From 23ca542c8745a080663e58787a53cd21a7ea1d84 Mon Sep 17 00:00:00 2001 From: Julian Sikorski Date: Thu, 23 Oct 2025 19:05:47 +0200 Subject: [PATCH] Update odroidxu4-current to 6.6.113 (#8806) --- .../odroidxu4-6.6/patch-6.6.108-109.patch | 3085 +++++++ .../odroidxu4-6.6/patch-6.6.109-110.patch | 327 + .../odroidxu4-6.6/patch-6.6.110-111.patch | 860 ++ .../odroidxu4-6.6/patch-6.6.111-112.patch | 6153 +++++++++++++ .../odroidxu4-6.6/patch-6.6.112-113.patch | 7576 +++++++++++++++++ 5 files changed, 18001 insertions(+) create mode 100644 patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch create mode 100644 patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch create mode 100644 patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch create mode 100644 patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch create mode 100644 patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch new file mode 100644 index 0000000000..a0a74cbd8e --- /dev/null +++ b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.108-109.patch @@ -0,0 +1,3085 @@ +diff --git a/Makefile b/Makefile +index 1e3fb36bb71d78..afeacf5efc9553 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 108 ++SUBLEVEL = 109 + EXTRAVERSION = + NAME = Pinguïn Aangedreven + +diff --git a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts +index 2564671fc1c67f..59745ba9c8dabd 100644 +--- a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts ++++ b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts +@@ -66,8 +66,10 @@ &gmac1 { + mdio0 { + #address-cells = <1>; + #size-cells = <0>; +- phy0: ethernet-phy@0 { +- reg = <0>; ++ compatible = "snps,dwmac-mdio"; ++ ++ phy0: ethernet-phy@4 { ++ reg = <4>; + rxd0-skew-ps = <0>; + rxd1-skew-ps = <0>; + rxd2-skew-ps = <0>; +diff --git a/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts b/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts +index d4e0b8150a84ce..cf26e2ceaaa074 100644 +--- a/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts ++++ b/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts +@@ -38,7 +38,7 @@ sound { + simple-audio-card,mclk-fs = <256>; + + simple-audio-card,cpu { +- sound-dai = <&audio0 0>; ++ sound-dai = <&audio0>; + }; + + simple-audio-card,codec { +diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig +index 8789d93a7c04b3..c705bec1410c57 100644 +--- a/arch/arm/mach-bcm/Kconfig ++++ b/arch/arm/mach-bcm/Kconfig +@@ -186,6 +186,7 @@ config ARCH_BRCMSTB + select ARCH_HAS_RESET_CONTROLLER + select ARM_AMBA + select ARM_GIC ++ select ARM_GIC_V3 + select ARM_ERRATA_798181 if SMP + select HAVE_ARM_ARCH_TIMER + select ZONE_DMA if ARM_LPAE +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 69b213ed7a5943..7f7bd8477efde3 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -228,7 +228,7 @@ thermal-zones { + cpu-thermal { + polling-delay-passive = <250>; + polling-delay = <2000>; +- thermal-sensors = <&tmu 0>; ++ thermal-sensors = <&tmu 1>; + trips { + cpu_alert0: trip0 { + temperature = <85000>; +@@ -258,7 +258,7 @@ map0 { + soc-thermal { + polling-delay-passive = <250>; + polling-delay = <2000>; +- thermal-sensors = <&tmu 1>; ++ thermal-sensors = <&tmu 0>; + trips { + soc_alert0: trip0 { + temperature = <85000>; +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index 771e1cb17540db..e590b4c096253e 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -852,7 +852,7 @@ static int cpumf_pmu_event_type(struct perf_event *event) + static int cpumf_pmu_event_init(struct perf_event *event) + { + unsigned int type = event->attr.type; +- int err; ++ int err = -ENOENT; + + if (is_sampling_event(event)) /* No sampling support */ + return err; +@@ -861,8 +861,6 @@ static int cpumf_pmu_event_init(struct perf_event *event) + else if (event->pmu->type == type) + /* Registered as unknown PMU */ + err = __hw_perf_event_init(event, cpumf_pmu_event_type(event)); +- else +- return -ENOENT; + + if (unlikely(err) && event->destroy) + event->destroy(event); +diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c +index e24298a734befd..a04cd13c6315a2 100644 +--- a/arch/um/drivers/mconsole_user.c ++++ b/arch/um/drivers/mconsole_user.c +@@ -71,7 +71,9 @@ static struct mconsole_command *mconsole_parse(struct mc_request *req) + return NULL; + } + ++#ifndef MIN + #define MIN(a,b) ((a)<(b) ? (a):(b)) ++#endif + + #define STRINGX(x) #x + #define STRING(x) STRINGX(x) +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 455e2a2b149f4b..6fe9180aafb36b 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1472,19 +1472,36 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg) + return error; + } + +-static int loop_set_block_size(struct loop_device *lo, unsigned long arg) ++static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, ++ struct block_device *bdev, unsigned long arg) + { + int err = 0; + +- if (lo->lo_state != Lo_bound) +- return -ENXIO; ++ /* ++ * If we don't hold exclusive handle for the device, upgrade to it ++ * here to avoid changing device under exclusive owner. ++ */ ++ if (!(mode & BLK_OPEN_EXCL)) { ++ err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL); ++ if (err) ++ return err; ++ } ++ ++ err = mutex_lock_killable(&lo->lo_mutex); ++ if (err) ++ goto abort_claim; ++ ++ if (lo->lo_state != Lo_bound) { ++ err = -ENXIO; ++ goto unlock; ++ } + + err = blk_validate_block_size(arg); + if (err) +- return err; ++ goto unlock; + + if (lo->lo_queue->limits.logical_block_size == arg) +- return 0; ++ goto unlock; + + sync_blockdev(lo->lo_device); + invalidate_bdev(lo->lo_device); +@@ -1496,6 +1513,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg) + loop_update_dio(lo); + blk_mq_unfreeze_queue(lo->lo_queue); + ++unlock: ++ mutex_unlock(&lo->lo_mutex); ++abort_claim: ++ if (!(mode & BLK_OPEN_EXCL)) ++ bd_abort_claiming(bdev, loop_set_block_size); + return err; + } + +@@ -1514,9 +1536,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd, + case LOOP_SET_DIRECT_IO: + err = loop_set_dio(lo, arg); + break; +- case LOOP_SET_BLOCK_SIZE: +- err = loop_set_block_size(lo, arg); +- break; + default: + err = -EINVAL; + } +@@ -1571,9 +1590,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode, + break; + case LOOP_GET_STATUS64: + return loop_get_status64(lo, argp); ++ case LOOP_SET_BLOCK_SIZE: ++ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ return loop_set_block_size(lo, mode, bdev, arg); + case LOOP_SET_CAPACITY: + case LOOP_SET_DIRECT_IO: +- case LOOP_SET_BLOCK_SIZE: + if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) + return -EPERM; + fallthrough; +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 30d8f2ada0f176..76b0b9e6309b91 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2950,6 +2950,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + goto err_null_driver; + } + ++ /* ++ * Mark support for the scheduler's frequency invariance engine for ++ * drivers that implement target(), target_index() or fast_switch(). ++ */ ++ if (!cpufreq_driver->setpolicy) { ++ static_branch_enable_cpuslocked(&cpufreq_freq_invariance); ++ pr_debug("cpufreq: supports frequency invariance\n"); ++ } ++ + ret = subsys_interface_register(&cpufreq_interface); + if (ret) + goto err_boost_unreg; +@@ -2971,21 +2980,14 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + hp_online = ret; + ret = 0; + +- /* +- * Mark support for the scheduler's frequency invariance engine for +- * drivers that implement target(), target_index() or fast_switch(). +- */ +- if (!cpufreq_driver->setpolicy) { +- static_branch_enable_cpuslocked(&cpufreq_freq_invariance); +- pr_debug("supports frequency invariance"); +- } +- + pr_debug("driver %s up and running\n", driver_data->name); + goto out; + + err_if_unreg: + subsys_interface_unregister(&cpufreq_interface); + err_boost_unreg: ++ if (!cpufreq_driver->setpolicy) ++ static_branch_disable_cpuslocked(&cpufreq_freq_invariance); + remove_boost_sysfs_file(); + err_null_driver: + write_lock_irqsave(&cpufreq_driver_lock, flags); +diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h +index 2ea4d1d1fbef26..1fa31a6fdfcd5d 100644 +--- a/drivers/edac/skx_common.h ++++ b/drivers/edac/skx_common.h +@@ -45,7 +45,6 @@ + #define I10NM_NUM_CHANNELS MAX(I10NM_NUM_DDR_CHANNELS, I10NM_NUM_HBM_CHANNELS) + #define I10NM_NUM_DIMMS MAX(I10NM_NUM_DDR_DIMMS, I10NM_NUM_HBM_DIMMS) + +-#define MAX(a, b) ((a) > (b) ? (a) : (b)) + #define NUM_IMC MAX(SKX_NUM_IMC, I10NM_NUM_IMC) + #define NUM_CHANNELS MAX(SKX_NUM_CHANNELS, I10NM_NUM_CHANNELS) + #define NUM_DIMMS MAX(SKX_NUM_DIMMS, I10NM_NUM_DIMMS) +diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c +index 73cc2f2dcbf923..bdf4b035325e95 100644 +--- a/drivers/firewire/core-cdev.c ++++ b/drivers/firewire/core-cdev.c +@@ -39,7 +39,7 @@ + /* + * ABI version history is documented in linux/firewire-cdev.h. + */ +-#define FW_CDEV_KERNEL_VERSION 5 ++#define FW_CDEV_KERNEL_VERSION 6 + #define FW_CDEV_VERSION_EVENT_REQUEST2 4 + #define FW_CDEV_VERSION_ALLOCATE_REGION_END 4 + #define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5 +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index efb592b6f6aa7a..9b8a200423858e 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -4022,6 +4022,23 @@ static struct gpio_desc *gpiod_find_by_fwnode(struct fwnode_handle *fwnode, + return desc; + } + ++static struct gpio_desc *gpiod_fwnode_lookup(struct fwnode_handle *fwnode, ++ struct device *consumer, ++ const char *con_id, ++ unsigned int idx, ++ enum gpiod_flags *flags, ++ unsigned long *lookupflags) ++{ ++ struct gpio_desc *desc; ++ ++ desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, flags, lookupflags); ++ if (gpiod_not_found(desc) && !IS_ERR_OR_NULL(fwnode)) ++ desc = gpiod_find_by_fwnode(fwnode->secondary, consumer, con_id, ++ idx, flags, lookupflags); ++ ++ return desc; ++} ++ + struct gpio_desc *gpiod_find_and_request(struct device *consumer, + struct fwnode_handle *fwnode, + const char *con_id, +@@ -4034,7 +4051,7 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer, + struct gpio_desc *desc; + int ret; + +- desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, &flags, &lookupflags); ++ desc = gpiod_fwnode_lookup(fwnode, consumer, con_id, idx, &flags, &lookupflags); + if (gpiod_not_found(desc) && platform_lookup_allowed) { + /* + * Either we are not using DT or ACPI, or their lookup did not +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index c5d706a4c7b4a7..78426f8c5420db 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1285,7 +1285,9 @@ int emu_soc_asic_init(struct amdgpu_device *adev); + for (i = ffs(inst_mask); i-- != 0; \ + i = ffs(inst_mask & BIT_MASK_UPPER(i + 1))) + ++#ifndef MIN + #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) ++#endif + + /* Common functions */ + bool amdgpu_device_has_job_running(struct amdgpu_device *adev); +diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +index 1b2df97226a3f2..40286e8dd4e1ab 100644 +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +@@ -25,7 +25,9 @@ + + #include "hdcp.h" + ++#ifndef MIN + #define MIN(a, b) ((a) < (b) ? (a) : (b)) ++#endif + #define HDCP_I2C_ADDR 0x3a /* 0x74 >> 1*/ + #define KSV_READ_SIZE 0xf /* 0x6803b - 0x6802c */ + #define HDCP_MAX_AUX_TRANSACTION_SIZE 16 +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h +index 6f54c410c2f985..409aeec6baa921 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h +@@ -22,12 +22,18 @@ + */ + #include + +-#define SHIFT_AMOUNT 16 /* We multiply all original integers with 2^SHIFT_AMOUNT to get the fInt representation */ ++enum ppevvmath_constants { ++ /* We multiply all original integers with 2^SHIFT_AMOUNT to get the fInt representation */ ++ SHIFT_AMOUNT = 16, + +-#define PRECISION 5 /* Change this value to change the number of decimal places in the final output - 5 is a good default */ ++ /* Change this value to change the number of decimal places in the final output - 5 is a good default */ ++ PRECISION = 5, + +-#define SHIFTED_2 (2 << SHIFT_AMOUNT) +-#define MAX (1 << (SHIFT_AMOUNT - 1)) - 1 /* 32767 - Might change in the future */ ++ SHIFTED_2 = (2 << SHIFT_AMOUNT), ++ ++ /* 32767 - Might change in the future */ ++ MAX = (1 << (SHIFT_AMOUNT - 1)) - 1, ++}; + + /* ------------------------------------------------------------------------------- + * NEW TYPE - fINT +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +index a7f4f82d23b4b9..2fdb982e70ef7d 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +@@ -2082,7 +2082,9 @@ static int sienna_cichlid_display_disable_memory_clock_switch(struct smu_context + return ret; + } + ++#ifndef MAX + #define MAX(a, b) ((a) > (b) ? (a) : (b)) ++#endif + + static int sienna_cichlid_update_pcie_parameters(struct smu_context *smu, + uint8_t pcie_gen_cap, +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +index 4022dd44ebb2b3..fe6c42a736d08b 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +@@ -1696,7 +1696,10 @@ static int smu_v13_0_0_get_thermal_temperature_range(struct smu_context *smu, + return 0; + } + ++#ifndef MAX + #define MAX(a, b) ((a) > (b) ? (a) : (b)) ++#endif ++ + static ssize_t smu_v13_0_0_get_gpu_metrics(struct smu_context *smu, + void **table) + { +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +index e1521d3a5e0ca1..df99d185cf8e03 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -1674,7 +1674,10 @@ static int smu_v13_0_7_get_thermal_temperature_range(struct smu_context *smu, + return 0; + } + ++#ifndef MAX + #define MAX(a, b) ((a) > (b) ? (a) : (b)) ++#endif ++ + static ssize_t smu_v13_0_7_get_gpu_metrics(struct smu_context *smu, + void **table) + { +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +index 12618a583e97cd..c1962f1974c6fe 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +@@ -708,7 +708,7 @@ static const char *smu_get_feature_name(struct smu_context *smu, + size_t smu_cmn_get_pp_feature_mask(struct smu_context *smu, + char *buf) + { +- int8_t sort_feature[max(SMU_FEATURE_COUNT, SMU_FEATURE_MAX)]; ++ int8_t sort_feature[MAX(SMU_FEATURE_COUNT, SMU_FEATURE_MAX)]; + uint64_t feature_mask; + int i, feature_index; + uint32_t count = 0; +diff --git a/drivers/gpu/drm/ast/ast_dp.c b/drivers/gpu/drm/ast/ast_dp.c +index c6f226b6f08136..fc9c36c8b81b99 100644 +--- a/drivers/gpu/drm/ast/ast_dp.c ++++ b/drivers/gpu/drm/ast/ast_dp.c +@@ -62,7 +62,7 @@ int ast_astdp_read_edid(struct drm_device *dev, u8 *ediddata) + * of right-click of mouse. + * 2. The Delays are often longer a lot when system resume from S3/S4. + */ +- mdelay(j+1); ++ msleep(j + 1); + + if (!(ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xD1, + ASTDP_MCU_FW_EXECUTING) && +diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi.c b/drivers/gpu/drm/gma500/oaktrail_hdmi.c +index ed8626c73541c1..f0ae675581d9a5 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c ++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c +@@ -726,8 +726,8 @@ void oaktrail_hdmi_teardown(struct drm_device *dev) + + if (hdmi_dev) { + pdev = hdmi_dev->dev; +- pci_set_drvdata(pdev, NULL); + oaktrail_hdmi_i2c_exit(pdev); ++ pci_set_drvdata(pdev, NULL); + iounmap(hdmi_dev->regs); + kfree(hdmi_dev); + pci_dev_put(pdev); +diff --git a/drivers/gpu/drm/i915/display/intel_backlight.c b/drivers/gpu/drm/i915/display/intel_backlight.c +index ff9b9918b0a134..d414627813aab7 100644 +--- a/drivers/gpu/drm/i915/display/intel_backlight.c ++++ b/drivers/gpu/drm/i915/display/intel_backlight.c +@@ -40,8 +40,9 @@ static u32 scale(u32 source_val, + { + u64 target_val; + +- WARN_ON(source_min > source_max); +- WARN_ON(target_min > target_max); ++ if (WARN_ON(source_min >= source_max) || ++ WARN_ON(target_min > target_max)) ++ return target_min; + + /* defensive */ + source_val = clamp(source_val, source_min, source_max); +diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c +index 820c2c3641d388..1311f10fad660c 100644 +--- a/drivers/gpu/drm/radeon/evergreen_cs.c ++++ b/drivers/gpu/drm/radeon/evergreen_cs.c +@@ -33,8 +33,10 @@ + #include "evergreen_reg_safe.h" + #include "cayman_reg_safe.h" + ++#ifndef MIN + #define MAX(a,b) (((a)>(b))?(a):(b)) + #define MIN(a,b) (((a)<(b))?(a):(b)) ++#endif + + #define REG_SAFE_BM_SIZE ARRAY_SIZE(evergreen_reg_safe_bm) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 896f73aa4d2c82..a8d440f6e804fb 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -869,7 +869,10 @@ static int asus_input_mapping(struct hid_device *hdev, + case 0xc4: asus_map_key_clear(KEY_KBDILLUMUP); break; + case 0xc5: asus_map_key_clear(KEY_KBDILLUMDOWN); break; + case 0xc7: asus_map_key_clear(KEY_KBDILLUMTOGGLE); break; ++ case 0x4e: asus_map_key_clear(KEY_FN_ESC); break; ++ case 0x7e: asus_map_key_clear(KEY_EMOJI_PICKER); break; + ++ case 0x8b: asus_map_key_clear(KEY_PROG1); break; /* ProArt Creator Hub key */ + case 0x6b: asus_map_key_clear(KEY_F21); break; /* ASUS touchpad toggle */ + case 0x38: asus_map_key_clear(KEY_PROG1); break; /* ROG key */ + case 0xba: asus_map_key_clear(KEY_PROG2); break; /* Fn+C ASUS Splendid */ +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 14b2547adae8d3..ce0ab4e4e41a73 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -22,23 +22,23 @@ + #include + + /* Indexes for the sysfs hooks */ +- +-#define INPUT 0 +-#define MIN 1 +-#define MAX 2 +-#define CONTROL 3 +-#define OFFSET 3 +-#define AUTOMIN 4 +-#define THERM 5 +-#define HYSTERSIS 6 +- ++enum adt_sysfs_id { ++ INPUT = 0, ++ MIN = 1, ++ MAX = 2, ++ CONTROL = 3, ++ OFFSET = 3, // Dup ++ AUTOMIN = 4, ++ THERM = 5, ++ HYSTERSIS = 6, + /* + * These are unique identifiers for the sysfs functions - unlike the + * numbers above, these are not also indexes into an array + */ ++ ALARM = 9, ++ FAULT = 10, ++}; + +-#define ALARM 9 +-#define FAULT 10 + + /* 7475 Common Registers */ + +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index f3245a68563095..1ebcf5673a06b2 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -168,7 +168,7 @@ static inline int dw_i2c_of_configure(struct platform_device *pdev) + } + #endif + +-static int txgbe_i2c_request_regs(struct dw_i2c_dev *dev) ++static int dw_i2c_get_parent_regmap(struct dw_i2c_dev *dev) + { + dev->map = dev_get_regmap(dev->dev->parent, NULL); + if (!dev->map) +@@ -190,12 +190,15 @@ static int dw_i2c_plat_request_regs(struct dw_i2c_dev *dev) + struct platform_device *pdev = to_platform_device(dev->dev); + int ret; + ++ if (device_is_compatible(dev->dev, "intel,xe-i2c")) ++ return dw_i2c_get_parent_regmap(dev); ++ + switch (dev->flags & MODEL_MASK) { + case MODEL_BAIKAL_BT1: + ret = bt1_i2c_request_regs(dev); + break; + case MODEL_WANGXUN_SP: +- ret = txgbe_i2c_request_regs(dev); ++ ret = dw_i2c_get_parent_regmap(dev); + break; + default: + dev->base = devm_platform_ioremap_resource(pdev, 0); +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 3f1fa45d936821..388c95562a927a 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -191,6 +191,7 @@ static u16 get_legacy_obj_type(u16 opcode) + { + switch (opcode) { + case MLX5_CMD_OP_CREATE_RQ: ++ case MLX5_CMD_OP_CREATE_RMP: + return MLX5_EVENT_QUEUE_TYPE_RQ; + case MLX5_CMD_OP_CREATE_QP: + return MLX5_EVENT_QUEUE_TYPE_QP; +diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c +index 7cb26929dc7328..9dc25eb2be445f 100644 +--- a/drivers/input/touchscreen/cyttsp4_core.c ++++ b/drivers/input/touchscreen/cyttsp4_core.c +@@ -871,7 +871,7 @@ static void cyttsp4_get_mt_touches(struct cyttsp4_mt_data *md, int num_cur_tch) + struct cyttsp4_touch tch; + int sig; + int i, j, t = 0; +- int ids[max(CY_TMA1036_MAX_TCH, CY_TMA4XX_MAX_TCH)]; ++ int ids[MAX(CY_TMA1036_MAX_TCH, CY_TMA4XX_MAX_TCH)]; + + memset(ids, 0, si->si_ofs.tch_abs[CY_TCH_T].max * sizeof(int)); + for (i = 0; i < num_cur_tch; i++) { +diff --git a/drivers/irqchip/irq-sun6i-r.c b/drivers/irqchip/irq-sun6i-r.c +index a01e440494154e..99958d470d6268 100644 +--- a/drivers/irqchip/irq-sun6i-r.c ++++ b/drivers/irqchip/irq-sun6i-r.c +@@ -270,7 +270,7 @@ static const struct irq_domain_ops sun6i_r_intc_domain_ops = { + + static int sun6i_r_intc_suspend(void) + { +- u32 buf[BITS_TO_U32(max(SUN6I_NR_TOP_LEVEL_IRQS, SUN6I_NR_MUX_BITS))]; ++ u32 buf[BITS_TO_U32(MAX(SUN6I_NR_TOP_LEVEL_IRQS, SUN6I_NR_MUX_BITS))]; + int i; + + /* Wake IRQs are enabled during system sleep and shutdown. */ +diff --git a/drivers/media/dvb-frontends/stv0367_priv.h b/drivers/media/dvb-frontends/stv0367_priv.h +index 617f605947b2c4..7f056d1cce8228 100644 +--- a/drivers/media/dvb-frontends/stv0367_priv.h ++++ b/drivers/media/dvb-frontends/stv0367_priv.h +@@ -25,8 +25,11 @@ + #endif + + /* MACRO definitions */ ++#ifndef MIN + #define MAX(X, Y) ((X) >= (Y) ? (X) : (Y)) + #define MIN(X, Y) ((X) <= (Y) ? (X) : (Y)) ++#endif ++ + #define INRANGE(X, Y, Z) \ + ((((X) <= (Y)) && ((Y) <= (Z))) || \ + (((Z) <= (Y)) && ((Y) <= (X))) ? 1 : 0) +diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c +index be1505e8c536e8..7759531ccca70f 100644 +--- a/drivers/mmc/host/sdhci-cadence.c ++++ b/drivers/mmc/host/sdhci-cadence.c +@@ -433,6 +433,13 @@ static const struct sdhci_cdns_drv_data sdhci_elba_drv_data = { + }, + }; + ++static const struct sdhci_cdns_drv_data sdhci_eyeq_drv_data = { ++ .pltfm_data = { ++ .ops = &sdhci_cdns_ops, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ }, ++}; ++ + static const struct sdhci_cdns_drv_data sdhci_cdns_drv_data = { + .pltfm_data = { + .ops = &sdhci_cdns_ops, +@@ -595,6 +602,10 @@ static const struct of_device_id sdhci_cdns_match[] = { + .compatible = "amd,pensando-elba-sd4hc", + .data = &sdhci_elba_drv_data, + }, ++ { ++ .compatible = "mobileye,eyeq-sd4hc", ++ .data = &sdhci_eyeq_drv_data, ++ }, + { .compatible = "cdns,sd4hc" }, + { /* sentinel */ } + }; +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index f5aa5dbacaf21f..1f26aba620b988 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -861,7 +861,6 @@ static int __maybe_unused rcar_can_resume(struct device *dev) + { + struct net_device *ndev = dev_get_drvdata(dev); + struct rcar_can_priv *priv = netdev_priv(ndev); +- u16 ctlr; + int err; + + if (!netif_running(ndev)) +@@ -873,12 +872,7 @@ static int __maybe_unused rcar_can_resume(struct device *dev) + return err; + } + +- ctlr = readw(&priv->regs->ctlr); +- ctlr &= ~RCAR_CAN_CTLR_SLPM; +- writew(ctlr, &priv->regs->ctlr); +- ctlr &= ~RCAR_CAN_CTLR_CANM; +- writew(ctlr, &priv->regs->ctlr); +- priv->can.state = CAN_STATE_ERROR_ACTIVE; ++ rcar_can_start(ndev); + + netif_device_attach(ndev); + netif_start_queue(ndev); +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index b757555ed4c4f6..57ea7dfe8a596f 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -813,6 +813,7 @@ static const struct net_device_ops hi3110_netdev_ops = { + .ndo_open = hi3110_open, + .ndo_stop = hi3110_stop, + .ndo_start_xmit = hi3110_hard_start_xmit, ++ .ndo_change_mtu = can_change_mtu, + }; + + static const struct ethtool_ops hi3110_ethtool_ops = { +diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c +index 283fbf59e66d5e..5ab1f9c7288e59 100644 +--- a/drivers/net/can/sun4i_can.c ++++ b/drivers/net/can/sun4i_can.c +@@ -768,6 +768,7 @@ static const struct net_device_ops sun4ican_netdev_ops = { + .ndo_open = sun4ican_open, + .ndo_stop = sun4ican_close, + .ndo_start_xmit = sun4ican_start_xmit, ++ .ndo_change_mtu = can_change_mtu, + }; + + static const struct ethtool_ops sun4ican_ethtool_ops = { +diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c +index 5e3a72b7c46919..bb49a2c0a9a5c1 100644 +--- a/drivers/net/can/usb/etas_es58x/es58x_core.c ++++ b/drivers/net/can/usb/etas_es58x/es58x_core.c +@@ -7,7 +7,7 @@ + * + * Copyright (c) 2019 Robert Bosch Engineering and Business Solutions. All rights reserved. + * Copyright (c) 2020 ETAS K.K.. All rights reserved. +- * Copyright (c) 2020-2022 Vincent Mailhol ++ * Copyright (c) 2020-2025 Vincent Mailhol + */ + + #include +@@ -1977,6 +1977,7 @@ static const struct net_device_ops es58x_netdev_ops = { + .ndo_stop = es58x_stop, + .ndo_start_xmit = es58x_start_xmit, + .ndo_eth_ioctl = can_eth_ioctl_hwts, ++ .ndo_change_mtu = can_change_mtu, + }; + + static const struct ethtool_ops es58x_ethtool_ops = { +diff --git a/drivers/net/can/usb/etas_es58x/es58x_devlink.c b/drivers/net/can/usb/etas_es58x/es58x_devlink.c +index e763a9904bedd0..0d155eb1b9e999 100644 +--- a/drivers/net/can/usb/etas_es58x/es58x_devlink.c ++++ b/drivers/net/can/usb/etas_es58x/es58x_devlink.c +@@ -215,7 +215,7 @@ static int es58x_devlink_info_get(struct devlink *devlink, + struct es58x_sw_version *fw_ver = &es58x_dev->firmware_version; + struct es58x_sw_version *bl_ver = &es58x_dev->bootloader_version; + struct es58x_hw_revision *hw_rev = &es58x_dev->hardware_revision; +- char buf[max(sizeof("xx.xx.xx"), sizeof("axxx/xxx"))]; ++ char buf[MAX(sizeof("xx.xx.xx"), sizeof("axxx/xxx"))]; + int ret = 0; + + if (es58x_sw_version_is_valid(fw_ver)) { +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index 47619e9cb0055b..ecc489afb84163 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -761,6 +761,7 @@ static const struct net_device_ops mcba_netdev_ops = { + .ndo_open = mcba_usb_open, + .ndo_stop = mcba_usb_close, + .ndo_start_xmit = mcba_usb_start_xmit, ++ .ndo_change_mtu = can_change_mtu, + }; + + static const struct ethtool_ops mcba_ethtool_ops = { +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +index 24ad9f593a7736..9d162d1004c267 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -111,7 +111,7 @@ void peak_usb_update_ts_now(struct peak_time_ref *time_ref, u32 ts_now) + u32 delta_ts = time_ref->ts_dev_2 - time_ref->ts_dev_1; + + if (time_ref->ts_dev_2 < time_ref->ts_dev_1) +- delta_ts &= (1 << time_ref->adapter->ts_used_bits) - 1; ++ delta_ts &= (1ULL << time_ref->adapter->ts_used_bits) - 1; + + time_ref->ts_total += delta_ts; + } +diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c +index 3c76a1a14aee3c..c1a9ab92597685 100644 +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -682,30 +682,24 @@ static int gswip_add_single_port_br(struct gswip_priv *priv, int port, bool add) + return 0; + } + +-static int gswip_port_enable(struct dsa_switch *ds, int port, +- struct phy_device *phydev) ++static int gswip_port_setup(struct dsa_switch *ds, int port) + { + struct gswip_priv *priv = ds->priv; + int err; + +- if (!dsa_is_user_port(ds, port)) +- return 0; +- + if (!dsa_is_cpu_port(ds, port)) { + err = gswip_add_single_port_br(priv, port, true); + if (err) + return err; + } + +- /* RMON Counter Enable for port */ +- gswip_switch_w(priv, GSWIP_BM_PCFG_CNTEN, GSWIP_BM_PCFGp(port)); ++ return 0; ++} + +- /* enable port fetch/store dma & VLAN Modification */ +- gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_EN | +- GSWIP_FDMA_PCTRL_VLANMOD_BOTH, +- GSWIP_FDMA_PCTRLp(port)); +- gswip_switch_mask(priv, 0, GSWIP_SDMA_PCTRL_EN, +- GSWIP_SDMA_PCTRLp(port)); ++static int gswip_port_enable(struct dsa_switch *ds, int port, ++ struct phy_device *phydev) ++{ ++ struct gswip_priv *priv = ds->priv; + + if (!dsa_is_cpu_port(ds, port)) { + u32 mdio_phy = 0; +@@ -717,6 +711,16 @@ static int gswip_port_enable(struct dsa_switch *ds, int port, + GSWIP_MDIO_PHYp(port)); + } + ++ /* RMON Counter Enable for port */ ++ gswip_switch_w(priv, GSWIP_BM_PCFG_CNTEN, GSWIP_BM_PCFGp(port)); ++ ++ /* enable port fetch/store dma & VLAN Modification */ ++ gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_EN | ++ GSWIP_FDMA_PCTRL_VLANMOD_BOTH, ++ GSWIP_FDMA_PCTRLp(port)); ++ gswip_switch_mask(priv, 0, GSWIP_SDMA_PCTRL_EN, ++ GSWIP_SDMA_PCTRLp(port)); ++ + return 0; + } + +@@ -724,9 +728,6 @@ static void gswip_port_disable(struct dsa_switch *ds, int port) + { + struct gswip_priv *priv = ds->priv; + +- if (!dsa_is_user_port(ds, port)) +- return; +- + gswip_switch_mask(priv, GSWIP_FDMA_PCTRL_EN, 0, + GSWIP_FDMA_PCTRLp(port)); + gswip_switch_mask(priv, GSWIP_SDMA_PCTRL_EN, 0, +@@ -1365,8 +1366,9 @@ static int gswip_port_fdb(struct dsa_switch *ds, int port, + int i; + int err; + ++ /* Operation not supported on the CPU port, don't throw errors */ + if (!bridge) +- return -EINVAL; ++ return 0; + + for (i = max_ports; i < ARRAY_SIZE(priv->vlans); i++) { + if (priv->vlans[i].bridge == bridge) { +@@ -1821,6 +1823,7 @@ static int gswip_get_sset_count(struct dsa_switch *ds, int port, int sset) + static const struct dsa_switch_ops gswip_xrx200_switch_ops = { + .get_tag_protocol = gswip_get_tag_protocol, + .setup = gswip_setup, ++ .port_setup = gswip_port_setup, + .port_enable = gswip_port_enable, + .port_disable = gswip_port_disable, + .port_bridge_join = gswip_port_bridge_join, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +index 273c9ba48f09a1..b896f8d20ff336 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -244,7 +244,7 @@ bnxt_tc_parse_pedit(struct bnxt *bp, struct bnxt_tc_actions *actions, + offset < offset_of_ip6_daddr + 16) { + actions->nat.src_xlate = false; + idx = (offset - offset_of_ip6_daddr) / 4; +- actions->nat.l3.ipv6.saddr.s6_addr32[idx] = htonl(val); ++ actions->nat.l3.ipv6.daddr.s6_addr32[idx] = htonl(val); + } else { + netdev_err(bp->dev, + "%s: IPv6_hdr: Invalid pedit field\n", +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 9fb7c5fe05d15f..f095069dc32a9e 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -23,6 +23,7 @@ + #define I40E_MAX_VEB 16 + + #define I40E_MAX_NUM_DESCRIPTORS 4096 ++#define I40E_MAX_NUM_DESCRIPTORS_XL710 8160 + #define I40E_MAX_CSR_SPACE (4 * 1024 * 1024 - 64 * 1024) + #define I40E_DEFAULT_NUM_DESCRIPTORS 512 + #define I40E_REQ_DESCRIPTOR_MULTIPLE 32 +@@ -1228,7 +1229,8 @@ struct i40e_mac_filter *i40e_add_mac_filter(struct i40e_vsi *vsi, + const u8 *macaddr); + int i40e_del_mac_filter(struct i40e_vsi *vsi, const u8 *macaddr); + bool i40e_is_vsi_in_vlan(struct i40e_vsi *vsi); +-int i40e_count_filters(struct i40e_vsi *vsi); ++int i40e_count_all_filters(struct i40e_vsi *vsi); ++int i40e_count_active_filters(struct i40e_vsi *vsi); + struct i40e_mac_filter *i40e_find_mac(struct i40e_vsi *vsi, const u8 *macaddr); + void i40e_vlan_stripping_enable(struct i40e_vsi *vsi); + static inline bool i40e_is_sw_dcb(struct i40e_pf *pf) +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index a89f7ca510fdb8..077d5daaedccaa 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -2015,6 +2015,18 @@ static void i40e_get_drvinfo(struct net_device *netdev, + drvinfo->n_priv_flags += I40E_GL_PRIV_FLAGS_STR_LEN; + } + ++static u32 i40e_get_max_num_descriptors(struct i40e_pf *pf) ++{ ++ struct i40e_hw *hw = &pf->hw; ++ ++ switch (hw->mac.type) { ++ case I40E_MAC_XL710: ++ return I40E_MAX_NUM_DESCRIPTORS_XL710; ++ default: ++ return I40E_MAX_NUM_DESCRIPTORS; ++ } ++} ++ + static void i40e_get_ringparam(struct net_device *netdev, + struct ethtool_ringparam *ring, + struct kernel_ethtool_ringparam *kernel_ring, +@@ -2024,8 +2036,8 @@ static void i40e_get_ringparam(struct net_device *netdev, + struct i40e_pf *pf = np->vsi->back; + struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi]; + +- ring->rx_max_pending = I40E_MAX_NUM_DESCRIPTORS; +- ring->tx_max_pending = I40E_MAX_NUM_DESCRIPTORS; ++ ring->rx_max_pending = i40e_get_max_num_descriptors(pf); ++ ring->tx_max_pending = i40e_get_max_num_descriptors(pf); + ring->rx_mini_max_pending = 0; + ring->rx_jumbo_max_pending = 0; + ring->rx_pending = vsi->rx_rings[0]->count; +@@ -2050,12 +2062,12 @@ static int i40e_set_ringparam(struct net_device *netdev, + struct kernel_ethtool_ringparam *kernel_ring, + struct netlink_ext_ack *extack) + { ++ u32 new_rx_count, new_tx_count, max_num_descriptors; + struct i40e_ring *tx_rings = NULL, *rx_rings = NULL; + struct i40e_netdev_priv *np = netdev_priv(netdev); + struct i40e_hw *hw = &np->vsi->back->hw; + struct i40e_vsi *vsi = np->vsi; + struct i40e_pf *pf = vsi->back; +- u32 new_rx_count, new_tx_count; + u16 tx_alloc_queue_pairs; + int timeout = 50; + int i, err = 0; +@@ -2063,14 +2075,15 @@ static int i40e_set_ringparam(struct net_device *netdev, + if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending)) + return -EINVAL; + +- if (ring->tx_pending > I40E_MAX_NUM_DESCRIPTORS || ++ max_num_descriptors = i40e_get_max_num_descriptors(pf); ++ if (ring->tx_pending > max_num_descriptors || + ring->tx_pending < I40E_MIN_NUM_DESCRIPTORS || +- ring->rx_pending > I40E_MAX_NUM_DESCRIPTORS || ++ ring->rx_pending > max_num_descriptors || + ring->rx_pending < I40E_MIN_NUM_DESCRIPTORS) { + netdev_info(netdev, + "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n", + ring->tx_pending, ring->rx_pending, +- I40E_MIN_NUM_DESCRIPTORS, I40E_MAX_NUM_DESCRIPTORS); ++ I40E_MIN_NUM_DESCRIPTORS, max_num_descriptors); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 72869336e3a9a9..affdbd3ee76c54 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1247,12 +1247,30 @@ void i40e_update_stats(struct i40e_vsi *vsi) + } + + /** +- * i40e_count_filters - counts VSI mac filters ++ * i40e_count_all_filters - counts VSI MAC filters + * @vsi: the VSI to be searched + * +- * Returns count of mac filters +- **/ +-int i40e_count_filters(struct i40e_vsi *vsi) ++ * Return: count of MAC filters in any state. ++ */ ++int i40e_count_all_filters(struct i40e_vsi *vsi) ++{ ++ struct i40e_mac_filter *f; ++ struct hlist_node *h; ++ int bkt, cnt = 0; ++ ++ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) ++ cnt++; ++ ++ return cnt; ++} ++ ++/** ++ * i40e_count_active_filters - counts VSI MAC filters ++ * @vsi: the VSI to be searched ++ * ++ * Return: count of active MAC filters. ++ */ ++int i40e_count_active_filters(struct i40e_vsi *vsi) + { + struct i40e_mac_filter *f; + struct hlist_node *h; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 6d7a4f2c3a49b7..7f5538e2c9de5c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -448,7 +448,7 @@ static void i40e_config_irq_link_list(struct i40e_vf *vf, u16 vsi_id, + (qtype << I40E_QINT_RQCTL_NEXTQ_TYPE_SHIFT) | + (pf_queue_id << I40E_QINT_RQCTL_NEXTQ_INDX_SHIFT) | + BIT(I40E_QINT_RQCTL_CAUSE_ENA_SHIFT) | +- (itr_idx << I40E_QINT_RQCTL_ITR_INDX_SHIFT); ++ FIELD_PREP(I40E_QINT_RQCTL_ITR_INDX_MASK, itr_idx); + wr32(hw, reg_idx, reg); + } + +@@ -657,6 +657,13 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id, + + /* only set the required fields */ + tx_ctx.base = info->dma_ring_addr / 128; ++ ++ /* ring_len has to be multiple of 8 */ ++ if (!IS_ALIGNED(info->ring_len, 8) || ++ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { ++ ret = -EINVAL; ++ goto error_context; ++ } + tx_ctx.qlen = info->ring_len; + tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]); + tx_ctx.rdylist_act = 0; +@@ -722,6 +729,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + + /* only set the required fields */ + rx_ctx.base = info->dma_ring_addr / 128; ++ ++ /* ring_len has to be multiple of 32 */ ++ if (!IS_ALIGNED(info->ring_len, 32) || ++ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { ++ ret = -EINVAL; ++ goto error_param; ++ } + rx_ctx.qlen = info->ring_len; + + if (info->splithdr_enabled) { +@@ -1459,6 +1473,7 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr) + * functions that may still be running at this point. + */ + clear_bit(I40E_VF_STATE_INIT, &vf->vf_states); ++ clear_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states); + + /* In the case of a VFLR, the HW has already reset the VF and we + * just need to clean up, so don't hit the VFRTRIG register. +@@ -2125,7 +2140,10 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) + size_t len = 0; + int ret; + +- if (!i40e_sync_vf_state(vf, I40E_VF_STATE_INIT)) { ++ i40e_sync_vf_state(vf, I40E_VF_STATE_INIT); ++ ++ if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states) || ++ test_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states)) { + aq_ret = -EINVAL; + goto err; + } +@@ -2228,6 +2246,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) + vf->default_lan_addr.addr); + } + set_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states); ++ set_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states); + + err: + /* send the response back to the VF */ +@@ -2390,7 +2409,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + } + + if (vf->adq_enabled) { +- if (idx >= ARRAY_SIZE(vf->ch)) { ++ if (idx >= vf->num_tc) { + aq_ret = -ENODEV; + goto error_param; + } +@@ -2411,7 +2430,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + * to its appropriate VSIs based on TC mapping + */ + if (vf->adq_enabled) { +- if (idx >= ARRAY_SIZE(vf->ch)) { ++ if (idx >= vf->num_tc) { + aq_ret = -ENODEV; + goto error_param; + } +@@ -2461,8 +2480,10 @@ static int i40e_validate_queue_map(struct i40e_vf *vf, u16 vsi_id, + u16 vsi_queue_id, queue_id; + + for_each_set_bit(vsi_queue_id, &queuemap, I40E_MAX_VSI_QP) { +- if (vf->adq_enabled) { +- vsi_id = vf->ch[vsi_queue_id / I40E_MAX_VF_VSI].vsi_id; ++ u16 idx = vsi_queue_id / I40E_MAX_VF_VSI; ++ ++ if (vf->adq_enabled && idx < vf->num_tc) { ++ vsi_id = vf->ch[idx].vsi_id; + queue_id = (vsi_queue_id % I40E_DEFAULT_QUEUES_PER_VF); + } else { + queue_id = vsi_queue_id; +@@ -2850,24 +2871,6 @@ static int i40e_vc_get_stats_msg(struct i40e_vf *vf, u8 *msg) + (u8 *)&stats, sizeof(stats)); + } + +-/** +- * i40e_can_vf_change_mac +- * @vf: pointer to the VF info +- * +- * Return true if the VF is allowed to change its MAC filters, false otherwise +- */ +-static bool i40e_can_vf_change_mac(struct i40e_vf *vf) +-{ +- /* If the VF MAC address has been set administratively (via the +- * ndo_set_vf_mac command), then deny permission to the VF to +- * add/delete unicast MAC addresses, unless the VF is trusted +- */ +- if (vf->pf_set_mac && !vf->trusted) +- return false; +- +- return true; +-} +- + #define I40E_MAX_MACVLAN_PER_HW 3072 + #define I40E_MAX_MACVLAN_PER_PF(num_ports) (I40E_MAX_MACVLAN_PER_HW / \ + (num_ports)) +@@ -2906,8 +2909,10 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; + struct i40e_hw *hw = &pf->hw; +- int mac2add_cnt = 0; +- int i; ++ int i, mac_add_max, mac_add_cnt = 0; ++ bool vf_trusted; ++ ++ vf_trusted = test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps); + + for (i = 0; i < al->num_elements; i++) { + struct i40e_mac_filter *f; +@@ -2927,9 +2932,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + * The VF may request to set the MAC address filter already + * assigned to it so do not return an error in that case. + */ +- if (!i40e_can_vf_change_mac(vf) && +- !is_multicast_ether_addr(addr) && +- !ether_addr_equal(addr, vf->default_lan_addr.addr)) { ++ if (!vf_trusted && !is_multicast_ether_addr(addr) && ++ vf->pf_set_mac && !ether_addr_equal(addr, vf->default_lan_addr.addr)) { + dev_err(&pf->pdev->dev, + "VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n"); + return -EPERM; +@@ -2938,29 +2942,33 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + /*count filters that really will be added*/ + f = i40e_find_mac(vsi, addr); + if (!f) +- ++mac2add_cnt; ++ ++mac_add_cnt; + } + + /* If this VF is not privileged, then we can't add more than a limited +- * number of addresses. Check to make sure that the additions do not +- * push us over the limit. +- */ +- if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) { +- if ((i40e_count_filters(vsi) + mac2add_cnt) > +- I40E_VC_MAX_MAC_ADDR_PER_VF) { +- dev_err(&pf->pdev->dev, +- "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n"); +- return -EPERM; +- } +- /* If this VF is trusted, it can use more resources than untrusted. ++ * number of addresses. ++ * ++ * If this VF is trusted, it can use more resources than untrusted. + * However to ensure that every trusted VF has appropriate number of + * resources, divide whole pool of resources per port and then across + * all VFs. + */ +- } else { +- if ((i40e_count_filters(vsi) + mac2add_cnt) > +- I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, +- hw->num_ports)) { ++ if (!vf_trusted) ++ mac_add_max = I40E_VC_MAX_MAC_ADDR_PER_VF; ++ else ++ mac_add_max = I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, hw->num_ports); ++ ++ /* VF can replace all its filters in one step, in this case mac_add_max ++ * will be added as active and another mac_add_max will be in ++ * a to-be-removed state. Account for that. ++ */ ++ if ((i40e_count_active_filters(vsi) + mac_add_cnt) > mac_add_max || ++ (i40e_count_all_filters(vsi) + mac_add_cnt) > 2 * mac_add_max) { ++ if (!vf_trusted) { ++ dev_err(&pf->pdev->dev, ++ "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n"); ++ return -EPERM; ++ } else { + dev_err(&pf->pdev->dev, + "Cannot add more MAC addresses, trusted VF exhausted it's resources\n"); + return -EPERM; +@@ -3593,7 +3601,7 @@ static int i40e_validate_cloud_filter(struct i40e_vf *vf, + + /* action_meta is TC number here to which the filter is applied */ + if (!tc_filter->action_meta || +- tc_filter->action_meta > vf->num_tc) { ++ tc_filter->action_meta >= vf->num_tc) { + dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n", + vf->vf_id, tc_filter->action_meta); + goto err; +@@ -3891,6 +3899,8 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg) + aq_ret); + } + ++#define I40E_MAX_VF_CLOUD_FILTER 0xFF00 ++ + /** + * i40e_vc_add_cloud_filter + * @vf: pointer to the VF info +@@ -3930,6 +3940,14 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) + goto err_out; + } + ++ if (vf->num_cloud_filters >= I40E_MAX_VF_CLOUD_FILTER) { ++ dev_warn(&pf->pdev->dev, ++ "VF %d: Max number of filters reached, can't apply cloud filter\n", ++ vf->vf_id); ++ aq_ret = -ENOSPC; ++ goto err_out; ++ } ++ + cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL); + if (!cfilter) { + aq_ret = -ENOMEM; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +index 66f95e2f3146a8..e0e797fea138ad 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -41,7 +41,8 @@ enum i40e_vf_states { + I40E_VF_STATE_MC_PROMISC, + I40E_VF_STATE_UC_PROMISC, + I40E_VF_STATE_PRE_ENABLE, +- I40E_VF_STATE_RESETTING ++ I40E_VF_STATE_RESETTING, ++ I40E_VF_STATE_RESOURCES_LOADED, + }; + + /* VF capabilities */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index 6302990e9a5ff8..729d1833a829a5 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -21,8 +21,7 @@ + #include "rvu.h" + #include "lmac_common.h" + +-#define DRV_NAME "Marvell-CGX/RPM" +-#define DRV_STRING "Marvell CGX/RPM Driver" ++#define DRV_NAME "Marvell-CGX-RPM" + + #define CGX_RX_STAT_GLOBAL_INDEX 9 + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +index 46bdbee9d38adf..635cfb9a3e2c5f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +@@ -1116,7 +1116,6 @@ static int otx2_tc_add_flow(struct otx2_nic *nic, + + free_leaf: + otx2_tc_del_from_flow_list(flow_cfg, new_node); +- kfree_rcu(new_node, rcu); + if (new_node->is_act_police) { + mutex_lock(&nic->mbox.lock); + +@@ -1136,6 +1135,7 @@ static int otx2_tc_add_flow(struct otx2_nic *nic, + + mutex_unlock(&nic->mbox.lock); + } ++ kfree_rcu(new_node, rcu); + + return rc; + } +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 2513be6d4e11d1..cfcf0f7d9d903e 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -14,9 +14,7 @@ + #include "fjes.h" + #include "fjes_trace.h" + +-#define MAJ 1 +-#define MIN 2 +-#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) ++#define DRV_VERSION "1.2" + #define DRV_NAME "fjes" + char fjes_driver_name[] = DRV_NAME; + char fjes_driver_version[] = DRV_VERSION; +diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c +index fb4d95a027fefa..2977b30c6d593c 100644 +--- a/drivers/net/wireless/virtual/virt_wifi.c ++++ b/drivers/net/wireless/virtual/virt_wifi.c +@@ -277,7 +277,9 @@ static void virt_wifi_connect_complete(struct work_struct *work) + priv->is_connected = true; + + /* Schedules an event that acquires the rtnl lock. */ +- cfg80211_connect_result(priv->upperdev, requested_bss, NULL, 0, NULL, 0, ++ cfg80211_connect_result(priv->upperdev, ++ priv->is_connected ? fake_router_bssid : NULL, ++ NULL, 0, NULL, 0, + status, GFP_KERNEL); + netif_carrier_on(priv->upperdev); + } +diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c +index 3f6d74832bac3b..be566ca7bae947 100644 +--- a/drivers/nfc/pn544/i2c.c ++++ b/drivers/nfc/pn544/i2c.c +@@ -126,8 +126,6 @@ struct pn544_i2c_fw_secure_blob { + #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0 + #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6 + +-#define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) +- + #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7 + #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE + #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8 +diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c +index 9569f11dec8c56..bd7323cf9a97f8 100644 +--- a/drivers/platform/x86/sony-laptop.c ++++ b/drivers/platform/x86/sony-laptop.c +@@ -757,7 +757,6 @@ static union acpi_object *__call_snc_method(acpi_handle handle, char *method, + return result; + } + +-#define MIN(a, b) (a > b ? b : a) + static int sony_nc_buffer_call(acpi_handle handle, char *name, u64 *value, + void *buffer, size_t buflen) + { +diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c +index 6277162a028bb9..6eefa7e5f4cf6a 100644 +--- a/drivers/scsi/isci/init.c ++++ b/drivers/scsi/isci/init.c +@@ -65,11 +65,7 @@ + #include "task.h" + #include "probe_roms.h" + +-#define MAJ 1 +-#define MIN 2 +-#define BUILD 0 +-#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) "." \ +- __stringify(BUILD) ++#define DRV_VERSION "1.2.0" + + MODULE_VERSION(DRV_VERSION); + +diff --git a/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h b/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h +index a444ec14ff9d5b..1c17a87a85720c 100644 +--- a/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h ++++ b/drivers/staging/media/atomisp/pci/hive_isp_css_include/math_support.h +@@ -31,11 +31,6 @@ + /* A => B */ + #define IMPLIES(a, b) (!(a) || (b)) + +-/* for preprocessor and array sizing use MIN and MAX +- otherwise use min and max */ +-#define MAX(a, b) (((a) > (b)) ? (a) : (b)) +-#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +- + #define ROUND_DIV(a, b) (((b) != 0) ? ((a) + ((b) >> 1)) / (b) : 0) + #define CEIL_DIV(a, b) (((b) != 0) ? ((a) + (b) - 1) / (b) : 0) + #define CEIL_MUL(a, b) (CEIL_DIV(a, b) * (b)) +diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c +index 14864cfc242238..cb8f0652a4beec 100644 +--- a/drivers/ufs/core/ufs-mcq.c ++++ b/drivers/ufs/core/ufs-mcq.c +@@ -209,7 +209,7 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba) + hwq->sqe_base_addr = dmam_alloc_coherent(hba->dev, utrdl_size, + &hwq->sqe_dma_addr, + GFP_KERNEL); +- if (!hwq->sqe_dma_addr) { ++ if (!hwq->sqe_base_addr) { + dev_err(hba->dev, "SQE allocation failed\n"); + return -ENOMEM; + } +@@ -218,7 +218,7 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba) + hwq->cqe_base_addr = dmam_alloc_coherent(hba->dev, cqe_size, + &hwq->cqe_dma_addr, + GFP_KERNEL); +- if (!hwq->cqe_dma_addr) { ++ if (!hwq->cqe_base_addr) { + dev_err(hba->dev, "CQE allocation failed\n"); + return -ENOMEM; + } +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index bfd97cad8aa4d7..c0fd8ab3fe8fc2 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -734,7 +734,7 @@ void usb_detect_quirks(struct usb_device *udev) + udev->quirks ^= usb_detect_dynamic_quirks(udev); + + if (udev->quirks) +- dev_dbg(&udev->dev, "USB quirks for this device: %x\n", ++ dev_dbg(&udev->dev, "USB quirks for this device: 0x%x\n", + udev->quirks); + + #ifdef CONFIG_USB_DEFAULT_PERSIST +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 58eee27aa6cca9..b49f15a3442eab 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2483,7 +2483,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, + unsigned charcount = font->charcount; + int w = font->width; + int h = font->height; +- int size; ++ int size, alloc_size; + int i, csum; + u8 *new_data, *data = font->data; + int pitch = PITCH(font->width); +@@ -2510,9 +2510,16 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, + if (fbcon_invalid_charcount(info, charcount)) + return -EINVAL; + +- size = CALC_FONTSZ(h, pitch, charcount); ++ /* Check for integer overflow in font size calculation */ ++ if (check_mul_overflow(h, pitch, &size) || ++ check_mul_overflow(size, charcount, &size)) ++ return -EINVAL; ++ ++ /* Check for overflow in allocation size calculation */ ++ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size)) ++ return -EINVAL; + +- new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); ++ new_data = kmalloc(alloc_size, GFP_USER); + + if (!new_data) + return -ENOMEM; +diff --git a/fs/afs/server.c b/fs/afs/server.c +index 87381c2ffe374c..f92ce4b7d73a19 100644 +--- a/fs/afs/server.c ++++ b/fs/afs/server.c +@@ -401,13 +401,14 @@ struct afs_server *afs_use_server(struct afs_server *server, enum afs_server_tra + void afs_put_server(struct afs_net *net, struct afs_server *server, + enum afs_server_trace reason) + { +- unsigned int a, debug_id = server->debug_id; ++ unsigned int a, debug_id; + bool zero; + int r; + + if (!server) + return; + ++ debug_id = server->debug_id; + a = atomic_read(&server->active); + zero = __refcount_dec_and_test(&server->ref, &r); + trace_afs_server(debug_id, r - 1, a, reason); +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index d49ce7768f7f5b..0d93368c1691ae 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -614,7 +614,7 @@ static int check_dir_item(struct extent_buffer *leaf, + */ + if (key->type == BTRFS_DIR_ITEM_KEY || + key->type == BTRFS_XATTR_ITEM_KEY) { +- char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; ++ char namebuf[MAX(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; + + read_extent_buffer(leaf, namebuf, + (unsigned long)(di + 1), name_len); +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index ab951fd475317c..914e850b9cbb77 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -619,14 +619,16 @@ static bool remove_inode_single_folio(struct hstate *h, struct inode *inode, + + /* + * If folio is mapped, it was faulted in after being +- * unmapped in caller. Unmap (again) while holding +- * the fault mutex. The mutex will prevent faults +- * until we finish removing the folio. ++ * unmapped in caller or hugetlb_vmdelete_list() skips ++ * unmapping it due to fail to grab lock. Unmap (again) ++ * while holding the fault mutex. The mutex will prevent ++ * faults until we finish removing the folio. Hold folio ++ * lock to guarantee no concurrent migration. + */ ++ folio_lock(folio); + if (unlikely(folio_mapped(folio))) + hugetlb_unmap_file_folio(h, mapping, folio, index); + +- folio_lock(folio); + /* + * We must remove the folio from page cache before removing + * the region/ reserve map (hugetlb_unreserve_pages). In +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 0cc80f472432ad..79641d1ee86757 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -641,7 +641,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + + tmp_rc = rc; + for (i = 0; i < num_cmds; i++) { +- char *buf = rsp_iov[i + i].iov_base; ++ char *buf = rsp_iov[i + 1].iov_base; + + if (buf && resp_buftype[i + 1] != CIFS_NO_BUFFER) + rc = server->ops->map_error(buf, false); +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index 3720304d679293..504e2a1cf33b84 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -147,7 +147,7 @@ struct smb_direct_transport { + wait_queue_head_t wait_send_pending; + atomic_t send_pending; + +- struct delayed_work post_recv_credits_work; ++ struct work_struct post_recv_credits_work; + struct work_struct send_immediate_work; + struct work_struct disconnect_work; + +@@ -366,8 +366,8 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + + spin_lock_init(&t->lock_new_recv_credits); + +- INIT_DELAYED_WORK(&t->post_recv_credits_work, +- smb_direct_post_recv_credits); ++ INIT_WORK(&t->post_recv_credits_work, ++ smb_direct_post_recv_credits); + INIT_WORK(&t->send_immediate_work, smb_direct_send_immediate_work); + INIT_WORK(&t->disconnect_work, smb_direct_disconnect_rdma_work); + +@@ -399,7 +399,7 @@ static void free_transport(struct smb_direct_transport *t) + atomic_read(&t->send_pending) == 0); + + cancel_work_sync(&t->disconnect_work); +- cancel_delayed_work_sync(&t->post_recv_credits_work); ++ cancel_work_sync(&t->post_recv_credits_work); + cancel_work_sync(&t->send_immediate_work); + + if (t->qp) { +@@ -614,8 +614,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + wake_up_interruptible(&t->wait_send_credits); + + if (is_receive_credit_post_required(receive_credits, avail_recvmsg_count)) +- mod_delayed_work(smb_direct_wq, +- &t->post_recv_credits_work, 0); ++ queue_work(smb_direct_wq, &t->post_recv_credits_work); + + if (data_length) { + enqueue_reassembly(t, recvmsg, (int)data_length); +@@ -772,8 +771,7 @@ static int smb_direct_read(struct ksmbd_transport *t, char *buf, + st->count_avail_recvmsg += queue_removed; + if (is_receive_credit_post_required(st->recv_credits, st->count_avail_recvmsg)) { + spin_unlock(&st->receive_credit_lock); +- mod_delayed_work(smb_direct_wq, +- &st->post_recv_credits_work, 0); ++ queue_work(smb_direct_wq, &st->post_recv_credits_work); + } else { + spin_unlock(&st->receive_credit_lock); + } +@@ -800,7 +798,7 @@ static int smb_direct_read(struct ksmbd_transport *t, char *buf, + static void smb_direct_post_recv_credits(struct work_struct *work) + { + struct smb_direct_transport *t = container_of(work, +- struct smb_direct_transport, post_recv_credits_work.work); ++ struct smb_direct_transport, post_recv_credits_work); + struct smb_direct_recvmsg *recvmsg; + int receive_credits, credits = 0; + int ret; +@@ -1681,7 +1679,7 @@ static int smb_direct_prepare_negotiation(struct smb_direct_transport *t) + goto out_err; + } + +- smb_direct_post_recv_credits(&t->post_recv_credits_work.work); ++ smb_direct_post_recv_credits(&t->post_recv_credits_work); + return 0; + out_err: + put_recvmsg(t, recvmsg); +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index 7402bf3e037ee7..2fe6abb2ca803d 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -150,7 +150,7 @@ struct af_alg_ctx { + size_t used; + atomic_t rcvused; + +- u32 more:1, ++ bool more:1, + merge:1, + enc:1, + write:1, +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index e84ed3a43f1f80..1d4f23ea3105d0 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -244,6 +244,15 @@ static inline void *offset_to_ptr(const int *off) + #define is_signed_type(type) (((type)(-1)) < (__force type)1) + #define is_unsigned_type(type) (!is_signed_type(type)) + ++/* ++ * Useful shorthand for "is this condition known at compile-time?" ++ * ++ * Note that the condition may involve non-constant values, ++ * but the compiler may know enough about the details of the ++ * values to determine that the condition is statically true. ++ */ ++#define statically_true(x) (__builtin_constant_p(x) && (x)) ++ + /* + * This is needed in functions which generate the stack canary, see + * arch/x86/kernel/smpboot.c::start_secondary() for an example. +diff --git a/include/linux/minmax.h b/include/linux/minmax.h +index 9c2848abc80496..eaaf5c008e4d05 100644 +--- a/include/linux/minmax.h ++++ b/include/linux/minmax.h +@@ -8,13 +8,10 @@ + #include + + /* +- * min()/max()/clamp() macros must accomplish three things: ++ * min()/max()/clamp() macros must accomplish several things: + * + * - Avoid multiple evaluations of the arguments (so side-effects like + * "x++" happen only once) when non-constant. +- * - Retain result as a constant expressions when called with only +- * constant expressions (to avoid tripping VLA warnings in stack +- * allocation usage). + * - Perform signed v unsigned type-checking (to generate compile + * errors instead of nasty runtime surprises). + * - Unsigned char/short are always promoted to signed int and can be +@@ -26,19 +23,59 @@ + #define __typecheck(x, y) \ + (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) + +-/* is_signed_type() isn't a constexpr for pointer types */ +-#define __is_signed(x) \ +- __builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))), \ +- is_signed_type(typeof(x)), 0) ++/* ++ * __sign_use for integer expressions: ++ * bit #0 set if ok for unsigned comparisons ++ * bit #1 set if ok for signed comparisons ++ * ++ * In particular, statically non-negative signed integer expressions ++ * are ok for both. ++ * ++ * NOTE! Unsigned types smaller than 'int' are implicitly converted to 'int' ++ * in expressions, and are accepted for signed conversions for now. ++ * This is debatable. ++ * ++ * Note that 'x' is the original expression, and 'ux' is the unique variable ++ * that contains the value. ++ * ++ * We use 'ux' for pure type checking, and 'x' for when we need to look at the ++ * value (but without evaluating it for side effects! ++ * Careful to only ever evaluate it with sizeof() or __builtin_constant_p() etc). ++ * ++ * Pointers end up being checked by the normal C type rules at the actual ++ * comparison, and these expressions only need to be careful to not cause ++ * warnings for pointer use. ++ */ ++#define __sign_use(ux) (is_signed_type(typeof(ux)) ? \ ++ (2 + __is_nonneg(ux)) : (1 + 2 * (sizeof(ux) < 4))) ++ ++/* ++ * Check whether a signed value is always non-negative. ++ * ++ * A cast is needed to avoid any warnings from values that aren't signed ++ * integer types (in which case the result doesn't matter). ++ * ++ * On 64-bit any integer or pointer type can safely be cast to 'long long'. ++ * But on 32-bit we need to avoid warnings about casting pointers to integers ++ * of different sizes without truncating 64-bit values so 'long' or 'long long' ++ * must be used depending on the size of the value. ++ * ++ * This does not work for 128-bit signed integers since the cast would truncate ++ * them, but we do not use s128 types in the kernel (we do use 'u128', ++ * but they are handled by the !is_signed_type() case). ++ */ ++#if __SIZEOF_POINTER__ == __SIZEOF_LONG_LONG__ ++#define __is_nonneg(ux) statically_true((long long)(ux) >= 0) ++#else ++#define __is_nonneg(ux) statically_true( \ ++ (typeof(__builtin_choose_expr(sizeof(ux) > 4, 1LL, 1L)))(ux) >= 0) ++#endif + +-/* True for a non-negative signed int constant */ +-#define __is_noneg_int(x) \ +- (__builtin_choose_expr(__is_constexpr(x) && __is_signed(x), x, -1) >= 0) ++#define __types_ok(ux, uy) \ ++ (__sign_use(ux) & __sign_use(uy)) + +-#define __types_ok(x, y) \ +- (__is_signed(x) == __is_signed(y) || \ +- __is_signed((x) + 0) == __is_signed((y) + 0) || \ +- __is_noneg_int(x) || __is_noneg_int(y)) ++#define __types_ok3(ux, uy, uz) \ ++ (__sign_use(ux) & __sign_use(uy) & __sign_use(uz)) + + #define __cmp_op_min < + #define __cmp_op_max > +@@ -51,34 +88,14 @@ + #define __cmp_once(op, type, x, y) \ + __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_)) + +-#define __careful_cmp_once(op, x, y) ({ \ +- static_assert(__types_ok(x, y), \ +- #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \ +- __cmp_once(op, __auto_type, x, y); }) +- +-#define __careful_cmp(op, x, y) \ +- __builtin_choose_expr(__is_constexpr((x) - (y)), \ +- __cmp(op, x, y), __careful_cmp_once(op, x, y)) +- +-#define __clamp(val, lo, hi) \ +- ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) +- +-#define __clamp_once(val, lo, hi, unique_val, unique_lo, unique_hi) ({ \ +- typeof(val) unique_val = (val); \ +- typeof(lo) unique_lo = (lo); \ +- typeof(hi) unique_hi = (hi); \ +- static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), \ +- (lo) <= (hi), true), \ +- "clamp() low limit " #lo " greater than high limit " #hi); \ +- static_assert(__types_ok(val, lo), "clamp() 'lo' signedness error"); \ +- static_assert(__types_ok(val, hi), "clamp() 'hi' signedness error"); \ +- __clamp(unique_val, unique_lo, unique_hi); }) ++#define __careful_cmp_once(op, x, y, ux, uy) ({ \ ++ __auto_type ux = (x); __auto_type uy = (y); \ ++ BUILD_BUG_ON_MSG(!__types_ok(ux, uy), \ ++ #op"("#x", "#y") signedness error"); \ ++ __cmp(op, ux, uy); }) + +-#define __careful_clamp(val, lo, hi) ({ \ +- __builtin_choose_expr(__is_constexpr((val) - (lo) + (hi)), \ +- __clamp(val, lo, hi), \ +- __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ +- __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) ++#define __careful_cmp(op, x, y) \ ++ __careful_cmp_once(op, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_)) + + /** + * min - return minimum of two values of the same or compatible types +@@ -111,13 +128,20 @@ + #define umax(x, y) \ + __careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) + ++#define __careful_op3(op, x, y, z, ux, uy, uz) ({ \ ++ __auto_type ux = (x); __auto_type uy = (y);__auto_type uz = (z);\ ++ BUILD_BUG_ON_MSG(!