@ void __init early_setup(unsigned long dt_ptr) + apply_feature_fixups(); + setup_feature_keys(); + +- early_ioremap_setup(); +- + /* Initialize the hash table or TLB handling */ + early_init_mmu(); + ++ early_ioremap_setup(); ++ + /* + * After firmware and early platform setup code has set things up, + * we note the SPR values for configurable control/performance +diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S +index 2136e42833af3..8a2b8d64265bc 100644 +--- a/arch/powerpc/platforms/pseries/hvCall.S ++++ b/arch/powerpc/platforms/pseries/hvCall.S +@@ -102,6 +102,16 @@ END_FTR_SECTION(0, 1); \ + #define HCALL_BRANCH(LABEL) + #endif + ++_GLOBAL_TOC(plpar_hcall_norets_notrace) ++ HMT_MEDIUM ++ ++ mfcr r0 ++ stw r0,8(r1) ++ HVSC /* invoke the hypervisor */ ++ lwz r0,8(r1) ++ mtcrf 0xff,r0 ++ blr /* return r3 = status */ ++ + _GLOBAL_TOC(plpar_hcall_norets) + HMT_MEDIUM + +diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c +index 764170fdb0f74..1c3ac0f663369 100644 +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -1827,8 +1827,7 @@ void hcall_tracepoint_unregfunc(void) + + /* + * Since the tracing code might execute hcalls we need to guard against +- * recursion. One example of this are spinlocks calling H_YIELD on +- * shared processor partitions. ++ * recursion. + */ + static DEFINE_PER_CPU(unsigned int, hcall_trace_depth); + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 017de6cc87dc6..72f655c238cf1 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -172,11 +172,21 @@ SYM_FUNC_START(startup_32) + */ + call get_sev_encryption_bit + xorl %edx, %edx ++#ifdef CONFIG_AMD_MEM_ENCRYPT + testl %eax, %eax + jz 1f + subl $32, %eax /* Encryption bit is always above bit 31 */ + bts %eax, %edx /* Set encryption mask for page tables */ ++ /* ++ * Mark SEV as active in sev_status so that startup32_check_sev_cbit() ++ * will do a check. The sev_status memory will be fully initialized ++ * with the contents of MSR_AMD_SEV_STATUS later in ++ * set_sev_encryption_mask(). For now it is sufficient to know that SEV ++ * is active. ++ */ ++ movl $1, rva(sev_status)(%ebp) + 1: ++#endif + + /* Initialize Page tables to 0 */ + leal rva(pgtable)(%ebx), %edi +@@ -261,6 +271,9 @@ SYM_FUNC_START(startup_32) + movl %esi, %edx + 1: + #endif ++ /* Check if the C-bit position is correct when SEV is active */ ++ call startup32_check_sev_cbit ++ + pushl $__KERNEL_CS + pushl %eax + +@@ -786,6 +799,78 @@ SYM_DATA_START_LOCAL(loaded_image_proto) + SYM_DATA_END(loaded_image_proto) + #endif + ++/* ++ * Check for the correct C-bit position when the startup_32 boot-path is used. ++ * ++ * The check makes use of the fact that all memory is encrypted when paging is ++ * disabled. The function creates 64 bits of random data using the RDRAND ++ * instruction. RDRAND is mandatory for SEV guests, so always available. If the ++ * hypervisor violates that the kernel will crash right here. ++ * ++ * The 64 bits of random data are stored to a memory location and at the same ++ * time kept in the %eax and %ebx registers. Since encryption is always active ++ * when paging is off the random data will be stored encrypted in main memory. ++ * ++ * Then paging is enabled. When the C-bit position is correct all memory is ++ * still mapped encrypted and comparing the register values with memory will ++ * succeed. An incorrect C-bit position will map all memory unencrypted, so that ++ * the compare will use the encrypted random data and fail. ++ */ ++ __HEAD ++ .code32 ++SYM_FUNC_START(startup32_check_sev_cbit) ++#ifdef CONFIG_AMD_MEM_ENCRYPT ++ pushl %eax ++ pushl %ebx ++ pushl %ecx ++ pushl %edx ++ ++ /* Check for non-zero sev_status */ ++ movl rva(sev_status)(%ebp), %eax ++ testl %eax, %eax ++ jz 4f ++ ++ /* ++ * Get two 32-bit random values - Don't bail out if RDRAND fails ++ * because it is better to prevent forward progress if no random value ++ * can be gathered. ++ */ ++1: rdrand %eax ++ jnc 1b ++2: rdrand %ebx ++ jnc 2b ++ ++ /* Store to memory and keep it in the registers */ ++ movl %eax, rva(sev_check_data)(%ebp) ++ movl %ebx, rva(sev_check_data+4)(%ebp) ++ ++ /* Enable paging to see if encryption is active */ ++ movl %cr0, %edx /* Backup %cr0 in %edx */ ++ movl $(X86_CR0_PG | X86_CR0_PE), %ecx /* Enable Paging and Protected mode */ ++ movl %ecx, %cr0 ++ ++ cmpl %eax, rva(sev_check_data)(%ebp) ++ jne 3f ++ cmpl %ebx, rva(sev_check_data+4)(%ebp) ++ jne 3f ++ ++ movl %edx, %cr0 /* Restore previous %cr0 */ ++ ++ jmp 4f ++ ++3: /* Check failed - hlt the machine */ ++ hlt ++ jmp 3b ++ ++4: ++ popl %edx ++ popl %ecx ++ popl %ebx ++ popl %eax ++#endif ++ ret ++SYM_FUNC_END(startup32_check_sev_cbit) ++ + /* + * Stack and heap for uncompression + */ +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 0b9975200ae35..ee659b5faf714 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -5563,7 +5563,7 @@ __init int intel_pmu_init(void) + * Check all LBT MSR here. + * Disable LBR access if any LBR MSRs can not be accessed. + */ +- if (x86_pmu.lbr_nr && !check_msr(x86_pmu.lbr_tos, 0x3UL)) ++ if (x86_pmu.lbr_tos && !check_msr(x86_pmu.lbr_tos, 0x3UL)) + x86_pmu.lbr_nr = 0; + for (i = 0; i < x86_pmu.lbr_nr; i++) { + if (!(check_msr(x86_pmu.lbr_from + i, 0xffffUL) && +diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c +index 387b716698187..ecb20b17b7df6 100644 +--- a/arch/x86/kernel/sev-es-shared.c ++++ b/arch/x86/kernel/sev-es-shared.c +@@ -63,6 +63,7 @@ static bool sev_es_negotiate_protocol(void) + + static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) + { ++ ghcb->save.sw_exit_code = 0; + memset(ghcb->save.valid_bitmap, 0, sizeof(ghcb->save.valid_bitmap)); + } + +diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c +index 04a780abb512d..e0cdab7cb632b 100644 +--- a/arch/x86/kernel/sev-es.c ++++ b/arch/x86/kernel/sev-es.c +@@ -191,8 +191,18 @@ static __always_inline struct ghcb *sev_es_get_ghcb(struct ghcb_state *state) + if (unlikely(data->ghcb_active)) { + /* GHCB is already in use - save its contents */ + +- if (unlikely(data->backup_ghcb_active)) +- return NULL; ++ if (unlikely(data->backup_ghcb_active)) { ++ /* ++ * Backup-GHCB is also already in use. There is no way ++ * to continue here so just kill the machine. To make ++ * panic() work, mark GHCBs inactive so that messages ++ * can be printed out. ++ */ ++ data->ghcb_active = false; ++ data->backup_ghcb_active = false; ++ ++ panic("Unable to handle #VC exception! GHCB and Backup GHCB are already in use"); ++ } + + /* Mark backup_ghcb active before writing to it */ + data->backup_ghcb_active = true; +@@ -209,24 +219,6 @@ static __always_inline struct ghcb *sev_es_get_ghcb(struct ghcb_state *state) + return ghcb; + } + +-static __always_inline void sev_es_put_ghcb(struct ghcb_state *state) +-{ +- struct sev_es_runtime_data *data; +- struct ghcb *ghcb; +- +- data = this_cpu_read(runtime_data); +- ghcb = &data->ghcb_page; +- +- if (state->ghcb) { +- /* Restore GHCB from Backup */ +- *ghcb = *state->ghcb; +- data->backup_ghcb_active = false; +- state->ghcb = NULL; +- } else { +- data->ghcb_active = false; +- } +-} +- + /* Needed in vc_early_forward_exception */ + void do_early_exception(struct pt_regs *regs, int trapnr); + +@@ -296,31 +288,44 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, + u16 d2; + u8 d1; + +- /* If instruction ran in kernel mode and the I/O buffer is in kernel space */ +- if (!user_mode(ctxt->regs) && !access_ok(target, size)) { +- memcpy(dst, buf, size); +- return ES_OK; +- } +- ++ /* ++ * This function uses __put_user() independent of whether kernel or user ++ * memory is accessed. This works fine because __put_user() does no ++ * sanity checks of the pointer being accessed. All that it does is ++ * to report when the access failed. ++ * ++ * Also, this function runs in atomic context, so __put_user() is not ++ * allowed to sleep. The page-fault handler detects that it is running ++ * in atomic context and will not try to take mmap_sem and handle the ++ * fault, so additional pagefault_enable()/disable() calls are not ++ * needed. ++ * ++ * The access can't be done via copy_to_user() here because ++ * vc_write_mem() must not use string instructions to access unsafe ++ * memory. The reason is that MOVS is emulated by the #VC handler by ++ * splitting the move up into a read and a write and taking a nested #VC ++ * exception on whatever of them is the MMIO access. Using string ++ * instructions here would cause infinite nesting. ++ */ + switch (size) { + case 1: + memcpy(&d1, buf, 1); +- if (put_user(d1, target)) ++ if (__put_user(d1, target)) + goto fault; + break; + case 2: + memcpy(&d2, buf, 2); +- if (put_user(d2, target)) ++ if (__put_user(d2, target)) + goto fault; + break; + case 4: + memcpy(&d4, buf, 4); +- if (put_user(d4, target)) ++ if (__put_user(d4, target)) + goto fault; + break; + case 8: + memcpy(&d8, buf, 8); +- if (put_user(d8, target)) ++ if (__put_user(d8, target)) + goto fault; + break; + default: +@@ -351,30 +356,43 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, + u16 d2; + u8 d1; + +- /* If instruction ran in kernel mode and the I/O buffer is in kernel space */ +- if (!user_mode(ctxt->regs) && !access_ok(s, size)) { +- memcpy(buf, src, size); +- return ES_OK; +- } +- ++ /* ++ * This function uses __get_user() independent of whether kernel or user ++ * memory is accessed. This works fine because __get_user() does no ++ * sanity checks of the pointer being accessed. All that it does is ++ * to report when the access failed. ++ * ++ * Also, this function runs in atomic context, so __get_user() is not ++ * allowed to sleep. The page-fault handler detects that it is running ++ * in atomic context and will not try to take mmap_sem and handle the ++ * fault, so additional pagefault_enable()/disable() calls are not ++ * needed. ++ * ++ * The access can't be done via copy_from_user() here because ++ * vc_read_mem() must not use string instructions to access unsafe ++ * memory. The reason is that MOVS is emulated by the #VC handler by ++ * splitting the move up into a read and a write and taking a nested #VC ++ * exception on whatever of them is the MMIO access. Using string ++ * instructions here would cause infinite nesting. ++ */ + switch (size) { + case 1: +- if (get_user(d1, s)) ++ if (__get_user(d1, s)) + goto fault; + memcpy(buf, &d1, 1); + break; + case 2: +- if (get_user(d2, s)) ++ if (__get_user(d2, s)) + goto fault; + memcpy(buf, &d2, 2); + break; + case 4: +- if (get_user(d4, s)) ++ if (__get_user(d4, s)) + goto fault; + memcpy(buf, &d4, 4); + break; + case 8: +- if (get_user(d8, s)) ++ if (__get_user(d8, s)) + goto fault; + memcpy(buf, &d8, 8); + break; +@@ -434,6 +452,29 @@ static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt + /* Include code shared with pre-decompression boot stage */ + #include "sev-es-shared.c" + ++static __always_inline void sev_es_put_ghcb(struct ghcb_state *state) ++{ ++ struct sev_es_runtime_data *data; ++ struct ghcb *ghcb; ++ ++ data = this_cpu_read(runtime_data); ++ ghcb = &data->ghcb_page; ++ ++ if (state->ghcb) { ++ /* Restore GHCB from Backup */ ++ *ghcb = *state->ghcb; ++ data->backup_ghcb_active = false; ++ state->ghcb = NULL; ++ } else { ++ /* ++ * Invalidate the GHCB so a VMGEXIT instruction issued ++ * from userspace won't appear to be valid. ++ */ ++ vc_ghcb_invalidate(ghcb); ++ data->ghcb_active = false; ++ } ++} ++ + void noinstr __sev_es_nmi_complete(void) + { + struct ghcb_state state; +@@ -1228,6 +1269,10 @@ static __always_inline void vc_forward_exception(struct es_em_ctxt *ctxt) + case X86_TRAP_UD: + exc_invalid_op(ctxt->regs); + break; ++ case X86_TRAP_PF: ++ write_cr2(ctxt->fi.cr2); ++ exc_page_fault(ctxt->regs, error_code); ++ break; + case X86_TRAP_AC: + exc_alignment_check(ctxt->regs, error_code); + break; +@@ -1257,7 +1302,6 @@ static __always_inline bool on_vc_fallback_stack(struct pt_regs *regs) + */ + DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) + { +- struct sev_es_runtime_data *data = this_cpu_read(runtime_data); + irqentry_state_t irq_state; + struct ghcb_state state; + struct es_em_ctxt ctxt; +@@ -1283,16 +1327,6 @@ DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) + */ + + ghcb = sev_es_get_ghcb(&state); +- if (!ghcb) { +- /* +- * Mark GHCBs inactive so that panic() is able to print the +- * message. +- */ +- data->ghcb_active = false; +- data->backup_ghcb_active = false; +- +- panic("Unable to handle #VC exception! GHCB and Backup GHCB are already in use"); +- } + + vc_ghcb_invalidate(ghcb); + result = vc_init_em_ctxt(&ctxt, regs, error_code); +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 9a5a50cdaab59..8064df6382227 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1262,16 +1262,16 @@ asmlinkage __visible void __init xen_start_kernel(void) + /* Get mfn list */ + xen_build_dynamic_phys_to_machine(); + ++ /* Work out if we support NX */ ++ get_cpu_cap(&boot_cpu_data); ++ x86_configure_nx(); ++ + /* + * Set up kernel GDT and segment registers, mainly so that + * -fstack-protector code can be executed. + */ + xen_setup_gdt(0); + +- /* Work out if we support NX */ +- get_cpu_cap(&boot_cpu_data); +- x86_configure_nx(); +- + /* Determine virtual and physical address sizes */ + get_cpu_address_sizes(&boot_cpu_data); + +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 9874fc1c815b5..1831099306aa9 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -743,6 +743,13 @@ static const struct blk_mq_ops gdrom_mq_ops = { + static int probe_gdrom(struct platform_device *devptr) + { + int err; ++ ++ /* ++ * Ensure our "one" device is initialized properly in case of previous ++ * usages of it ++ */ ++ memset(&gd, 0, sizeof(gd)); ++ + /* Start the device */ + if (gdrom_execute_diagnostic() != 1) { + pr_warn("ATA Probe for GDROM failed\n"); +@@ -831,6 +838,8 @@ static int remove_gdrom(struct platform_device *devptr) + if (gdrom_major) + unregister_blkdev(gdrom_major, GDROM_DEV_NAME); + unregister_cdrom(gd.cd_info); ++ kfree(gd.cd_info); ++ kfree(gd.toc); + + return 0; + } +@@ -846,7 +855,7 @@ static struct platform_driver gdrom_driver = { + static int __init init_gdrom(void) + { + int rc; +- gd.toc = NULL; ++ + rc = platform_driver_register(&gdrom_driver); + if (rc) + return rc; +@@ -862,8 +871,6 @@ static void __exit exit_gdrom(void) + { + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); +- kfree(gd.toc); +- kfree(gd.cd_info); + } + + module_init(init_gdrom); +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index d0dee37ad5228..4ceba5ef78958 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -552,8 +552,10 @@ static unsigned long scpi_clk_get_val(u16 clk_id) + + ret = scpi_send_message(CMD_GET_CLOCK_VALUE, &le_clk_id, + sizeof(le_clk_id), &rate, sizeof(rate)); ++ if (ret) ++ return 0; + +- return ret ? ret : le32_to_cpu(rate); ++ return le32_to_cpu(rate); + } + + static int scpi_clk_set_val(u16 clk_id, unsigned long rate) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index ab7755a3885a6..532250c2b19ee 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -267,7 +267,7 @@ static int amdgpu_ttm_map_buffer(struct ttm_buffer_object *bo, + *addr += offset & ~PAGE_MASK; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = num_pages * 8; ++ num_bytes = num_pages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, num_dw * 4 + num_bytes, + AMDGPU_IB_POOL_DELAYED, &job); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 4ebb43e090999..fc8da5fed779b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -1334,9 +1334,10 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG, 0xffffffff, 0x20000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xffffffff, 0x00000420), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000200), +- SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x04800000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x04900000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DFSM_TILES_IN_FLIGHT, 0x0000ffff, 0x0000003f), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_LAST_OF_BURST_CONFIG, 0xffffffff, 0x03860204), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGB_ADDR_CONFIG, 0x0c1800ff, 0x00000044), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL, 0x1ff0ffff, 0x00000500), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGE_PRIV_CONTROL, 0x00007fff, 0x000001fe), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGL1_PIPE_STEER, 0xffffffff, 0xe4e4e4e4), +@@ -1354,12 +1355,13 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_ENHANCE_2, 0x00000820, 0x00000820), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_LINE_STIPPLE_STATE, 0x0000ff0f, 0x00000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmRMI_SPARE, 0xffffffff, 0xffff3101), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSPI_CONFIG_CNTL_1, 0x001f0000, 0x00070104), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_ALU_CLK_CTRL, 0xffffffff, 0xffffffff), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_ARB_CONFIG, 0x00000133, 0x00000130), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_LDS_CLK_CTRL, 0xffffffff, 0xffffffff), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmTA_CNTL_AUX, 0xfff7ffff, 0x01030000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmTCP_CNTL, 0xffdf80ff, 0x479c0010), +- SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffffffff, 0x00800000) ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffffffff, 0x00c00000) + }; + + static void gfx_v10_rlcg_wreg(struct amdgpu_device *adev, u32 offset, u32 v) +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 957c12b727676..fb15e8b5af32f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -4859,7 +4859,7 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + amdgpu_gfx_rlc_enter_safe_mode(adev); + + /* Enable 3D CGCG/CGLS */ +- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG)) { ++ if (enable) { + /* write cmd to clear cgcg/cgls ov */ + def = data = RREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE); + /* unset CGCG override */ +@@ -4871,8 +4871,12 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + /* enable 3Dcgcg FSM(0x0000363f) */ + def = RREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL_3D); + +- data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | +- RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG) ++ data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | ++ RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ else ++ data = 0x0 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT; ++ + if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGLS) + data |= (0x000F << RLC_CGCG_CGLS_CTRL_3D__CGLS_REP_COMPANSAT_DELAY__SHIFT) | + RLC_CGCG_CGLS_CTRL_3D__CGLS_EN_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +index 9c72b95b74639..be23d637c3d77 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -124,6 +124,10 @@ static const struct soc15_reg_golden golden_settings_sdma_nv14[] = { + + static const struct soc15_reg_golden golden_settings_sdma_nv12[] = { + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_RLC3_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_GB_ADDR_CONFIG, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_GB_ADDR_CONFIG, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x001877ff, 0x00000044), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_RLC3_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), + }; + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 7efc618887e21..37226cbbbd11a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1183,7 +1183,6 @@ static int soc15_common_early_init(void *handle) + adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG | + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +@@ -1203,7 +1202,6 @@ static int soc15_common_early_init(void *handle) + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_RLC_LS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +diff --git a/drivers/gpu/drm/i915/gt/gen7_renderclear.c b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +index 4adbc2bba97fb..c724fba8a87b9 100644 +--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c ++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +@@ -397,7 +397,10 @@ static void emit_batch(struct i915_vma * const vma, + gen7_emit_pipeline_invalidate(&cmds); + batch_add(&cmds, MI_LOAD_REGISTER_IMM(2)); + batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_0_GEN7)); +- batch_add(&cmds, 0xffff0000); ++ batch_add(&cmds, 0xffff0000 | ++ ((IS_IVB_GT1(i915) || IS_VALLEYVIEW(i915)) ? ++ HIZ_RAW_STALL_OPT_DISABLE : ++ 0)); + batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_1)); + batch_add(&cmds, 0xffff0000 | PIXEL_SUBSPAN_COLLECT_OPT_DISABLE); + gen7_emit_pipeline_invalidate(&cmds); +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index ac4adb44b224d..97ab491d2922c 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -596,7 +596,6 @@ static int lm80_probe(struct i2c_client *client) + struct device *dev = &client->dev; + struct device *hwmon_dev; + struct lm80_data *data; +- int rv; + + data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); + if (!data) +@@ -609,14 +608,8 @@ static int lm80_probe(struct i2c_client *client) + lm80_init_client(client); + + /* A few vars need to be filled upon startup */ +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); +- if (rv < 0) +- return rv; +- data->fan[f_min][0] = rv; +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); +- if (rv < 0) +- return rv; +- data->fan[f_min][1] = rv; ++ data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); ++ data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); + + hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, + data, lm80_groups); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 6af066a2c8c06..d1e94147fb165 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -482,6 +482,7 @@ static void cma_release_dev(struct rdma_id_private *id_priv) + list_del(&id_priv->list); + cma_dev_put(id_priv->cma_dev); + id_priv->cma_dev = NULL; ++ id_priv->id.device = NULL; + if (id_priv->id.route.addr.dev_addr.sgid_attr) { + rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); + id_priv->id.route.addr.dev_addr.sgid_attr = NULL; +@@ -1864,6 +1865,7 @@ static void _destroy_id(struct rdma_id_private *id_priv, + iw_destroy_cm_id(id_priv->cm_id.iw); + } + cma_leave_mc_groups(id_priv); ++ rdma_restrack_del(&id_priv->res); + cma_release_dev(id_priv); + } + +@@ -1877,7 +1879,6 @@ static void _destroy_id(struct rdma_id_private *id_priv, + kfree(id_priv->id.route.path_rec); + + put_net(id_priv->id.route.addr.dev_addr.net); +- rdma_restrack_del(&id_priv->res); + kfree(id_priv); + } + +@@ -3740,7 +3741,7 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) + } + + id_priv->backlog = backlog; +- if (id->device) { ++ if (id_priv->cma_dev) { + if (rdma_cap_ib_cm(id->device, 1)) { + ret = cma_ib_listen(id_priv); + if (ret) +diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c +index 9ec6971056fa8..049684880ae03 100644 +--- a/drivers/infiniband/core/uverbs_std_types_device.c ++++ b/drivers/infiniband/core/uverbs_std_types_device.c +@@ -117,8 +117,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_INFO_HANDLES)( + return ret; + + uapi_object = uapi_get_object(attrs->ufile->device->uapi, object_id); +- if (!uapi_object) +- return -EINVAL; ++ if (IS_ERR(uapi_object)) ++ return PTR_ERR(uapi_object); + + handles = gather_objects_handle(attrs->ufile, uapi_object, attrs, + out_len, &total); +@@ -331,6 +331,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)( + if (ret) + return ret; + ++ if (!user_entry_size) ++ return -EINVAL; ++ + max_entries = uverbs_attr_ptr_get_array_size( + attrs, UVERBS_ATTR_QUERY_GID_TABLE_RESP_ENTRIES, + user_entry_size); +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index efb9ec99b68bd..06a8732576193 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -559,9 +559,8 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + case UVERBS_OBJECT_QP: + { + struct mlx5_ib_qp *qp = to_mqp(uobj->object); +- enum ib_qp_type qp_type = qp->ibqp.qp_type; + +- if (qp_type == IB_QPT_RAW_PACKET || ++ if (qp->type == IB_QPT_RAW_PACKET || + (qp->flags & IB_QP_CREATE_SOURCE_QPN)) { + struct mlx5_ib_raw_packet_qp *raw_packet_qp = + &qp->raw_packet_qp; +@@ -578,10 +577,9 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + sq->tisn) == obj_id); + } + +- if (qp_type == MLX5_IB_QPT_DCT) ++ if (qp->type == MLX5_IB_QPT_DCT) + return get_enc_obj_id(MLX5_CMD_OP_CREATE_DCT, + qp->dct.mdct.mqp.qpn) == obj_id; +- + return get_enc_obj_id(MLX5_CMD_OP_CREATE_QP, + qp->ibqp.qp_num) == obj_id; + } +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index beec0d7c0d6e8..b19506707e45c 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -4762,6 +4762,7 @@ static void *mlx5_ib_add_slave_port(struct mlx5_core_dev *mdev) + + if (bound) { + rdma_roce_rescan_device(&dev->ib_dev); ++ mpi->ibdev->ib_active = true; + break; + } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 656a5b4be847e..1e716fe7014cc 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -231,6 +231,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->sq.queue->buf); + kfree(qp->sq.queue); ++ qp->sq.queue = NULL; + return err; + } + +@@ -284,6 +285,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->rq.queue->buf); + kfree(qp->rq.queue); ++ qp->rq.queue = NULL; + return err; + } + } +@@ -344,6 +346,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, + err2: + rxe_queue_cleanup(qp->sq.queue); + err1: ++ qp->pd = NULL; ++ qp->rcq = NULL; ++ qp->scq = NULL; ++ qp->srq = NULL; ++ + if (srq) + rxe_drop_ref(srq); + rxe_drop_ref(scq); +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index fb25e8011f5a4..34e847a91eb80 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -300,7 +300,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + struct siw_ucontext *uctx = + rdma_udata_to_drv_context(udata, struct siw_ucontext, + base_ucontext); +- struct siw_cq *scq = NULL, *rcq = NULL; + unsigned long flags; + int num_sqe, num_rqe, rv = 0; + size_t length; +@@ -340,10 +339,8 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + rv = -EINVAL; + goto err_out; + } +- scq = to_siw_cq(attrs->send_cq); +- rcq = to_siw_cq(attrs->recv_cq); + +- if (!scq || (!rcq && !attrs->srq)) { ++ if (!attrs->send_cq || (!attrs->recv_cq && !attrs->srq)) { + siw_dbg(base_dev, "send CQ or receive CQ invalid\n"); + rv = -EINVAL; + goto err_out; +@@ -375,7 +372,7 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + else { + /* Zero sized SQ is not supported */ + rv = -EINVAL; +- goto err_out; ++ goto err_out_xa; + } + if (num_rqe) + num_rqe = roundup_pow_of_two(num_rqe); +@@ -398,8 +395,8 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + } + } + qp->pd = pd; +- qp->scq = scq; +- qp->rcq = rcq; ++ qp->scq = to_siw_cq(attrs->send_cq); ++ qp->rcq = to_siw_cq(attrs->recv_cq); + + if (attrs->srq) { + /* +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index fc433e63b1dc0..b1590cb4a1887 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -307,7 +307,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + usleep_range(3000, 6000); + ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); + if (ret) +- return ret; ++ goto out; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index 11890db71f3fe..962f7df0691ef 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1408,6 +1408,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + if (!s->store->chunk_size) { + ti->error = "Chunk size not set"; ++ r = -EINVAL; + goto bad_read_metadata; + } + +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index f318cd4b8086f..083dba95beaa0 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -915,7 +915,6 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + +- memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c +index 926408b41270c..7a6f01ace78ac 100644 +--- a/drivers/misc/eeprom/at24.c ++++ b/drivers/misc/eeprom/at24.c +@@ -763,7 +763,8 @@ static int at24_probe(struct i2c_client *client) + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); +- regulator_disable(at24->vcc_reg); ++ if (!pm_runtime_status_suspended(dev)) ++ regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + +@@ -774,7 +775,8 @@ static int at24_probe(struct i2c_client *client) + err = at24_read(at24, 0, &test_byte, 1); + if (err) { + pm_runtime_disable(dev); +- regulator_disable(at24->vcc_reg); ++ if (!pm_runtime_status_suspended(dev)) ++ regulator_disable(at24->vcc_reg); + return -ENODEV; + } + +diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c +index 2bdf560ee681b..0f9ea75b0b189 100644 +--- a/drivers/misc/ics932s401.c ++++ b/drivers/misc/ics932s401.c +@@ -134,7 +134,7 @@ static struct ics932s401_data *ics932s401_update_device(struct device *dev) + for (i = 0; i < NUM_MIRRORED_REGS; i++) { + temp = i2c_smbus_read_word_data(client, regs_to_copy[i]); + if (temp < 0) +- data->regs[regs_to_copy[i]] = 0; ++ temp = 0; + data->regs[regs_to_copy[i]] = temp >> 8; + } + +diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c +index 9887485a41348..23b89b4cad088 100644 +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -555,8 +555,13 @@ static void sdhci_gli_voltage_switch(struct sdhci_host *host) + * + * Wait 5ms after set 1.8V signal enable in Host Control 2 register + * to ensure 1.8V signal enable bit is set by GL9750/GL9755. ++ * ++ * ...however, the controller in the NUC10i3FNK4 (a 9755) requires ++ * slightly longer than 5ms before the control register reports that ++ * 1.8V is ready, and far longer still before the card will actually ++ * work reliably. + */ +- usleep_range(5000, 5500); ++ usleep_range(100000, 110000); + } + + static void sdhci_gl9750_reset(struct sdhci_host *host, u8 mask) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index d8a3ecaed3fc6..d8f0863b39342 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -1048,7 +1048,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { + skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); + if (!skb) +- break; ++ goto error; + qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); + skb_put(skb, QLCNIC_ILB_PKT_SIZE); + adapter->ahw->diag_cnt = 0; +@@ -1072,6 +1072,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + cnt++; + } + if (cnt != i) { ++error: + dev_err(&adapter->pdev->dev, + "LB Test: failed, TX[%d], RX[%d]\n", i, cnt); + if (mode != QLCNIC_ILB_MODE) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index 0e1ca2cba3c7c..e18dee7fe6876 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -30,7 +30,7 @@ struct sunxi_priv_data { + static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + { + struct sunxi_priv_data *gmac = priv; +- int ret; ++ int ret = 0; + + if (gmac->regulator) { + ret = regulator_enable(gmac->regulator); +@@ -51,11 +51,11 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + } else { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); + ret = clk_prepare(gmac->tx_clk); +- if (ret) +- return ret; ++ if (ret && gmac->regulator) ++ regulator_disable(gmac->regulator); + } + +- return 0; ++ return ret; + } + + static void sun7i_gmac_exit(struct platform_device *pdev, void *priv) +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 707ccdd03b19e..74e748662ec01 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -8144,10 +8144,10 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + "VPD_SCAN: Reading in property [%s] len[%d]\n", + namebuf, prop_len); + for (i = 0; i < prop_len; i++) { +- err = niu_pci_eeprom_read(np, off + i); +- if (err >= 0) +- *prop_buf = err; +- ++prop_buf; ++ err = niu_pci_eeprom_read(np, off + i); ++ if (err < 0) ++ return err; ++ *prop_buf++ = err; + } + } + +@@ -8158,14 +8158,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + } + + /* ESPC_PIO_EN_ENABLE must be set */ +-static void niu_pci_vpd_fetch(struct niu *np, u32 start) ++static int niu_pci_vpd_fetch(struct niu *np, u32 start) + { + u32 offset; + int err; + + err = niu_pci_eeprom_read16_swp(np, start + 1); + if (err < 0) +- return; ++ return err; + + offset = err + 3; + +@@ -8174,12 +8174,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + u32 end; + + err = niu_pci_eeprom_read(np, here); ++ if (err < 0) ++ return err; + if (err != 0x90) +- return; ++ return -EINVAL; + + err = niu_pci_eeprom_read16_swp(np, here + 1); + if (err < 0) +- return; ++ return err; + + here = start + offset + 3; + end = start + offset + err; +@@ -8187,9 +8189,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + offset += err; + + err = niu_pci_vpd_scan_props(np, here, end); +- if (err < 0 || err == 1) +- return; ++ if (err < 0) ++ return err; ++ if (err == 1) ++ return -EINVAL; + } ++ return 0; + } + + /* ESPC_PIO_EN_ENABLE must be set */ +@@ -9280,8 +9285,11 @@ static int niu_get_invariants(struct niu *np) + offset = niu_pci_vpd_offset(np); + netif_printk(np, probe, KERN_DEBUG, np->dev, + "%s() VPD offset [%08x]\n", __func__, offset); +- if (offset) +- niu_pci_vpd_fetch(np, offset); ++ if (offset) { ++ err = niu_pci_vpd_fetch(np, offset); ++ if (err < 0) ++ return err; ++ } + nw64(ESPC_PIO_EN, 0); + + if (np->flags & NIU_FLAGS_VPD_VALID) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 6e8bd99e8911d..1866f6c2acab1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -440,9 +440,14 @@ static void rtl_watchdog_wq_callback(struct work_struct *work); + static void rtl_fwevt_wq_callback(struct work_struct *work); + static void rtl_c2hcmd_wq_callback(struct work_struct *work); + +-static void _rtl_init_deferred_work(struct ieee80211_hw *hw) ++static int _rtl_init_deferred_work(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct workqueue_struct *wq; ++ ++ wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); ++ if (!wq) ++ return -ENOMEM; + + /* <1> timer */ + timer_setup(&rtlpriv->works.watchdog_timer, +@@ -451,11 +456,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + rtl_easy_concurrent_retrytimer_callback, 0); + /* <2> work queue */ + rtlpriv->works.hw = hw; +- rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); +- if (unlikely(!rtlpriv->works.rtl_wq)) { +- pr_err("Failed to allocate work queue\n"); +- return; +- } ++ rtlpriv->works.rtl_wq = wq; + + INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, + rtl_watchdog_wq_callback); +@@ -466,6 +467,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + rtl_swlps_rfon_wq_callback); + INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq, rtl_fwevt_wq_callback); + INIT_DELAYED_WORK(&rtlpriv->works.c2hcmd_wq, rtl_c2hcmd_wq_callback); ++ return 0; + } + + void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq) +@@ -565,9 +567,7 @@ int rtl_init_core(struct ieee80211_hw *hw) + rtlmac->link_state = MAC80211_NOLINK; + + /* <6> init deferred work */ +- _rtl_init_deferred_work(hw); +- +- return 0; ++ return _rtl_init_deferred_work(hw); + } + EXPORT_SYMBOL_GPL(rtl_init_core); + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 740de61d12a0e..f520a71a361fc 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3131,7 +3131,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + ctrl->hmmaxd = le16_to_cpu(id->hmmaxd); + } + +- ret = nvme_mpath_init(ctrl, id); ++ ret = nvme_mpath_init_identify(ctrl, id); + kfree(id); + + if (ret < 0) +@@ -4517,6 +4517,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + min(default_ps_max_latency_us, (unsigned long)S32_MAX)); + + nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device)); ++ nvme_mpath_init_ctrl(ctrl); + + return 0; + out_free_name: +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 41257daf7464d..a0bcec33b0208 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2460,6 +2460,18 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved) + static void + __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues) + { ++ int q; ++ ++ /* ++ * if aborting io, the queues are no longer good, mark them ++ * all as not live. ++ */ ++ if (ctrl->ctrl.queue_count > 1) { ++ for (q = 1; q < ctrl->ctrl.queue_count; q++) ++ clear_bit(NVME_FC_Q_LIVE, &ctrl->queues[q].flags); ++ } ++ clear_bit(NVME_FC_Q_LIVE, &ctrl->queues[0].flags); ++ + /* + * If io queues are present, stop them and terminate all outstanding + * ios on them. As FC allocates FC exchange for each io, the +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index f750cf98ae264..2747efc03825c 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -708,9 +708,18 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head) + put_disk(head->disk); + } + +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) + { +- int error; ++ mutex_init(&ctrl->ana_lock); ++ timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); ++ INIT_WORK(&ctrl->ana_work, nvme_ana_work); ++} ++ ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++{ ++ size_t max_transfer_size = ctrl->max_hw_sectors << SECTOR_SHIFT; ++ size_t ana_log_size; ++ int error = 0; + + /* check if multipath is enabled and we have the capability */ + if (!multipath || !ctrl->subsys || +@@ -722,37 +731,31 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + ctrl->nanagrpid = le32_to_cpu(id->nanagrpid); + ctrl->anagrpmax = le32_to_cpu(id->anagrpmax); + +- mutex_init(&ctrl->ana_lock); +- timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); +- ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + +- ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); +- +- if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { ++ ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + ++ ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc) + ++ ctrl->max_namespaces * sizeof(__le32); ++ if (ana_log_size > max_transfer_size) { + dev_err(ctrl->device, +- "ANA log page size (%zd) larger than MDTS (%d).\n", +- ctrl->ana_log_size, +- ctrl->max_hw_sectors << SECTOR_SHIFT); ++ "ANA log page size (%zd) larger than MDTS (%zd).\n", ++ ana_log_size, max_transfer_size); + dev_err(ctrl->device, "disabling ANA support.