6 files changed, 42 insertions, 22 deletions

diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index c9f9c30d6467..a5880f4ab40e 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -337,6 +337,9 @@ static blk_qc_t brd_make_request(struct request_queue *q, struct bio *bio)
                 goto io_error;
 
         if (unlikely(bio->bi_rw & REQ_DISCARD)) {
+                if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) ||
+                    bio->bi_iter.bi_size & PAGE_MASK)
+                        goto io_error;
                 discard_from_brd(brd, sector, bio->bi_iter.bi_size);
                 goto out;
         }
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index f26b0ae23bea..45cc39aabeee 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -226,21 +226,23 @@ int tpm_chip_register(struct tpm_chip *chip)
         if (rc)
                 goto out_err;
 
-        if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
-                rc = __compat_only_sysfs_link_entry_to_kobj(&chip->pdev->kobj,
-                                                            &chip->dev.kobj,
-                                                            "ppi");
-                if (rc)
-                        goto out_err;
-        }
-
         /* Make the chip available. */
         spin_lock(&driver_lock);
-        list_add_rcu(&chip->list, &tpm_chip_list);
+        list_add_tail_rcu(&chip->list, &tpm_chip_list);
         spin_unlock(&driver_lock);
 
         chip->flags |= TPM_CHIP_FLAG_REGISTERED;
 
+        if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+                rc = __compat_only_sysfs_link_entry_to_kobj(&chip->pdev->kobj,
+                                                            &chip->dev.kobj,
+                                                            "ppi");
+                if (rc && rc != -ENOENT) {
+                        tpm_chip_unregister(chip);
+                        return rc;
+                }
+        }
+
         return 0;
 out_err:
         tpm1_chip_unregister(chip);
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index bd7039fafa8a..c12130485fc1 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -443,12 +443,13 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
                              TPM_DIGEST_SIZE);
 
         /* sensitive */
-        tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len);
+        tpm_buf_append_u16(&buf, 4 + TPM_DIGEST_SIZE + payload->key_len + 1);
 
         tpm_buf_append_u16(&buf, TPM_DIGEST_SIZE);
         tpm_buf_append(&buf, options->blobauth, TPM_DIGEST_SIZE);
-        tpm_buf_append_u16(&buf, payload->key_len);
+        tpm_buf_append_u16(&buf, payload->key_len + 1);
         tpm_buf_append(&buf, payload->key, payload->key_len);
+        tpm_buf_append_u8(&buf, payload->migratable);
 
         /* public */
         tpm_buf_append_u16(&buf, 14);
@@ -573,6 +574,8 @@ static int tpm2_unseal(struct tpm_chip *chip,
                        u32 blob_handle)
 {
         struct tpm_buf buf;
+        u16 data_len;
+        u8 *data;
         int rc;
 
         rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);
@@ -591,11 +594,13 @@ static int tpm2_unseal(struct tpm_chip *chip,
                 rc = -EPERM;
 
         if (!rc) {
-                payload->key_len = be16_to_cpup(
+                data_len = be16_to_cpup(
                         (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
+                data = &buf.data[TPM_HEADER_SIZE + 6];
 
-                memcpy(payload->key, &buf.data[TPM_HEADER_SIZE + 6],
-                       payload->key_len);
+                memcpy(payload->key, data, data_len - 1);
+                payload->key_len = data_len - 1;
+                payload->migratable = data[data_len - 1];
         }
 
         tpm_buf_destroy(&buf);
diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 1141456a4b1f..570f30c5c5f4 100644
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
                 goto cleanup_eio;
         }
 
-        of_node_put(np);
         log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
         if (!log->bios_event_log) {
                 pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
                        __func__);
+                of_node_put(np);
                 return -ENOMEM;
         }
 
         log->bios_event_log_end = log->bios_event_log + *sizep;
 
         memcpy(log->bios_event_log, __va(*basep), *sizep);
+        of_node_put(np);
 
         return 0;
 
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 696ef1d56b4f..65f7eecc45b0 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -645,6 +645,7 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
 {
         u32 vendor, intfcaps, intmask;
         int rc, i, irq_s, irq_e, probe;
+        int irq_r = -1;
         struct tpm_chip *chip;
         struct priv_data *priv;
 