__types_ok3(ux, uy, uz), \ ++ #op"3("#x", "#y", "#z") signedness error"); \ ++ __cmp(op, ux, __cmp(op, uy, uz)); }) ++ + /** + * min3 - return minimum of three values + * @x: first value + * @y: second value + * @z: third value + */ +-#define min3(x, y, z) min((typeof(x))min(x, y), z) ++#define min3(x, y, z) \ ++ __careful_op3(min, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_)) + + /** + * max3 - return maximum of three values +@@ -125,7 +149,24 @@ + * @y: second value + * @z: third value + */ +-#define max3(x, y, z) max((typeof(x))max(x, y), z) ++#define max3(x, y, z) \ ++ __careful_op3(max, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_)) ++ ++/** ++ * min_t - return minimum of two values, using the specified type ++ * @type: data type to use ++ * @x: first value ++ * @y: second value ++ */ ++#define min_t(type, x, y) __cmp_once(min, type, x, y) ++ ++/** ++ * max_t - return maximum of two values, using the specified type ++ * @type: data type to use ++ * @x: first value ++ * @y: second value ++ */ ++#define max_t(type, x, y) __cmp_once(max, type, x, y) + + /** + * min_not_zero - return the minimum that is _not_ zero, unless both are zero +@@ -137,39 +178,57 @@ + typeof(y) __y = (y); \ + __x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); }) + ++#define __clamp(val, lo, hi) \ ++ ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) ++ ++#define __clamp_once(type, val, lo, hi, uval, ulo, uhi) ({ \ ++ type uval = (val); \ ++ type ulo = (lo); \ ++ type uhi = (hi); \ ++ BUILD_BUG_ON_MSG(statically_true(ulo > uhi), \ ++ "clamp() low limit " #lo " greater than high limit " #hi); \ ++ BUILD_BUG_ON_MSG(!__types_ok3(uval, ulo, uhi), \ ++ "clamp("#val", "#lo", "#hi") signedness error"); \ ++ __clamp(uval, ulo, uhi); }) ++ ++#define __careful_clamp(type, val, lo, hi) \ ++ __clamp_once(type, val, lo, hi, __UNIQUE_ID(v_), __UNIQUE_ID(l_), __UNIQUE_ID(h_)) ++ + /** +- * clamp - return a value clamped to a given range with strict typechecking ++ * clamp - return a value clamped to a given range with typechecking + * @val: current value + * @lo: lowest allowable value + * @hi: highest allowable value + * +- * This macro does strict typechecking of @lo/@hi to make sure they are of the +- * same type as @val. See the unnecessary pointer comparisons. +- */ +-#define clamp(val, lo, hi) __careful_clamp(val, lo, hi) +- +-/* +- * ..and if you can't take the strict +- * types, you can specify one yourself. +- * +- * Or not use min/max/clamp at all, of course. ++ * This macro checks @val/@lo/@hi to make sure they have compatible ++ * signedness. + */ ++#define clamp(val, lo, hi) __careful_clamp(__auto_type, val, lo, hi) + + /** +- * min_t - return minimum of two values, using the specified type +- * @type: data type to use +- * @x: first value +- * @y: second value ++ * clamp_t - return a value clamped to a given range using a given type ++ * @type: the type of variable to use ++ * @val: current value ++ * @lo: minimum allowable value ++ * @hi: maximum allowable value ++ * ++ * This macro does no typechecking and uses temporary variables of type ++ * @type to make all the comparisons. + */ +-#define min_t(type, x, y) __cmp_once(min, type, x, y) ++#define clamp_t(type, val, lo, hi) __careful_clamp(type, val, lo, hi) + + /** +- * max_t - return maximum of two values, using the specified type +- * @type: data type to use +- * @x: first value +- * @y: second value ++ * clamp_val - return a value clamped to a given range using val's type ++ * @val: current value ++ * @lo: minimum allowable value ++ * @hi: maximum allowable value ++ * ++ * This macro does no typechecking and uses temporary variables of whatever ++ * type the input argument @val is. This is useful when @val is an unsigned ++ * type and @lo and @hi are literals that will otherwise be assigned a signed ++ * integer type. + */ +-#define max_t(type, x, y) __cmp_once(max, type, x, y) ++#define clamp_val(val, lo, hi) __careful_clamp(typeof(val), val, lo, hi) + + /* + * Do not check the array parameter using __must_be_array(). +@@ -214,31 +273,6 @@ + */ + #define max_array(array, len) __minmax_array(max, array, len) + +-/** +- * clamp_t - return a value clamped to a given range using a given type +- * @type: the type of variable to use +- * @val: current value +- * @lo: minimum allowable value +- * @hi: maximum allowable value +- * +- * This macro does no typechecking and uses temporary variables of type +- * @type to make all the comparisons. +- */ +-#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi)) +- +-/** +- * clamp_val - return a value clamped to a given range using val's type +- * @val: current value +- * @lo: minimum allowable value +- * @hi: maximum allowable value +- * +- * This macro does no typechecking and uses temporary variables of whatever +- * type the input argument @val is. This is useful when @val is an unsigned +- * type and @lo and @hi are literals that will otherwise be assigned a signed +- * integer type. +- */ +-#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi) +- + static inline bool in_range64(u64 val, u64 start, u64 len) + { + return (val - start) < len; +@@ -277,7 +311,9 @@ static inline bool in_range32(u32 val, u32 start, u32 len) + * Use these carefully: no type checking, and uses the arguments + * multiple times. Use for obvious constants only. + */ +-#define MIN_T(type,a,b) __cmp(min,(type)(a),(type)(b)) +-#define MAX_T(type,a,b) __cmp(max,(type)(a),(type)(b)) ++#define MIN(a, b) __cmp(min, a, b) ++#define MAX(a, b) __cmp(max, a, b) ++#define MIN_T(type, a, b) __cmp(min, (type)(a), (type)(b)) ++#define MAX_T(type, a, b) __cmp(max, (type)(a), (type)(b)) + + #endif /* _LINUX_MINMAX_H */ +diff --git a/include/linux/mm.h b/include/linux/mm.h +index b97d8a691b28bf..ba77f08900ca2e 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2156,6 +2156,61 @@ static inline int folio_estimated_sharers(struct folio *folio) + return page_mapcount(folio_page(folio, 0)); + } + ++/** ++ * folio_expected_ref_count - calculate the expected folio refcount ++ * @folio: the folio ++ * ++ * Calculate the expected folio refcount, taking references from the pagecache, ++ * swapcache, PG_private and page table mappings into account. Useful in ++ * combination with folio_ref_count() to detect unexpected references (e.g., ++ * GUP or other temporary references). ++ * ++ * Does currently not consider references from the LRU cache. If the folio ++ * was isolated from the LRU (which is the case during migration or split), ++ * the LRU cache does not apply. ++ * ++ * Calling this function on an unmapped folio -- !folio_mapped() -- that is ++ * locked will return a stable result. ++ * ++ * Calling this function on a mapped folio will not result in a stable result, ++ * because nothing stops additional page table mappings from coming (e.g., ++ * fork()) or going (e.g., munmap()). ++ * ++ * Calling this function without the folio lock will also not result in a ++ * stable result: for example, the folio might get dropped from the swapcache ++ * concurrently. ++ * ++ * However, even when called without the folio lock or on a mapped folio, ++ * this function can be used to detect unexpected references early (for example, ++ * if it makes sense to even lock the folio and unmap it). ++ * ++ * The caller must add any reference (e.g., from folio_try_get()) it might be ++ * holding itself to the result. ++ * ++ * Returns the expected folio refcount. ++ */ ++static inline int folio_expected_ref_count(struct folio *folio) ++{ ++ const int order = folio_order(folio); ++ int ref_count = 0; ++ ++ if (WARN_ON_ONCE(folio_test_slab(folio))) ++ return 0; ++ ++ if (folio_test_anon(folio)) { ++ /* One reference per page from the swapcache. */ ++ ref_count += folio_test_swapcache(folio) << order; ++ } else if (!((unsigned long)folio->mapping & PAGE_MAPPING_FLAGS)) { ++ /* One reference per page from the pagecache. */ ++ ref_count += !!folio->mapping << order; ++ /* One reference from PG_private. */ ++ ref_count += folio_test_private(folio); ++ } ++ ++ /* One reference per page table mapping. */ ++ return ref_count + folio_mapcount(folio); ++} ++ + #ifndef HAVE_ARCH_MAKE_PAGE_ACCESSIBLE + static inline int arch_make_page_accessible(struct page *page) + { +diff --git a/include/linux/swap.h b/include/linux/swap.h +index cb25db2a93dd1b..d7a5b7817987d8 100644 +--- a/include/linux/swap.h ++++ b/include/linux/swap.h +@@ -375,6 +375,16 @@ void folio_add_lru_vma(struct folio *, struct vm_area_struct *); + void mark_page_accessed(struct page *); + void folio_mark_accessed(struct folio *); + ++static inline bool folio_may_be_lru_cached(struct folio *folio) ++{ ++ /* ++ * Holding PMD-sized folios in per-CPU LRU cache unbalances accounting. ++ * Holding small numbers of low-order mTHP folios in per-CPU LRU cache ++ * will be sensible, but nobody has implemented and tested that yet. ++ */ ++ return !folio_test_large(folio); ++} ++ + extern atomic_t lru_disable_count; + + static inline bool lru_cache_disabled(void) +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 4f067599e6e9e0..62135b7782f5be 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1169,6 +1169,27 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev, + return NULL; + } + ++static inline struct hci_conn *hci_conn_hash_lookup_role(struct hci_dev *hdev, ++ __u8 type, __u8 role, ++ bdaddr_t *ba) ++{ ++ struct hci_conn_hash *h = &hdev->conn_hash; ++ struct hci_conn *c; ++ ++ rcu_read_lock(); ++ ++ list_for_each_entry_rcu(c, &h->list, list) { ++ if (c->type == type && c->role == role && !bacmp(&c->dst, ba)) { ++ rcu_read_unlock(); ++ return c; ++ } ++ } ++ ++ rcu_read_unlock(); ++ ++ return NULL; ++} ++ + static inline struct hci_conn *hci_conn_hash_lookup_le(struct hci_dev *hdev, + bdaddr_t *ba, + __u8 ba_type) +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 7d6ee41f4b4f4f..a6f825b7fbe6cd 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -7546,6 +7546,10 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno, + verbose(env, "verifier bug. Two map pointers in a timer helper\n"); + return -EFAULT; + } ++ if (IS_ENABLED(CONFIG_PREEMPT_RT)) { ++ verbose(env, "bpf_timer cannot be used for PREEMPT_RT.\n"); ++ return -EOPNOTSUPP; ++ } + meta->map_uid = reg->map_uid; + meta->map_ptr = map; + return 0; +diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c +index cba8b1a6a4cc27..7e43839ca7b05c 100644 +--- a/kernel/futex/requeue.c ++++ b/kernel/futex/requeue.c +@@ -223,18 +223,20 @@ static inline + void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, + struct futex_hash_bucket *hb) + { +- q->key = *key; ++ struct task_struct *task; + ++ q->key = *key; + __futex_unqueue(q); + + WARN_ON(!q->rt_waiter); + q->rt_waiter = NULL; + + q->lock_ptr = &hb->lock; ++ task = READ_ONCE(q->task); + + /* Signal locked state to the waiter */ + futex_requeue_pi_complete(q, 1); +- wake_up_state(q->task, TASK_NORMAL); ++ wake_up_state(task, TASK_NORMAL); + } + + /** +diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c +index 8af92dbe98f07b..acb0c971a4082a 100644 +--- a/kernel/trace/preemptirq_delay_test.c ++++ b/kernel/trace/preemptirq_delay_test.c +@@ -34,8 +34,6 @@ MODULE_PARM_DESC(cpu_affinity, "Cpu num test is running on"); + + static struct completion done; + +-#define MIN(x, y) ((x) < (y) ? (x) : (y)) +- + static void busy_wait(ulong time) + { + u64 start, end; +diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c +index c9b0533407edeb..76737492e750e3 100644 +--- a/kernel/trace/trace_dynevent.c ++++ b/kernel/trace/trace_dynevent.c +@@ -239,6 +239,10 @@ static int dyn_event_open(struct inode *inode, struct file *file) + { + int ret; + ++ ret = security_locked_down(LOCKDOWN_TRACEFS); ++ if (ret) ++ return ret; ++ + ret = tracing_check_open_get_tr(NULL); + if (ret) + return ret; +diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c +index 8800f5acc00717..5a2116356428f8 100644 +--- a/kernel/vhost_task.c ++++ b/kernel/vhost_task.c +@@ -100,6 +100,7 @@ void vhost_task_stop(struct vhost_task *vtsk) + * freeing it below. + */ + wait_for_completion(&vtsk->exited); ++ put_task_struct(vtsk->task); + kfree(vtsk); + } + EXPORT_SYMBOL_GPL(vhost_task_stop); +@@ -148,7 +149,7 @@ struct vhost_task *vhost_task_create(bool (*fn)(void *), + return NULL; + } + +- vtsk->task = tsk; ++ vtsk->task = get_task_struct(tsk); + return vtsk; + } + EXPORT_SYMBOL_GPL(vhost_task_create); +diff --git a/lib/btree.c b/lib/btree.c +index 49420cae3a8330..bb81d3393ac5c5 100644 +--- a/lib/btree.c ++++ b/lib/btree.c +@@ -43,7 +43,6 @@ + #include + #include + +-#define MAX(a, b) ((a) > (b) ? (a) : (b)) + #define NODESIZE MAX(L1_CACHE_BYTES, 128) + + struct btree_geo { +diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c +index 20a858031f12b7..9d34d35908daa8 100644 +--- a/lib/decompress_unlzma.c ++++ b/lib/decompress_unlzma.c +@@ -37,7 +37,9 @@ + + #include + ++#ifndef MIN + #define MIN(a, b) (((a) < (b)) ? (a) : (b)) ++#endif + + static long long INIT read_int(unsigned char *ptr, int size) + { +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 2aa408441cd3e7..f4ab2750cfc129 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -1079,7 +1079,7 @@ char *resource_string(char *buf, char *end, struct resource *res, + #define FLAG_BUF_SIZE (2 * sizeof(res->flags)) + #define DECODED_BUF_SIZE sizeof("[mem - 64bit pref window disabled]") + #define RAW_BUF_SIZE sizeof("[mem - flags 0x]") +- char sym[max(2*RSRC_BUF_SIZE + DECODED_BUF_SIZE, ++ char sym[MAX(2*RSRC_BUF_SIZE + DECODED_BUF_SIZE, + 2*RSRC_BUF_SIZE + FLAG_BUF_SIZE + RAW_BUF_SIZE)]; + + char *p = sym, *pend = sym + sizeof(sym); +diff --git a/mm/gup.c b/mm/gup.c +index 29c719b3ab31e1..53154b63295ab6 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -1946,14 +1946,14 @@ struct page *get_dump_page(unsigned long addr) + /* + * Returns the number of collected pages. Return value is always >= 0. + */ +-static void collect_longterm_unpinnable_pages( ++static unsigned long collect_longterm_unpinnable_pages( + struct list_head *movable_page_list, + unsigned long nr_pages, + struct page **pages) + { ++ unsigned long i, collected = 0; + struct folio *prev_folio = NULL; +- bool drain_allow = true; +- unsigned long i; ++ int drained = 0; + + for (i = 0; i < nr_pages; i++) { + struct folio *folio = page_folio(pages[i]); +@@ -1965,6 +1965,8 @@ static void collect_longterm_unpinnable_pages( + if (folio_is_longterm_pinnable(folio)) + continue; + ++ collected++; ++ + if (folio_is_device_coherent(folio)) + continue; + +@@ -1973,9 +1975,17 @@ static void collect_longterm_unpinnable_pages( + continue; + } + +- if (!folio_test_lru(folio) && drain_allow) { ++ if (drained == 0 && folio_may_be_lru_cached(folio) && ++ folio_ref_count(folio) != ++ folio_expected_ref_count(folio) + 1) { ++ lru_add_drain(); ++ drained = 1; ++ } ++ if (drained == 1 && folio_may_be_lru_cached(folio) && ++ folio_ref_count(folio) != ++ folio_expected_ref_count(folio) + 1) { + lru_add_drain_all(); +- drain_allow = false; ++ drained = 2; + } + + if (!folio_isolate_lru(folio)) +@@ -1986,6 +1996,8 @@ static void collect_longterm_unpinnable_pages( + NR_ISOLATED_ANON + folio_is_file_lru(folio), + folio_nr_pages(folio)); + } ++ ++ return collected; + } + + /* +@@ -2078,10 +2090,12 @@ static int migrate_longterm_unpinnable_pages( + static long check_and_migrate_movable_pages(unsigned long nr_pages, + struct page **pages) + { ++ unsigned long collected; + LIST_HEAD(movable_page_list); + +- collect_longterm_unpinnable_pages(&movable_page_list, nr_pages, pages); +- if (list_empty(&movable_page_list)) ++ collected = collect_longterm_unpinnable_pages(&movable_page_list, ++ nr_pages, pages); ++ if (!collected) + return 0; + + return migrate_longterm_unpinnable_pages(&movable_page_list, nr_pages, +diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c +index 38a3bff23e8d00..38155d6982152a 100644 +--- a/mm/kmsan/core.c ++++ b/mm/kmsan/core.c +@@ -262,7 +262,8 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b, + u32 origin, bool checked) + { + u64 address = (u64)addr; +- u32 *shadow_start, *origin_start; ++ void *shadow_start; ++ u32 *aligned_shadow, *origin_start; + size_t pad = 0; + + KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size)); +@@ -281,9 +282,12 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b, + } + __memset(shadow_start, b, size); + +- if (!IS_ALIGNED(address, KMSAN_ORIGIN_SIZE)) { ++ if (IS_ALIGNED(address, KMSAN_ORIGIN_SIZE)) { ++ aligned_shadow = shadow_start; ++ } else { + pad = address % KMSAN_ORIGIN_SIZE; + address -= pad; ++ aligned_shadow = shadow_start - pad; + size += pad; + } + size = ALIGN(size, KMSAN_ORIGIN_SIZE); +@@ -297,7 +301,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b, + * corresponding shadow slot is zero. + */ + for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) { +- if (origin || !shadow_start[i]) ++ if (origin || !aligned_shadow[i]) + origin_start[i] = origin; + } + } +diff --git a/mm/kmsan/kmsan_test.c b/mm/kmsan/kmsan_test.c +index 312989aa2865c4..e98c89d3a73aa4 100644 +--- a/mm/kmsan/kmsan_test.c ++++ b/mm/kmsan/kmsan_test.c +@@ -523,6 +523,21 @@ DEFINE_TEST_MEMSETXX(16) + DEFINE_TEST_MEMSETXX(32) + DEFINE_TEST_MEMSETXX(64) + ++/* Test case: ensure that KMSAN does not access shadow memory out of bounds. */ ++static void test_memset_on_guarded_buffer(struct kunit *test) ++{ ++ void *buf = vmalloc(PAGE_SIZE); ++ ++ kunit_info(test, ++ "memset() on ends of guarded buffer should not crash\n"); ++ ++ for (size_t size = 0; size <= 128; size++) { ++ memset(buf, 0xff, size); ++ memset(buf + PAGE_SIZE - size, 0xff, size); ++ } ++ vfree(buf); ++} ++ + static noinline void fibonacci(int *array, int size, int start) + { + if (start < 2 || (start == size)) +@@ -602,6 +617,7 @@ static struct kunit_case kmsan_test_cases[] = { + KUNIT_CASE(test_memset16), + KUNIT_CASE(test_memset32), + KUNIT_CASE(test_memset64), ++ KUNIT_CASE(test_memset_on_guarded_buffer), + KUNIT_CASE(test_long_origin_chain), + KUNIT_CASE(test_stackdepot_roundtrip), + {}, +diff --git a/mm/migrate_device.c b/mm/migrate_device.c +index 8ac1f79f754a29..f209dc512d8216 100644 +--- a/mm/migrate_device.c ++++ b/mm/migrate_device.c +@@ -814,42 +814,40 @@ void migrate_device_finalize(unsigned long *src_pfns, + unsigned long i; + + for (i = 0; i < npages; i++) { +- struct folio *dst, *src; ++ struct folio *dst = NULL, *src = NULL; + struct page *newpage = migrate_pfn_to_page(dst_pfns[i]); + struct page *page = migrate_pfn_to_page(src_pfns[i]); + ++ if (newpage) ++ dst = page_folio(newpage); ++ + if (!page) { +- if (newpage) { +- unlock_page(newpage); +- put_page(newpage); ++ if (dst) { ++ folio_unlock(dst); ++ folio_put(dst); + } + continue; + } + +- if (!(src_pfns[i] & MIGRATE_PFN_MIGRATE) || !newpage) { +- if (newpage) { +- unlock_page(newpage); +- put_page(newpage); ++ src = page_folio(page); ++ ++ if (!(src_pfns[i] & MIGRATE_PFN_MIGRATE) || !dst) { ++ if (dst) { ++ folio_unlock(dst); ++ folio_put(dst); + } +- newpage = page; ++ dst = src; + } + +- src = page_folio(page); +- dst = page_folio(newpage); ++ if (!folio_is_zone_device(dst)) ++ folio_add_lru(dst); + remove_migration_ptes(src, dst, false); + folio_unlock(src); ++ folio_put(src); + +- if (is_zone_device_page(page)) +- put_page(page); +- else +- putback_lru_page(page); +- +- if (newpage != page) { +- unlock_page(newpage); +- if (is_zone_device_page(newpage)) +- put_page(newpage); +- else +- putback_lru_page(newpage); ++ if (dst != src) { ++ folio_unlock(dst); ++ folio_put(dst); + } + } + } +diff --git a/mm/mlock.c b/mm/mlock.c +index 06bdfab83b58af..6858095c20dd9c 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -256,7 +256,7 @@ void mlock_folio(struct folio *folio) + + folio_get(folio); + if (!folio_batch_add(fbatch, mlock_lru(folio)) || +- folio_test_large(folio) || lru_cache_disabled()) ++ !folio_may_be_lru_cached(folio) || lru_cache_disabled()) + mlock_folio_batch(fbatch); + local_unlock(&mlock_fbatch.lock); + } +@@ -279,7 +279,7 @@ void mlock_new_folio(struct folio *folio) + + folio_get(folio); + if (!folio_batch_add(fbatch, mlock_new(folio)) || +- folio_test_large(folio) || lru_cache_disabled()) ++ !folio_may_be_lru_cached(folio) || lru_cache_disabled()) + mlock_folio_batch(fbatch); + local_unlock(&mlock_fbatch.lock); + } +@@ -300,7 +300,7 @@ void munlock_folio(struct folio *folio) + */ + folio_get(folio); + if (!folio_batch_add(fbatch, folio) || +- folio_test_large(folio) || lru_cache_disabled()) ++ !folio_may_be_lru_cached(folio) || lru_cache_disabled()) + mlock_folio_batch(fbatch); + local_unlock(&mlock_fbatch.lock); + } +diff --git a/mm/swap.c b/mm/swap.c +index 42082eba42de3e..8fde1a27aa4825 100644 +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -220,8 +220,8 @@ static void folio_batch_move_lru(struct folio_batch *fbatch, move_fn_t move_fn) + static void folio_batch_add_and_move(struct folio_batch *fbatch, + struct folio *folio, move_fn_t move_fn) + { +- if (folio_batch_add(fbatch, folio) && !folio_test_large(folio) && +- !lru_cache_disabled()) ++ if (folio_batch_add(fbatch, folio) && ++ folio_may_be_lru_cached(folio) && !lru_cache_disabled()) + return; + folio_batch_move_lru(fbatch, move_fn); + } +diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c +index c82070167d8aa8..14327fc34aa713 100644 +--- a/mm/zsmalloc.c ++++ b/mm/zsmalloc.c +@@ -119,8 +119,6 @@ + #define ISOLATED_BITS 5 + #define MAGIC_VAL_BITS 8 + +-#define MAX(a, b) ((a) >= (b) ? (a) : (b)) +- + #define ZS_MAX_PAGES_PER_ZSPAGE (_AC(CONFIG_ZSMALLOC_CHAIN_SIZE, UL)) + + /* ZS_MIN_ALLOC_SIZE must be multiple of ZS_ALIGN */ +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 5eed23b8d6c332..7bda00dcb0b2f0 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3048,8 +3048,18 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + + hci_dev_lock(hdev); + ++ /* Check for existing connection: ++ * ++ * 1. If it doesn't exist then it must be receiver/slave role. ++ * 2. If it does exist confirm that it is connecting/BT_CONNECT in case ++ * of initiator/master role since there could be a collision where ++ * either side is attempting to connect or something like a fuzzing ++ * testing is trying to play tricks to destroy the hcon object before ++ * it even attempts to connect (e.g. hcon->state == BT_OPEN). ++ */ + conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); +- if (!conn) { ++ if (!conn || ++ (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) { + /* In case of error status and there is no connection pending + * just unlock as there is nothing to cleanup. + */ +@@ -5615,8 +5625,18 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + */ + hci_dev_clear_flag(hdev, HCI_LE_ADV); + +- conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr); +- if (!conn) { ++ /* Check for existing connection: ++ * ++ * 1. If it doesn't exist then use the role to create a new object. ++ * 2. If it does exist confirm that it is connecting/BT_CONNECT in case ++ * of initiator/master role since there could be a collision where ++ * either side is attempting to connect or something like a fuzzing ++ * testing is trying to play tricks to destroy the hcon object before ++ * it even attempts to connect (e.g. hcon->state == BT_OPEN). ++ */ ++ conn = hci_conn_hash_lookup_role(hdev, LE_LINK, role, bdaddr); ++ if (!conn || ++ (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) { + /* In case of error status and there is no connection pending + * just unlock as there is nothing to cleanup. + */ +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 7f3f700faebc24..dc9209f9f1a6a3 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -2639,6 +2639,13 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev) + hci_remove_ext_adv_instance_sync(hdev, adv->instance, + NULL); + } ++ ++ /* If current advertising instance is set to instance 0x00 ++ * then we need to re-enable it. ++ */ ++ if (!hdev->cur_adv_instance) ++ err = hci_enable_ext_advertising_sync(hdev, ++ hdev->cur_adv_instance); + } else { + /* Schedule for most recent instance to be restarted and begin + * the software rotation loop +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 21a83e26f004bb..867832f8bbaea9 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -6330,7 +6330,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len, + return NULL; + + while (data_len) { +- if (nr_frags == MAX_SKB_FRAGS - 1) ++ if (nr_frags == MAX_SKB_FRAGS) + goto failure; + while (order && PAGE_ALIGN(data_len) < (PAGE_SIZE << order)) + order--; +diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c +index 8d41b039421976..fab550633ec9f3 100644 +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -2136,6 +2136,13 @@ static int replace_nexthop_single(struct net *net, struct nexthop *old, + return -EINVAL; + } + ++ if (!list_empty(&old->grp_list) && ++ rtnl_dereference(new->nh_info)->fdb_nh != ++ rtnl_dereference(old->nh_info)->fdb_nh) { ++ NL_SET_ERR_MSG(extack, "Cannot change nexthop FDB status while in a group"); ++ return -EINVAL; ++ } ++ + err = call_nexthop_notifiers(net, NEXTHOP_EVENT_REPLACE, new, extack); + if (err) + return err; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index acfbe1f013d1b8..ded559f5576754 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2296,6 +2296,8 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, + + for (h = 0; h < range; h++) { + u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high); ++ if (spi == 0) ++ goto next; + newspi = htonl(spi); + + spin_lock_bh(&net->xfrm.xfrm_state_lock); +@@ -2311,6 +2313,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, + xfrm_state_put(x0); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + ++next: + if (signal_pending(current)) { + err = -ERESTARTSYS; + goto unlock; +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 68c82e344d3baf..270a0be672b7ec 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -16,6 +16,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -76,7 +77,8 @@ static int snd_create_std_mono_ctl_offset(struct usb_mixer_interface *mixer, + cval->idx_off = idx_off; + + /* get_min_max() is called only for integer volumes later, +- * so provide a short-cut for booleans */ ++ * so provide a short-cut for booleans ++ */ + cval->min = 0; + cval->max = 1; + cval->res = 0; +@@ -125,7 +127,7 @@ static int snd_create_std_mono_table(struct usb_mixer_interface *mixer, + { + int err; + +- while (t->name != NULL) { ++ while (t->name) { + err = snd_create_std_mono_ctl(mixer, t->unitid, t->control, + t->cmask, t->val_type, t->name, t->tlv_callback); + if (err < 0) +@@ -207,7 +209,6 @@ static void snd_usb_soundblaster_remote_complete(struct urb *urb) + if (code == rc->mute_code) + snd_usb_mixer_notify_id(mixer, rc->mute_mixer_id); + mixer->rc_code = code; +- wmb(); + wake_up(&mixer->rc_waitq); + } + +@@ -375,10 +376,10 @@ static int snd_audigy2nx_controls_create(struct usb_mixer_interface *mixer) + struct snd_kcontrol_new knew; + + /* USB X-Fi S51 doesn't have a CMSS LED */ +- if ((mixer->chip->usb_id == USB_ID(0x041e, 0x3042)) && i == 0) ++ if (mixer->chip->usb_id == USB_ID(0x041e, 0x3042) && i == 0) + continue; + /* USB X-Fi S51 Pro doesn't have one either */ +- if ((mixer->chip->usb_id == USB_ID(0x041e, 0x30df)) && i == 0) ++ if (mixer->chip->usb_id == USB_ID(0x041e, 0x30df) && i == 0) + continue; + if (i > 1 && /* Live24ext has 2 LEDs only */ + (mixer->chip->usb_id == USB_ID(0x041e, 0x3040) || +@@ -527,6 +528,265 @@ static int snd_emu0204_controls_create(struct usb_mixer_interface *mixer) + &snd_emu0204_control, NULL); + } + ++#if IS_REACHABLE(CONFIG_INPUT) ++/* ++ * Sony DualSense controller (PS5) jack detection ++ * ++ * Since this is an UAC 1 device, it doesn't support jack detection. ++ * However, the controller hid-playstation driver reports HP & MIC ++ * insert events through a dedicated input device. ++ */ ++ ++#define SND_DUALSENSE_JACK_OUT_TERM_ID 3 ++#define SND_DUALSENSE_JACK_IN_TERM_ID 4 ++ ++struct dualsense_mixer_elem_info { ++ struct usb_mixer_elem_info info; ++ struct input_handler ih; ++ struct input_device_id id_table[2]; ++ bool connected; ++}; ++ ++static void snd_dualsense_ih_event(struct input_handle *handle, ++ unsigned int type, unsigned int code, ++ int value) ++{ ++ struct dualsense_mixer_elem_info *mei; ++ struct usb_mixer_elem_list *me; ++ ++ if (type != EV_SW) ++ return; ++ ++ mei = container_of(handle->handler, struct dualsense_mixer_elem_info, ih); ++ me = &mei->info.head; ++ ++ if ((me->id == SND_DUALSENSE_JACK_OUT_TERM_ID && code == SW_HEADPHONE_INSERT) || ++ (me->id == SND_DUALSENSE_JACK_IN_TERM_ID && code == SW_MICROPHONE_INSERT)) { ++ mei->connected = !!value; ++ snd_ctl_notify(me->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, ++ &me->kctl->id); ++ } ++} ++ ++static bool snd_dualsense_ih_match(struct input_handler *handler, ++ struct input_dev *dev) ++{ ++ struct dualsense_mixer_elem_info *mei; ++ struct usb_device *snd_dev; ++ char *input_dev_path, *usb_dev_path; ++ size_t usb_dev_path_len; ++ bool match = false; ++ ++ mei = container_of(handler, struct dualsense_mixer_elem_info, ih); ++ snd_dev = mei->info.head.mixer->chip->dev; ++ ++ input_dev_path = kobject_get_path(&dev->dev.kobj, GFP_KERNEL); ++ if (!input_dev_path) { ++ dev_warn(&snd_dev->dev, "Failed to get input dev path\n"); ++ return false; ++ } ++ ++ usb_dev_path = kobject_get_path(&snd_dev->dev.kobj, GFP_KERNEL); ++ if (!usb_dev_path) { ++ dev_warn(&snd_dev->dev, "Failed to get USB dev path\n"); ++ goto free_paths; ++ } ++ ++ /* ++ * Ensure the VID:PID matched input device supposedly owned by the ++ * hid-playstation driver belongs to the actual hardware handled by ++ * the current USB audio device, which implies input_dev_path being ++ * a subpath of usb_dev_path. ++ * ++ * This verification is necessary when there is more than one identical ++ * controller attached to the host system. ++ */ ++ usb_dev_path_len = strlen(usb_dev_path); ++ if (usb_dev_path_len >= strlen(input_dev_path)) ++ goto free_paths; ++ ++ usb_dev_path[usb_dev_path_len] = '/'; ++ match = !memcmp(input_dev_path, usb_dev_path, usb_dev_path_len + 1); ++ ++free_paths: ++ kfree(input_dev_path); ++ kfree(usb_dev_path); ++ ++ return match; ++} ++ ++static int snd_dualsense_ih_connect(struct input_handler *handler, ++ struct input_dev *dev, ++ const struct input_device_id *id) ++{ ++ struct input_handle *handle; ++ int err; ++ ++ handle = kzalloc(sizeof(*handle), GFP_KERNEL); ++ if (!handle) ++ return -ENOMEM; ++ ++ handle->dev = dev; ++ handle->handler = handler; ++ handle->name = handler->name; ++ ++ err = input_register_handle(handle); ++ if (err) ++ goto err_free; ++ ++ err = input_open_device(handle); ++ if (err) ++ goto err_unregister; ++ ++ return 0; ++ ++err_unregister: ++ input_unregister_handle(handle); ++err_free: ++ kfree(handle); ++ return err; ++} ++ ++static void snd_dualsense_ih_disconnect(struct input_handle *handle) ++{ ++ input_close_device(handle); ++ input_unregister_handle(handle); ++ kfree(handle); ++} ++ ++static void snd_dualsense_ih_start(struct input_handle *handle) ++{ ++ struct dualsense_mixer_elem_info *mei; ++ struct usb_mixer_elem_list *me; ++ int status = -1; ++ ++ mei = container_of(handle->handler, struct dualsense_mixer_elem_info, ih); ++ me = &mei->info.head; ++ ++ if (me->id == SND_DUALSENSE_JACK_OUT_TERM_ID && ++ test_bit(SW_HEADPHONE_INSERT, handle->dev->swbit)) ++ status = test_bit(SW_HEADPHONE_INSERT, handle->dev->sw); ++ else if (me->id == SND_DUALSENSE_JACK_IN_TERM_ID && ++ test_bit(SW_MICROPHONE_INSERT, handle->dev->swbit)) ++ status = test_bit(SW_MICROPHONE_INSERT, handle->dev->sw); ++ ++ if (status >= 0) { ++ mei->connected = !!status; ++ snd_ctl_notify(me->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, ++ &me->kctl->id); ++ } ++} ++ ++static int snd_dualsense_jack_get(struct snd_kcontrol *kctl, ++ struct snd_ctl_elem_value *ucontrol) ++{ ++ struct dualsense_mixer_elem_info *mei = snd_kcontrol_chip(kctl); ++ ++ ucontrol->value.integer.value[0] = mei->connected; ++ ++ return 0; ++} ++ ++static const struct snd_kcontrol_new snd_dualsense_jack_control = { ++ .iface = SNDRV_CTL_ELEM_IFACE_CARD, ++ .access = SNDRV_CTL_ELEM_ACCESS_READ, ++ .info = snd_ctl_boolean_mono_info, ++ .get = snd_dualsense_jack_get, ++}; ++ ++static int snd_dualsense_resume_jack(struct usb_mixer_elem_list *list) ++{ ++ snd_ctl_notify(list->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, ++ &list->kctl->id); ++ return 0; ++} ++ ++static void snd_dualsense_mixer_elem_free(struct snd_kcontrol *kctl) ++{ ++ struct dualsense_mixer_elem_info *mei = snd_kcontrol_chip(kctl); ++ ++ if (mei->ih.event) ++ input_unregister_handler(&mei->ih); ++ ++ snd_usb_mixer_elem_free(kctl); ++} ++ ++static int snd_dualsense_jack_create(struct usb_mixer_interface *mixer, ++ const char *name, bool is_output) ++{ ++ struct dualsense_mixer_elem_info *mei; ++ struct input_device_id *idev_id; ++ struct snd_kcontrol *kctl; ++ int err; ++ ++ mei = kzalloc(sizeof(*mei), GFP_KERNEL); ++ if (!mei) ++ return -ENOMEM; ++ ++ snd_usb_mixer_elem_init_std(&mei->info.head, mixer, ++ is_output ? SND_DUALSENSE_JACK_OUT_TERM_ID : ++ SND_DUALSENSE_JACK_IN_TERM_ID); ++ ++ mei->info.head.resume = snd_dualsense_resume_jack; ++ mei->info.val_type = USB_MIXER_BOOLEAN; ++ mei->info.channels = 1; ++ mei->info.min = 0; ++ mei->info.max = 1; ++ ++ kctl = snd_ctl_new1(&snd_dualsense_jack_control, mei); ++ if (!kctl) { ++ kfree(mei); ++ return -ENOMEM; ++ } ++ ++ strscpy(kctl->id.name, name, sizeof(kctl->id.name)); ++ kctl->private_free = snd_dualsense_mixer_elem_free; ++ ++ err = snd_usb_mixer_add_control(&mei->info.head, kctl); ++ if (err) ++ return err; ++ ++ idev_id = &mei->id_table[0]; ++ idev_id->flags = INPUT_DEVICE_ID_MATCH_VENDOR | INPUT_DEVICE_ID_MATCH_PRODUCT | ++ INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_SWBIT; ++ idev_id->vendor = USB_ID_VENDOR(mixer->chip->usb_id); ++ idev_id->product = USB_ID_PRODUCT(mixer->chip->usb_id); ++ idev_id->evbit[BIT_WORD(EV_SW)] = BIT_MASK(EV_SW); ++ if (is_output) ++ idev_id->swbit[BIT_WORD(SW_HEADPHONE_INSERT)] = BIT_MASK(SW_HEADPHONE_INSERT); ++ else ++ idev_id->swbit[BIT_WORD(SW_MICROPHONE_INSERT)] = BIT_MASK(SW_MICROPHONE_INSERT); ++ ++ mei->ih.event = snd_dualsense_ih_event; ++ mei->ih.match = snd_dualsense_ih_match; ++ mei->ih.connect = snd_dualsense_ih_connect; ++ mei->ih.disconnect = snd_dualsense_ih_disconnect; ++ mei->ih.start = snd_dualsense_ih_start; ++ mei->ih.name = name; ++ mei->ih.id_table = mei->id_table; ++ ++ err = input_register_handler(&mei->ih); ++ if (err) { ++ dev_warn(&mixer->chip->dev->dev, ++ "Could not register input handler: %d\n", err); ++ mei->ih.event = NULL; ++ } ++ ++ return 0; ++} ++ ++static int snd_dualsense_controls_create(struct usb_mixer_interface *mixer) ++{ ++ int err; ++ ++ err = snd_dualsense_jack_create(mixer, "Headphone Jack", true); ++ if (err < 0) ++ return err; ++ ++ return snd_dualsense_jack_create(mixer, "Headset Mic Jack", false); ++} ++#endif /* IS_REACHABLE(CONFIG_INPUT) */ ++ + /* ASUS Xonar U1 / U3 controls */ + + static int snd_xonar_u1_switch_get(struct snd_kcontrol *kcontrol, +@@ -1733,7 +1993,8 @@ static int snd_microii_spdif_default_put(struct snd_kcontrol *kcontrol, + unsigned int pval, pval_old; + int err; + +- pval = pval_old = kcontrol->private_value; ++ pval = kcontrol->private_value; ++ pval_old = pval; + pval &= 0xfffff0f0; + pval |= (ucontrol->value.iec958.status[1] & 0x0f) << 8; + pval |= (ucontrol->value.iec958.status[0] & 0x0f); +@@ -3271,7 +3532,7 @@ static int snd_djm_controls_update(struct usb_mixer_interface *mixer, + int err; + const struct snd_djm_device *device = &snd_djm_devices[device_idx]; + +- if ((group >= device->ncontrols) || value >= device->controls[group].noptions) ++ if (group >= device->ncontrols || value >= device->controls[group].noptions) + return -EINVAL; + + err = snd_usb_lock_shutdown(mixer->chip); +@@ -3389,6 +3650,13 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) + err = snd_emu0204_controls_create(mixer); + break; + ++#if IS_REACHABLE(CONFIG_INPUT) ++ case USB_ID(0x054c, 0x0ce6): /* Sony DualSense controller (PS5) */ ++ case USB_ID(0x054c, 0x0df2): /* Sony DualSense Edge controller (PS5) */ ++ err = snd_dualsense_controls_create(mixer); ++ break; ++#endif /* IS_REACHABLE(CONFIG_INPUT) */ ++ + case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */ + case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C400 */ + err = snd_c400_create_mixer(mixer); +@@ -3546,7 +3814,8 @@ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer, + struct snd_kcontrol *kctl) + { + /* Approximation using 10 ranges based on output measurement on hw v1.2. +- * This seems close to the cubic mapping e.g. alsamixer uses. */ ++ * This seems close to the cubic mapping e.g. alsamixer uses. ++ */ + static const DECLARE_TLV_DB_RANGE(scale, + 0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970), + 2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160), +@@ -3630,16 +3899,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, + if (unitid == 7 && cval->control == UAC_FU_VOLUME) + snd_dragonfly_quirk_db_scale(mixer, cval, kctl); + break; ++ } ++ + /* lowest playback value is muted on some devices */ +- case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */ +- case USB_ID(0x0d8c, 0x000c): /* C-Media */ +- case USB_ID(0x0d8c, 0x0014): /* C-Media */ +- case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ +- case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */ ++ if (mixer->chip->quirk_flags & QUIRK_FLAG_MIXER_MIN_MUTE) + if (strstr(kctl->id.name, "Playback")) + cval->min_mute = 1; +- break; +- } + + /* ALSA-ify some Plantronics headset control names */ + if (USB_ID_VENDOR(mixer->chip->usb_id) == 0x047f && +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index f19c808444c97a..7d747677b58da8 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2096,6 +2096,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_SET_IFACE_FIRST), + DEVICE_FLG(0x0556, 0x0014, /* Phoenix Audio TMX320VC */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x0572, 0x1b08, /* Conexant Systems (Rockwell), Inc. */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), ++ DEVICE_FLG(0x0572, 0x1b09, /* Conexant Systems (Rockwell), Inc. */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x05a3, 0x9420, /* ELP HD USB Camera */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x05a7, 0x1020, /* Bose Companion 5 */ +@@ -2138,12 +2142,16 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x0b0e, 0x0349, /* Jabra 550a */ + QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x0bda, 0x498a, /* Realtek Semiconductor Corp. */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x0c45, 0x636b, /* Microdia JP001 USB Camera */ + QUIRK_FLAG_GET_SAMPLE_RATE), +- DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */ +- QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x0d8c, 0x000c, /* C-Media */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), ++ DEVICE_FLG(0x0d8c, 0x0014, /* C-Media */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */ + QUIRK_FLAG_FIXED_RATE), + DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */ +@@ -2152,6 +2160,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), + DEVICE_FLG(0x1101, 0x0003, /* Audioengine D1 */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x12d1, 0x3a07, /* Huawei Technologies Co., Ltd. */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */ +@@ -2190,6 +2200,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), + DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x19f7, 0x0003, /* RODE NT-USB */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x1bcf, 0x2281, /* HD Webcam */ +@@ -2240,6 +2252,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x2a70, 0x1881, /* OnePlus Technology (Shenzhen) Co., Ltd. BE02T */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x2b53, 0x0023, /* Fiero SC-01 (firmware v1.0.0 @ 48 kHz) */ + QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x2b53, 0x0024, /* Fiero SC-01 (firmware v1.0.0 @ 96 kHz) */ +@@ -2250,10 +2264,14 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */ + QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x2d99, 0x0026, /* HECATE G2 GAMING HEADSET */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x2fc6, 0xf0b7, /* iBasso DC07 Pro */ + QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */ + QUIRK_FLAG_IGNORE_CTL_ERROR), ++ DEVICE_FLG(0x339b, 0x3a07, /* Synaptics HONOR USB-C HEADSET */ ++ QUIRK_FLAG_MIXER_MIN_MUTE), + DEVICE_FLG(0x413c, 0xa506, /* Dell AE515 sound bar */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x534d, 0x0021, /* MacroSilicon MS2100/MS2106 */ +@@ -2305,6 +2323,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x2d87, /* Cayin device */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x2fc6, /* Comture-inc devices */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3336, /* HEM devices */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3353, /* Khadas devices */ +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index ddfbe045e7a941..3c927316bc9929 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -184,6 +184,9 @@ extern bool snd_usb_skip_validation; + * for the given endpoint. + * QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384 + * Set the fixed resolution for Mic Capture Volume (mostly for webcams) ++ * QUIRK_FLAG_MIXER_MIN_MUTE ++ * Set minimum volume control value as mute for devices where the lowest ++ * playback value represents muted state instead of minimum audible volume + */ + + #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) +@@ -210,5 +213,6 @@ extern bool snd_usb_skip_validation; + #define QUIRK_FLAG_FIXED_RATE (1U << 21) + #define QUIRK_FLAG_MIC_RES_16 (1U << 22) + #define QUIRK_FLAG_MIC_RES_384 (1U << 23) ++#define QUIRK_FLAG_MIXER_MIN_MUTE (1U << 24) + + #endif /* __USBAUDIO_H */ +diff --git a/tools/testing/selftests/mm/mremap_test.c b/tools/testing/selftests/mm/mremap_test.c +index 5c3773de9f0f78..944645f9d2b3d7 100644 +--- a/tools/testing/selftests/mm/mremap_test.c ++++ b/tools/testing/selftests/mm/mremap_test.c +@@ -22,7 +22,9 @@ + #define VALIDATION_DEFAULT_THRESHOLD 4 /* 4MB */ + #define VALIDATION_NO_THRESHOLD 0 /* Verify the entire region */ + ++#ifndef MIN + #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) ++#endif + + struct config { + unsigned long long src_alignment; +diff --git a/tools/testing/selftests/net/fib_nexthops.sh b/tools/testing/selftests/net/fib_nexthops.sh +index a6f2c0b9555d12..e2e4fffd87e39a 100755 +--- a/tools/testing/selftests/net/fib_nexthops.sh ++++ b/tools/testing/selftests/net/fib_nexthops.sh +@@ -464,8 +464,8 @@ ipv6_fdb_grp_fcnal() + log_test $? 0 "Get Fdb nexthop group by id" + + # fdb nexthop group can only contain fdb nexthops +- run_cmd "$IP nexthop add id 63 via 2001:db8:91::4" +- run_cmd "$IP nexthop add id 64 via 2001:db8:91::5" ++ run_cmd "$IP nexthop add id 63 via 2001:db8:91::4 dev veth1" ++ run_cmd "$IP nexthop add id 64 via 2001:db8:91::5 dev veth1" + run_cmd "$IP nexthop add id 103 group 63/64 fdb" + log_test $? 2 "Fdb Nexthop group with non-fdb nexthops" + +@@ -544,15 +544,15 @@ ipv4_fdb_grp_fcnal() + log_test $? 0 "Get Fdb nexthop group by id" + + # fdb nexthop group can only contain fdb nexthops +- run_cmd "$IP nexthop add id 14 via 172.16.1.2" +- run_cmd "$IP nexthop add id 15 via 172.16.1.3" ++ run_cmd "$IP nexthop add id 14 via 172.16.1.2 dev veth1" ++ run_cmd "$IP nexthop add id 15 via 172.16.1.3 dev veth1" + run_cmd "$IP nexthop add id 103 group 14/15 fdb" + log_test $? 2 "Fdb Nexthop group with non-fdb nexthops" + + # Non fdb nexthop group can not contain fdb nexthops + run_cmd "$IP nexthop add id 16 via 172.16.1.2 fdb" + run_cmd "$IP nexthop add id 17 via 172.16.1.3 fdb" +- run_cmd "$IP nexthop add id 104 group 14/15" ++ run_cmd "$IP nexthop add id 104 group 16/17" + log_test $? 2 "Non-Fdb Nexthop group with fdb nexthops" + + # fdb nexthop cannot have blackhole +@@ -579,7 +579,7 @@ ipv4_fdb_grp_fcnal() + run_cmd "$BRIDGE fdb add 02:02:00:00:00:14 dev vx10 nhid 12 self" + log_test $? 255 "Fdb mac add with nexthop" + +- run_cmd "$IP ro add 172.16.0.0/22 nhid 15" ++ run_cmd "$IP ro add 172.16.0.0/22 nhid 16" + log_test $? 2 "Route add with fdb nexthop" + + run_cmd "$IP ro add 172.16.0.0/22 nhid 103" +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 15325ca35f1e2b..4390965c84c422 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -60,7 +60,9 @@ + #define SKIP(s, ...) XFAIL(s, ##__VA_ARGS__) + #endif + ++#ifndef MIN + #define MIN(X, Y) ((X) < (Y) ? (X) : (Y)) ++#endif + + #ifndef PR_SET_PTRACER + # define PR_SET_PTRACER 0x59616d61 diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch new file mode 100644 index 0000000000..09637783c1 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.109-110.patch @@ -0,0 +1,327 @@ +diff --git a/Makefile b/Makefile +index afeacf5efc9553..196343089737f3 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 109 ++SUBLEVEL = 110 + EXTRAVERSION = + NAME = Pinguïn Aangedreven + +diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/flexcop-pci.c +index 486c8ec0fa60d9..ab53c5b02c48df 100644 +--- a/drivers/media/pci/b2c2/flexcop-pci.c ++++ b/drivers/media/pci/b2c2/flexcop-pci.c +@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pci_dev *pdev) + struct flexcop_pci *fc_pci = pci_get_drvdata(pdev); + + if (irq_chk_intv > 0) +- cancel_delayed_work(&fc_pci->irq_check_work); ++ cancel_delayed_work_sync(&fc_pci->irq_check_work); + + flexcop_pci_dma_exit(fc_pci); + flexcop_device_exit(fc_pci->fc_dev); +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index e5590a708f1c5d..f4deca8894e0f7 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -536,7 +536,9 @@ static int display_open(struct inode *inode, struct file *file) + + mutex_lock(&ictx->lock); + +- if (!ictx->display_supported) { ++ if (ictx->disconnected) { ++ retval = -ENODEV; ++ } else if (!ictx->display_supported) { + pr_err("display not supported by device\n"); + retval = -ENODEV; + } else if (ictx->display_isopen) { +@@ -598,6 +600,9 @@ static int send_packet(struct imon_context *ictx) + int retval = 0; + struct usb_ctrlrequest *control_req = NULL; + ++ if (ictx->disconnected) ++ return -ENODEV; ++ + /* Check if we need to use control or interrupt urb */ + if (!ictx->tx_control) { + pipe = usb_sndintpipe(ictx->usbdev_intf0, +@@ -949,12 +954,14 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, + static const unsigned char vfd_packet6[] = { + 0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF }; + +- if (ictx->disconnected) +- return -ENODEV; +- + if (mutex_lock_interruptible(&ictx->lock)) + return -ERESTARTSYS; + ++ if (ictx->disconnected) { ++ retval = -ENODEV; ++ goto exit; ++ } ++ + if (!ictx->dev_present_intf0) { + pr_err_ratelimited("no iMON device present\n"); + retval = -ENODEV; +@@ -1029,11 +1036,13 @@ static ssize_t lcd_write(struct file *file, const char __user *buf, + int retval = 0; + struct imon_context *ictx = file->private_data; + +- if (ictx->disconnected) +- return -ENODEV; +- + mutex_lock(&ictx->lock); + ++ if (ictx->disconnected) { ++ retval = -ENODEV; ++ goto exit; ++ } ++ + if (!ictx->display_supported) { + pr_err_ratelimited("no iMON display present\n"); + retval = -ENODEV; +@@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_interface *interface) + int ifnum; + + ictx = usb_get_intfdata(interface); ++ ++ mutex_lock(&ictx->lock); + ictx->disconnected = true; ++ mutex_unlock(&ictx->lock); ++ + dev = ictx->dev; + ifnum = interface->cur_altsetting->desc.bInterfaceNumber; + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 09753993068a95..c7cee6b185264d 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -135,6 +135,9 @@ struct uvc_entity *uvc_entity_by_id(struct uvc_device *dev, int id) + { + struct uvc_entity *entity; + ++ if (id == UVC_INVALID_ENTITY_ID) ++ return NULL; ++ + list_for_each_entry(entity, &dev->entities, list) { + if (entity->id == id) + return entity; +@@ -778,14 +781,27 @@ static const u8 uvc_media_transport_input_guid[16] = + UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT; + static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING; + +-static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, +- unsigned int num_pads, unsigned int extra_size) ++static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, ++ u16 id, unsigned int num_pads, ++ unsigned int extra_size) + { + struct uvc_entity *entity; + unsigned int num_inputs; + unsigned int size; + unsigned int i; + ++ /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */ ++ if (id == 0) { ++ dev_err(&dev->intf->dev, "Found Unit with invalid ID 0\n"); ++ id = UVC_INVALID_ENTITY_ID; ++ } ++ ++ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ ++ if (uvc_entity_by_id(dev, id)) { ++ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id); ++ id = UVC_INVALID_ENTITY_ID; ++ } ++ + extra_size = roundup(extra_size, sizeof(*entity->pads)); + if (num_pads) + num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1; +@@ -795,7 +811,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, + + num_inputs; + entity = kzalloc(size, GFP_KERNEL); + if (entity == NULL) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + entity->id = id; + entity->type = type; +@@ -907,10 +923,10 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, + break; + } + +- unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3], +- p + 1, 2*n); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT, ++ buffer[3], p + 1, 2 * n); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->guid, &buffer[4], 16); + unit->extension.bNumControls = buffer[20]; +@@ -1019,10 +1035,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3], +- 1, n + p); +- if (term == NULL) +- return -ENOMEM; ++ term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT, ++ buffer[3], 1, n + p); ++ if (IS_ERR(term)) ++ return PTR_ERR(term); + + if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) { + term->camera.bControlSize = n; +@@ -1078,10 +1094,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return 0; + } + +- term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3], +- 1, 0); +- if (term == NULL) +- return -ENOMEM; ++ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT, ++ buffer[3], 1, 0); ++ if (IS_ERR(term)) ++ return PTR_ERR(term); + + memcpy(term->baSourceID, &buffer[7], 1); + +@@ -1100,9 +1116,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], ++ p + 1, 0); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->baSourceID, &buffer[5], p); + +@@ -1122,9 +1139,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->baSourceID, &buffer[4], 1); + unit->processing.wMaxMultiplier = +@@ -1151,9 +1168,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], ++ p + 1, n); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->guid, &buffer[4], 16); + unit->extension.bNumControls = buffer[20]; +@@ -1293,9 +1311,10 @@ static int uvc_gpio_parse(struct uvc_device *dev) + return dev_err_probe(&dev->intf->dev, irq, + "No IRQ for privacy GPIO\n"); + +- unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1); +- if (!unit) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT, ++ UVC_EXT_GPIO_UNIT_ID, 0, 1); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + unit->gpio.gpio_privacy = gpio_privacy; + unit->gpio.irq = irq; +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index e99bfaa622669b..cbb5ce963cd097 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -41,6 +41,8 @@ + #define UVC_EXT_GPIO_UNIT 0x7ffe + #define UVC_EXT_GPIO_UNIT_ID 0x100 + ++#define UVC_INVALID_ENTITY_ID 0xffff ++ + /* ------------------------------------------------------------------------ + * Driver specific constants. + */ +diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c +index 9a88774836c9db..eddcfd09c05b86 100644 +--- a/drivers/target/target_core_configfs.c ++++ b/drivers/target/target_core_configfs.c +@@ -2738,7 +2738,7 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page) + config_item_name(&dev->dev_group.cg_item)); + cur_len++; /* Extra byte for NULL terminator */ + +- if ((cur_len + len) > PAGE_SIZE) { ++ if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) { + pr_warn("Ran out of lu_gp_show_attr" + "_members buffer\n"); + break; +diff --git a/include/crypto/sha256_base.h b/include/crypto/sha256_base.h +index ab904d82236fb8..0f5f3a6f79f0cf 100644 +--- a/include/crypto/sha256_base.h ++++ b/include/crypto/sha256_base.h +@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_update(struct sha256_state *sctx, + sctx->count += len; + + if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) { +- int blocks; ++ unsigned int blocks; + + if (partial) { + int p = SHA256_BLOCK_SIZE - partial; +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 90e83d62adb547..de1e4c927cbc76 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -196,10 +196,17 @@ inline bool is_a_helper::test(const_gimple gs) + } + #endif + ++#if BUILDING_GCC_VERSION < 16000 + #define TODO_verify_ssa TODO_verify_il + #define TODO_verify_flow TODO_verify_il + #define TODO_verify_stmts TODO_verify_il + #define TODO_verify_rtl_sharing TODO_verify_il ++#else ++#define TODO_verify_ssa 0 ++#define TODO_verify_flow 0 ++#define TODO_verify_stmts 0 ++#define TODO_verify_rtl_sharing 0 ++#endif + + #define INSN_DELETED_P(insn) (insn)->deleted() + +diff --git a/sound/soc/qcom/qdsp6/topology.c b/sound/soc/qcom/qdsp6/topology.c +index 70572c83e1017d..d4c3bc85fb3562 100644 +--- a/sound/soc/qcom/qdsp6/topology.c ++++ b/sound/soc/qcom/qdsp6/topology.c +@@ -586,8 +586,8 @@ static int audioreach_widget_load_module_common(struct snd_soc_component *compon + return PTR_ERR(cont); + + mod = audioreach_parse_common_tokens(apm, cont, &tplg_w->priv, w); +- if (IS_ERR(mod)) +- return PTR_ERR(mod); ++ if (IS_ERR_OR_NULL(mod)) ++ return mod ? PTR_ERR(mod) : -ENODEV; + + dobj = &w->dobj; + dobj->private = mod; diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch new file mode 100644 index 0000000000..c7965c371e --- /dev/null +++ b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.110-111.patch @@ -0,0 +1,860 @@ +diff --git a/Makefile b/Makefile +index 196343089737f3..9531c465e9c240 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 110 ++SUBLEVEL = 111 + EXTRAVERSION = + NAME = Pinguïn Aangedreven + +diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c +index d0d836448a76b2..83827384982e49 100644 +--- a/arch/arm64/kernel/fpsimd.c ++++ b/arch/arm64/kernel/fpsimd.c +@@ -1873,13 +1873,17 @@ static void fpsimd_flush_cpu_state(void) + */ + void fpsimd_save_and_flush_cpu_state(void) + { ++ unsigned long flags; ++ + if (!system_supports_fpsimd()) + return; + WARN_ON(preemptible()); +- get_cpu_fpsimd_context(); ++ local_irq_save(flags); ++ __get_cpu_fpsimd_context(); + fpsimd_save(); + fpsimd_flush_cpu_state(); +- put_cpu_fpsimd_context(); ++ __put_cpu_fpsimd_context(); ++ local_irq_restore(flags); + } + + #ifdef CONFIG_KERNEL_MODE_NEON +diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h +index 4f6af8c6cfa060..4747277983ad1a 100644 +--- a/arch/riscv/include/asm/processor.h ++++ b/arch/riscv/include/asm/processor.h +@@ -13,42 +13,19 @@ + + #include + +-#ifdef CONFIG_64BIT +-#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1)) +-#define STACK_TOP_MAX TASK_SIZE +- + #define arch_get_mmap_end(addr, len, flags) \ + ({ \ +- unsigned long mmap_end; \ +- typeof(addr) _addr = (addr); \ +- if ((_addr) == 0 || (IS_ENABLED(CONFIG_COMPAT) && is_compat_task())) \ +- mmap_end = STACK_TOP_MAX; \ +- else if ((_addr) >= VA_USER_SV57) \ +- mmap_end = STACK_TOP_MAX; \ +- else if ((((_addr) >= VA_USER_SV48)) && (VA_BITS >= VA_BITS_SV48)) \ +- mmap_end = VA_USER_SV48; \ +- else \ +- mmap_end = VA_USER_SV39; \ +- mmap_end; \ ++ STACK_TOP_MAX; \ + }) + + #define arch_get_mmap_base(addr, base) \ + ({ \ +- unsigned long mmap_base; \ +- typeof(addr) _addr = (addr); \ +- typeof(base) _base = (base); \ +- unsigned long rnd_gap = DEFAULT_MAP_WINDOW - (_base); \ +- if ((_addr) == 0 || (IS_ENABLED(CONFIG_COMPAT) && is_compat_task())) \ +- mmap_base = (_base); \ +- else if (((_addr) >= VA_USER_SV57) && (VA_BITS >= VA_BITS_SV57)) \ +- mmap_base = VA_USER_SV57 - rnd_gap; \ +- else if ((((_addr) >= VA_USER_SV48)) && (VA_BITS >= VA_BITS_SV48)) \ +- mmap_base = VA_USER_SV48 - rnd_gap; \ +- else \ +- mmap_base = VA_USER_SV39 - rnd_gap; \ +- mmap_base; \ ++ base; \ + }) + ++#ifdef CONFIG_64BIT ++#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1)) ++#define STACK_TOP_MAX TASK_SIZE + #else + #define DEFAULT_MAP_WINDOW TASK_SIZE + #define STACK_TOP_MAX TASK_SIZE +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 2673cd5c46cb48..313cb2ffd6aae6 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -5134,12 +5134,11 @@ void init_decode_cache(struct x86_emulate_ctxt *ctxt) + ctxt->mem_read.end = 0; + } + +-int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) ++int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts) + { + const struct x86_emulate_ops *ops = ctxt->ops; + int rc = X86EMUL_CONTINUE; + int saved_dst_type = ctxt->dst.type; +- bool is_guest_mode = ctxt->ops->is_guest_mode(ctxt); + + ctxt->mem_read.pos = 0; + +@@ -5187,7 +5186,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + fetch_possible_mmx_operand(&ctxt->dst); + } + +- if (unlikely(is_guest_mode) && ctxt->intercept) { ++ if (unlikely(check_intercepts) && ctxt->intercept) { + rc = emulator_check_intercept(ctxt, ctxt->intercept, + X86_ICPT_PRE_EXCEPT); + if (rc != X86EMUL_CONTINUE) +@@ -5216,7 +5215,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + goto done; + } + +- if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { ++ if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { + rc = emulator_check_intercept(ctxt, ctxt->intercept, + X86_ICPT_POST_EXCEPT); + if (rc != X86EMUL_CONTINUE) +@@ -5270,7 +5269,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + + special_insn: + +- if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { ++ if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { + rc = emulator_check_intercept(ctxt, ctxt->intercept, + X86_ICPT_POST_MEMACCESS); + if (rc != X86EMUL_CONTINUE) +diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h +index be7aeb9b8ea3b1..b940ee604bd849 100644 +--- a/arch/x86/kvm/kvm_emulate.h ++++ b/arch/x86/kvm/kvm_emulate.h +@@ -220,7 +220,6 @@ struct x86_emulate_ops { + void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); + + bool (*is_smm)(struct x86_emulate_ctxt *ctxt); +- bool (*is_guest_mode)(struct x86_emulate_ctxt *ctxt); + int (*leave_smm)(struct x86_emulate_ctxt *ctxt); + void (*triple_fault)(struct x86_emulate_ctxt *ctxt); + int (*set_xcr)(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr); +@@ -498,7 +497,7 @@ bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt); + #define EMULATION_RESTART 1 + #define EMULATION_INTERCEPTED 2 + void init_decode_cache(struct x86_emulate_ctxt *ctxt); +-int x86_emulate_insn(struct x86_emulate_ctxt *ctxt); ++int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts); + int emulator_task_switch(struct x86_emulate_ctxt *ctxt, + u16 tss_selector, int idt_index, int reason, + bool has_error_code, u32 error_code); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 7238686a49bb5a..71d60d4e991fd3 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -8308,11 +8308,6 @@ static bool emulator_is_smm(struct x86_emulate_ctxt *ctxt) + return is_smm(emul_to_vcpu(ctxt)); + } + +-static bool emulator_is_guest_mode(struct x86_emulate_ctxt *ctxt) +-{ +- return is_guest_mode(emul_to_vcpu(ctxt)); +-} +- + #ifndef CONFIG_KVM_SMM + static int emulator_leave_smm(struct x86_emulate_ctxt *ctxt) + { +@@ -8379,7 +8374,6 @@ static const struct x86_emulate_ops emulate_ops = { + .guest_has_rdpid = emulator_guest_has_rdpid, + .set_nmi_mask = emulator_set_nmi_mask, + .is_smm = emulator_is_smm, +- .is_guest_mode = emulator_is_guest_mode, + .leave_smm = emulator_leave_smm, + .triple_fault = emulator_triple_fault, + .set_xcr = emulator_set_xcr, +@@ -8999,7 +8993,14 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, + ctxt->exception.address = 0; + } + +- r = x86_emulate_insn(ctxt); ++ /* ++ * Check L1's instruction intercepts when emulating instructions for ++ * L2, unless KVM is re-emulating a previously decoded instruction, ++ * e.g. to complete userspace I/O, in which case KVM has already ++ * checked the intercepts. ++ */ ++ r = x86_emulate_insn(ctxt, is_guest_mode(vcpu) && ++ !