\n"); +- return 0; ++ goto out_uninit; + } +- +- INIT_WORK(&ctrl->ana_work, nvme_ana_work); +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL); +- if (!ctrl->ana_log_buf) { +- error = -ENOMEM; +- goto out; ++ if (ana_log_size > ctrl->ana_log_size) { ++ nvme_mpath_stop(ctrl); ++ kfree(ctrl->ana_log_buf); ++ ctrl->ana_log_buf = kmalloc(ana_log_size, GFP_KERNEL); ++ if (!ctrl->ana_log_buf) ++ return -ENOMEM; + } +- ++ ctrl->ana_log_size = ana_log_size; + error = nvme_read_ana_log(ctrl); + if (error) +- goto out_free_ana_log_buf; ++ goto out_uninit; + return 0; +-out_free_ana_log_buf: +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = NULL; +-out: ++ ++out_uninit: ++ nvme_mpath_uninit(ctrl); + return error; + } + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index f843540cc238e..3cb3c82061d7e 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -654,7 +654,8 @@ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl); + int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head); + void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id); + void nvme_mpath_remove_disk(struct nvme_ns_head *head); +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_mpath_uninit(struct nvme_ctrl *ctrl); + void nvme_mpath_stop(struct nvme_ctrl *ctrl); + bool nvme_mpath_clear_current_path(struct nvme_ns *ns); +@@ -730,7 +731,10 @@ static inline void nvme_trace_bio_complete(struct request *req, + blk_status_t status) + { + } +-static inline int nvme_mpath_init(struct nvme_ctrl *ctrl, ++static inline void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) ++{ ++} ++static inline int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, + struct nvme_id_ctrl *id) + { + if (ctrl->subsys->cmic & (1 << 3)) +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 4cf81f3841aee..82b2611d39a2f 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -940,7 +940,6 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req) + if (ret <= 0) + return ret; + +- nvme_tcp_advance_req(req, ret); + if (queue->data_digest) + nvme_tcp_ddgst_update(queue->snd_hash, page, + offset, ret); +@@ -957,6 +956,7 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req) + } + return 1; + } ++ nvme_tcp_advance_req(req, ret); + } + return -EAGAIN; + } +@@ -1140,7 +1140,8 @@ static void nvme_tcp_io_work(struct work_struct *w) + pending = true; + else if (unlikely(result < 0)) + break; +- } ++ } else ++ pending = !llist_empty(&queue->req_list); + + result = nvme_tcp_try_recv(queue); + if (result > 0) +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 1e79d33c1df7e..46e4f7ea34c8b 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -757,8 +757,6 @@ void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq, + { + cq->qid = qid; + cq->size = size; +- +- ctrl->cqs[qid] = cq; + } + + void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq, +@@ -1355,20 +1353,14 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, + if (!ctrl->changed_ns_list) + goto out_free_ctrl; + +- ctrl->cqs = kcalloc(subsys->max_qid + 1, +- sizeof(struct nvmet_cq *), +- GFP_KERNEL); +- if (!ctrl->cqs) +- goto out_free_changed_ns_list; +- + ctrl->sqs = kcalloc(subsys->max_qid + 1, + sizeof(struct nvmet_sq *), + GFP_KERNEL); + if (!ctrl->sqs) +- goto out_free_cqs; ++ goto out_free_changed_ns_list; + + if (subsys->cntlid_min > subsys->cntlid_max) +- goto out_free_cqs; ++ goto out_free_sqs; + + ret = ida_simple_get(&cntlid_ida, + subsys->cntlid_min, subsys->cntlid_max, +@@ -1406,8 +1398,6 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, + + out_free_sqs: + kfree(ctrl->sqs); +-out_free_cqs: +- kfree(ctrl->cqs); + out_free_changed_ns_list: + kfree(ctrl->changed_ns_list); + out_free_ctrl: +@@ -1437,7 +1427,6 @@ static void nvmet_ctrl_free(struct kref *ref) + + nvmet_async_events_free(ctrl); + kfree(ctrl->sqs); +- kfree(ctrl->cqs); + kfree(ctrl->changed_ns_list); + kfree(ctrl); + +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index 0abbefd9925e3..b575997244482 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -49,9 +49,11 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns) + + ns->file = filp_open(ns->device_path, flags, 0); + if (IS_ERR(ns->file)) { +- pr_err("failed to open file %s: (%ld)\n", +- ns->device_path, PTR_ERR(ns->file)); +- return PTR_ERR(ns->file); ++ ret = PTR_ERR(ns->file); ++ pr_err("failed to open file %s: (%d)\n", ++ ns->device_path, ret); ++ ns->file = NULL; ++ return ret; + } + + ret = nvmet_file_ns_revalidate(ns); +diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c +index f6d81239be215..b869b686e9623 100644 +--- a/drivers/nvme/target/loop.c ++++ b/drivers/nvme/target/loop.c +@@ -578,8 +578,10 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, + + ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, + 0 /* no quirks, we're perfect! */); +- if (ret) ++ if (ret) { ++ kfree(ctrl); + goto out; ++ } + + if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) + WARN_ON_ONCE(1); +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index bc91336080e01..ea96487b5424e 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -164,7 +164,6 @@ static inline struct nvmet_port *ana_groups_to_port( + + struct nvmet_ctrl { + struct nvmet_subsys *subsys; +- struct nvmet_cq **cqs; + struct nvmet_sq **sqs; + + bool cmd_seen; +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index bbc4e71a16ff8..38800e86ed8ad 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -294,6 +294,9 @@ mlxbf_tmfifo_get_next_desc(struct mlxbf_tmfifo_vring *vring) + if (vring->next_avail == virtio16_to_cpu(vdev, vr->avail->idx)) + return NULL; + ++ /* Make sure 'avail->idx' is visible already. */ ++ virtio_rmb(false); ++ + idx = vring->next_avail % vr->num; + head = virtio16_to_cpu(vdev, vr->avail->ring[idx]); + if (WARN_ON(head >= vr->num)) +@@ -322,7 +325,7 @@ static void mlxbf_tmfifo_release_desc(struct mlxbf_tmfifo_vring *vring, + * done or not. Add a memory barrier here to make sure the update above + * completes before updating the idx. + */ +- mb(); ++ virtio_mb(false); + vr->used->idx = cpu_to_virtio16(vdev, vr_idx + 1); + } + +@@ -733,6 +736,12 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + desc = NULL; + fifo->vring[is_rx] = NULL; + ++ /* ++ * Make sure the load/store are in order before ++ * returning back to virtio. ++ */ ++ virtio_mb(false); ++ + /* Notify upper layer that packet is done. */ + spin_lock_irqsave(&fifo->spin_lock[is_rx], flags); + vring_interrupt(0, vring->vq); +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 0d91d136bc3b7..a1858689d6e10 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -821,7 +821,7 @@ config INTEL_HID_EVENT + + config INTEL_INT0002_VGPIO + tristate "Intel ACPI INT0002 Virtual GPIO driver" +- depends on GPIOLIB && ACPI ++ depends on GPIOLIB && ACPI && PM_SLEEP + select GPIOLIB_IRQCHIP + help + Some peripherals on Bay Trail and Cherry Trail platforms signal a +diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c +index 27a298b7c541b..c97bd4a452422 100644 +--- a/drivers/platform/x86/dell-smbios-wmi.c ++++ b/drivers/platform/x86/dell-smbios-wmi.c +@@ -271,7 +271,8 @@ int init_dell_smbios_wmi(void) + + void exit_dell_smbios_wmi(void) + { +- wmi_driver_unregister(&dell_smbios_wmi_driver); ++ if (wmi_supported) ++ wmi_driver_unregister(&dell_smbios_wmi_driver); + } + + MODULE_DEVICE_TABLE(wmi, dell_smbios_wmi_id_table); +diff --git a/drivers/platform/x86/intel_int0002_vgpio.c b/drivers/platform/x86/intel_int0002_vgpio.c +index 289c6655d425d..569342aa8926e 100644 +--- a/drivers/platform/x86/intel_int0002_vgpio.c ++++ b/drivers/platform/x86/intel_int0002_vgpio.c +@@ -51,6 +51,12 @@ + #define GPE0A_STS_PORT 0x420 + #define GPE0A_EN_PORT 0x428 + ++struct int0002_data { ++ struct gpio_chip chip; ++ int parent_irq; ++ int wake_enable_count; ++}; ++ + /* + * As this is not a real GPIO at all, but just a hack to model an event in + * ACPI the get / set functions are dummy functions. +@@ -98,14 +104,16 @@ static void int0002_irq_mask(struct irq_data *data) + static int int0002_irq_set_wake(struct irq_data *data, unsigned int on) + { + struct gpio_chip *chip = irq_data_get_irq_chip_data(data); +- struct platform_device *pdev = to_platform_device(chip->parent); +- int irq = platform_get_irq(pdev, 0); ++ struct int0002_data *int0002 = container_of(chip, struct int0002_data, chip); + +- /* Propagate to parent irq */ ++ /* ++ * Applying of the wakeup flag to our parent IRQ is delayed till system ++ * suspend, because we only want to do this when using s2idle. ++ */ + if (on) +- enable_irq_wake(irq); ++ int0002->wake_enable_count++; + else +- disable_irq_wake(irq); ++ int0002->wake_enable_count--; + + return 0; + } +@@ -135,7 +143,7 @@ static bool int0002_check_wake(void *data) + return (gpe_sts_reg & GPE0A_PME_B0_STS_BIT); + } + +-static struct irq_chip int0002_byt_irqchip = { ++static struct irq_chip int0002_irqchip = { + .name = DRV_NAME, + .irq_ack = int0002_irq_ack, + .irq_mask = int0002_irq_mask, +@@ -143,21 +151,9 @@ static struct irq_chip int0002_byt_irqchip = { + .irq_set_wake = int0002_irq_set_wake, + }; + +-static struct irq_chip int0002_cht_irqchip = { +- .name = DRV_NAME, +- .irq_ack = int0002_irq_ack, +- .irq_mask = int0002_irq_mask, +- .irq_unmask = int0002_irq_unmask, +- /* +- * No set_wake, on CHT the IRQ is typically shared with the ACPI SCI +- * and we don't want to mess with the ACPI SCI irq settings. +- */ +- .flags = IRQCHIP_SKIP_SET_WAKE, +-}; +- + static const struct x86_cpu_id int0002_cpu_ids[] = { +- X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT, &int0002_byt_irqchip), +- X86_MATCH_INTEL_FAM6_MODEL(ATOM_AIRMONT, &int0002_cht_irqchip), ++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT, NULL), ++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_AIRMONT, NULL), + {} + }; + +@@ -172,8 +168,9 @@ static int int0002_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + const struct x86_cpu_id *cpu_id; +- struct gpio_chip *chip; ++ struct int0002_data *int0002; + struct gpio_irq_chip *girq; ++ struct gpio_chip *chip; + int irq, ret; + + /* Menlow has a different INT0002 device? <sigh> */ +@@ -185,10 +182,13 @@ static int int0002_probe(struct platform_device *pdev) + if (irq < 0) + return irq; + +- chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL); +- if (!chip) ++ int0002 = devm_kzalloc(dev, sizeof(*int0002), GFP_KERNEL); ++ if (!int0002) + return -ENOMEM; + ++ int0002->parent_irq = irq; ++ ++ chip = &int0002->chip; + chip->label = DRV_NAME; + chip->parent = dev; + chip->owner = THIS_MODULE; +@@ -214,7 +214,7 @@ static int int0002_probe(struct platform_device *pdev) + } + + girq = &chip->irq; +- girq->chip = (struct irq_chip *)cpu_id->driver_data; ++ girq->chip = &int0002_irqchip; + /* This let us handle the parent IRQ in the driver */ + girq->parent_handler = NULL; + girq->num_parents = 0; +@@ -230,6 +230,7 @@ static int int0002_probe(struct platform_device *pdev) + + acpi_register_wakeup_handler(irq, int0002_check_wake, NULL); + device_init_wakeup(dev, true); ++ dev_set_drvdata(dev, int0002); + return 0; + } + +@@ -240,6 +241,36 @@ static int int0002_remove(struct platform_device *pdev) + return 0; + } + ++static int int0002_suspend(struct device *dev) ++{ ++ struct int0002_data *int0002 = dev_get_drvdata(dev); ++ ++ /* ++ * The INT0002 parent IRQ is often shared with the ACPI GPE IRQ, don't ++ * muck with it when firmware based suspend is used, otherwise we may ++ * cause spurious wakeups from firmware managed suspend. ++ */ ++ if (!pm_suspend_via_firmware() && int0002->wake_enable_count) ++ enable_irq_wake(int0002->parent_irq); ++ ++ return 0; ++} ++ ++static int int0002_resume(struct device *dev) ++{ ++ struct int0002_data *int0002 = dev_get_drvdata(dev); ++ ++ if (!pm_suspend_via_firmware() && int0002->wake_enable_count) ++ disable_irq_wake(int0002->parent_irq); ++ ++ return 0; ++} ++ ++static const struct dev_pm_ops int0002_pm_ops = { ++ .suspend = int0002_suspend, ++ .resume = int0002_resume, ++}; ++ + static const struct acpi_device_id int0002_acpi_ids[] = { + { "INT0002", 0 }, + { }, +@@ -250,6 +281,7 @@ static struct platform_driver int0002_driver = { + .driver = { + .name = DRV_NAME, + .acpi_match_table = int0002_acpi_ids, ++ .pm = &int0002_pm_ops, + }, + .probe = int0002_probe, + .remove = int0002_remove, +diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c +index 50ec53d67a4c0..db4c265287ae6 100644 +--- a/drivers/rapidio/rio_cm.c ++++ b/drivers/rapidio/rio_cm.c +@@ -2127,6 +2127,14 @@ static int riocm_add_mport(struct device *dev, + return -ENODEV; + } + ++ cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); ++ if (!cm->rx_wq) { ++ rio_release_inb_mbox(mport, cmbox); ++ rio_release_outb_mbox(mport, cmbox); ++ kfree(cm); ++ return -ENOMEM; ++ } ++ + /* + * Allocate and register inbound messaging buffers to be ready + * to receive channel and system management requests +@@ -2137,15 +2145,6 @@ static int riocm_add_mport(struct device *dev, + cm->rx_slots = RIOCM_RX_RING_SIZE; + mutex_init(&cm->rx_lock); + riocm_rx_fill(cm, RIOCM_RX_RING_SIZE); +- cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); +- if (!cm->rx_wq) { +- riocm_error("failed to allocate IBMBOX_%d on %s", +- cmbox, mport->name); +- rio_release_outb_mbox(mport, cmbox); +- kfree(cm); +- return -ENOMEM; +- } +- + INIT_WORK(&cm->rx_work, rio_ibmsg_handler); + + cm->tx_slot = 0; +diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c +index f8b99cb729590..62684ca3a665e 100644 +--- a/drivers/rtc/rtc-pcf85063.c ++++ b/drivers/rtc/rtc-pcf85063.c +@@ -486,6 +486,7 @@ static struct clk *pcf85063_clkout_register_clk(struct pcf85063 *pcf85063) + { + struct clk *clk; + struct clk_init_data init; ++ struct device_node *node = pcf85063->rtc->dev.parent->of_node; + + init.name = "pcf85063-clkout"; + init.ops = &pcf85063_clkout_ops; +@@ -495,15 +496,13 @@ static struct clk *pcf85063_clkout_register_clk(struct pcf85063 *pcf85063) + pcf85063->clkout_hw.init = &init; + + /* optional override of the clockname */ +- of_property_read_string(pcf85063->rtc->dev.of_node, +- "clock-output-names", &init.name); ++ of_property_read_string(node, "clock-output-names", &init.name); + + /* register the clock */ + clk = devm_clk_register(&pcf85063->rtc->dev, &pcf85063->clkout_hw); + + if (!IS_ERR(clk)) +- of_clk_add_provider(pcf85063->rtc->dev.of_node, +- of_clk_src_simple_get, clk); ++ of_clk_add_provider(node, of_clk_src_simple_get, clk); + + return clk; + } +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 46d185cb9ea80..a464d0a4f4653 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -536,7 +536,9 @@ static void qedf_update_link_speed(struct qedf_ctx *qedf, + if (linkmode_intersects(link->supported_caps, sup_caps)) + lport->link_supported_speeds |= FC_PORTSPEED_20GBIT; + +- fc_host_supported_speeds(lport->host) = lport->link_supported_speeds; ++ if (lport->host && lport->host->shost_data) ++ fc_host_supported_speeds(lport->host) = ++ lport->link_supported_speeds; + } + + static void qedf_bw_update(void *dev) +diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c +index b3ba0de5d4fb8..0563c9530dcad 100644 +--- a/drivers/scsi/qla2xxx/qla_nx.c ++++ b/drivers/scsi/qla2xxx/qla_nx.c +@@ -1066,7 +1066,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr, + return ret; + } + +- if (qla82xx_flash_set_write_enable(ha)) ++ ret = qla82xx_flash_set_write_enable(ha); ++ if (ret < 0) + goto done_write; + + qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data); +diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c +index 074a6a055a4c0..55b7161d76977 100644 +--- a/drivers/scsi/ufs/ufs-hisi.c ++++ b/drivers/scsi/ufs/ufs-hisi.c +@@ -478,21 +478,24 @@ static int ufs_hisi_init_common(struct ufs_hba *hba) + host->hba = hba; + ufshcd_set_variant(hba, host); + +- host->rst = devm_reset_control_get(dev, "rst"); ++ host->rst = devm_reset_control_get(dev, "rst"); + if (IS_ERR(host->rst)) { + dev_err(dev, "%s: failed to get reset control\n", __func__); +- return PTR_ERR(host->rst); ++ err = PTR_ERR(host->rst); ++ goto error; + } + + ufs_hisi_set_pm_lvl(hba); + + err = ufs_hisi_get_resource(host); +- if (err) { +- ufshcd_set_variant(hba, NULL); +- return err; +- } ++ if (err) ++ goto error; + + return 0; ++ ++error: ++ ufshcd_set_variant(hba, NULL); ++ return err; + } + + static int ufs_hi3660_init(struct ufs_hba *hba) +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 08d4d40c510ea..854c96e630077 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -2768,7 +2768,7 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, + * ufshcd_exec_dev_cmd - API for sending device management requests + * @hba: UFS hba + * @cmd_type: specifies the type (NOP, Query...) +- * @timeout: time in seconds ++ * @timeout: timeout in milliseconds + * + * NOTE: Since there is only one available tag for device management commands, + * it is expected you hold the hba->dev_cmd.lock mutex. +@@ -2798,6 +2798,9 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, + } + tag = req->tag; + WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); ++ /* Set the timeout such that the SCSI error handler is not activated. */ ++ req->timeout = msecs_to_jiffies(2 * timeout); ++ blk_mq_start_request(req); + + init_completion(&wait); + lrbp = &hba->lrb[tag]; +diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h +index 337c8d82f74eb..6d0f7062bb870 100644 +--- a/drivers/tee/amdtee/amdtee_private.h ++++ b/drivers/tee/amdtee/amdtee_private.h +@@ -21,6 +21,7 @@ + #define TEEC_SUCCESS 0x00000000 + #define TEEC_ERROR_GENERIC 0xFFFF0000 + #define TEEC_ERROR_BAD_PARAMETERS 0xFFFF0006 ++#define TEEC_ERROR_OUT_OF_MEMORY 0xFFFF000C + #define TEEC_ERROR_COMMUNICATION 0xFFFF000E + + #define TEEC_ORIGIN_COMMS 0x00000002 +@@ -93,6 +94,18 @@ struct amdtee_shm_data { + u32 buf_id; + }; + ++/** ++ * struct amdtee_ta_data - Keeps track of all TAs loaded in AMD Secure ++ * Processor ++ * @ta_handle: Handle to TA loaded in TEE ++ * @refcount: Reference count for the loaded TA ++ */ ++struct amdtee_ta_data { ++ struct list_head list_node; ++ u32 ta_handle; ++ u32 refcount; ++}; ++ + #define LOWER_TWO_BYTE_MASK 0x0000FFFF + + /** +diff --git a/drivers/tee/amdtee/call.c b/drivers/tee/amdtee/call.c +index 096dd4d92d39c..07f36ac834c88 100644 +--- a/drivers/tee/amdtee/call.c ++++ b/drivers/tee/amdtee/call.c +@@ -121,15 +121,69 @@ static int amd_params_to_tee_params(struct tee_param *tee, u32 count, + return ret; + } + ++static DEFINE_MUTEX(ta_refcount_mutex); ++static struct list_head ta_list = LIST_HEAD_INIT(ta_list); ++ ++static u32 get_ta_refcount(u32 ta_handle) ++{ ++ struct amdtee_ta_data *ta_data; ++ u32 count = 0; ++ ++ /* Caller must hold a mutex */ ++ list_for_each_entry(ta_data, &ta_list, list_node) ++ if (ta_data->ta_handle == ta_handle) ++ return ++ta_data->refcount; ++ ++ ta_data = kzalloc(sizeof(*ta_data), GFP_KERNEL); ++ if (ta_data) { ++ ta_data->ta_handle = ta_handle; ++ ta_data->refcount = 1; ++ count = ta_data->refcount; ++ list_add(&ta_data->list_node, &ta_list); ++ } ++ ++ return count; ++} ++ ++static u32 put_ta_refcount(u32 ta_handle) ++{ ++ struct amdtee_ta_data *ta_data; ++ u32 count = 0; ++ ++ /* Caller must hold a mutex */ ++ list_for_each_entry(ta_data, &ta_list, list_node) ++ if (ta_data->ta_handle == ta_handle) { ++ count = --ta_data->refcount; ++ if (count == 0) { ++ list_del(&ta_data->list_node); ++ kfree(ta_data); ++ break; ++ } ++ } ++ ++ return count; ++} ++ + int handle_unload_ta(u32 ta_handle) + { + struct tee_cmd_unload_ta cmd = {0}; +- u32 status; ++ u32 status, count; + int ret; + + if (!ta_handle) + return -EINVAL; + ++ mutex_lock(&ta_refcount_mutex); ++ ++ count = put_ta_refcount(ta_handle); ++ ++ if (count) { ++ pr_debug("unload ta: not unloading %u count %u\n", ++ ta_handle, count); ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + cmd.ta_handle = ta_handle; + + ret = psp_tee_process_cmd(TEE_CMD_ID_UNLOAD_TA, (void *)&cmd, +@@ -137,8 +191,12 @@ int handle_unload_ta(u32 ta_handle) + if (!ret && status != 0) { + pr_err("unload ta: status = 0x%x\n", status); + ret = -EBUSY; ++ } else { ++ pr_debug("unloaded ta handle %u\n", ta_handle); + } + ++unlock: ++ mutex_unlock(&ta_refcount_mutex); + return ret; + } + +@@ -340,7 +398,8 @@ int handle_open_session(struct tee_ioctl_open_session_arg *arg, u32 *info, + + int handle_load_ta(void *data, u32 size, struct tee_ioctl_open_session_arg *arg) + { +- struct tee_cmd_load_ta cmd = {0}; ++ struct tee_cmd_unload_ta unload_cmd = {}; ++ struct tee_cmd_load_ta load_cmd = {}; + phys_addr_t blob; + int ret; + +@@ -353,21 +412,36 @@ int handle_load_ta(void *data, u32 size, struct tee_ioctl_open_session_arg *arg) + return -EINVAL; + } + +- cmd.hi_addr = upper_32_bits(blob); +- cmd.low_addr = lower_32_bits(blob); +- cmd.size = size; ++ load_cmd.hi_addr = upper_32_bits(blob); ++ load_cmd.low_addr = lower_32_bits(blob); ++ load_cmd.size = size; + +- ret = psp_tee_process_cmd(TEE_CMD_ID_LOAD_TA, (void *)&cmd, +- sizeof(cmd), &arg->ret); ++ mutex_lock(&ta_refcount_mutex); ++ ++ ret = psp_tee_process_cmd(TEE_CMD_ID_LOAD_TA, (void *)&load_cmd, ++ sizeof(load_cmd), &arg->ret); + if (ret) { + arg->ret_origin = TEEC_ORIGIN_COMMS; + arg->ret = TEEC_ERROR_COMMUNICATION; +- } else { +- set_session_id(cmd.ta_handle, 0, &arg->session); ++ } else if (arg->ret == TEEC_SUCCESS) { ++ ret = get_ta_refcount(load_cmd.ta_handle); ++ if (!ret) { ++ arg->ret_origin = TEEC_ORIGIN_COMMS; ++ arg->ret = TEEC_ERROR_OUT_OF_MEMORY; ++ ++ /* Unload the TA on error */ ++ unload_cmd.ta_handle = load_cmd.ta_handle; ++ psp_tee_process_cmd(TEE_CMD_ID_UNLOAD_TA, ++ (void *)&unload_cmd, ++ sizeof(unload_cmd), &ret); ++ } else { ++ set_session_id(load_cmd.ta_handle, 0, &arg->session); ++ } + } ++ mutex_unlock(&ta_refcount_mutex); + + pr_debug("load TA: TA handle = 0x%x, RO = 0x%x, ret = 0x%x\n", +- cmd.ta_handle, arg->ret_origin, arg->ret); ++ load_cmd.ta_handle, arg->ret_origin, arg->ret); + + return 0; + } +diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c +index 8a6a8f30bb427..da6b88e80dc07 100644 +--- a/drivers/tee/amdtee/core.c ++++ b/drivers/tee/amdtee/core.c +@@ -59,10 +59,9 @@ static void release_session(struct amdtee_session *sess) + continue; + + handle_close_session(sess->ta_handle, sess->session_info[i]); ++ handle_unload_ta(sess->ta_handle); + } + +- /* Unload Trusted Application once all sessions are closed */ +- handle_unload_ta(sess->ta_handle); + kfree(sess); + } + +@@ -224,8 +223,6 @@ static void destroy_session(struct kref *ref) + struct amdtee_session *sess = container_of(ref, struct amdtee_session, + refcount); + +- /* Unload the TA from TEE */ +- handle_unload_ta(sess->ta_handle); + mutex_lock(&session_list_mutex); + list_del(&sess->list_node); + mutex_unlock(&session_list_mutex); +@@ -238,7 +235,7 @@ int amdtee_open_session(struct tee_context *ctx, + { + struct amdtee_context_data *ctxdata = ctx->data; + struct amdtee_session *sess = NULL; +- u32 session_info; ++ u32 session_info, ta_handle; + size_t ta_size; + int rc, i; + void *ta; +@@ -259,11 +256,14 @@ int amdtee_open_session(struct tee_context *ctx, + if (arg->ret != TEEC_SUCCESS) + goto out; + ++ ta_handle = get_ta_handle(arg->session); ++ + mutex_lock(&session_list_mutex); + sess = alloc_session(ctxdata, arg->session); + mutex_unlock(&session_list_mutex); + + if (!sess) { ++ handle_unload_ta(ta_handle); + rc = -ENOMEM; + goto out; + } +@@ -277,6 +277,7 @@ int amdtee_open_session(struct tee_context *ctx, + + if (i >= TEE_NUM_SESSIONS) { + pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); ++ handle_unload_ta(ta_handle); + kref_put(&sess->refcount, destroy_session); + rc = -ENOMEM; + goto out; +@@ -289,12 +290,13 @@ int amdtee_open_session(struct tee_context *ctx, + spin_lock(&sess->lock); + clear_bit(i, sess->sess_mask); + spin_unlock(&sess->lock); ++ handle_unload_ta(ta_handle); + kref_put(&sess->refcount, destroy_session); + goto out; + } + + sess->session_info[i] = session_info; +- set_session_id(sess->ta_handle, i, &arg->session); ++ set_session_id(ta_handle, i, &arg->session); + out: + free_pages((u64)ta, get_order(ta_size)); + return rc; +@@ -329,6 +331,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) + + /* Close the session */ + handle_close_session(ta_handle, session_info); ++ handle_unload_ta(ta_handle); + + kref_put(&sess->refcount, destroy_session); + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index e0c00a1b07639..51b0ecabf2ec9 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -818,9 +818,6 @@ static int mvebu_uart_probe(struct platform_device *pdev) + return -EINVAL; + } + +- if (!match) +- return -ENODEV; +- + /* Assume that all UART ports have a DT alias or none has */ + id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (!pdev->dev.of_node || id < 0) +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 8f88ee2a2c8d0..06757b1d4aecd 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1172,7 +1172,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height, + /* Resizes the resolution of the display adapater */ + int err = 0; + +- if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize) ++ if (vc->vc_sw->con_resize) + err = vc->vc_sw->con_resize(vc, width, height, user); + + return err; +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index 5f61b25a9aaa8..09b8d02acd996 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -771,21 +771,58 @@ static int vt_resizex(struct vc_data *vc, struct vt_consize __user *cs) + if (copy_from_user(&v, cs, sizeof(struct vt_consize))) + return -EFAULT; + +- if (v.v_vlin) +- pr_info_once("\"struct vt_consize\"->v_vlin is ignored. Please report if you need this.\n"); +- if (v.v_clin) +- pr_info_once("\"struct vt_consize\"->v_clin is ignored. Please report if you need this.\n"); ++ /* FIXME: Should check the copies properly */ ++ if (!v.v_vlin) ++ v.v_vlin = vc->vc_scan_lines; ++ ++ if (v.v_clin) { ++ int rows = v.v_vlin / v.v_clin; ++ if (v.v_rows != rows) { ++ if (v.v_rows) /* Parameters don't add up */ ++ return -EINVAL; ++ v.v_rows = rows; ++ } ++ } ++ ++ if (v.v_vcol && v.v_ccol) { ++ int cols = v.v_vcol / v.v_ccol; ++ if (v.v_cols != cols) { ++ if (v.v_cols) ++ return -EINVAL; ++ v.v_cols = cols; ++ } ++ } ++ ++ if (v.v_clin > 32) ++ return -EINVAL; + +- console_lock(); + for (i = 0; i < MAX_NR_CONSOLES; i++) { +- vc = vc_cons[i].d; ++ struct vc_data *vcp; + +- if (vc) { +- vc->vc_resize_user = 1; +- vc_resize(vc, v.v_cols, v.v_rows); ++ if (!vc_cons[i].d) ++ continue; ++ console_lock(); ++ vcp = vc_cons[i].d; ++ if (vcp) { ++ int ret; ++ int save_scan_lines = vcp->vc_scan_lines; ++ int save_cell_height = vcp->vc_cell_height; ++ ++ if (v.v_vlin) ++ vcp->vc_scan_lines = v.v_vlin; ++ if (v.v_clin) ++ vcp->vc_cell_height = v.v_clin; ++ vcp->vc_resize_user = 1; ++ ret = vc_resize(vcp, v.v_cols, v.v_rows); ++ if (ret) { ++ vcp->vc_scan_lines = save_scan_lines; ++ vcp->vc_cell_height = save_cell_height; ++ console_unlock(); ++ return ret; ++ } + } ++ console_unlock(); + } +- console_unlock(); + + return 0; + } +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 4dae2320b103e..c31febe90d4ea 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -296,8 +296,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, + RECV_BUFFER_SIZE, &pdata->recv_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->recv_buf); + goto fail_close; ++ } + + /* put Global Physical Address Label in name */ + snprintf(pdata->recv_name, sizeof(pdata->recv_name), +@@ -316,8 +318,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->send_buf, + SEND_BUFFER_SIZE, &pdata->send_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->send_buf); + goto fail_close; ++ } + + snprintf(pdata->send_name, sizeof(pdata->send_name), + "send:%u", pdata->send_gpadl); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 17876f0179b57..5dc88a914b349 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -384,7 +384,7 @@ static void vgacon_init(struct vc_data *c, int init) + vc_resize(c, vga_video_num_columns, vga_video_num_lines); + + c->vc_scan_lines = vga_scan_lines; +- c->vc_font.height = vga_video_font_height; ++ c->vc_font.height = c->vc_cell_height = vga_video_font_height; + c->vc_complement_mask = 0x7700; + if (vga_512_chars) + c->vc_hi_font_mask = 0x0800; +@@ -519,32 +519,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) + switch (CUR_SIZE(c->vc_cursor_type)) { + case CUR_UNDERLINE: + vgacon_set_cursor_size(c->state.x, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 2 : 3), +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_TWO_THIRDS: + vgacon_set_cursor_size(c->state.x, +- c->vc_font.height / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_THIRD: + vgacon_set_cursor_size(c->state.x, +- (c->vc_font.height * 2) / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ (c->vc_cell_height * 2) / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_HALF: + vgacon_set_cursor_size(c->state.x, +- c->vc_font.height / 2, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 2, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_NONE: +@@ -555,7 +555,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) + break; + default: + vgacon_set_cursor_size(c->state.x, 1, +- c->vc_font.height); ++ c->vc_cell_height); + break; + } + break; +@@ -566,13 +566,13 @@ static int vgacon_doresize(struct vc_data *c, + unsigned int width, unsigned int height) + { + unsigned long flags; +- unsigned int scanlines = height * c->vc_font.height; ++ unsigned int scanlines = height * c->vc_cell_height; + u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan; + + raw_spin_lock_irqsave(&vga_lock, flags); + + vgacon_xres = width * VGA_FONTWIDTH; +- vgacon_yres = height * c->vc_font.height; ++ vgacon_yres = height * c->vc_cell_height; + if (vga_video_type >= VIDEO_TYPE_VGAC) { + outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg); + max_scan = inb_p(vga_video_port_val); +@@ -627,9 +627,9 @@ static int vgacon_doresize(struct vc_data *c, + static int vgacon_switch(struct vc_data *c) + { + int x = c->vc_cols * VGA_FONTWIDTH; +- int y = c->vc_rows * c->vc_font.height; ++ int y = c->vc_rows * c->vc_cell_height; + int rows = screen_info.orig_video_lines * vga_default_font_height/ +- c->vc_font.height; ++ c->vc_cell_height; + /* + * We need to save screen size here as it's the only way + * we can spot the screen has been resized and we need to +@@ -1060,7 +1060,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) + cursor_size_lastto = 0; + c->vc_sw->con_cursor(c, CM_DRAW); + } +- c->vc_font.height = fontheight; ++ c->vc_font.height = c->vc_cell_height = fontheight; + vc_resize(c, 0, rows); /* Adjust console size */ + } + } +@@ -1108,12 +1108,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + ++ if (user) { ++ /* ++ * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed ++ * the video mode! Set the new defaults then and go away. ++ */ ++ screen_info.orig_video_cols = width; ++ screen_info.orig_video_lines = height; ++ vga_default_font_height = c->vc_cell_height; ++ return 0; ++ } + if (width % 2 || width > screen_info.orig_video_cols || + height > (screen_info.orig_video_lines * vga_default_font_height)/ +- c->vc_font.height) +- /* let svgatextmode tinker with video timings and +- return success */ +- return (user) ? 0 : -EINVAL; ++ c->vc_cell_height) ++ return -EINVAL; + + if (con_is_visible(c) && !vga_is_gfx) /* who knows */ + vgacon_doresize(c, width, height); +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 26581194fdf81..42c72d051158f 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2031,7 +2031,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, + return -EINVAL; + + DPRINTK("resize now %ix%i\n", var.xres, var.yres); +- if (con_is_visible(vc)) { ++ if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) { + var.activate = FB_ACTIVATE_NOW | + FB_ACTIVATE_FORCE; + fb_set_var(info, &var); +diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c +index a45fcff1461fb..0fe32737ba084 100644 +--- a/drivers/video/fbdev/hgafb.c ++++ b/drivers/video/fbdev/hgafb.c +@@ -286,7 +286,7 @@ static int hga_card_detect(void) + + hga_vram = ioremap(0xb0000, hga_vram_len); + if (!hga_vram) +- goto error; ++ return -ENOMEM; + + if (request_region(0x3b0, 12, "hgafb")) + release_io_ports = 1; +@@ -346,13 +346,18 @@ static int hga_card_detect(void) + hga_type_name = "Hercules"; + break; + } +- return 1; ++ return 0; + error: + if (release_io_ports) + release_region(0x3b0, 12); + if (release_io_port) + release_region(0x3bf, 1); +- return 0; ++ ++ iounmap(hga_vram); ++ ++ pr_err("hgafb: HGA card not detected.\n"); ++ ++ return -EINVAL; + } + + /** +@@ -550,13 +555,11 @@ static const struct fb_ops hgafb_ops = { + static int hgafb_probe(struct platform_device *pdev) + { + struct fb_info *info; ++ int ret; + +- if (! hga_card_detect()) { +- printk(KERN_INFO "hgafb: HGA card not detected.\n"); +- if (hga_vram) +- iounmap(hga_vram); +- return -EINVAL; +- } ++ ret = hga_card_detect(); ++ if (ret) ++ return ret; + + printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n", + hga_type_name, hga_vram_len/1024); +diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c +index 3ac053b884958..e04411701ec85 100644 +--- a/drivers/video/fbdev/imsttfb.c ++++ b/drivers/video/fbdev/imsttfb.c +@@ -1512,11 +1512,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + info->fix.smem_start = addr; + info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? + 0x400000 : 0x800000); +- if (!info->screen_base) { +- release_mem_region(addr, size); +- framebuffer_release(info); +- return -ENOMEM; +- } + info->fix.mmio_start = addr + 0x800000; + par->dc_regs = ioremap(addr + 0x800000, 0x1000); + par->cmap_regs_phys = addr + 0x840000; +diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c +index 5447b5ab7c766..1221cfd914cb0 100644 +--- a/drivers/xen/xen-pciback/vpci.c ++++ b/drivers/xen/xen-pciback/vpci.c +@@ -70,7 +70,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev, + struct pci_dev *dev, int devid, + publish_pci_dev_cb publish_cb) + { +- int err = 0, slot, func = -1; ++ int err = 0, slot, func = PCI_FUNC(dev->devfn); + struct pci_dev_entry *t, *dev_entry; + struct vpci_dev_data *vpci_dev = pdev->pci_dev_data; + +@@ -95,22 +95,25 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev, + + /* + * Keep multi-function devices together on the virtual PCI bus, except +- * virtual functions. ++ * that we want to keep virtual functions at func 0 on their own. They ++ * aren't multi-function devices and hence their presence at func 0 ++ * may cause guests to not scan the other functions. + */ +- if (!dev->is_virtfn) { ++ if (!dev->is_virtfn || func) { + for (slot = 0; slot < PCI_SLOT_MAX; slot++) { + if (list_empty(&vpci_dev->dev_list[slot])) + continue; + + t = list_entry(list_first(&vpci_dev->dev_list[slot]), + struct pci_dev_entry, list); ++ if (t->dev->is_virtfn && !PCI_FUNC(t->dev->devfn)) ++ continue; + + if (match_slot(dev, t->dev)) { + dev_info(&dev->dev, "vpci: assign to virtual slot %d func %d\n", +- slot, PCI_FUNC(dev->devfn)); ++ slot, func); + list_add_tail(&dev_entry->list, + &vpci_dev->dev_list[slot]); +- func = PCI_FUNC(dev->devfn); + goto unlock; + } + } +@@ -123,7 +126,6 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev, + slot); + list_add_tail(&dev_entry->list, + &vpci_dev->dev_list[slot]); +- func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn); + goto unlock; + } + } +diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c +index e7c692cfb2cf8..cad56ea61376d 100644 +--- a/drivers/xen/xen-pciback/xenbus.c ++++ b/drivers/xen/xen-pciback/xenbus.c +@@ -359,7 +359,8 @@ out: + return err; + } + +-static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) ++static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev, ++ enum xenbus_state state) + { + int err = 0; + int num_devs; +@@ -373,9 +374,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n"); + + mutex_lock(&pdev->dev_lock); +- /* Make sure we only reconfigure once */ +- if (xenbus_read_driver_state(pdev->xdev->nodename) != +- XenbusStateReconfiguring) ++ if (xenbus_read_driver_state(pdev->xdev->nodename) != state) + goto out; + + err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d", +@@ -500,6 +499,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + } + } + ++ if (state != XenbusStateReconfiguring) ++ /* Make sure we only reconfigure once. */ ++ goto out; ++ + err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured); + if (err) { + xenbus_dev_fatal(pdev->xdev, err, +@@ -525,7 +528,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev, + break; + + case XenbusStateReconfiguring: +- xen_pcibk_reconfigure(pdev); ++ xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring); + break; + + case XenbusStateConnected: +@@ -664,6 +667,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch, + xen_pcibk_setup_backend(pdev); + break; + ++ case XenbusStateInitialised: ++ /* ++ * We typically move to Initialised when the first device was ++ * added. Hence subsequent devices getting added may need ++ * reconfiguring. ++ */ ++ xen_pcibk_reconfigure(pdev, XenbusStateInitialised); ++ break; ++ + default: + break; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 4162ef602a024..94c24b2a211bf 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2967,6 +2967,7 @@ void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info) + inode = list_first_entry(&fs_info->delayed_iputs, + struct btrfs_inode, delayed_iput); + run_delayed_iput_locked(fs_info, inode); ++ cond_resched_lock(&fs_info->delayed_iput_lock); + } + spin_unlock(&fs_info->delayed_iput_lock); + } +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 6e45a25adeff8..a9d1555301446 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1764,6 +1764,8 @@ smb2_copychunk_range(const unsigned int xid, + cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk)); + + /* Request server copy to target from src identified by key */ ++ kfree(retbuf); ++ retbuf = NULL; + rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, + trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE, + true /* is_fsctl */, (char *)pcchunk, +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index 0681540c48d98..adf0707263a1b 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -296,10 +296,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat, + struct extent_crypt_result ecr; + int rc = 0; + +- if (!crypt_stat || !crypt_stat->tfm +- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) +- return -EINVAL; +- ++ BUG_ON(!crypt_stat || !crypt_stat->tfm ++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)); + if (unlikely(ecryptfs_verbosity > 0)) { + ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n", + crypt_stat->key_size); +diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h +index 153734816b49c..d5b9c8d40c18e 100644 +--- a/include/linux/console_struct.h ++++ b/include/linux/console_struct.h +@@ -101,6 +101,7 @@ struct vc_data { + unsigned int vc_rows; + unsigned int vc_size_row; /* Bytes per row */ + unsigned int vc_scan_lines; /* # of scan lines */ ++ unsigned int vc_cell_height; /* CRTC character cell height */ + unsigned long vc_origin; /* [!] Start of real screen */ + unsigned long vc_scr_end; /* [!] End of real screen */ + unsigned long vc_visible_origin; /* [!] Top of visible window */ +diff --git a/ipc/mqueue.c b/ipc/mqueue.c +index beff0cfcd1e87..05d2176cc4712 100644 +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -1003,12 +1003,14 @@ static inline void __pipelined_op(struct wake_q_head *wake_q, + struct mqueue_inode_info *info, + struct ext_wait_queue *this) + { ++ struct task_struct *task; ++ + list_del(&this->list); +- get_task_struct(this->task); ++ task = get_task_struct(this->task); + + /* see MQ_BARRIER for purpose/pairing */ + smp_store_release(&this->state, STATE_READY); +- wake_q_add_safe(wake_q, this->task); ++ wake_q_add_safe(wake_q, task); + } + + /* pipelined_send() - send a message directly to the task waiting in +diff --git a/ipc/msg.c b/ipc/msg.c +index acd1bc7af55a2..6e6c8e0c9380e 100644 +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -251,11 +251,13 @@ static void expunge_all(struct msg_queue *msq, int res, + struct msg_receiver *msr, *t; + + list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) { +- get_task_struct(msr->r_tsk); ++ struct task_struct *r_tsk; ++ ++ r_tsk = get_task_struct(msr->r_tsk); + + /* see MSG_BARRIER for purpose/pairing */ + smp_store_release(&msr->r_msg, ERR_PTR(res)); +- wake_q_add_safe(wake_q, msr->r_tsk); ++ wake_q_add_safe(wake_q, r_tsk); + } + } + +diff --git a/ipc/sem.c b/ipc/sem.c +index f6c30a85dadf9..7d9c06b0ad6e2 100644 +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -784,12 +784,14 @@ would_block: + static inline void wake_up_sem_queue_prepare(struct sem_queue *q, int error, + struct wake_q_head *wake_q) + { +- get_task_struct(q->sleeper); ++ struct task_struct *sleeper; ++ ++ sleeper = get_task_struct(q->sleeper); + + /* see SEM_BARRIER_2 for purpuse/pairing */ + smp_store_release(&q->status, error); + +- wake_q_add_safe(wake_q, q->sleeper); ++ wake_q_add_safe(wake_q, sleeper); + } + + static void unlink_queue(struct sem_array *sma, struct sem_queue *q) +diff --git a/kernel/kcsan/debugfs.c b/kernel/kcsan/debugfs.c +index 209ad8dcfcecf..62a52be8f6ba9 100644 +--- a/kernel/kcsan/debugfs.c ++++ b/kernel/kcsan/debugfs.c +@@ -261,9 +261,10 @@ static const struct file_operations debugfs_ops = + .release = single_release + }; + +-static void __init kcsan_debugfs_init(void) ++static int __init kcsan_debugfs_init(void) + { + debugfs_create_file("kcsan", 0644, NULL, NULL, &debugfs_ops); ++ return 0; + } + + late_initcall(kcsan_debugfs_init); +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 38d7c03e694cd..858b96b438cee 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -5664,7 +5664,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip) + { + unsigned long flags; + +- trace_lock_acquired(lock, ip); ++ trace_lock_contended(lock, ip); + + if (unlikely(!lock_stat || !lockdep_enabled())) + return; +@@ -5682,7 +5682,7 @@ void lock_acquired(struct lockdep_map *lock, unsigned long ip) + { + unsigned long flags; + +- trace_lock_contended(lock, ip); ++ trace_lock_acquired(lock, ip); + + if (unlikely(!lock_stat || !lockdep_enabled())) + return; +diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c +index a7276aaf2abc0..db9301591e3fc 100644 +--- a/kernel/locking/mutex-debug.c ++++ b/kernel/locking/mutex-debug.c +@@ -57,7 +57,7 @@ void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + task->blocked_on = waiter; + } + +-void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, ++void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct task_struct *task) + { + DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list)); +@@ -65,7 +65,7 @@ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter); + task->blocked_on = NULL; + +- list_del_init(&waiter->list); ++ INIT_LIST_HEAD(&waiter->list); + waiter->task = NULL; + } + +diff --git a/kernel/locking/mutex-debug.h b/kernel/locking/mutex-debug.h +index 1edd3f45a4ecb..53e631e1d76da 100644 +--- a/kernel/locking/mutex-debug.h ++++ b/kernel/locking/mutex-debug.h +@@ -22,7 +22,7 @@ extern void debug_mutex_free_waiter(struct mutex_waiter *waiter); + extern void debug_mutex_add_waiter(struct mutex *lock, + struct mutex_waiter *waiter, + struct task_struct *task); +-extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, ++extern void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct task_struct *task); + extern void debug_mutex_unlock(struct mutex *lock); + extern void debug_mutex_init(struct mutex *lock, const char *name, +diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c +index 2c25b830203cd..15ac7c4bb1117 100644 +--- a/kernel/locking/mutex.c ++++ b/kernel/locking/mutex.c +@@ -204,7 +204,7 @@ static inline bool __mutex_waiter_is_first(struct mutex *lock, struct mutex_wait + * Add @waiter to a given location in the lock wait_list and set the + * FLAG_WAITERS flag if it's the first waiter. + */ +-static void __sched ++static void + __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct list_head *list) + { +@@ -215,6 +215,16 @@ __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + __mutex_set_flag(lock, MUTEX_FLAG_WAITERS); + } + ++static void ++__mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter) ++{ ++ list_del(&waiter->list); ++ if (likely(list_empty(&lock->wait_list))) ++ __mutex_clear_flag(lock, MUTEX_FLAGS); ++ ++ debug_mutex_remove_waiter(lock, waiter, current); ++} ++ + /* + * Give up ownership to a specific task, when @task = NULL, this is equivalent + * to a regular unlock. Sets PICKUP on a handoff, clears HANDOF, preserves +@@ -1071,9 +1081,7 @@ acquired: + __ww_mutex_check_waiters(lock, ww_ctx); + } + +- mutex_remove_waiter(lock, &waiter, current); +- if (likely(list_empty(&lock->wait_list))) +- __mutex_clear_flag(lock, MUTEX_FLAGS); ++ __mutex_remove_waiter(lock, &waiter); + + debug_mutex_free_waiter(&waiter); + +@@ -1090,7 +1098,7 @@ skip_wait: + + err: + __set_current_state(TASK_RUNNING); +- mutex_remove_waiter(lock, &waiter, current); ++ __mutex_remove_waiter(lock, &waiter); + err_early_kill: + spin_unlock(&lock->wait_lock); + debug_mutex_free_waiter(&waiter); +diff --git a/kernel/locking/mutex.h b/kernel/locking/mutex.h +index 1c2287d3fa719..f0c710b1d1927 100644 +--- a/kernel/locking/mutex.h ++++ b/kernel/locking/mutex.h +@@ -10,12 +10,10 @@ + * !CONFIG_DEBUG_MUTEXES case. Most of them are NOPs: + */ + +-#define mutex_remove_waiter(lock, waiter, task) \ +- __list_del((waiter)->list.prev, (waiter)->list.next) +- + #define debug_mutex_wake_waiter(lock, waiter) do { } while (0) + #define debug_mutex_free_waiter(waiter) do { } while (0) + #define debug_mutex_add_waiter(lock, waiter, ti) do { } while (0) ++#define debug_mutex_remove_waiter(lock, waiter, ti) do { } while (0) + #define debug_mutex_unlock(lock) do { } while (0) + #define debug_mutex_init(lock, name, key) do { } while (0) + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 79de1294f8ebd..eb4d04cb3aaf5 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -169,6 +169,21 @@ void __ptrace_unlink(struct task_struct *child) + spin_unlock(&child->sighand->siglock); + } + ++static bool looks_like_a_spurious_pid(struct task_struct *task) ++{ ++ if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP)) ++ return false; ++ ++ if (task_pid_vnr(task) == task->ptrace_message) ++ return false; ++ /* ++ * The tracee changed its pid but the PTRACE_EVENT_EXEC event ++ * was not wait()'ed, most probably debugger targets the old ++ * leader which was destroyed in de_thread(). ++ */ ++ return true; ++} ++ + /* Ensure that nothing can wake it up, even SIGKILL */ + static bool ptrace_freeze_traced(struct task_struct *task) + { +@@ -179,7 +194,8 @@ static bool ptrace_freeze_traced(struct task_struct *task) + return ret; + + spin_lock_irq(&task->sighand->siglock); +- if (task_is_traced(task) && !__fatal_signal_pending(task)) { ++ if (task_is_traced(task) && !looks_like_a_spurious_pid(task) && ++ !__fatal_signal_pending(task)) { + task->state = __TASK_TRACED; + ret = true; + } +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index bf4bef13d9354..2b7879afc333b 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2733,6 +2733,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) + if (skb->len < sizeof(*key)) + return SMP_INVALID_PARAMS; + ++ /* Check if remote and local public keys are the same and debug key is ++ * not in use. ++ */ ++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && ++ !crypto_memneq(key, smp->local_pk, 64)) { ++ bt_dev_err(hdev, "Remote and local public keys are identical"); ++ return SMP_UNSPECIFIED; ++ } ++ + memcpy(smp->remote_pk, key, 64); + + if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index 25778765cbfe9..9897bd26a4388 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -38,7 +38,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.2 pro/d.4 pro ++ * Mackie(Loud) d.4 pro + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -84,7 +84,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) ++ * Mackie d.2 (FireWire Option) and d.2 Pro + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h +index 26e7cb555d3c5..aa53c13b89d34 100644 +--- a/sound/firewire/amdtp-stream-trace.h ++++ b/sound/firewire/amdtp-stream-trace.h +@@ -14,8 +14,8 @@ + #include <linux/tracepoint.h> + + TRACE_EVENT(amdtp_packet, +- TP_PROTO(const struct amdtp_stream *s, u32 cycles, const __be32 *cip_header, unsigned int payload_length, unsigned int data_blocks, unsigned int data_block_counter, unsigned int index), +- TP_ARGS(s, cycles, cip_header, payload_length, data_blocks, data_block_counter, index), ++ TP_PROTO(const struct amdtp_stream *s, u32 cycles, const __be32 *cip_header, unsigned int payload_length, unsigned int data_blocks, unsigned int data_block_counter, unsigned int packet_index, unsigned int index), ++ TP_ARGS(s, cycles, cip_header, payload_length, data_blocks, data_block_counter, packet_index, index), + TP_STRUCT__entry( + __field(unsigned int, second) + __field(unsigned int, cycle) +@@ -48,7 +48,7 @@ TRACE_EVENT(amdtp_packet, + __entry->payload_quadlets = payload_length / sizeof(__be32); + __entry->data_blocks = data_blocks; + __entry->data_block_counter = data_block_counter, +- __entry->packet_index = s->packet_index; ++ __entry->packet_index = packet_index; + __entry->irq = !!in_interrupt(); + __entry->index = index; + ), +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index 4e2f2bb7879fb..e0faa6601966c 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -526,7 +526,7 @@ static void build_it_pkt_header(struct amdtp_stream *s, unsigned int cycle, + } + + trace_amdtp_packet(s, cycle, cip_header, payload_length, data_blocks, +- data_block_counter, index); ++ data_block_counter, s->packet_index, index); + } + + static int check_cip_header(struct amdtp_stream *s, const __be32 *buf, +@@ -630,21 +630,27 @@ static int parse_ir_ctx_header(struct amdtp_stream *s, unsigned int cycle, + unsigned int *payload_length, + unsigned int *data_blocks, + unsigned int *data_block_counter, +- unsigned int *syt, unsigned int index) ++ unsigned int *syt, unsigned int packet_index, unsigned int index) + { + const __be32 *cip_header; ++ unsigned int cip_header_size; + int err; + + *payload_length = be32_to_cpu(ctx_header[0]) >> ISO_DATA_LENGTH_SHIFT; +- if (*payload_length > s->ctx_data.tx.ctx_header_size + +- s->ctx_data.tx.max_ctx_payload_length) { ++ ++ if (!(s->flags & CIP_NO_HEADER)) ++ cip_header_size = 8; ++ else ++ cip_header_size = 0; ++ ++ if (*payload_length > cip_header_size + s->ctx_data.tx.max_ctx_payload_length) { + dev_err(&s->unit->device, + "Detect jumbo payload: %04x %04x\n", +- *payload_length, s->ctx_data.tx.max_ctx_payload_length); ++ *payload_length, cip_header_size + s->ctx_data.tx.max_ctx_payload_length); + return -EIO; + } + +- if (!(s->flags & CIP_NO_HEADER)) { ++ if (cip_header_size > 0) { + cip_header = ctx_header + 2; + err = check_cip_header(s, cip_header, *payload_length, + data_blocks, data_block_counter, syt); +@@ -662,7 +668,7 @@ static int parse_ir_ctx_header(struct amdtp_stream *s, unsigned int cycle, + } + + trace_amdtp_packet(s, cycle, cip_header, *payload_length, *data_blocks, +- *data_block_counter, index); ++ *data_block_counter, packet_index, index); + + return err; + } +@@ -701,12 +707,13 @@ static int generate_device_pkt_descs(struct amdtp_stream *s, + unsigned int packets) + { + unsigned int dbc = s->data_block_counter; ++ unsigned int packet_index = s->packet_index; ++ unsigned int queue_size = s->queue_size; + int i; + int err; + + for (i = 0; i < packets; ++i) { + struct pkt_desc *desc = descs + i; +- unsigned int index = (s->packet_index + i) % s->queue_size; + unsigned int cycle; + unsigned int payload_length; + unsigned int data_blocks; +@@ -715,7 +722,7 @@ static int generate_device_pkt_descs(struct amdtp_stream *s, + cycle = compute_cycle_count(ctx_header[1]); + + err = parse_ir_ctx_header(s, cycle, ctx_header, &payload_length, +- &data_blocks, &dbc, &syt, i); ++ &data_blocks, &dbc, &syt, packet_index, i); + if (err < 0) + return err; + +@@ -723,13 +730,15 @@ static int generate_device_pkt_descs(struct amdtp_stream *s, + desc->syt = syt; + desc->data_blocks = data_blocks; + desc->data_block_counter = dbc; +- desc->ctx_payload = s->buffer.packets[index].buffer; ++ desc->ctx_payload = s->buffer.packets[packet_index].buffer; + + if (!(s->flags & CIP_DBC_IS_END_EVENT)) + dbc = (dbc + desc->data_blocks) & 0xff; + + ctx_header += + s->ctx_data.tx.ctx_header_size / sizeof(*ctx_header); ++ ++ packet_index = (packet_index + 1) % queue_size; + } + + s->data_block_counter = dbc; +@@ -1065,23 +1074,22 @@ static int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed, + s->data_block_counter = 0; + } + +- /* initialize packet buffer */ ++ // initialize packet buffer. ++ max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (s->direction == AMDTP_IN_STREAM) { + dir = DMA_FROM_DEVICE; + type = FW_ISO_CONTEXT_RECEIVE; +- if (!(s->flags & CIP_NO_HEADER)) ++ if (!(s->flags & CIP_NO_HEADER)) { ++ max_ctx_payload_size -= 8; + ctx_header_size = IR_CTX_HEADER_SIZE_CIP; +- else ++ } else { + ctx_header_size = IR_CTX_HEADER_SIZE_NO_CIP; +- +- max_ctx_payload_size = amdtp_stream_get_max_payload(s) - +- ctx_header_size; ++ } + } else { + dir = DMA_TO_DEVICE; + type = FW_ISO_CONTEXT_TRANSMIT; + ctx_header_size = 0; // No effect for IT context. + +- max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (!(s->flags & CIP_NO_HEADER)) + max_ctx_payload_size -= IT_PKT_HEADER_SIZE_CIP; + } +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 2c8e3392a4903..daeecfa8b9aac 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -387,7 +387,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- /* Mackie, d.2 (Firewire Option) */ ++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/dice/dice-alesis.c b/sound/firewire/dice/dice-alesis.c +index 0916864511d50..27c13b9cc9efd 100644 +--- a/sound/firewire/dice/dice-alesis.c ++++ b/sound/firewire/dice/dice-alesis.c +@@ -16,7 +16,7 @@ alesis_io14_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + static const unsigned int + alesis_io26_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + {10, 10, 4}, /* Tx0 = Analog + S/PDIF. */ +- {16, 8, 0}, /* Tx1 = ADAT1 + ADAT2. */ ++ {16, 4, 0}, /* Tx1 = ADAT1 + ADAT2 (available at low rate). */ + }; + + int snd_dice_detect_alesis_formats(struct snd_dice *dice) +diff --git a/sound/firewire/dice/dice-tcelectronic.c b/sound/firewire/dice/dice-tcelectronic.c +index a8875d24ba2aa..43a3bcb15b3d1 100644 +--- a/sound/firewire/dice/dice-tcelectronic.c ++++ b/sound/firewire/dice/dice-tcelectronic.c +@@ -38,8 +38,8 @@ static const struct dice_tc_spec konnekt_24d = { + }; + + static const struct dice_tc_spec konnekt_live = { +- .tx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, +- .rx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, ++ .tx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, ++ .rx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, + .has_midi = true, + }; + +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 1f1e3236efb8e..9eea25c46dc7e 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -355,7 +355,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.2 pro: Unknown + * d.4 pro: Unknown + * U.420: Unknown + * U.420d: Unknown +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index 438109f167d61..ae93191ffdc9f 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -96,10 +96,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + + /* block the 0x388 port to avoid PnP conflicts */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); +- if (!acard->fm_res) { +- err = -EBUSY; +- goto _err; +- } + + if (port[dev] != SNDRV_AUTO_PORT) { + if ((err = snd_sbdsp_create(card, port[dev], irq[dev], +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1fe70f2fe4fe8..43a63db4ab6ad 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -395,7 +395,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0282: + case 0x10ec0283: + case 0x10ec0286: +- case 0x10ec0287: + case 0x10ec0288: + case 0x10ec0285: + case 0x10ec0298: +@@ -406,6 +405,10 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; ++ case 0x10ec0287: ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ alc_write_coef_idx(codec, 0x8, 0x4ab7); ++ break; + case 0x10ec0293: + alc_update_coef_idx(codec, 0xa, 1<<13, 0); + break; +@@ -5717,6 +5720,18 @@ static void alc_fixup_tpt470_dacs(struct hda_codec *codec, + spec->gen.preferred_dacs = preferred_pairs; + } + ++static void alc295_fixup_asus_dacs(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ static const hda_nid_t preferred_pairs[] = { ++ 0x17, 0x02, 0x21, 0x03, 0 ++ }; ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ spec->gen.preferred_dacs = preferred_pairs; ++} ++ + static void alc_shutup_dell_xps13(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -6232,6 +6247,35 @@ static void alc294_fixup_gx502_hp(struct hda_codec *codec, + } + } + ++static void alc294_gu502_toggle_output(struct hda_codec *codec, ++ struct hda_jack_callback *cb) ++{ ++ /* Windows sets 0x10 to 0x8420 for Node 0x20 which is ++ * responsible from changes between speakers and headphones ++ */ ++ if (snd_hda_jack_detect_state(codec, 0x21) == HDA_JACK_PRESENT) ++ alc_write_coef_idx(codec, 0x10, 0x8420); ++ else ++ alc_write_coef_idx(codec, 0x10, 0x0a20); ++} ++ ++static void alc294_fixup_gu502_hp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (!is_jack_detectable(codec, 0x21)) ++ return; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ snd_hda_jack_detect_enable_callback(codec, 0x21, ++ alc294_gu502_toggle_output); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ alc294_gu502_toggle_output(codec, NULL); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6449,6 +6493,9 @@ enum { + ALC294_FIXUP_ASUS_GX502_HP, + ALC294_FIXUP_ASUS_GX502_PINS, + ALC294_FIXUP_ASUS_GX502_VERBS, ++ ALC294_FIXUP_ASUS_GU502_HP, ++ ALC294_FIXUP_ASUS_GU502_PINS, ++ ALC294_FIXUP_ASUS_GU502_VERBS, + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_GPIO_LED, +@@ -6485,6 +6532,9 @@ enum { + ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST, + ALC256_FIXUP_ACER_HEADSET_MIC, + ALC285_FIXUP_IDEAPAD_S740_COEF, ++ ALC295_FIXUP_ASUS_DACS, ++ ALC295_FIXUP_HP_OMEN, ++ ALC285_FIXUP_HP_SPECTRE_X360, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7687,6 +7737,35 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc294_fixup_gx502_hp, + }, ++ [ALC294_FIXUP_ASUS_GU502_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a11050 }, /* rear HP mic */ ++ { 0x1a, 0x01a11830 }, /* rear external mic */ ++ { 0x21, 0x012110f0 }, /* rear HP out */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_VERBS ++ }, ++ [ALC294_FIXUP_ASUS_GU502_VERBS] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* set 0x15 to HP-OUT ctrl */ ++ { 0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc0 }, ++ /* unmute the 0x15 amp */ ++ { 0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0xb000 }, ++ /* set 0x1b to HP-OUT */ ++ { 0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_HP ++ }, ++ [ALC294_FIXUP_ASUS_GU502_HP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc294_fixup_gu502_hp, ++ }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7983,6 +8062,39 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_THINKPAD_ACPI, + }, ++ [ALC295_FIXUP_ASUS_DACS] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_asus_dacs, ++ }, ++ [ALC295_FIXUP_HP_OMEN] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x12, 0xb7a60130 }, ++ { 0x13, 0x40000000 }, ++ { 0x14, 0x411111f0 }, ++ { 0x16, 0x411111f0 }, ++ { 0x17, 0x90170110 }, ++ { 0x18, 0x411111f0 }, ++ { 0x19, 0x02a11030 }, ++ { 0x1a, 0x411111f0 }, ++ { 0x1b, 0x04a19030 }, ++ { 0x1d, 0x40600001 }, ++ { 0x1e, 0x411111f0 }, ++ { 0x21, 0x03211020 }, ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HP_LINE1_MIC1_LED, ++ }, ++ [ALC285_FIXUP_HP_SPECTRE_X360] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x90170110 }, /* enable top speaker */ ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_SPEAKER2_TO_DAC1, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -8141,7 +8253,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO), + SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), +@@ -8181,6 +8295,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), ++ SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), + SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), +@@ -8198,6 +8313,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), ++ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), +@@ -8254,12 +8370,19 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f5, "Clevo NH55EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f6, "Clevo NH55DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f3, "Clevo NH77DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f4, "Clevo NH77EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f6, "Clevo NH77DPQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -8277,9 +8400,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x9600, "Clevo N960K[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL5XNU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc022, "Clevo NH77[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS), + SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), +@@ -8544,6 +8675,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, + {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"}, ++ {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, ++ {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, + {} + }; + #define ALC225_STANDARD_PINS \ +diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c +index 3349e455a871a..6fb6f36d0d377 100644 +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -354,6 +354,7 @@ struct ichdev { + unsigned int ali_slot; /* ALI DMA slot */ + struct ac97_pcm *pcm; + int pcm_open_flag; ++ unsigned int prepared:1; + unsigned int suspended: 1; + }; + +@@ -714,6 +715,9 @@ static inline void snd_intel8x0_update(struct intel8x0 *chip, struct ichdev *ich + int status, civ, i, step; + int ack = 0; + ++ if (!ichdev->prepared || ichdev->suspended) ++ return; ++ + spin_lock_irqsave(&chip->reg_lock, flags); + status = igetbyte(chip, port + ichdev->roff_sr); + civ = igetbyte(chip, port + ICH_REG_OFF_CIV); +@@ -904,6 +908,7 @@ static int snd_intel8x0_hw_params(struct snd_pcm_substream *substream, + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + err = snd_ac97_pcm_open(ichdev->pcm, params_rate(hw_params), + params_channels(hw_params), +@@ -925,6 +930,7 @@ static int snd_intel8x0_hw_free(struct snd_pcm_substream *substream) + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + return 0; + } +@@ -999,6 +1005,7 @@ static int snd_intel8x0_pcm_prepare(struct snd_pcm_substream *substream) + ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1; + } + snd_intel8x0_setup_periods(chip, ichdev); ++ ichdev->prepared = 1; + return 0; + } + +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index a030dd65eb280..9602929b7de90 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -699,6 +699,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) + line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; ++ ++ ret = line6_init_midi(line6); ++ if (ret < 0) ++ return ret; + } else { + ret = line6_hwdep_init(line6); + if (ret < 0) +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index cd44cb5f1310c..16e644330c4d6 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -376,11 +376,6 @@ static int pod_init(struct usb_line6 *line6, + if (err < 0) + return err; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(line6); +- if (err < 0) +- return err; +- + /* initialize PCM subsystem: */ + err = line6_init_pcm(line6, &pod_pcm_properties); + if (err < 0) +diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c +index ed158f04de80f..c2245aa93b08f 100644 +--- a/sound/usb/line6/variax.c ++++ b/sound/usb/line6/variax.c +@@ -159,7 +159,6 @@ static int variax_init(struct usb_line6 *line6, + const struct usb_device_id *id) + { + struct usb_line6_variax *variax = line6_to_variax(line6); +- int err; + + line6->process_message = line6_variax_process_message; + line6->disconnect = line6_variax_disconnect; +@@ -172,11 +171,6 @@ static int variax_init(struct usb_line6 *line6, + if (variax->buffer_activate == NULL) + return -ENOMEM; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(&variax->line6); +- if (err < 0) +- return err; +- + /* initiate startup procedure: */ + schedule_delayed_work(&line6->startup_work, + msecs_to_jiffies(VARIAX_STARTUP_DELAY1)); +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index cd46ca7cd28de..fa91290ad89db 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1889,8 +1889,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, + ms_ep = find_usb_ms_endpoint_descriptor(hostep); + if (!ms_ep) + continue; ++ if (ms_ep->bLength <= sizeof(*ms_ep)) ++ continue; + if (ms_ep->bNumEmbMIDIJack > 0x10) + continue; ++ if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) ++ continue; + if (usb_endpoint_dir_out(ep)) { + if (endpoints[epidx].out_ep) { + if (++epidx >= MIDI_MAX_ENDPOINTS) { +diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftests/exec/Makefile +index cf69b2fcce59e..dd61118df66ed 100644 +--- a/tools/testing/selftests/exec/Makefile ++++ b/tools/testing/selftests/exec/Makefile +@@ -28,8 +28,8 @@ $(OUTPUT)/execveat.denatured: $(OUTPUT)/execveat + cp $< $@ + chmod -x $@ + $(OUTPUT)/load_address_4096: load_address.c +- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000 -pie $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000 -pie -static $< -o $@ + $(OUTPUT)/load_address_2097152: load_address.c +- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x200000 -pie $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x200000 -pie -static $< -o $@ + $(OUTPUT)/load_address_16777216: load_address.c +- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000000 -pie $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000000 -pie -static $< -o $@ +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 1b6c7d33c4ff2..dc21dc49b426f 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -1753,16 +1753,25 @@ TEST_F(TRACE_poke, getpid_runs_normally) + # define SYSCALL_RET_SET(_regs, _val) \ + do { \ + typeof(_val) _result = (_val); \ +- /* \ +- * A syscall error is signaled by CR0 SO bit \ +- * and the code is stored as a positive value. \ +- */ \ +- if (_result < 0) { \ +- SYSCALL_RET(_regs) = -_result; \ +- (_regs).ccr |= 0x10000000; \ +- } else { \ ++ if ((_regs.trap & 0xfff0) == 0x3000) { \ ++ /* \ ++ * scv 0 system call uses -ve result \ ++ * for error, so no need to adjust. \ ++ */ \ + SYSCALL_RET(_regs) = _result; \ +- (_regs).ccr &= ~0x10000000; \ ++ } else { \ ++ /* \ ++ * A syscall error is signaled by the \ ++ * CR0 SO bit and the code is stored as \ ++ * a positive value. \ ++ */ \ ++ if (_result < 0) { \ ++ SYSCALL_RET(_regs) = -_result; \ ++ (_regs).ccr |= 0x10000000; \ ++ } else { \ ++ SYSCALL_RET(_regs) = _result; \ ++ (_regs).ccr &= ~0x10000000; \ ++ } \ + } \ + } while (0) + # define SYSCALL_RET_SET_ON_PTRACE_EXIT
