Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

There were quite a few overlapping sets of changes here.

Daniel's bug fix for off-by-ones in the new BPF branch instructions,
along with the added allowances for "data_end > ptr + x" forms
collided with the metadata additions.

Along with those three changes came veritifer test cases, which in
their final form I tried to group together properly.  If I had just
trimmed GIT's conflict tags as-is, this would have split up the
meta tests unnecessarily.

In the socketmap code, a set of preemption disabling changes
overlapped with the rename of bpf_compute_data_end() to
bpf_compute_data_pointers().

Changes were made to the mv88e6060.c driver set addr method
which got removed in net-next.

The hyperv transport socket layer had a locking change in 'net'
which overlapped with a change of socket state macro usage
in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 35 insertions, 25 deletions

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index dbb31a014419..deaf869374ea 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -248,7 +248,7 @@ disable_clks:
         clk_disable_unprepare(ahb_clk);
 disable_gdsc:
         regulator_disable(gdsc_reg);
-        pm_runtime_put_autosuspend(dev);
+        pm_runtime_put_sync(dev);
 put_clk:
         clk_put(ahb_clk);
 put_gdsc:
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
index c2bdad88447e..824067d2d427 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
@@ -83,6 +83,8 @@ const struct mdp5_cfg_hw msm8x74v1_config = {
                                   .caps = MDP_LM_CAP_WB },
                              },
                 .nb_stages = 5,
+                .max_width = 2048,
+                .max_height = 0xFFFF,
         },
         .dspp = {
                 .count = 3,
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 6fcb58ab718c..440977677001 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -804,8 +804,6 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
 
         spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
 
-        pm_runtime_put_autosuspend(&pdev->dev);
-
 set_cursor:
         ret = mdp5_ctl_set_cursor(ctl, pipeline, 0, cursor_enable);
         if (ret) {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index f15821a0d900..ea5bb0e1632c 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -610,17 +610,6 @@ int msm_gem_sync_object(struct drm_gem_object *obj,
         struct dma_fence *fence;
         int i, ret;
 
-        if (!exclusive) {
-                /* NOTE: _reserve_shared() must happen before _add_shared_fence(),
-                 * which makes this a slightly strange place to call it.  OTOH this
-                 * is a convenient can-fail point to hook it in.  (And similar to
-                 * how etnaviv and nouveau handle this.)
-                 */
-                ret = reservation_object_reserve_shared(msm_obj->resv);
-                if (ret)
-                        return ret;
-        }
-
         fobj = reservation_object_get_list(msm_obj->resv);
         if (!fobj || (fobj->shared_count == 0)) {
                 fence = reservation_object_get_excl(msm_obj->resv);
@@ -1045,10 +1034,10 @@ static void *_msm_gem_kernel_new(struct drm_device *dev, uint32_t size,
         }
 
         vaddr = msm_gem_get_vaddr(obj);
-        if (!vaddr) {
+        if (IS_ERR(vaddr)) {
                 msm_gem_put_iova(obj, aspace);
                 drm_gem_object_unreference(obj);
-                return ERR_PTR(-ENOMEM);
+                return ERR_CAST(vaddr);
         }
 
         if (bo)
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 5d0a75d4b249..93535cac0676 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -221,7 +221,7 @@ fail:
         return ret;
 }
 
-static int submit_fence_sync(struct msm_gem_submit *submit)
+static int submit_fence_sync(struct msm_gem_submit *submit, bool no_implicit)
 {
         int i, ret = 0;
 
@@ -229,6 +229,20 @@ static int submit_fence_sync(struct msm_gem_submit *submit)
                 struct msm_gem_object *msm_obj = submit->bos[i].obj;
                 bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE;
 
+                if (!write) {
+                        /* NOTE: _reserve_shared() must happen before
+                         * _add_shared_fence(), which makes this a slightly
+                         * strange place to call it.  OTOH this is a
+                         * convenient can-fail point to hook it in.
+                         */
+                        ret = reservation_object_reserve_shared(msm_obj->resv);
+                        if (ret)
+                                return ret;
+                }
+
+                if (no_implicit)
+                        continue;
+
                 ret = msm_gem_sync_object(&msm_obj->base, submit->gpu->fctx, write);
                 if (ret)
                         break;
@@ -451,11 +465,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 goto out;
 
-        if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
-                ret = submit_fence_sync(submit);
-                if (ret)
-                        goto out;
-        }
+        ret = submit_fence_sync(submit, !!(args->flags & MSM_SUBMIT_NO_IMPLICIT));
+        if (ret)
+                goto out;
 
         ret = submit_pin_objects(submit);
         if (ret)
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index ffbff27600e0..6a887032c66a 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -718,7 +718,8 @@ void msm_gpu_cleanup(struct msm_gpu *gpu)
                         msm_gem_put_iova(gpu->rb->bo, gpu->aspace);
                 msm_ringbuffer_destroy(gpu->rb);
         }
-        if (gpu->aspace) {
+
+        if (!IS_ERR_OR_NULL(gpu->aspace)) {
                 gpu->aspace->mmu->funcs->detach(gpu->aspace->mmu,
                         NULL, 0);
                 msm_gem_address_space_put(gpu->aspace);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 0366b8092f97..ec56794ad039 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -111,10 +111,14 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
 
                 wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
 
+                /* Note that smp_load_acquire() is not strictly required
+                 * as CIRC_SPACE_TO_END() does not access the tail more
+                 * than once.
+                 */
                 n = min(sz, circ_space_to_end(&rd->fifo));
                 memcpy(fptr, ptr, n);
 
-                fifo->head = (fifo->head + n) & (BUF_SZ - 1);
+                smp_store_release(&fifo->head, (fifo->head + n) & (BUF_SZ - 1));
                 sz  -= n;
                 ptr += n;
 
@@ -145,13 +149,17 @@ static ssize_t rd_read(struct file *file, char __user *buf,
         if (ret)
                 goto out;
 
+        /* Note that smp_load_acquire() is not strictly required
+         * as CIRC_CNT_TO_END() does not access the head more than
+         * once.
+         */
         n = min_t(int, sz, circ_count_to_end(&rd->fifo));
         if (copy_to_user(buf, fptr, n)) {
                 ret = -EFAULT;
                 goto out;
         }
 
-        fifo->tail = (fifo->tail + n) & (BUF_SZ - 1);
+        smp_store_release(&fifo->tail, (fifo->tail + n) & (BUF_SZ - 1));
         *ppos += n;
 
         wake_up_all(&rd->fifo_event);