(emulation_type & EMULTYPE_NO_DECODE)); + + if (r == EMULATION_INTERCEPTED) + return 1; +diff --git a/crypto/rng.c b/crypto/rng.c +index 279dffdebf5981..e462031fef68c6 100644 +--- a/crypto/rng.c ++++ b/crypto/rng.c +@@ -197,6 +197,11 @@ int crypto_del_default_rng(void) + EXPORT_SYMBOL_GPL(crypto_del_default_rng); + #endif + ++static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data, ++ unsigned int len) ++{ ++} ++ + int crypto_register_rng(struct rng_alg *alg) + { + struct crypto_istat_rng *istat = rng_get_stat(alg); +@@ -212,6 +217,9 @@ int crypto_register_rng(struct rng_alg *alg) + if (IS_ENABLED(CONFIG_CRYPTO_STATS)) + memset(istat, 0, sizeof(*istat)); + ++ if (!alg->set_ent) ++ alg->set_ent = rng_default_set_ent; ++ + return crypto_register_alg(base); + } + EXPORT_SYMBOL_GPL(crypto_register_rng); +diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c +index a985301a4135f5..d2d413c829f44a 100644 +--- a/drivers/hid/hid-mcp2221.c ++++ b/drivers/hid/hid-mcp2221.c +@@ -814,6 +814,10 @@ static int mcp2221_raw_event(struct hid_device *hdev, + } + if (data[2] == MCP2221_I2C_READ_COMPL || + data[2] == MCP2221_I2C_READ_PARTIAL) { ++ if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) { ++ mcp->status = -EINVAL; ++ break; ++ } + buf = mcp->rxbuf; + memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]); + mcp->rxbuf_idx = mcp->rxbuf_idx + data[3]; +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 0bd76f8d4dc6b8..6442d41622eff9 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -129,7 +129,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 8a1a33862ba712..4b6ad85cf261de 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -2180,10 +2180,10 @@ static int tc358743_probe(struct i2c_client *client) + err_work_queues: + cec_unregister_adapter(state->cec_adap); + if (!state->i2c_client->irq) { +- del_timer(&state->timer); ++ timer_delete_sync(&state->timer); + flush_work(&state->work_i2c_poll); + } +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + mutex_destroy(&state->confctl_mutex); + err_hdl: + media_entity_cleanup(&sd->entity); +diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c +index 2182e5b7b6064c..ec9a3cd4784e1f 100644 +--- a/drivers/media/tuners/xc5000.c ++++ b/drivers/media/tuners/xc5000.c +@@ -58,7 +58,7 @@ struct xc5000_priv { + struct dvb_frontend *fe; + struct delayed_work timer_sleep; + +- const struct firmware *firmware; ++ bool inited; + }; + + /* Misc Defines */ +@@ -1110,23 +1110,19 @@ static int xc_load_fw_and_init_tuner(struct dvb_frontend *fe, int force) + if (!force && xc5000_is_firmware_loaded(fe) == 0) + return 0; + +- if (!priv->firmware) { +- ret = request_firmware(&fw, desired_fw->name, +- priv->i2c_props.adap->dev.parent); +- if (ret) { +- pr_err("xc5000: Upload failed. rc %d\n", ret); +- return ret; +- } +- dprintk(1, "firmware read %zu bytes.\n", fw->size); ++ ret = request_firmware(&fw, desired_fw->name, ++ priv->i2c_props.adap->dev.parent); ++ if (ret) { ++ pr_err("xc5000: Upload failed. rc %d\n", ret); ++ return ret; ++ } ++ dprintk(1, "firmware read %zu bytes.\n", fw->size); + +- if (fw->size != desired_fw->size) { +- pr_err("xc5000: Firmware file with incorrect size\n"); +- release_firmware(fw); +- return -EINVAL; +- } +- priv->firmware = fw; +- } else +- fw = priv->firmware; ++ if (fw->size != desired_fw->size) { ++ pr_err("xc5000: Firmware file with incorrect size\n"); ++ release_firmware(fw); ++ return -EINVAL; ++ } + + /* Try up to 5 times to load firmware */ + for (i = 0; i < 5; i++) { +@@ -1204,6 +1200,7 @@ static int xc_load_fw_and_init_tuner(struct dvb_frontend *fe, int force) + } + + err: ++ release_firmware(fw); + if (!ret) + printk(KERN_INFO "xc5000: Firmware %s loaded and running.\n", + desired_fw->name); +@@ -1274,7 +1271,7 @@ static int xc5000_resume(struct dvb_frontend *fe) + + /* suspended before firmware is loaded. + Avoid firmware load in resume path. */ +- if (!priv->firmware) ++ if (!priv->inited) + return 0; + + return xc5000_set_params(fe); +@@ -1293,6 +1290,8 @@ static int xc5000_init(struct dvb_frontend *fe) + if (debug) + xc_debug_dump(priv); + ++ priv->inited = true; ++ + return 0; + } + +@@ -1305,11 +1304,7 @@ static void xc5000_release(struct dvb_frontend *fe) + mutex_lock(&xc5000_list_mutex); + + if (priv) { +- cancel_delayed_work(&priv->timer_sleep); +- if (priv->firmware) { +- release_firmware(priv->firmware); +- priv->firmware = NULL; +- } ++ cancel_delayed_work_sync(&priv->timer_sleep); + hybrid_tuner_release_state(priv); + } + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index e501b55678d1dc..ae4ebcee607792 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -738,9 +738,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + /* Reset Global error flags */ + rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); + +- /* Set the controller into appropriate mode */ +- rcar_canfd_set_mode(gpriv); +- + /* Transition all Channels to reset mode */ + for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) { + rcar_canfd_clear_bit(gpriv->base, +@@ -760,6 +757,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + return err; + } + } ++ ++ /* Set the controller into appropriate mode */ ++ rcar_canfd_set_mode(gpriv); ++ + return 0; + } + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 57ea7dfe8a596f..1acd4fc7adc8bf 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) + + priv->force_quit = 1; + free_irq(spi->irq, priv); +- destroy_workqueue(priv->wq); +- priv->wq = NULL; + + mutex_lock(&priv->hi3110_lock); + +@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net) + goto out_close; + } + +- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, +- 0); +- if (!priv->wq) { +- ret = -ENOMEM; +- goto out_free_irq; +- } +- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); +- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); +- + ret = hi3110_hw_reset(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_setup(net); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_set_normal_mode(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + netif_wake_queue(net); + mutex_unlock(&priv->hi3110_lock); + + return 0; + +- out_free_wq: +- destroy_workqueue(priv->wq); + out_free_irq: + free_irq(spi->irq, priv); + hi3110_hw_sleep(spi); +@@ -915,6 +902,15 @@ static int hi3110_can_probe(struct spi_device *spi) + if (ret) + goto out_clk; + ++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } ++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); ++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); ++ + priv->spi = spi; + mutex_init(&priv->hi3110_lock); + +@@ -950,6 +946,8 @@ static int hi3110_can_probe(struct spi_device *spi) + return 0; + + error_probe: ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; + hi3110_power_enable(priv->power, 0); + + out_clk: +@@ -970,6 +968,9 @@ static void hi3110_can_remove(struct spi_device *spi) + + hi3110_power_enable(priv->power, 0); + ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; ++ + clk_disable_unprepare(priv->clk); + + free_candev(net); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c +index e6403d4c937c8c..a0c0932a85d1e9 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c +@@ -294,7 +294,6 @@ static const struct usb_device_id rtl8192c_usb_ids[] = { + {RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/ + {RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/ + {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/ +- {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ + {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ + {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ + {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/ +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 6f5437d210a617..9fd2829ee2ab48 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -233,6 +233,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), + } + }, ++ { ++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */ + { + .ident = "PCSpecialist Lafite Pro V 14M", +@@ -242,6 +250,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), + } + }, ++ { ++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), ++ } ++ }, + { + .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", + .driver_data = &quirk_spurious_8042, +diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c +index f667b3b62f1883..4c38eeda53c4e7 100644 +--- a/drivers/staging/axis-fifo/axis-fifo.c ++++ b/drivers/staging/axis-fifo/axis-fifo.c +@@ -42,7 +42,6 @@ + #define DRIVER_NAME "axis_fifo" + + #define READ_BUF_SIZE 128U /* read buffer length in words */ +-#define WRITE_BUF_SIZE 128U /* write buffer length in words */ + + /* ---------------------------- + * IP register offsets +@@ -397,6 +396,7 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, + } + + bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); ++ words_available = bytes_available / sizeof(u32); + if (!bytes_available) { + dev_err(fifo->dt_device, "received a packet of length 0\n"); + ret = -EIO; +@@ -407,7 +407,7 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, + dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", + bytes_available, len); + ret = -EINVAL; +- goto end_unlock; ++ goto err_flush_rx; + } + + if (bytes_available % sizeof(u32)) { +@@ -416,11 +416,9 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, + */ + dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); + ret = -EIO; +- goto end_unlock; ++ goto err_flush_rx; + } + +- words_available = bytes_available / sizeof(u32); +- + /* read data into an intermediate buffer, copying the contents + * to userspace when the buffer is full + */ +@@ -432,18 +430,23 @@ static ssize_t axis_fifo_read(struct file *f, char __user *buf, + tmp_buf[i] = ioread32(fifo->base_addr + + XLLF_RDFD_OFFSET); + } ++ words_available -= copy; + + if (copy_to_user(buf + copied * sizeof(u32), tmp_buf, + copy * sizeof(u32))) { + ret = -EFAULT; +- goto end_unlock; ++ goto err_flush_rx; + } + + copied += copy; +- words_available -= copy; + } ++ mutex_unlock(&fifo->read_lock); ++ ++ return bytes_available; + +- ret = bytes_available; ++err_flush_rx: ++ while (words_available--) ++ ioread32(fifo->base_addr + XLLF_RDFD_OFFSET); + + end_unlock: + mutex_unlock(&fifo->read_lock); +@@ -471,11 +474,8 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, + { + struct axis_fifo *fifo = (struct axis_fifo *)f->private_data; + unsigned int words_to_write; +- unsigned int copied; +- unsigned int copy; +- unsigned int i; ++ u32 *txbuf; + int ret; +- u32 tmp_buf[WRITE_BUF_SIZE]; + + if (len % sizeof(u32)) { + dev_err(fifo->dt_device, +@@ -491,11 +491,17 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, + return -EINVAL; + } + +- if (words_to_write > fifo->tx_fifo_depth) { +- dev_err(fifo->dt_device, "tried to write more words [%u] than slots in the fifo buffer [%u]\n", +- words_to_write, fifo->tx_fifo_depth); ++ /* ++ * In 'Store-and-Forward' mode, the maximum packet that can be ++ * transmitted is limited by the size of the FIFO, which is ++ * (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. ++ * ++ * Do not attempt to send a packet larger than 'tx_fifo_depth - 4', ++ * otherwise a 'Transmit Packet Overrun Error' interrupt will be ++ * raised, which requires a reset of the TX circuit to recover. ++ */ ++ if (words_to_write > (fifo->tx_fifo_depth - 4)) + return -EINVAL; +- } + + if (fifo->write_flags & O_NONBLOCK) { + /* +@@ -534,32 +540,20 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf, + } + } + +- /* write data from an intermediate buffer into the fifo IP, refilling +- * the buffer with userspace data as needed +- */ +- copied = 0; +- while (words_to_write > 0) { +- copy = min(words_to_write, WRITE_BUF_SIZE); +- +- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), +- copy * sizeof(u32))) { +- ret = -EFAULT; +- goto end_unlock; +- } +- +- for (i = 0; i < copy; i++) +- iowrite32(tmp_buf[i], fifo->base_addr + +- XLLF_TDFD_OFFSET); +- +- copied += copy; +- words_to_write -= copy; ++ txbuf = vmemdup_user(buf, len); ++ if (IS_ERR(txbuf)) { ++ ret = PTR_ERR(txbuf); ++ goto end_unlock; + } + +- ret = copied * sizeof(u32); ++ for (int i = 0; i < words_to_write; ++i) ++ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET); + + /* write packet size to fifo */ +- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET); ++ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET); + ++ ret = len; ++ kvfree(txbuf); + end_unlock: + mutex_unlock(&fifo->write_lock); + +diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig +index bdc568a4ab6693..4f57833e3ec742 100644 +--- a/drivers/tty/serial/Kconfig ++++ b/drivers/tty/serial/Kconfig +@@ -1405,7 +1405,7 @@ config SERIAL_STM32 + + config SERIAL_STM32_CONSOLE + bool "Support for console on STM32" +- depends on SERIAL_STM32=y ++ depends on SERIAL_STM32 + select SERIAL_CORE_CONSOLE + select SERIAL_EARLYCON + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index ef546f660b9927..dca610369ca94a 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2114,6 +2114,12 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ + .driver_info = RSVD(7) }, ++ { USB_DEVICE(0x1e0e, 0x9071), /* Simcom SIM8230 RMNET mode */ ++ .driver_info = RSVD(3) | RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9078, 0xff), /* Simcom SIM8230 ECM mode */ ++ .driver_info = RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x907b, 0xff), /* Simcom SIM8230 RNDIS mode */ ++ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c +index 28ac7995716e04..b8122582d75556 100644 +--- a/fs/btrfs/ref-verify.c ++++ b/fs/btrfs/ref-verify.c +@@ -990,11 +990,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) + if (!btrfs_test_opt(fs_info, REF_VERIFY)) + return 0; + ++ extent_root = btrfs_extent_root(fs_info, 0); ++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ ++ if (IS_ERR(extent_root)) { ++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling"); ++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); ++ return 0; ++ } ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; + +- extent_root = btrfs_extent_root(fs_info, 0); + eb = btrfs_read_lock_root_node(extent_root); + level = btrfs_header_level(eb); + path->nodes[level] = eb; +diff --git a/include/linux/device.h b/include/linux/device.h +index 3627b26b243e61..e5f1a773dc5470 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -968,6 +968,9 @@ static inline bool device_pm_not_required(struct device *dev) + static inline void device_set_pm_not_required(struct device *dev) + { + dev->power.no_pm = true; ++#ifdef CONFIG_PM ++ dev->power.no_callbacks = true; ++#endif + } + + static inline void dev_pm_syscore_device(struct device *dev, bool val) +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index d0eb03ada704dc..a1e3cb48621a90 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -719,10 +719,10 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) + p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); + + spin_lock(&m->req_lock); +- /* Ignore cancelled request if message has been received +- * before lock. +- */ +- if (req->status == REQ_STATUS_RCVD) { ++ /* Ignore cancelled request if status changed since the request was ++ * processed in p9_client_flush() ++ */ ++ if (req->status != REQ_STATUS_SENT) { + spin_unlock(&m->req_lock); + return 0; + } +diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h +index d6cfae6ec5f74a..3f1761755b8660 100644 +--- a/sound/soc/amd/acp/amd.h ++++ b/sound/soc/amd/acp/amd.h +@@ -116,7 +116,7 @@ + #define PDM_DMA_INTR_MASK 0x10000 + #define PDM_DEC_64 0x2 + #define PDM_CLK_FREQ_MASK 0x07 +-#define PDM_MISC_CTRL_MASK 0x10 ++#define PDM_MISC_CTRL_MASK 0x18 + #define PDM_ENABLE 0x01 + #define PDM_DISABLE 0x00 + #define DMA_EN_MASK 0x02 +diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c +index 92c647d439ec7f..89de427c19e793 100644 +--- a/sound/soc/codecs/rt5682s.c ++++ b/sound/soc/codecs/rt5682s.c +@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + switch (mode) { + case SAR_PWR_SAVING: + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3, +- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS); ++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK, +- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG); ++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK | ++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM | ++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + usleep_range(5000, 5500); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN); +@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + break; + default: + dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode); +@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component) + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + } + + /** +@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ + jack_type = SND_JACK_HEADSET; + snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN); ++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT); + rt5682s_enable_push_button_irq(component); +@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component, + RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE | + RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK, + RT5682S_EMB_JD_EN | RT5682S_DET_TYPE | +- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS); ++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS); + regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN); + regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1, +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index 3059f814eb5c2d..fdf69917d19cc8 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1522,12 +1522,12 @@ static void snd_usbmidi_free(struct snd_usb_midi *umidi) + { + int i; + ++ if (!umidi->disconnected) ++ snd_usbmidi_disconnect(&umidi->list); ++ + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; +- if (ep->out) +- snd_usbmidi_out_endpoint_delete(ep->out); +- if (ep->in) +- snd_usbmidi_in_endpoint_delete(ep->in); ++ kfree(ep->out); + } + mutex_destroy(&umidi->mutex); + kfree(umidi); +@@ -1553,7 +1553,7 @@ void snd_usbmidi_disconnect(struct list_head *p) + spin_unlock_irq(&umidi->disc_lock); + up_write(&umidi->disc_rwsem); + +- del_timer_sync(&umidi->error_timer); ++ timer_shutdown_sync(&umidi->error_timer); + + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 9ef569492560ef..ddaeb4eb3e2497 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch new file mode 100644 index 0000000000..3197a64c47 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.111-112.patch @@ -0,0 +1,6153 @@ +diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst +index 5765eb3e9efa78..a30f4bed11b4ee 100644 +--- a/Documentation/trace/histogram-design.rst ++++ b/Documentation/trace/histogram-design.rst +@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking + trigger above. + + sched_waking histogram +-----------------------:: ++---------------------- ++ ++.. code-block:: + + +------------------+ + | hist_data |<-------------------------------------------------------+ +diff --git a/Makefile b/Makefile +index 9531c465e9c240..64d76baa0e0c9b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 111 ++SUBLEVEL = 112 + EXTRAVERSION = + NAME = Pinguïn Aangedreven + +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index fcc9a2313e1dfd..0cd08f7b8d8e06 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -266,7 +266,7 @@ vin0_pins: vin0 { + }; + + can0_pins: can0 { +- groups = "can0_data"; ++ groups = "can0_data_b"; + function = "can0"; + }; + +diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +index c14d5b70c72f6c..56f704082f94a5 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi +@@ -270,7 +270,7 @@ &tps { + vcc7-supply = <&vbat>; + vccio-supply = <&vbat>; + +- ti,en-ck32k-xtal = <1>; ++ ti,en-ck32k-xtal; + + regulators { + vrtc_reg: regulator@0 { +diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +index 72990e7ffe10ee..44718a4cec474c 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts +@@ -483,8 +483,6 @@ &mcasp1 { + + op-mode = <0>; /* MCASP_IIS_MODE */ + tdm-slots = <2>; +- /* 16 serializers */ +- num-serializer = <16>; + serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */ + 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 + >; +diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +index a7f99ae0c1fe9a..78c657429f6410 100644 +--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi ++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi +@@ -65,7 +65,7 @@ ads7846@0 { + ti,debounce-max = /bits/ 16 <10>; + ti,debounce-tol = /bits/ 16 <5>; + ti,debounce-rep = /bits/ 16 <1>; +- ti,keep-vref-on = <1>; ++ ti,keep-vref-on; + ti,settle-delay-usec = /bits/ 16 <150>; + + wakeup-source; +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index e5869cca5e7916..94dece1839af34 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -872,7 +872,7 @@ e_done: + /** + * at91_mckx_ps_restore: restore MCK1..4 settings + * +- * Side effects: overwrites tmp1, tmp2 ++ * Side effects: overwrites tmp1, tmp2 and tmp3 + */ + .macro at91_mckx_ps_restore + #ifdef CONFIG_SOC_SAMA7 +@@ -916,7 +916,7 @@ r_ps: + bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK + orr tmp3, tmp3, tmp1 + orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD +- str tmp2, [pmc, #AT91_PMC_MCR_V2] ++ str tmp3, [pmc, #AT91_PMC_MCR_V2] + + wait_mckrdy tmp1 + +diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts +index 152f95fd49a211..7089ccf3ce5566 100644 +--- a/arch/arm64/boot/dts/apple/t8103-j457.dts ++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts +@@ -21,6 +21,14 @@ aliases { + }; + }; + ++/* ++ * Adjust pcie0's iommu-map to account for the disabled port01. ++ */ ++&pcie0 { ++ iommu-map = <0x100 &pcie0_dart_0 1 1>, ++ <0x200 &pcie0_dart_2 1 1>; ++}; ++ + &bluetooth0 { + brcm,board-type = "apple,santorini"; + }; +@@ -36,10 +44,10 @@ &wifi0 { + */ + + &port02 { +- bus-range = <3 3>; ++ bus-range = <2 2>; + status = "okay"; + ethernet0: ethernet@0,0 { +- reg = <0x30000 0x0 0x0 0x0 0x0>; ++ reg = <0x20000 0x0 0x0 0x0 0x0>; + /* To be filled by the loader */ + local-mac-address = [00 10 18 00 00 00]; + }; +diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +index d89858c73ab1b0..243afbffa21fd7 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi +@@ -6,12 +6,12 @@ + #include + + &pwrap { +- pmic: mt6331 { ++ pmic: pmic { + compatible = "mediatek,mt6331"; + interrupt-controller; + #interrupt-cells = <2>; + +- mt6331regulator: mt6331regulator { ++ mt6331regulator: regulators { + compatible = "mediatek,mt6331-regulator"; + + mt6331_vdvfs11_reg: buck-vdvfs11 { +@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc { + }; + + mt6331_vdig18_reg: ldo-vdig18 { +- regulator-name = "dvdd18_dig"; ++ regulator-name = "vdig18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-ramp-delay = <0>; +@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 { + }; + }; + +- mt6331rtc: mt6331rtc { ++ mt6331rtc: rtc { + compatible = "mediatek,mt6331-rtc"; + }; + +- mt6331keys: mt6331keys { ++ mt6331keys: keys { + compatible = "mediatek,mt6331-keys"; + power { + linux,keycodes = ; +diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +index b5746e6d0b15a5..110fae4ec11c95 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts ++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts +@@ -136,7 +136,7 @@ proximity@48 { + + &mmc0 { + /* eMMC controller */ +- mediatek,latch-ck = <0x14>; /* hs400 */ ++ mediatek,latch-ck = <4>; /* hs400 */ + mediatek,hs200-cmd-int-delay = <1>; + mediatek,hs400-cmd-int-delay = <1>; + mediatek,hs400-ds-dly3 = <0x1a>; +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 22604d3abde3bd..4b701afe995e2f 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1524,9 +1524,6 @@ pcie0: pcie@112f0000 { + + power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>; + +- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>; +- reset-names = "mac"; +- + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc0 0>, +diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +index cce642c5381280..3d3db33a64dc66 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +@@ -11,7 +11,7 @@ + + / { + model = "Pumpkin MT8516"; +- compatible = "mediatek,mt8516"; ++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; + + memory@40000000 { + device_type = "memory"; +diff --git a/arch/arm64/boot/dts/qcom/qcm2290.dtsi b/arch/arm64/boot/dts/qcom/qcm2290.dtsi +index 40a8506553ef5d..4051a7660eb063 100644 +--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi +@@ -1107,6 +1107,7 @@ usb_dwc3: usb@4e00000 { + snps,has-lpm-erratum; + snps,hird-threshold = /bits/ 8 <0x10>; + snps,usb3_lpm_capable; ++ snps,parkmode-disable-ss-quirk; + maximum-speed = "super-speed"; + dr_mode = "otg"; + }; +diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +index 83fce96a25752e..0234dbe95413cd 100644 +--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi ++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi +@@ -38,7 +38,10 @@ hdmi_con_out: endpoint { + #if (SW_SCIF_CAN || SW_RSPI_CAN) + &canfd { + pinctrl-0 = <&can1_pins>; +- /delete-node/ channel@0; ++ ++ channel0 { ++ status = "disabled"; ++ }; + }; + #else + &canfd { +diff --git a/arch/loongarch/kernel/relocate.c b/arch/loongarch/kernel/relocate.c +index 0eddd4a66b8745..1432bb214e3f49 100644 +--- a/arch/loongarch/kernel/relocate.c ++++ b/arch/loongarch/kernel/relocate.c +@@ -124,6 +124,10 @@ static inline __init bool kaslr_disabled(void) + if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' ')) + return true; + ++ str = strstr(boot_command_line, "kexec_file"); ++ if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' ')) ++ return true; ++ + return false; + } + +diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S +index cbd42ea7c3f7c2..99357bfa8e82ad 100644 +--- a/arch/sparc/lib/M7memcpy.S ++++ b/arch/sparc/lib/M7memcpy.S +@@ -696,16 +696,16 @@ FUNC_NAME: + EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) + faligndata %f24, %f26, %f10 + EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) +- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) + faligndata %f26, %f28, %f12 +- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) + add %o4, 64, %o4 +- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) ++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) + faligndata %f28, %f30, %f14 +- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) +- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) + add %o0, 64, %o0 +- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) ++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f30, %f14 + bgu,pt %xcc, .Lunalign_sloop + prefetch [%o4 + (8 * BLOCK_SIZE)], 20 +@@ -728,7 +728,7 @@ FUNC_NAME: + add %o4, 8, %o4 + faligndata %f0, %f2, %f16 + subcc %o5, 8, %o5 +- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) ++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) + fsrc2 %f2, %f0 + bgu,pt %xcc, .Lunalign_by8 + add %o0, 8, %o0 +@@ -772,7 +772,7 @@ FUNC_NAME: + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %xcc, 1b + add %o0, 0x20, %o0 +@@ -804,12 +804,12 @@ FUNC_NAME: + brz,pt %o3, 2f + sub %o2, %o3, %o2 + +-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) ++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) + add %o1, 1, %o1 + subcc %o3, 1, %o3 + add %o0, 1, %o0 + bne,pt %xcc, 1b +- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) ++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) + 2: + and %o1, 0x7, %o3 + brz,pn %o3, .Lmedium_noprefetch_cp +diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S +index 64fbac28b3db18..207343367bb2da 100644 +--- a/arch/sparc/lib/Memcpy_utils.S ++++ b/arch/sparc/lib/Memcpy_utils.S +@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) + ba,pt %xcc, __restore_asi + add %o2, 8, %o0 + ENDPROC(memcpy_retl_o2_plus_63_8) ++ENTRY(memcpy_retl_o2_plus_o3) ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3) ++ENTRY(memcpy_retl_o2_plus_o3_plus_1) ++ add %o3, 1, %o3 ++ ba,pt %xcc, __restore_asi ++ add %o2, %o3, %o0 ++ENDPROC(memcpy_retl_o2_plus_o3_plus_1) + ENTRY(memcpy_retl_o2_plus_o5) + ba,pt %xcc, __restore_asi + add %o2, %o5, %o0 +diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S +index 7ad58ebe0d0096..df0ec1bd194892 100644 +--- a/arch/sparc/lib/NG4memcpy.S ++++ b/arch/sparc/lib/NG4memcpy.S +@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + subcc %o5, 0x20, %o5 + EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) + EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) +- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) ++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) + EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) + bne,pt %icc, 1b + add %o0, 0x20, %o0 +diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S +index ee51c12306894e..bbd3ea0a64822c 100644 +--- a/arch/sparc/lib/NGmemcpy.S ++++ b/arch/sparc/lib/NGmemcpy.S +@@ -79,8 +79,8 @@ + #ifndef EX_RETVAL + #define EX_RETVAL(x) x + __restore_asi: +- ret + wr %g0, ASI_AIUS, %asi ++ ret + restore + ENTRY(NG_ret_i2_plus_i4_plus_1) + ba,pt %xcc, __restore_asi +@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) + ba,pt %xcc, __restore_asi + add %i2, %g1, %i0 + ENDPROC(NG_ret_i2_plus_g1_minus_56) +-ENTRY(NG_ret_i2_plus_i4) ++ENTRY(NG_ret_i2_plus_i4_plus_16) ++ add %i4, 16, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4) +-ENTRY(NG_ret_i2_plus_i4_minus_8) +- sub %i4, 8, %i4 ++ENDPROC(NG_ret_i2_plus_i4_plus_16) ++ENTRY(NG_ret_i2_plus_i4_plus_8) ++ add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +-ENDPROC(NG_ret_i2_plus_i4_minus_8) ++ENDPROC(NG_ret_i2_plus_i4_plus_8) + ENTRY(NG_ret_i2_plus_8) + ba,pt %xcc, __restore_asi + add %i2, 8, %i0 +@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 + ENDPROC(NG_ret_i2_and_7_plus_i4) ++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) ++ and %i2, 7, %i2 ++ add %i4, 8, %i4 ++ ba,pt %xcc, __restore_asi ++ add %i2, %i4, %i0 ++ENDPROC(NG_ret_i2_and_7_plus_i4) + #endif + + .align 64 +@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + andn %i2, 0xf, %i4 + and %i2, 0xf, %i2 + 1: subcc %i4, 0x10, %i4 +- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x08, %i1 +- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) ++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) + sub %i1, 0x08, %i1 +- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) ++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) + add %i1, 0x8, %i1 +- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) ++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) + bgu,pt %XCC, 1b + add %i1, 0x8, %i1 + 73: andcc %i2, 0x8, %g0 +@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ + subcc %i4, 0x8, %i4 + srlx %g3, %i3, %i5 + or %i5, %g2, %i5 +- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) ++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) + add %o0, 0x8, %o0 + bgu,pt %icc, 1b + sllx %g3, %g1, %g2 +diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S +index 635398ec7540ee..154fbd35400ca8 100644 +--- a/arch/sparc/lib/U1memcpy.S ++++ b/arch/sparc/lib/U1memcpy.S +@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) + retl + add %o0, %o2, %o0 + ENDPROC(U1_gs_40_fp) +-ENTRY(U1_g3_0_fp) +- VISExitHalf +- retl +- add %g3, %o2, %o0 +-ENDPROC(U1_g3_0_fp) + ENTRY(U1_g3_8_fp) + VISExitHalf + add %g3, 8, %g3 + retl + add %g3, %o2, %o0 + ENDPROC(U1_g3_8_fp) ++ENTRY(U1_g3_16_fp) ++ VISExitHalf ++ add %g3, 16, %g3 ++ retl ++ add %g3, %o2, %o0 ++ENDPROC(U1_g3_16_fp) + ENTRY(U1_o2_0_fp) + VISExitHalf + retl +@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + 62: FINISH_VISCHUNK(o0, f44, f46) + 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) + +-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) ++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f0, %f2, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bl,pn %xcc, 95f + add %o0, 8, %o0 +- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) ++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) + add %o1, 8, %o1 + subcc %g3, 8, %g3 + faligndata %f2, %f0, %f8 +- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) ++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) + bge,pt %xcc, 93b + add %o0, 8, %o0 + +diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S +index 9248d59c734ce2..bace3a18f836f1 100644 +--- a/arch/sparc/lib/U3memcpy.S ++++ b/arch/sparc/lib/U3memcpy.S +@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + faligndata %f10, %f12, %f26 + EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + ++ and %o2, 0x3f, %o2 + subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE + add %o1, 0x40, %o1 + bgu,pt %XCC, 1f +@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ + * Also notice how this code is careful not to perform a + * load past the end of the src buffer. + */ +- and %o2, 0x3f, %o2 + andcc %o2, 0x38, %g2 + be,pn %XCC, 2f + subcc %g2, 0x8, %g2 +diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h +index 9d6411c6592050..00cefbb59fa98c 100644 +--- a/arch/x86/include/asm/segment.h ++++ b/arch/x86/include/asm/segment.h +@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node) + + static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + { +- unsigned int p; ++ unsigned long p; + + /* + * Load CPU and node number from the GDT. LSL is faster than RDTSCP +@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node) + * + * If RDPID is available, use it. + */ +- alternative_io ("lsl %[seg],%[p]", +- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */ ++ alternative_io ("lsl %[seg],%k[p]", ++ "rdpid %[p]", + X86_FEATURE_RDPID, +- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); ++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); + + if (cpu) + *cpu = (p & VDSO_CPUNODE_MASK); +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 156e9bb07abf1a..2fb234ab467b16 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx) + return; + + hctx_for_each_ctx(hctx, ctx, i) +- kobject_del(&ctx->kobj); ++ if (ctx->kobj.state_in_sysfs) ++ kobject_del(&ctx->kobj); + +- kobject_del(&hctx->kobj); ++ if (hctx->kobj.state_in_sysfs) ++ kobject_del(&hctx->kobj); + } + + static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 021994f6d2d829..a891f27ff834d0 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -553,7 +553,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb + int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + sector_t start) + { +- unsigned int top, bottom, alignment, ret = 0; ++ unsigned int top, bottom, alignment; ++ int ret = 0; + + t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors); + t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors); +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index 0a7049b470c181..5201f47e31d8b0 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -618,11 +618,14 @@ int x509_process_extension(void *context, size_t hdrlen, + /* + * Get hold of the basicConstraints + * v[1] is the encoding size +- * (Expect 0x2 or greater, making it 1 or more bytes) ++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or ++ * 0x03 or greater for non-empty SEQUENCE) + * v[2] is the encoding type + * (Expect an ASN1_BOOL for the CA) +- * v[3] is the contents of the ASN1_BOOL +- * (Expect 1 if the CA is TRUE) ++ * v[3] is the length of the ASN1_BOOL ++ * (Expect 1 for a single byte boolean) ++ * v[4] is the contents of the ASN1_BOOL ++ * (Expect 0xFF if the CA is TRUE) + * vlen should match the entire extension size + */ + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) +@@ -631,8 +634,13 @@ int x509_process_extension(void *context, size_t hdrlen, + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; +- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) ++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */ ++ if (v[1] == 0) ++ return 0; ++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF) + ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA; ++ else ++ return -EBADMSG; + return 0; + } + +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index 82563b44af3514..261dc8f87556df 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -1139,7 +1139,7 @@ struct acpi_port_info { + #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91 + #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92 + #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93 +-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94 ++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93 + + /***************************************************************************** + * +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index a466ad6e5d93a9..5a1ced5bf7f6fa 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + if (ndr_desc->target_node == NUMA_NO_NODE) { + ndr_desc->target_node = phys_to_target_node(spa->address); + dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]", +- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end); ++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end); + } + + /* +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 0888e4d618d53a..b524cf27213d4f 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr) + if (retval) { + if (acpi_processor_registered == 0) + cpuidle_unregister_driver(&acpi_idle_driver); ++ ++ per_cpu(acpi_cpuidle_device, pr->id) = NULL; ++ kfree(dev); + return retval; + } + acpi_processor_registered++; +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 4d588f4658c85c..47960a34305d3f 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -878,6 +878,10 @@ int __register_one_node(int nid) + node_devices[nid] = node; + + error = register_node(node_devices[nid], nid); ++ if (error) { ++ node_devices[nid] = NULL; ++ return error; ++ } + + /* link cpu under this node */ + for_each_present_cpu(cpu) { +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index baa31194cf20d5..ef5157fc8dcc51 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a + if (dev->power.syscore || dev->power.direct_complete) + goto Out; + +- if (!dev->power.is_noirq_suspended) ++ if (!dev->power.is_noirq_suspended) { ++ /* ++ * This means that system suspend has been aborted in the noirq ++ * phase before invoking the noirq suspend callback for the ++ * device, so if device_suspend_late() has left it in suspend, ++ * device_resume_early() should leave it in suspend either in ++ * case the early resume of it depends on the noirq resume that ++ * has not run. ++ */ ++ if (dev_pm_skip_suspend(dev)) ++ dev->power.must_resume = false; ++ + goto Out; ++ } + + if (!dpm_wait_for_superior(dev, async)) + goto Out; +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1209e01f8c7f97..9603c28a3ed823 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev, + map->read_flag_mask = bus->read_flag_mask; + } + +- if (config && config->read && config->write) { ++ if (config->read && config->write) { + map->reg_read = _regmap_bus_read; + if (config->reg_update_bits) + map->reg_update_bits = config->reg_update_bits; +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 3742ddf46c55ae..27a05b1521f693 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, + if (!sock) + return NULL; + ++ if (!sk_is_tcp(sock->sk) && ++ !sk_is_stream_unix(sock->sk)) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); ++ *err = -EINVAL; ++ sockfd_put(sock); ++ return NULL; ++ } ++ + if (sock->ops->shutdown == sock_no_shutdown) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); + *err = -EINVAL; +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 97ed3bd9707f41..2dd254c720f5fa 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu + + static unsigned long g_cache_size; + module_param_named(cache_size, g_cache_size, ulong, 0444); +-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)"); ++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)"); + + static unsigned int g_mbps; + module_param_named(mbps, g_mbps, uint, 0444); +diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c +index 350e7b24ee2b09..03642df2df0bbf 100644 +--- a/drivers/bus/fsl-mc/fsl-mc-bus.c ++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c +@@ -1103,6 +1103,9 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) + * Get physical address of MC portal for the root DPRC: + */ + plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!plat_res) ++ return -EINVAL; ++ + mc_portal_phys_addr = plat_res->start; + mc_portal_size = resource_size(plat_res); + mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff; +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index 8de74dcfa18cf5..ece2d794174d40 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG + config HW_RANDOM_NOMADIK + tristate "ST-Ericsson Nomadik Random Number Generator support" + depends on ARCH_NOMADIK || COMPILE_TEST ++ depends on ARM_AMBA + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c +index 2f2f21f1b659e0..d7b42888f25c28 100644 +--- a/drivers/char/hw_random/ks-sa-rng.c ++++ b/drivers/char/hw_random/ks-sa-rng.c +@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(ks_sa_rng->clk)) ++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n"); ++ + pm_runtime_enable(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 6ff77003a96eac..68325ebd56fe37 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev) + return true; + } + ++ /* ++ * Older Broadcom STB chips had a "clocks" property for CPU node(s) ++ * that did not match the SCMI performance protocol node, if we got ++ * there, it means we had such an older Device Tree, therefore return ++ * true to preserve backwards compatibility. ++ */ ++ if (of_machine_is_compatible("brcm,brcmstb")) ++ return true; ++ + return false; + } + +diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c +index 1fc9968eae1996..b6b06a510fd866 100644 +--- a/drivers/cpuidle/cpuidle-qcom-spm.c ++++ b/drivers/cpuidle/cpuidle-qcom-spm.c +@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu) + return -ENODEV; + + saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0); ++ of_node_put(cpu_node); + if (!saw_node) + return -ENODEV; + + pdev = of_find_device_by_node(saw_node); + of_node_put(saw_node); +- of_node_put(cpu_node); + if (!pdev) + return -ENODEV; + + data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ put_device(&pdev->dev); + return -ENOMEM; ++ } + + data->spm = dev_get_drvdata(&pdev->dev); ++ put_device(&pdev->dev); + if (!data->spm) + return -EINVAL; + +diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c +index bd205f1f2279e4..573c0033a5afe3 100644 +--- a/drivers/crypto/hisilicon/debugfs.c ++++ b/drivers/crypto/hisilicon/debugfs.c +@@ -865,6 +865,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm, + dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs)); + ret = PTR_ERR(qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs = NULL; ++ qm->debug.qm_diff_regs = NULL; + return ret; + } + +diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c +index 762a2a54ca8219..e3d113334d4e48 100644 +--- a/drivers/crypto/hisilicon/hpre/hpre_main.c ++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c +@@ -689,6 +689,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm) + + /* Config data buffer pasid needed by Kunpeng 920 */ + hpre_config_pasid(qm); ++ hpre_open_sva_prefetch(qm); + + hpre_enable_clock_gate(qm); + +@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre) + if (ret) + return ret; + +- hpre_open_sva_prefetch(qm); +- + hisi_qm_dev_err_init(qm); + ret = hpre_show_last_regs_init(qm); + if (ret) +diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c +index 7921409791fb03..203240e78f6adb 100644 +--- a/drivers/crypto/hisilicon/qm.c ++++ b/drivers/crypto/hisilicon/qm.c +@@ -3748,6 +3748,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf, + } + + pdev = container_of(dev, struct pci_dev, dev); ++ if (pci_physfn(pdev) != qm->pdev) { ++ pci_err(qm->pdev, "the pdev input does not match the pf!\n"); ++ return -EINVAL; ++ } + + *fun_index = pdev->devfn; + +@@ -4363,9 +4367,6 @@ static void qm_restart_prepare(struct hisi_qm *qm) + { + u32 value; + +- if (qm->err_ini->open_sva_prefetch) +- qm->err_ini->open_sva_prefetch(qm); +- + if (qm->ver >= QM_HW_V3) + return; + +diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c +index 6aaaaf784ddc03..064fbc8db16fc8 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_main.c ++++ b/drivers/crypto/hisilicon/sec2/sec_main.c +@@ -436,6 +436,45 @@ static void sec_set_endian(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG); + } + ++static void sec_close_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val |= SEC_PREFETCH_DISABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, ++ val, !(val & SEC_SVA_DISABLE_READY), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to close sva prefetch\n"); ++} ++ ++static void sec_open_sva_prefetch(struct hisi_qm *qm) ++{ ++ u32 val; ++ int ret; ++ ++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) ++ return; ++ ++ /* Enable prefetch */ ++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); ++ val &= SEC_PREFETCH_ENABLE; ++ writel(val, qm->io_base + SEC_PREFETCH_CFG); ++ ++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, ++ val, !(val & SEC_PREFETCH_DISABLE), ++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); ++ if (ret) ++ pci_err(qm->pdev, "failed to open sva prefetch\n"); ++} ++ + static void sec_engine_sva_config(struct hisi_qm *qm) + { + u32 reg; +@@ -469,45 +508,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm) + writel_relaxed(reg, qm->io_base + + SEC_INTERFACE_USER_CTRL1_REG); + } +-} +- +-static void sec_open_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- /* Enable prefetch */ +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val &= SEC_PREFETCH_ENABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG, +- val, !(val & SEC_PREFETCH_DISABLE), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to open sva prefetch\n"); +-} +- +-static void sec_close_sva_prefetch(struct hisi_qm *qm) +-{ +- u32 val; +- int ret; +- +- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps)) +- return; +- +- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG); +- val |= SEC_PREFETCH_DISABLE; +- writel(val, qm->io_base + SEC_PREFETCH_CFG); +- +- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS, +- val, !(val & SEC_SVA_DISABLE_READY), +- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to close sva prefetch\n"); ++ sec_open_sva_prefetch(qm); + } + + static void sec_enable_clock_gate(struct hisi_qm *qm) +@@ -1090,7 +1091,6 @@ static int sec_pf_probe_init(struct sec_dev *sec) + if (ret) + return ret; + +- sec_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + sec_debug_regs_clear(qm); + ret = sec_show_last_regs_init(qm); +diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c +index 66e553115adfd5..b70aa6032874e1 100644 +--- a/drivers/crypto/hisilicon/zip/zip_main.c ++++ b/drivers/crypto/hisilicon/zip/zip_main.c +@@ -469,10 +469,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg) + return false; + } + +-static int hisi_zip_set_high_perf(struct hisi_qm *qm) ++static void hisi_zip_set_high_perf(struct hisi_qm *qm) + { + u32 val; +- int ret; + + val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET); + if (perf_mode == HZIP_HIGH_COMP_PERF) +@@ -482,13 +481,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm) + + /* Set perf mode */ + writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET); +- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET, +- val, val == perf_mode, HZIP_DELAY_1_US, +- HZIP_POLL_TIMEOUT_US); +- if (ret) +- pci_err(qm->pdev, "failed to set perf mode\n"); +- +- return ret; + } + + static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm) +@@ -585,6 +577,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63); + writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63); + } ++ hisi_zip_open_sva_prefetch(qm); + + /* let's open all compression/decompression cores */ + dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val; +@@ -596,6 +589,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm) + CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) | + FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL); + ++ hisi_zip_set_high_perf(qm); + hisi_zip_enable_clock_gate(qm); + + return 0; +@@ -1180,11 +1174,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip) + if (ret) + return ret; + +- ret = hisi_zip_set_high_perf(qm); +- if (ret) +- return ret; +- +- hisi_zip_open_sva_prefetch(qm); + hisi_qm_dev_err_init(qm); + hisi_zip_debug_regs_clear(qm); + +diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +index b7322230353998..3b5d5b64e14142 100644 +--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c ++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c +@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + struct device *dev = rctx->hcu_dev->dev; + unsigned int remainder = 0; + unsigned int total; +- size_t nents; ++ int nents; + size_t count; + int rc; + int i; +@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req) + /* Determine the number of scatter gather list entries to process. */ + nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder); + ++ if (nents < 0) ++ return nents; ++ + /* If there are entries to process, map them. */ + if (nents) { + rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents, +diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c +index 83a73f0ccd803b..eff9b2c06aef4d 100644 +--- a/drivers/devfreq/mtk-cci-devfreq.c ++++ b/drivers/devfreq/mtk-cci-devfreq.c +@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev) + out_free_resources: + if (regulator_is_enabled(drv->proc_reg)) + regulator_disable(drv->proc_reg); +- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg)) ++ if (!IS_ERR_OR_NULL(drv->sram_reg) && ++ regulator_is_enabled(drv->sram_reg)) + regulator_disable(drv->sram_reg); + + return ret; +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index 068597e8fce95a..3c70d860749757 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -970,6 +970,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan) + return !!GET_BITFIELD(mcmtr, 2, 2); + } + ++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan) ++{ ++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan); ++ ++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr); ++ ++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18)); ++} ++ + static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + struct res_config *cfg) + { +@@ -983,6 +992,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci, + if (!imc->mbase) + continue; + ++ if (i10nm_channel_disabled(imc, i)) { ++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i); ++ continue; ++ } ++ + ndimms = 0; + amap = I10NM_GET_AMAP(imc, i); + +diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig +index f2fdd375664822..179f5d46d8ddff 100644 +--- a/drivers/firmware/meson/Kconfig ++++ b/drivers/firmware/meson/Kconfig +@@ -5,7 +5,7 @@ + config MESON_SM + tristate "Amlogic Secure Monitor driver" + depends on ARCH_MESON || COMPILE_TEST +- default y ++ default ARCH_MESON + depends on ARM64_4K_PAGES + help + Say y here to enable the Amlogic secure monitor driver +diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +index 5534c769b65508..1e0189f90fd6ac 100644 +--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev, + * + * @handle: handle used to pass amdgpu_device pointer + * +- * Initialize the hardware, boot up the VCPU and do some testing ++ * Initialize the hardware, boot up the VCPU and do some testing. ++ * ++ * On SI, the UVD is meant to be used in a specific power state, ++ * or alternatively the driver can manually enable its clock. ++ * In amdgpu we use the dedicated UVD power state when DPM is enabled. ++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state ++ * for the SMU and afterwards enables the UVD clock. ++ * This is automatically done by amdgpu_uvd_ring_begin_use when work ++ * is submitted to the UVD ring. Here, we have to call it manually ++ * in order to power up UVD before firmware validation. ++ * ++ * Note that we must not disable the UVD clock here, as that would ++ * cause the ring test to fail. However, UVD is powered off ++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls ++ * the UVD idle work handler which will disable the UVD clock when ++ * all fences are signalled. + */ + static int uvd_v3_1_hw_init(void *handle) + { +@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle) + int r; + + uvd_v3_1_mc_resume(adev); ++ uvd_v3_1_enable_mgcg(adev, true); ++ ++ /* Make sure UVD is powered during FW validation. ++ * It's going to be automatically powered off after the ring test. ++ */ ++ if (adev->pm.dpm_enabled) ++ amdgpu_dpm_enable_uvd(adev, true); ++ else ++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); + + r = uvd_v3_1_fw_validate(adev); + if (r) { +@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle) + return r; + } + +- uvd_v3_1_enable_mgcg(adev, true); +- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000); +- + uvd_v3_1_start(adev); + + r = amdgpu_ring_test_helper(ring); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index b77b4723323164..3168d6fb11e76b 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -4142,7 +4142,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, + r = svm_range_get_attr(p, mm, start, size, nattrs, attrs); + break; + default: +- r = EINVAL; ++ r = -EINVAL; + break; + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +index 9ba6cb67655f4a..6c75aa82327ac1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c +@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs, + if (dual_plane) { + unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param, + num_pipes, pipe_idx); +- ; + if (src->sw_mode == dm_sw_linear) + ASSERT(p1_pte_row_height_linear >= 8); + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +index 42efe838fa85c5..2d2d2d5e676341 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev) + (amdgpu_crtc->v_border * 2)); + + vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock; ++ ++ /* we have issues with mclk switching with ++ * refresh rates over 120 hz on the non-DC code. ++ */ ++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120) ++ vblank_time_us = 0; ++ + break; + } + } +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index e7b1fa2feb9288..2863dc65ffc6fb 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle) + /* we never hit the non-gddr5 limit so disable it */ + u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0; + +- if (vblank_time < switch_limit) ++ /* Consider zero vblank time too short and disable MCLK switching. ++ * Note that the vblank time is set to maximum when no displays are attached, ++ * so we'll still enable MCLK switching in that case. ++ */ ++ if (vblank_time == 0) ++ return true; ++ else if (vblank_time < switch_limit) + return true; + else + return false; +@@ -3424,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + { + struct si_ps *ps = si_get_ps(rps); + struct amdgpu_clock_and_voltage_limits *max_limits; ++ struct amdgpu_connector *conn; + bool disable_mclk_switching = false; + bool disable_sclk_switching = false; + u32 mclk, sclk; + u16 vddc, vddci, min_vce_voltage = 0; + u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc; + u32 max_sclk = 0, max_mclk = 0; ++ u32 high_pixelclock_count = 0; + int i; + + if (adev->asic_type == CHIP_HAINAN) { +@@ -3457,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + } + } + ++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz. ++ * For example, 4K 60Hz and 1080p 144Hz fall into this category. ++ * Find number of such displays connected. ++ */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) { ++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) || ++ !adev->mode_info.crtcs[i]->enabled) ++ continue; ++ ++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector); ++ ++ if (conn->pixelclock_for_modeset > 297000) ++ high_pixelclock_count++; ++ } ++ ++ /* These are some ad-hoc fixes to some issues observed with SI GPUs. ++ * They are necessary because we don't have something like dce_calcs ++ * for these GPUs to calculate bandwidth requirements. ++ */ ++ if (high_pixelclock_count) { ++ /* On Oland, we observe some flickering when two 4K 60Hz ++ * displays are connected, possibly because voltage is too low. ++ * Raise the voltage by requiring a higher SCLK. ++ * (Voltage cannot be adjusted independently without also SCLK.) ++ */ ++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND) ++ disable_sclk_switching = true; ++ } ++ + if (rps->vce_active) { + rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk; + rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk; +@@ -5617,14 +5654,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev, + + static int si_disable_ulv(struct amdgpu_device *adev) + { +- struct si_power_info *si_pi = si_get_pi(adev); +- struct si_ulv_param *ulv = &si_pi->ulv; +- +- if (ulv->supported) +- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ? +- 0 : -EINVAL; ++ PPSMC_Result r; + +- return 0; ++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV); ++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL; + } + + static bool si_is_state_ulv_compatible(struct amdgpu_device *adev, +@@ -5797,9 +5830,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + { + struct amdgpu_crtc *amdgpu_crtc = NULL; + int i; +- +- if (adev->pm.dpm.new_active_crtc_count == 0) +- return 0; ++ u32 crtc_index = 0; ++ u32 mclk_change_block_cp_min = 0; ++ u32 mclk_change_block_cp_max = 0; + + for (i = 0; i < adev->mode_info.num_crtc; i++) { + if (adev->pm.dpm.new_active_crtcs & (1 << i)) { +@@ -5808,26 +5841,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev) + } + } + +- if (amdgpu_crtc == NULL) +- return 0; ++ /* When a display is plugged in, program these so that the SMC ++ * performs MCLK switching when it doesn't cause flickering. ++ * When no display is plugged in, there is no need to restrict ++ * MCLK switching, so program them to zero. ++ */ ++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) { ++ crtc_index = amdgpu_crtc->crtc_id; + +- if (amdgpu_crtc->line_time <= 0) +- return 0; ++ if (amdgpu_crtc->line_time) { ++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time; ++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time; ++ } ++ } + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_crtc_index, +- amdgpu_crtc->crtc_id) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_crtc_index, ++ crtc_index); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, +- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min, ++ mclk_change_block_cp_min); + +- if (si_write_smc_soft_register(adev, +- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, +- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK) +- return 0; ++ si_write_smc_soft_register(adev, ++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max, ++ mclk_change_block_cp_max); + + return 0; + } +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index 3e6a4e2044c0eb..5a4d574b37b89f 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -85,6 +85,7 @@ config DRM_ITE_IT6505 + select EXTCON + select CRYPTO + select CRYPTO_HASH ++ select REGMAP_I2C + help + ITE IT6505 DisplayPort bridge chip driver. + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 0a45c546b03f2b..a5cd41c9224d75 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -433,7 +433,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + static int dpu_encoder_phys_wb_wait_for_commit_done( + struct dpu_encoder_phys *phys_enc) + { +- unsigned long ret; ++ int ret; + struct dpu_encoder_wait_info wait_info; + struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc); + +diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +index 5bbea734123bc0..ee04c55175bb85 100644 +--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c ++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c +@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl) + par = 0x00; + ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY, + &par, 1); +- if (ret) { ++ if (ret < 0) { + dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret); + return ret; + } +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index ac77d1246b9453..811265648a5828 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + unsigned block_align, unsigned height_align, unsigned base_align, + unsigned *l0_size, unsigned *mipmap_size) + { +- unsigned offset, i, level; ++ unsigned offset, i; + unsigned width, height, depth, size; + unsigned blocksize; + unsigned nbx, nby; +@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, + w0 = r600_mip_minify(w0, 0); + h0 = r600_mip_minify(h0, 0); + d0 = r600_mip_minify(d0, 0); +- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) { ++ for (i = 0, offset = 0; i < nlevels; i++) { + width = r600_mip_minify(w0, i); + nbx = r600_fmt_get_nblocksx(format, width); + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index c25a54d5b39ad5..0ba9195c9d713e 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -113,8 +113,8 @@ struct mlxreg_fan { + int divider; + }; + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state); ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal); + + static int + mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, +@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, + * last thermal state. + */ + if (pwm->last_hwmon_state >= pwm->last_thermal_state) +- return mlxreg_fan_set_cur_state(pwm->cdev, +- pwm->last_hwmon_state); ++ return _mlxreg_fan_set_cur_state(pwm->cdev, ++ pwm->last_hwmon_state, ++ false); + return 0; + } + return regmap_write(fan->regmap, pwm->reg, val); +@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + +-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, +- unsigned long state) +- ++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state, bool thermal) + { + struct mlxreg_fan_pwm *pwm = cdev->devdata; + struct mlxreg_fan *fan = pwm->fan; +@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return -EINVAL; + + /* Save thermal state. */ +- pwm->last_thermal_state = state; ++ if (thermal) ++ pwm->last_thermal_state = state; + + state = max_t(unsigned long, state, pwm->last_hwmon_state); + err = regmap_write(fan->regmap, pwm->reg, +@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, + return 0; + } + ++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, ++ unsigned long state) ++ ++{ ++ return _mlxreg_fan_set_cur_state(cdev, state, true); ++} ++ + static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { + .get_max_state = mlxreg_fan_get_max_state, + .get_cur_state = mlxreg_fan_get_cur_state, +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index 3b57851869eaae..a8369527372097 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1638,8 +1638,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc) + goto out_unlock; + } + +- if (csdev->type == CORESIGHT_DEV_TYPE_SINK || +- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) { ++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || ++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && ++ sink_ops(csdev)->alloc_buffer) { + ret = etm_perf_add_symlink_sink(csdev); + + if (ret) { +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 05d9f87e35333c..e4d8d446ea4d32 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); + etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i)); +@@ -1323,6 +1324,7 @@ static void etm4_init_arch_data(void *info) + etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5); + /* NUMEXTIN, bits[8:0] number of external inputs implemented */ + drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5); ++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5); + /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */ + drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5); + /* ATBTRIG, bit[22] implementation can support ATB triggers? */ +@@ -1750,7 +1752,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } +- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); ++ ++ if (drvdata->numextinsel) ++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i)); +@@ -1882,7 +1886,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } +- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); ++ if (drvdata->numextinsel) ++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i)); +@@ -2113,6 +2118,10 @@ static int etm4_probe(struct device *dev) + if (WARN_ON(!drvdata)) + return -ENOMEM; + ++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk"); ++ if (IS_ERR(drvdata->atclk)) ++ return PTR_ERR(drvdata->atclk); ++ + if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE) + pm_save_enable = coresight_loses_context_with_cpu(dev) ? + PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER; +@@ -2364,8 +2373,8 @@ static int etm4_runtime_suspend(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_disable_unprepare(drvdata->pclk); ++ clk_disable_unprepare(drvdata->atclk); ++ clk_disable_unprepare(drvdata->pclk); + + return 0; + } +@@ -2373,11 +2382,17 @@ static int etm4_runtime_suspend(struct device *dev) + static int etm4_runtime_resume(struct device *dev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(dev); ++ int ret; + +- if (drvdata->pclk && !IS_ERR(drvdata->pclk)) +- clk_prepare_enable(drvdata->pclk); ++ ret = clk_prepare_enable(drvdata->pclk); ++ if (ret) ++ return ret; + +- return 0; ++ ret = clk_prepare_enable(drvdata->atclk); ++ if (ret) ++ clk_disable_unprepare(drvdata->pclk); ++ ++ return ret; + } + #endif + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 6b6760e49ed357..d8b8102d790ccb 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -162,6 +162,7 @@ + #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28) + + #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0) ++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9) + #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16) + #define TRCIDR5_ATBTRIG BIT(22) + #define TRCIDR5_LPOVERRIDE BIT(23) +@@ -919,7 +920,8 @@ struct etmv4_save_state { + + /** + * struct etm4_drvdata - specifics associated to an ETM component +- * @pclk APB clock if present, otherwise NULL ++ * @pclk: APB clock if present, otherwise NULL ++ * @atclk: Optional clock for the core parts of the ETMv4. + * @base: Memory mapped base address for this component. + * @csdev: Component vitals needed by the framework. + * @spinlock: Only one at a time pls. +@@ -987,6 +989,7 @@ struct etmv4_save_state { + */ + struct etmv4_drvdata { + struct clk *pclk; ++ struct clk *atclk; + void __iomem *base; + struct coresight_device *csdev; + spinlock_t spinlock; +@@ -999,6 +1002,7 @@ struct etmv4_drvdata { + u8 nr_cntr; + u8 nr_ext_inp; + u8 numcidc; ++ u8 numextinsel; + u8 numvmidc; + u8 nrseqstate; + u8 nr_event; +diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c +index e20c1c6acc7315..a564bd5c8b62d3 100644 +--- a/drivers/hwtracing/coresight/coresight-trbe.c ++++ b/drivers/hwtracing/coresight/coresight-trbe.c +@@ -21,7 +21,8 @@ + #include "coresight-self-hosted-trace.h" + #include "coresight-trbe.h" + +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* + * A padding packet that will help the user space tools +@@ -743,12 +744,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + + buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event)); + if (!buf) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL); + if (!pglist) { + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + + for (i = 0; i < nr_pages; i++) +@@ -758,7 +759,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, + if (!buf->trbe_base) { + kfree(pglist); + kfree(buf); +- return ERR_PTR(-ENOMEM); ++ return NULL; + } + buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE; + buf->trbe_write = buf->trbe_base; +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 1ebcf5673a06b2..e6fa6cb1011ab1 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -394,6 +394,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) + + exit_probe: + dw_i2c_plat_pm_cleanup(dev); ++ i2c_dw_prepare_clk(dev, false); + exit_reset: + reset_control_assert(dev->rst); + return ret; +@@ -411,9 +412,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev) + i2c_dw_disable(dev); + + pm_runtime_dont_use_autosuspend(device); +- pm_runtime_put_sync(device); ++ pm_runtime_put_noidle(device); + dw_i2c_plat_pm_cleanup(dev); + ++ i2c_dw_prepare_clk(dev, false); ++ + i2c_dw_remove_lock_support(dev); + + reset_control_assert(dev->rst); +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 1a9b5a068ef1b2..6b788bca64d54c 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + { + int ret; + int left_num = num; ++ bool write_then_read_en = false; + struct mtk_i2c *i2c = i2c_get_adapdata(adap); + + ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks); +@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) && + msgs[0].addr == msgs[1].addr) { + i2c->auto_restart = 0; ++ write_then_read_en = true; + } + } + +@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + else + i2c->op = I2C_MASTER_WR; + +- if (!i2c->auto_restart) { +- if (num > 1) { +- /* combined two messages into one transaction */ +- i2c->op = I2C_MASTER_WRRD; +- left_num--; +- } ++ if (write_then_read_en) { ++ /* combined two messages into one transaction */ ++ i2c->op = I2C_MASTER_WRRD; ++ left_num--; + } + + /* always use DMA mode. */ +@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, + if (ret < 0) + goto err_exit; + +- msgs++; ++ if (i2c->op == I2C_MASTER_WRRD) ++ msgs += 2; ++ else ++ msgs++; + } + /* the return value is number of executed messages */ + ret = num; +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index d1630d47ef6fcf..277884b5e1ca4f 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -369,6 +369,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, + SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot); + return ret; + } + +@@ -430,9 +431,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + */ + writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); + +- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ +- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | +- SVC_I3C_MCTRL_IBIRESP_AUTO, ++ /* ++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration, ++ * instend of using AUTO_IBI. ++ * ++ * Using AutoIBI request may cause controller to remain in AutoIBI state when ++ * there is a glitch on SDA line (high->low->high). ++ * 1. SDA high->low, raising an interrupt to execute IBI isr. ++ * 2. SDA low->high. ++ * 3. IBI isr writes an AutoIBI request. ++ * 4. The controller will not start AutoIBI process because SDA is not low. ++ * 5. IBIWON polling times out. ++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request. ++ */ ++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | ++ SVC_I3C_MCTRL_TYPE_I3C | ++ SVC_I3C_MCTRL_IBIRESP_MANUAL | ++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) | ++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR), + master->regs + SVC_I3C_MCTRL); + + /* Wait for IBIWON, should take approximately 100us */ +@@ -452,10 +468,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work) + switch (ibitype) { + case SVC_I3C_MSTATUS_IBITYPE_IBI: + dev = svc_i3c_master_dev_from_addr(master, ibiaddr); +- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) ++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) { + svc_i3c_master_nack_ibi(master); +- else ++ } else { ++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) ++ svc_i3c_master_ack_ibi(master, true); ++ else ++ svc_i3c_master_ack_ibi(master, false); + svc_i3c_master_handle_ibi(master, dev); ++ } + break; + case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN: + if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN)) +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 8255035ff124f3..c7b2ab78709936 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -635,7 +636,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + { + int scale_type, scale_val, scale_val2; + int offset_type, offset_val, offset_val2; +- s64 raw64 = raw; ++ s64 denominator, raw64 = raw; + + offset_type = iio_channel_read(chan, &offset_val, &offset_val2, + IIO_CHAN_INFO_OFFSET); +@@ -670,7 +671,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + * If no channel scaling is available apply consumer scale to + * raw value and return. + */ +- *processed = raw * scale; ++ *processed = raw64 * scale; + return 0; + } + +@@ -679,20 +680,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000LL); +- break; + case IIO_VAL_INT_PLUS_NANO: +- if (scale_val2 < 0) +- *processed = -raw64 * scale_val * scale; +- else +- *processed = raw64 * scale_val * scale; +- *processed += div_s64(raw64 * (s64)scale_val2 * scale, +- 1000000000LL); ++ switch (scale_type) { ++ case IIO_VAL_INT_PLUS_MICRO: ++ denominator = MICRO; ++ break; ++ case IIO_VAL_INT_PLUS_NANO: ++ denominator = NANO; ++ break; ++ } ++ *processed = raw64 * scale * abs(scale_val); ++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator); ++ if (scale_val < 0 || scale_val2 < 0) ++ *processed *= -1; + break; + case IIO_VAL_FRACTIONAL: + *processed = div_s64(raw64 * (s64)scale_val * scale, +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index f20dfe70fa0e4f..8bf705921618c2 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, + { + int ret = 0; + +- if (ndev_flags & IFF_LOOPBACK) { ++ if (ndev_flags & IFF_LOOPBACK) + memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN); +- } else { +- if (!(ndev_flags & IFF_NOARP)) { +- /* If the device doesn't do ARP internally */ +- ret = fetch_ha(dst, addr, dst_in, seq); +- } +- } ++ else ++ ret = fetch_ha(dst, addr, dst_in, seq); + return ret; + } + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index d45e3909dafe1d..50bb3c43f40bf6 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, + struct cm_id_private *cm_id_priv; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, +- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__, ++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount)); + } + + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index 8175dde60b0a84..9902bb96c74094 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) + timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX; + ++ spin_lock_irqsave(&ib_nl_request_lock, flags); ++ + delta = timeout - sa_local_svc_timeout_ms; + if (delta < 0) + abs_delta = -delta; +@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + abs_delta = delta; + + if (delta != 0) { +- spin_lock_irqsave(&ib_nl_request_lock, flags); + sa_local_svc_timeout_ms = timeout; + list_for_each_entry(query, &ib_nl_request_list, list) { + if (delta < 0 && abs_delta > query->timeout) +@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, + if (delay) + mod_delayed_work(ib_nl_wq, &ib_nl_timed_work, + (unsigned long)delay); +- spin_unlock_irqrestore(&ib_nl_request_lock, flags); + } + ++ spin_unlock_irqrestore(&ib_nl_request_lock, flags); ++ + settimeout_out: + return 0; + } +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index e922fb87286547..0adb98b8dacc87 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1691,7 +1691,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, + } + + static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + int err; + +@@ -1703,6 +1704,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + if (err) + goto out; + ++ lb_state->force_enable = true; + return 0; + + out: +@@ -1711,16 +1713,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, + } + + static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, +- struct mlx5_core_dev *slave) ++ struct mlx5_core_dev *slave, ++ struct mlx5_ib_lb_state *lb_state) + { + mlx5_nic_vport_update_local_lb(slave, false); + mlx5_nic_vport_update_local_lb(master, false); ++ ++ lb_state->force_enable = false; + } + + int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { + int err = 0; + ++ if (dev->lb.force_enable) ++ return 0; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td++; +@@ -1742,6 +1750,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + + void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) + { ++ if (dev->lb.force_enable) ++ return; ++ + mutex_lock(&dev->lb.mutex); + if (td) + dev->lb.user_td--; +@@ -3251,7 +3262,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + lockdep_assert_held(&mlx5_ib_multiport_mutex); + +- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); ++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + + mlx5_core_mp_event_replay(ibdev->mdev, + MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, +@@ -3348,7 +3359,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, + MLX5_DRIVER_EVENT_AFFILIATION_DONE, + &key); + +- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); ++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); + if (err) + goto unbind; + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 94678e5c59dd59..9b780f48a382b5 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1065,6 +1065,7 @@ struct mlx5_ib_lb_state { + u32 user_td; + int qps; + bool enabled; ++ bool force_enable; + }; + + struct mlx5_ib_pf_eq { +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 80332638d9e3ac..be6cd8ce4d97ec 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task) + * yield the cpu and reschedule the task + */ + if (!ret) { +- task->state = TASK_STATE_IDLE; +- resched = 1; ++ if (task->state != TASK_STATE_DRAINING) { ++ task->state = TASK_STATE_IDLE; ++ resched = 1; ++ } else { ++ cont = 1; ++ } + goto exit; + } + +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index fdbef3254e3086..1768b8695c45ad 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + struct siw_wqe *wqe = tx_wqe(qp); + + unsigned long flags; +- int rv = 0; ++ int rv = 0, imm_err = 0; + + if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) { + siw_dbg_qp(qp, "wr must be empty for user mapped sq\n"); +@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + * Send directly if SQ processing is not in progress. + * Eventual immediate errors (rv < 0) do not affect the involved + * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ +- * processing, if new work is already pending. But rv must be passed +- * to caller. ++ * processing, if new work is already pending. But rv and pointer ++ * to failed work request must be passed to caller. + */ ++ if (unlikely(rv < 0)) { ++ /* ++ * Immediate error ++ */ ++ siw_dbg_qp(qp, "Immediate error %d\n", rv); ++ imm_err = rv; ++ *bad_wr = wr; ++ } + if (wqe->wr_status != SIW_WR_IDLE) { + spin_unlock_irqrestore(&qp->sq_lock, flags); + goto skip_direct_sending; +@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + + up_read(&qp->state_lock); + +- if (rv >= 0) +- return 0; +- /* +- * Immediate error +- */ +- siw_dbg_qp(qp, "error %d\n", rv); ++ if (unlikely(imm_err)) ++ return imm_err; + +- *bad_wr = wr; +- return rv; ++ return (rv >= 0) ? 0 : rv; + } + + /* +diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c +index 2c973f15cab7da..edb62a284548b9 100644 +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char __user *buffer, + if (in_compat_syscall()) { + struct uinput_ff_upload_compat ff_up_compat; + ++ memset(&ff_up_compat, 0, sizeof(ff_up_compat)); + ff_up_compat.request_id = ff_up->request_id; + ff_up_compat.retval = ff_up->retval; + /* +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 20094b9899f093..176b1ab516853c 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -3324,7 +3324,7 @@ static int mxt_probe(struct i2c_client *client) + if (data->reset_gpio) { + /* Wait a while and then de-assert the RESET GPIO line */ + msleep(MXT_RESET_GPIO_TIME); +- gpiod_set_value(data->reset_gpio, 0); ++ gpiod_set_value_cansleep(data->reset_gpio, 0); + msleep(MXT_RESET_INVALID_CHG); + } + +diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c +index a619dbe0152434..07ca3e32d4becc 100644 +--- a/drivers/leds/flash/leds-qcom-flash.c ++++ b/drivers/leds/flash/leds-qcom-flash.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -114,36 +114,39 @@ enum { + REG_THERM_THRSH1, + REG_THERM_THRSH2, + REG_THERM_THRSH3, ++ REG_TORCH_CLAMP, + REG_MAX_COUNT, + }; + + static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x08, 0, 7), /* status1 */ +- REG_FIELD(0x09, 0, 7), /* status2 */ +- REG_FIELD(0x0a, 0, 7), /* status3 */ +- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */ +- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x47, 0, 5), /* iresolution */ +- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */ +- REG_FIELD(0x4c, 0, 2), /* chan_en */ +- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */ +- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */ ++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7), ++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2), ++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2), ++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6), + }; + + static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = { +- REG_FIELD(0x06, 0, 7), /* status1 */ +- REG_FIELD(0x07, 0, 6), /* status2 */ +- REG_FIELD(0x09, 0, 7), /* status3 */ +- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */ +- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */ +- REG_FIELD(0x46, 7, 7), /* module_en */ +- REG_FIELD(0x49, 0, 3), /* iresolution */ +- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */ +- REG_FIELD(0x4e, 0, 3), /* chan_en */ +- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */ +- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */ ++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7), ++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6), ++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7), ++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1), ++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1), ++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7), ++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3), ++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1), ++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3), ++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2), ++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2), ++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6), + }; + + struct qcom_flash_data { +@@ -156,6 +159,7 @@ struct qcom_flash_data { + u8 max_channels; + u8 chan_en_bits; + u8 revision; ++ u8 torch_clamp; + }; + + struct qcom_flash_led { +@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev, + u32 current_ua, timeout_us; + u32 channels[4]; + int i, rc, count; ++ u8 torch_clamp; + + count = fwnode_property_count_u32(node, "led-sources"); + if (count <= 0) { +@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev, + current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count); + led->max_torch_current_ma = current_ua / UA_PER_MA; + ++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA; ++ if (torch_clamp != 0) ++ torch_clamp--; ++ ++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp); ++ + if (fwnode_property_present(node, "flash-max-microamp")) { + flash->led_cdev.flags |= LED_DEV_CAP_FLASH; + +@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev) + flash_data->leds_count++; + } + +- return 0; +- ++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp); + release: + fwnode_handle_put(child); + while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count) +diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h +index e6757a30dccad1..8a42c1590ecef7 100644 +--- a/drivers/md/dm-core.h ++++ b/drivers/md/dm-core.h +@@ -161,6 +161,7 @@ struct mapped_device { + #define DMF_SUSPENDED_INTERNALLY 7 + #define DMF_POST_SUSPENDING 8 + #define DMF_EMULATE_ZONE_APPEND 9 ++#define DMF_QUEUE_STOPPED 10 + + void disable_discard(struct mapped_device *md); + void disable_write_zeroes(struct mapped_device *md); +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 44424554e6b52a..f0c4c3553c0166 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2688,7 +2688,7 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, + { + bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG; + bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG; +- int r; ++ int r = 0; + + lockdep_assert_held(&md->suspend_lock); + +@@ -2740,8 +2740,10 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, + * Stop md->queue before flushing md->wq in case request-based + * dm defers requests to md->wq from md->queue. + */ +- if (dm_request_based(md)) ++ if (map && dm_request_based(md)) { + dm_stop_queue(md->queue); ++ set_bit(DMF_QUEUE_STOPPED, &md->flags); ++ } + + flush_workqueue(md->wq); + +@@ -2750,7 +2752,8 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, + * We call dm_wait_for_completion to wait for all existing requests + * to finish. + */ +- r = dm_wait_for_completion(md, task_state); ++ if (map) ++ r = dm_wait_for_completion(md, task_state); + if (!r) + set_bit(dmf_suspended_flag, &md->flags); + +@@ -2763,7 +2766,7 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, + if (r < 0) { + dm_queue_flush(md); + +- if (dm_request_based(md)) ++ if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags)) + dm_start_queue(md->queue); + + unlock_fs(md); +@@ -2847,7 +2850,7 @@ static int __dm_resume(struct mapped_device *md, struct dm_table *map) + * so that mapping of targets can work correctly. + * Request-based dm is queueing the deferred I/Os in its request_queue. + */ +- if (dm_request_based(md)) ++ if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags)) + dm_start_queue(md->queue); + + unlock_fs(md); +diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c +index b430046f9e2a9f..09293e90025d55 100644 +--- a/drivers/media/i2c/rj54n1cb0c.c ++++ b/drivers/media/i2c/rj54n1cb0c.c +@@ -1331,10 +1331,13 @@ static int rj54n1_probe(struct i2c_client *client) + V4L2_CID_GAIN, 0, 127, 1, 66); + v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops, + V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1); +- rj54n1->subdev.ctrl_handler = &rj54n1->hdl; +- if (rj54n1->hdl.error) +- return rj54n1->hdl.error; + ++ if (rj54n1->hdl.error) { ++ ret = rj54n1->hdl.error; ++ goto err_free_ctrl; ++ } ++ ++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl; + rj54n1->clk_div = clk_div; + rj54n1->rect.left = RJ54N1_COLUMN_SKIP; + rj54n1->rect.top = RJ54N1_ROW_SKIP; +diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h +index 56340553b28239..63592c4f9ed8c4 100644 +--- a/drivers/media/pci/zoran/zoran.h ++++ b/drivers/media/pci/zoran/zoran.h +@@ -154,12 +154,6 @@ struct zoran_jpg_settings { + + struct zoran; + +-/* zoran_fh contains per-open() settings */ +-struct zoran_fh { +- struct v4l2_fh fh; +- struct zoran *zr; +-}; +- + struct card_info { + enum card_type type; + char name[32]; +diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c +index fa672cc8bc678e..feb39854a989e6 100644 +--- a/drivers/media/pci/zoran/zoran_driver.c ++++ b/drivers/media/pci/zoran/zoran_driver.c +@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh, + struct v4l2_format *fmt) + { + struct zoran *zr = video_drvdata(file); +- struct zoran_fh *fh = __fh; + int i; + int res = 0; + + if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG) +- return zoran_s_fmt_vid_out(file, fh, fmt); ++ return zoran_s_fmt_vid_out(file, __fh, fmt); + + for (i = 0; i < NUM_FORMATS; i++) + if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc) +diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +index 0533d4a083d249..a078f1107300ee 100644 +--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c ++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c +@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx) + return 0; + } + +-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) ++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend) + { + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); +@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au) + + memset(params, 0, sizeof(*params)); + +- params->picture_start_addr_p = (u32)(au->paddr); +- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1); ++ params->picture_start_addr_p = pstart; ++ params->picture_end_addr_p = pend; + + /* + * !WARNING! +@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + struct delta_dev *delta = pctx->dev; + struct delta_mjpeg_ctx *ctx = to_ctx(pctx); + int ret; +- struct delta_au au = *pau; ++ void *au_vaddr = pau->vaddr; ++ dma_addr_t au_dma = pau->paddr; ++ size_t au_size = pau->size; + unsigned int data_offset = 0; + struct mjpeg_header *header = &ctx->header_struct; + + if (!ctx->header) { +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + header, &data_offset); + if (ret) { + pctx->stream_errors++; +@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau) + goto err; + } + +- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size, ++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size, + ctx->header, &data_offset); + if (ret) { + pctx->stream_errors++; + goto err; + } + +- au.paddr += data_offset; +- au.vaddr += data_offset; ++ au_dma += data_offset; ++ au_vaddr += data_offset; + +- ret = delta_mjpeg_ipc_decode(pctx, &au); ++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1); + if (ret) + goto err; + +diff --git a/drivers/mfd/rz-mtu3.c b/drivers/mfd/rz-mtu3.c +index f3dac4a29a8324..9cdfef610398f3 100644 +--- a/drivers/mfd/rz-mtu3.c ++++ b/drivers/mfd/rz-mtu3.c +@@ -32,7 +32,7 @@ static const unsigned long rz_mtu3_8bit_ch_reg_offs[][13] = { + [RZ_MTU3_CHAN_2] = MTU_8BIT_CH_1_2(0x204, 0x092, 0x205, 0x200, 0x20c, 0x201, 0x202), + [RZ_MTU3_CHAN_3] = MTU_8BIT_CH_3_4_6_7(0x008, 0x093, 0x02c, 0x000, 0x04c, 0x002, 0x004, 0x005, 0x038), + [RZ_MTU3_CHAN_4] = MTU_8BIT_CH_3_4_6_7(0x009, 0x094, 0x02d, 0x001, 0x04d, 0x003, 0x006, 0x007, 0x039), +- [RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x1eb, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6), ++ [RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x895, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6), + [RZ_MTU3_CHAN_6] = MTU_8BIT_CH_3_4_6_7(0x808, 