@@ -751,6 +752,7 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
                 irq_s =
                     ioread8(chip->vendor.iobase +
                             TPM_INT_VECTOR(chip->vendor.locality));
+                irq_r = irq_s;
                 if (irq_s) {
                         irq_e = irq_s;
                 } else {
@@ -805,6 +807,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
                         iowrite32(intmask,
                                   chip->vendor.iobase +
                                   TPM_INT_ENABLE(chip->vendor.locality));
+
+                        devm_free_irq(dev, i, chip);
                 }
         }
         if (chip->vendor.irq) {
@@ -831,7 +835,9 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
                                   chip->vendor.iobase +
                                   TPM_INT_ENABLE(chip->vendor.locality));
                 }
-        }
+        } else if (irq_r != -1)
+                iowrite8(irq_r, chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
 
         if (chip->flags & TPM_CHIP_FLAG_TPM2) {
                 chip->vendor.timeout_a = msecs_to_jiffies(TPM2_TIMEOUT_A);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 3dfc28875cc3..8187df204695 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1725,7 +1725,7 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
 {
         int result;
         u32 aqa;
-        u64 cap = readq(&dev->bar->cap);
+        u64 cap = lo_hi_readq(&dev->bar->cap);
         struct nvme_queue *nvmeq;
         unsigned page_shift = PAGE_SHIFT;
         unsigned dev_page_min = NVME_CAP_MPSMIN(cap) + 12;
@@ -1774,8 +1774,8 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
         dev->ctrl_config |= NVME_CC_IOSQES | NVME_CC_IOCQES;
 
         writel(aqa, &dev->bar->aqa);
-        writeq(nvmeq->sq_dma_addr, &dev->bar->asq);
-        writeq(nvmeq->cq_dma_addr, &dev->bar->acq);
+        lo_hi_writeq(nvmeq->sq_dma_addr, &dev->bar->asq);
+        lo_hi_writeq(nvmeq->cq_dma_addr, &dev->bar->acq);
 
         result = nvme_enable_ctrl(dev, cap);
         if (result)
@@ -2606,7 +2606,7 @@ static int nvme_dev_add(struct nvme_dev *dev)
         struct pci_dev *pdev = to_pci_dev(dev->dev);
         int res;
         struct nvme_id_ctrl *ctrl;
-        int shift = NVME_CAP_MPSMIN(readq(&dev->bar->cap)) + 12;
+        int shift = NVME_CAP_MPSMIN(lo_hi_readq(&dev->bar->cap)) + 12;
 
         res = nvme_identify_ctrl(dev, &ctrl);
         if (res) {
@@ -2622,6 +2622,8 @@ static int nvme_dev_add(struct nvme_dev *dev)
         memcpy(dev->firmware_rev, ctrl->fr, sizeof(ctrl->fr));
         if (ctrl->mdts)
                 dev->max_hw_sectors = 1 << (ctrl->mdts + shift - 9);
+        else
+                dev->max_hw_sectors = UINT_MAX;
         if ((pdev->vendor == PCI_VENDOR_ID_INTEL) &&
                         (pdev->device == 0x0953) && ctrl->vs[3]) {
                 unsigned int max_hw_sectors;
@@ -2695,7 +2697,7 @@ static int nvme_dev_map(struct nvme_dev *dev)
                         goto unmap;
         }
 
-        cap = readq(&dev->bar->cap);
+        cap = lo_hi_readq(&dev->bar->cap);
         dev->q_depth = min_t(int, NVME_CAP_MQES(cap) + 1, NVME_Q_DEPTH);
         dev->db_stride = 1 << NVME_CAP_STRIDE(cap);
         dev->dbs = ((void __iomem *)dev->bar) + 4096;
@@ -2758,7 +2760,7 @@ static void nvme_wait_dq(struct nvme_delq_ctx *dq, struct nvme_dev *dev)
                          * queues than admin tags.
                          */
                         set_current_state(TASK_RUNNING);
-                        nvme_disable_ctrl(dev, readq(&dev->bar->cap));
+                        nvme_disable_ctrl(dev, lo_hi_readq(&dev->bar->cap));
                         nvme_clear_queue(dev->queues[0]);
                         flush_kthread_worker(dq->worker);
                         nvme_disable_queue(dev, 0);
@@ -3401,6 +3403,7 @@ static const struct pci_error_handlers nvme_err_handler = {
 
 static const struct pci_device_id nvme_id_table[] = {
         { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
+        { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, nvme_id_table);