0x893, 0x82c, 0x800, 0x84c, 0x802, 0x804, 0x805, 0x838), + [RZ_MTU3_CHAN_7] = MTU_8BIT_CH_3_4_6_7(0x809, 0x894, 0x82d, 0x801, 0x84d, 0x803, 0x806, 0x807, 0x839), + [RZ_MTU3_CHAN_8] = MTU_8BIT_CH_8(0x404, 0x098, 0x400, 0x406, 0x401, 0x402, 0x403) +diff --git a/drivers/mfd/vexpress-sysreg.c b/drivers/mfd/vexpress-sysreg.c +index eab82619ec314a..8e41942081138e 100644 +--- a/drivers/mfd/vexpress-sysreg.c ++++ b/drivers/mfd/vexpress-sysreg.c +@@ -90,6 +90,7 @@ static int vexpress_sysreg_probe(struct platform_device *pdev) + struct resource *mem; + void __iomem *base; + struct gpio_chip *mmc_gpio_chip; ++ int ret; + + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!mem) +@@ -110,7 +111,10 @@ static int vexpress_sysreg_probe(struct platform_device *pdev) + bgpio_init(mmc_gpio_chip, &pdev->dev, 0x4, base + SYS_MCI, + NULL, NULL, NULL, NULL, 0); + mmc_gpio_chip->ngpio = 2; +- devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL); ++ ++ ret = devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL); ++ if (ret) ++ return ret; + + return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, + vexpress_sysreg_cells, +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index fc021e265edc01..5e03a6ba55711a 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -362,26 +362,21 @@ static int fastrpc_map_get(struct fastrpc_map *map) + + + static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd, +- struct fastrpc_map **ppmap, bool take_ref) ++ struct fastrpc_map **ppmap) + { +- struct fastrpc_session_ctx *sess = fl->sctx; + struct fastrpc_map *map = NULL; ++ struct dma_buf *buf; + int ret = -ENOENT; + ++ buf = dma_buf_get(fd); ++ if (IS_ERR(buf)) ++ return PTR_ERR(buf); ++ + spin_lock(&fl->lock); + list_for_each_entry(map, &fl->maps, node) { +- if (map->fd != fd) ++ if (map->fd != fd || map->buf != buf) + continue; + +- if (take_ref) { +- ret = fastrpc_map_get(map); +- if (ret) { +- dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n", +- __func__, fd, ret); +- break; +- } +- } +- + *ppmap = map; + ret = 0; + break; +@@ -751,7 +746,7 @@ static const struct dma_buf_ops fastrpc_dma_buf_ops = { + .release = fastrpc_release, + }; + +-static int fastrpc_map_create(struct fastrpc_user *fl, int fd, ++static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, + u64 len, u32 attr, struct fastrpc_map **ppmap) + { + struct fastrpc_session_ctx *sess = fl->sctx; +@@ -759,9 +754,6 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd, + struct sg_table *table; + int err = 0; + +- if (!fastrpc_map_lookup(fl, fd, ppmap, true)) +- return 0; +- + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) + return -ENOMEM; +@@ -838,6 +830,24 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd, + return err; + } + ++static int fastrpc_map_create(struct fastrpc_user *fl, int fd, ++ u64 len, u32 attr, struct fastrpc_map **ppmap) ++{ ++ struct fastrpc_session_ctx *sess = fl->sctx; ++ int err = 0; ++ ++ if (!fastrpc_map_lookup(fl, fd, ppmap)) { ++ if (!fastrpc_map_get(*ppmap)) ++ return 0; ++ dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n", ++ __func__, fd); ++ } ++ ++ err = fastrpc_map_attach(fl, fd, len, attr, ppmap); ++ ++ return err; ++} ++ + /* + * Fastrpc payload buffer with metadata looks like: + * +@@ -910,8 +920,12 @@ static int fastrpc_create_maps(struct fastrpc_invoke_ctx *ctx) + ctx->args[i].length == 0) + continue; + +- err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, +- ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); ++ if (i < ctx->nbufs) ++ err = fastrpc_map_create(ctx->fl, ctx->args[i].fd, ++ ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); ++ else ++ err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd, ++ ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); + if (err) { + dev_err(dev, "Error Creating map %d\n", err); + return -EINVAL; +@@ -1067,6 +1081,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, + struct fastrpc_phy_page *pages; + u64 *fdlist; + int i, inbufs, outbufs, handles; ++ int ret = 0; + + inbufs = REMOTE_SCALARS_INBUFS(ctx->sc); + outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc); +@@ -1082,23 +1097,26 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, + u64 len = rpra[i].buf.len; + + if (!kernel) { +- if (copy_to_user((void __user *)dst, src, len)) +- return -EFAULT; ++ if (copy_to_user((void __user *)dst, src, len)) { ++ ret = -EFAULT; ++ goto cleanup_fdlist; ++ } + } else { + memcpy(dst, src, len); + } + } + } + ++cleanup_fdlist: + /* Clean up fdlist which is updated by DSP */ + for (i = 0; i < FASTRPC_MAX_FDLIST; i++) { + if (!fdlist[i]) + break; +- if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false)) ++ if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap)) + fastrpc_map_put(mmap); + } + +- return 0; ++ return ret; + } + + static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx, +diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c +index 500b1feaf1f6f5..fd7d5cd50d3966 100644 +--- a/drivers/misc/genwqe/card_ddcb.c ++++ b/drivers/misc/genwqe/card_ddcb.c +@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, + } + if (cmd->asv_length > DDCB_ASV_LENGTH) { + dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n", +- __func__, cmd->asiv_length); ++ __func__, cmd->asv_length); + return -EINVAL; + } + rc = __genwqe_enqueue_ddcb(cd, req, f_flags); +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index c5aff27ec4a895..14a09285f1551d 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc) + + static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + { +- struct device_node *np, *nand_np; ++ struct device_node *np; + struct device *dev = nc->dev; + int ret, reg_cells; + u32 val; +@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) + + reg_cells += val; + +- for_each_child_of_node(np, nand_np) { ++ for_each_child_of_node_scoped(np, nand_np) { + struct atmel_nand *nand; + + nand = atmel_nand_create(nc, nand_np, reg_cells); +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index d901877544445e..82a7c52fdb7210 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -752,7 +752,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev) + + static u32 ena_get_rxfh_key_size(struct net_device *netdev) + { +- return ENA_HASH_KEY_SIZE; ++ struct ena_adapter *adapter = netdev_priv(netdev); ++ struct ena_rss *rss = &adapter->ena_dev->rss; ++ ++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0; + } + + static int ena_indirection_table_set(struct ena_adapter *adapter, +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index f1208591ed67e3..1c3a5cf379cd03 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -954,15 +954,18 @@ receive_packet (struct net_device *dev) + } else { + struct sk_buff *skb; + ++ skb = NULL; + /* Small skbuffs for short packets */ +- if (pkt_len > copy_thresh) { ++ if (pkt_len <= copy_thresh) ++ skb = netdev_alloc_skb_ip_align(dev, pkt_len); ++ if (!skb) { + dma_unmap_single(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, + DMA_FROM_DEVICE); + skb_put (skb = np->rx_skbuff[entry], pkt_len); + np->rx_skbuff[entry] = NULL; +- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { ++ } else { + dma_sync_single_for_cpu(&np->pdev->dev, + desc_to_dma(desc), + np->rx_buf_sz, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 5a2126679415c7..336e0a54b3dc2e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) + return; + } + cond_resched(); ++ if (mlx5_cmd_is_down(dev)) { ++ ent->ret = -ENXIO; ++ return; ++ } + } while (time_before(jiffies, poll_end)); + + ent->ret = -ETIMEDOUT; +@@ -1059,7 +1063,7 @@ static void cmd_work_handler(struct work_struct *work) + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); ++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +index 66d276a1be836a..f4a19ffbb641c0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +@@ -66,23 +66,11 @@ struct mlx5e_port_buffer { + struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER]; + }; + +-#ifdef CONFIG_MLX5_CORE_EN_DCB + int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, + u32 change, unsigned int mtu, + struct ieee_pfc *pfc, + u32 *buffer_size, + u8 *prio2buffer); +-#else +-static inline int +-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, +- u32 change, unsigned int mtu, +- void *pfc, +- u32 *buffer_size, +- u8 *prio2buffer) +-{ +- return 0; +-} +-#endif + + int mlx5e_port_query_buffer(struct mlx5e_priv *priv, + struct mlx5e_port_buffer *port_buffer); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 09ba60b2e744b1..5c6f01abdcb91d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -44,7 +44,6 @@ + #include "eswitch.h" + #include "en.h" + #include "en/txrx.h" +-#include "en/port_buffer.h" + #include "en_tc.h" + #include "en_rep.h" + #include "en_accel/ipsec.h" +@@ -2723,11 +2722,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + struct mlx5e_params *params = &priv->channels.params; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; +- u16 mtu, prev_mtu; ++ u16 mtu; + int err; + +- mlx5e_query_mtu(mdev, params, &prev_mtu); +- + err = mlx5e_set_mtu(mdev, params, params->sw_mtu); + if (err) + return err; +@@ -2737,18 +2734,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv) + netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n", + __func__, mtu, params->sw_mtu); + +- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) { +- err = mlx5e_port_manual_buffer_config(priv, 0, mtu, +- NULL, NULL, NULL); +- if (err) { +- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n", +- __func__, mtu, err, prev_mtu); +- +- mlx5e_set_mtu(mdev, params, prev_mtu); +- return err; +- } +- } +- + params->sw_mtu = mtu; + return 0; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +index 1547704c89767f..4d64d179b5dd7d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +@@ -27,6 +27,7 @@ struct mlx5_fw_reset { + struct work_struct reset_reload_work; + struct work_struct reset_now_work; + struct work_struct reset_abort_work; ++ struct delayed_work reset_timeout_work; + unsigned long reset_flags; + u8 reset_method; + struct timer_list timer; +@@ -257,6 +258,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool + return -EALREADY; + } + ++ if (current_work() != &fw_reset->reset_timeout_work.work) ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + mlx5_stop_sync_reset_poll(dev); + if (poll_health) + mlx5_start_health_poll(dev); +@@ -327,6 +330,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) + } + mlx5_stop_health_poll(dev, true); + mlx5_start_sync_reset_poll(dev); ++ ++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, ++ &fw_reset->reset_flags)) ++ schedule_delayed_work(&fw_reset->reset_timeout_work, ++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); + return 0; + } + +@@ -700,6 +708,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct + } + } + ++static void mlx5_sync_reset_timeout_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_fw_reset *fw_reset = ++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); ++ struct mlx5_core_dev *dev = fw_reset->dev; ++ ++ if (mlx5_sync_reset_clear_reset_requested(dev, true)) ++ return; ++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); ++} ++ + static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) + { + struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); +@@ -783,6 +804,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) + cancel_work_sync(&fw_reset->reset_reload_work); + cancel_work_sync(&fw_reset->reset_now_work); + cancel_work_sync(&fw_reset->reset_abort_work); ++ cancel_delayed_work(&fw_reset->reset_timeout_work); + } + + static const struct devlink_param mlx5_fw_reset_devlink_params[] = { +@@ -826,6 +848,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) + INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); + INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); + INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); ++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, ++ mlx5_sync_reset_timeout_work); + + init_completion(&fw_reset->done); + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index e0581c6f9cecd5..5df1472fe2be2f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 func_id; + u32 npages; + u32 i = 0; ++ int err; + +- if (!mlx5_cmd_is_down(dev)) +- return mlx5_cmd_do(dev, in, in_size, out, out_size); ++ err = mlx5_cmd_do(dev, in, in_size, out, out_size); ++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ ++ if (err != -ENXIO) ++ return err; + + /* No hard feelings, we want our pages back! */ + npages = MLX5_GET(manage_pages_in, in, input_num_entries); +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index e75cbb287625fc..87383f9d09ce30 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -1413,7 +1413,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev) + struct nfp_net *nn = netdev_priv(netdev); + + if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)) +- return -EOPNOTSUPP; ++ return 0; + + return nfp_net_rss_key_sz(nn); + } +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index f4340d4ef7eeab..0516ef71a64cb0 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbnet *dev) + asix_read_medium_status(dev, 1)); + } + ++/* Notes on PM callbacks and locking context: ++ * ++ * - asix_suspend()/asix_resume() are invoked for both runtime PM and ++ * system-wide suspend/resume. For struct usb_driver the ->resume() ++ * callback does not receive pm_message_t, so the resume type cannot ++ * be distinguished here. ++ * ++ * - The MAC driver must hold RTNL when calling phylink interfaces such as ++ * phylink_suspend()/resume(). Those calls will also perform MDIO I/O. ++ * ++ * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while ++ * the USB PM lock is held) is fragile. Since autosuspend brings no ++ * measurable power saving here, we block it by holding a PM usage ++ * reference in ax88772_bind(). ++ */ + static int asix_suspend(struct usb_interface *intf, pm_message_t message) + { + struct usbnet *dev = usb_get_intfdata(intf); +@@ -919,6 +934,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + if (ret) + goto initphy_err; + ++ /* Keep this interface runtime-PM active by taking a usage ref. ++ * Prevents runtime suspend while bound and avoids resume paths ++ * that could deadlock (autoresume under RTNL while USB PM lock ++ * is held, phylink/MDIO wants RTNL). ++ */ ++ pm_runtime_get_noresume(&intf->dev); ++ + return 0; + + initphy_err: +@@ -948,6 +970,8 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf) + phylink_destroy(priv->phylink); + ax88772_mdio_unregister(priv); + asix_rx_fixup_common_free(dev->driver_priv); ++ /* Drop the PM usage ref taken in bind() */ ++ pm_runtime_put(&intf->dev); + } + + static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf) +@@ -1600,6 +1624,11 @@ static struct usb_driver asix_driver = { + .resume = asix_resume, + .reset_resume = asix_resume, + .disconnect = usbnet_disconnect, ++ /* usbnet enables autosuspend by default (supports_autosuspend=1). ++ * We keep runtime-PM active for AX88772* by taking a PM usage ++ * reference in ax88772_bind() (pm_runtime_get_noresume()) and ++ * dropping it in unbind(), which effectively blocks autosuspend. ++ */ + .supports_autosuspend = 1, + .disable_hub_initiated_lpm = 1, + }; +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index ddff6f19ff98eb..92add3daadbb18 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rtl8150_t *dev = netdev_priv(netdev); + u16 rx_creg = 0x9e; + +- netif_stop_queue(netdev); + if (netdev->flags & IFF_PROMISC) { + rx_creg |= 0x0001; + dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); +@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) + rx_creg &= 0x00fc; + } + async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); +- netif_wake_queue(netdev); + } + + static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 818aea99f85eb3..340502c47a10d6 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1763,33 +1763,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch, + + int ath10k_wmi_wait_for_service_ready(struct ath10k *ar) + { ++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ; + unsigned long time_left, i; + +- time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- /* Sometimes the PCI HIF doesn't receive interrupt +- * for the service ready message even if the buffer +- * was completed. PCIe sniffer shows that it's +- * because the corresponding CE ring doesn't fires +- * it. Workaround here by polling CE rings once. +- */ +- ath10k_warn(ar, "failed to receive service ready completion, polling..\n"); +- ++ /* Sometimes the PCI HIF doesn't receive interrupt ++ * for the service ready message even if the buffer ++ * was completed. PCIe sniffer shows that it's ++ * because the corresponding CE ring doesn't fires ++ * it. Workaround here by polling CE rings. Since ++ * the message could arrive at any time, continue ++ * polling until timeout. ++ */ ++ do { + for (i = 0; i < CE_COUNT; i++) + ath10k_hif_send_complete_check(ar, i, 1); + ++ /* The 100 ms granularity is a tradeoff considering scheduler ++ * overhead and response latency ++ */ + time_left = wait_for_completion_timeout(&ar->wmi.service_ready, +- WMI_SERVICE_READY_TIMEOUT_HZ); +- if (!time_left) { +- ath10k_warn(ar, "polling timed out\n"); +- return -ETIMEDOUT; +- } +- +- ath10k_warn(ar, "service ready completion received, continuing normally\n"); +- } ++ msecs_to_jiffies(100)); ++ if (time_left) ++ return 0; ++ } while (time_before(jiffies, timeout)); + +- return 0; ++ ath10k_warn(ar, "failed to receive service ready completion\n"); ++ return -ETIMEDOUT; + } + + int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar) +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 69eea0628e670e..df6e4a112ec48b 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy, + return; + } + +- /* Don't send world or same regdom info to firmware */ +- if (strncmp(request->alpha2, "00", 2) && +- strncmp(request->alpha2, adapter->country_code, +- sizeof(request->alpha2))) { ++ /* Don't send same regdom info to firmware */ ++ if (strncmp(request->alpha2, adapter->country_code, ++ sizeof(request->alpha2)) != 0) { + memcpy(adapter->country_code, request->alpha2, + sizeof(request->alpha2)); + mwifiex_send_domain_info_cmd_fw(wiphy); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +index ba927033bbe8c3..1206769cdc7fd9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c +@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev) + + return 0; + error: +- ieee80211_free_hw(mt76_hw(dev)); ++ mt76_free_device(mdev); + return ret; + } + +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index 45165cf3e824e6..ae3e02efcc5d75 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work) + + static int ser_send_msg(struct rtw89_ser *ser, u8 event) + { +- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser); + struct ser_msg *msg = NULL; + + if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags)) +@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event) + list_add(&msg->list, &ser->msg_q); + spin_unlock_irq(&ser->msg_q_lock); + +- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work); ++ schedule_work(&ser->ser_hdl_work); + return 0; + } + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 570c58d2b5a585..a15e764bae35b7 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */ + int ls_error; + struct list_head lsreq_list; /* tgtport->ls_req_list */ + bool req_queued; ++ ++ struct work_struct put_work; + }; + + +@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; +- +- struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); +-static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++static void nvmet_fc_put_lsop_work(struct work_struct *work) + { +- struct nvmet_fc_tgtport *tgtport = +- container_of(work, struct nvmet_fc_tgtport, put_work); ++ struct nvmet_fc_ls_req_op *lsop = ++ container_of(work, struct nvmet_fc_ls_req_op, put_work); + +- nvmet_fc_tgtport_put(tgtport); ++ nvmet_fc_tgtport_put(lsop->tgtport); ++ kfree(lsop); + } + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, +@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + DMA_BIDIRECTIONAL); + + out_putwork: +- queue_work(nvmet_wq, &tgtport->put_work); ++ queue_work(nvmet_wq, &lsop->put_work); + } + + static int +@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, + lsreq->done = done; + lsop->req_queued = false; + INIT_LIST_HEAD(&lsop->lsreq_list); ++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work); + + lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, + lsreq->rqstlen + lsreq->rsplen, +@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status) + __nvmet_fc_finish_ls_req(lsop); + + /* fc-nvme target doesn't care about success or failure of cmd */ +- +- kfree(lsop); + } + + /* +@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; +- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 416d6b45d1fe8d..115a21cf869ae6 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1734,9 +1734,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie) + ret); + } + +- ret = tegra_pcie_bpmp_set_pll_state(pcie, false); ++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false); + if (ret) +- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret); ++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret); + + pcie->ep_state = EP_STATE_DISABLED; + dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n"); +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 038d974a318eaf..80d975dcb2ee27 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port) + unsigned int i; + int err; + +- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL); ++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL); + if (!port->phys) + return -ENOMEM; + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 2bec2e3af0bd62..affa78376b6a80 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -96,7 +96,8 @@ struct arm_spe_pmu { + #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) + + /* Convert a free-running index from perf into an SPE buffer offset */ +-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) ++#define PERF_IDX2OFF(idx, buf) \ ++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) + + /* Keep track of our dynamic hotplug state */ + static enum cpuhp_state arm_spe_pmu_online; +diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +index 2354ce8b215943..9ef496092b7e6a 100644 +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg { + struct combphy_reg pipe_xpcs_phy_ready; + struct combphy_reg pipe_pcie1l0_sel; + struct combphy_reg pipe_pcie1l1_sel; ++ struct combphy_reg u3otg0_port_en; ++ struct combphy_reg u3otg1_port_en; + }; + + struct rockchip_combphy_cfg { +@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv) + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false); + rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true); ++ switch (priv->id) { ++ case 0: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true); ++ break; ++ case 1: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true); ++ break; ++ } + break; + + case PHY_TYPE_SATA: +@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { + /* pipe-grf */ + .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 }, + .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 }, ++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 }, ++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 }, + }; + + static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 51408996255bd3..e2601e45935e6d 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 }; + static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 }; + static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 }; + ++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 }; ++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 }; ++ + static const unsigned int eth_mdio_pins[] = { GPIOZ_0 }; + static const unsigned int eth_mdc_pins[] = { GPIOZ_1 }; + static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 }; +@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = { + GPIO_GROUP(GPIO_TEST_N), + + /* Bank X */ ++ GROUP(i2c_sda_d, 5, 5), ++ GROUP(i2c_sck_d, 5, 4), + GROUP(sdio_d0, 5, 31), + GROUP(sdio_d1, 5, 30), + GROUP(sdio_d2, 5, 29), +@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { + "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", + }; + ++static const char * const i2c_d_groups[] = { ++ "i2c_sck_d", "i2c_sda_d", ++}; ++ + static const char * const eth_groups[] = { + "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv", + "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3", +@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = { + FUNCTION(i2c_a), + FUNCTION(i2c_b), + FUNCTION(i2c_c), ++ FUNCTION(i2c_d), + FUNCTION(eth), + FUNCTION(pwm_a), + FUNCTION(pwm_b), +diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c +index ab853d6c586b60..1c324d216ad773 100644 +--- a/drivers/pinctrl/pinmux.c ++++ b/drivers/pinctrl/pinmux.c +@@ -339,7 +339,7 @@ static int pinmux_func_name_to_selector(struct pinctrl_dev *pctldev, + while (selector < nfuncs) { + const char *fname = ops->get_function_name(pctldev, selector); + +- if (!strcmp(function, fname)) ++ if (fname && !strcmp(function, fname)) + return selector; + + selector++; +diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c +index 4d9d58fc1356ff..852e179f9e3837 100644 +--- a/drivers/pinctrl/renesas/pinctrl.c ++++ b/drivers/pinctrl/renesas/pinctrl.c +@@ -730,7 +730,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev); + const unsigned int *pins; + unsigned int num_pins; +- unsigned int i, ret; ++ unsigned int i; ++ int ret; + + pins = pmx->pfc->info->groups[group].pins; + num_pins = pmx->pfc->info->groups[group].nr_pins; +diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c +index 99f3ccdc30a6a7..434e3233c9f8c6 100644 +--- a/drivers/power/supply/cw2015_battery.c ++++ b/drivers/power/supply/cw2015_battery.c +@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client) + if (!cw_bat->battery_workqueue) + return -ENOMEM; + +- devm_delayed_work_autocancel(&client->dev, +- &cw_bat->battery_delay_work, cw_bat_work); ++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work); + queue_delayed_work(cw_bat->battery_workqueue, + &cw_bat->battery_delay_work, msecs_to_jiffies(10)); + return 0; +diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c +index 92d1b62ea239d7..e9389876229eaa 100644 +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info, + if (err < 0) { + pr_err("%s: unable to create char device\n", + info->name); +- goto kfree_pps; ++ goto pps_register_source_exit; + } + + dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + + return pps; + +-kfree_pps: +- kfree(pps); +- + pps_register_source_exit: + pr_err("%s: unable to register source\n", info->name); + +diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c +index e1689957736d95..9539695b337a81 100644 +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) + pps->info.name); + err = -EBUSY; + } ++ kfree(pps); + goto out_unlock; + } + pps->id = err; +@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) + pps->dev.devt = MKDEV(pps_major, pps->id); + dev_set_drvdata(&pps->dev, pps); + dev_set_name(&pps->dev, "pps%d", pps->id); ++ pps->dev.release = pps_device_destruct; + err = device_register(&pps->dev); + if (err) + goto free_idr; + +- /* Override the release function with our own */ +- pps->dev.release = pps_device_destruct; +- + pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, + pps->id); + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index ecbfd7e954ecb8..d693b2d65cccf9 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, + + *prescale_div = (1 << clkdiv) * + (hspclkdiv ? (hspclkdiv * 2) : 1); +- if (*prescale_div > rqst_prescaler) { ++ if (*prescale_div >= rqst_prescaler) { + *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) | + (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT); + return 0; +@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + pc->period_cycles[pwm->hwpwm] = period_cycles; + + /* Configure clock prescaler to support Low frequency PWM wave */ +- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval, ++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval, + &tb_divval)) { + dev_err(chip->dev, "Unsupported values\n"); + return -EINVAL; +diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c +index 29ab217297d6dd..432654fbd7a126 100644 +--- a/drivers/regulator/scmi-regulator.c ++++ b/drivers/regulator/scmi-regulator.c +@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev, + struct device_node *np, + struct scmi_regulator_info *rinfo) + { +- u32 dom, ret; ++ u32 dom; ++ int ret; + + ret = of_property_read_u32(np, "reg", &dom); + if (ret) +diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c +index 327f0c7ee3d6ba..7ffbae209a31fb 100644 +--- a/drivers/remoteproc/pru_rproc.c ++++ b/drivers/remoteproc/pru_rproc.c +@@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put); + */ + int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr) + { +- struct pru_rproc *pru = rproc->priv; ++ struct pru_rproc *pru; + unsigned int reg; + u32 mask, set; + u16 idx; +@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr) + if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent)) + return -ENODEV; + ++ pru = rproc->priv; + /* pointer is 16 bit and index is 8-bit so mask out the rest */ + idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF; + +diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c +index 4ee5e67a9f03f5..769c6d6d6a7316 100644 +--- a/drivers/remoteproc/qcom_q6v5.c ++++ b/drivers/remoteproc/qcom_q6v5.c +@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout) + int ret; + + ret = wait_for_completion_timeout(&q6v5->start_done, timeout); +- if (!ret) +- disable_irq(q6v5->handover_irq); +- + return !ret ? -ETIMEDOUT : 0; + } + EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start); +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index e8a4750f6ec473..7d6e4fe31ceed8 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + list_for_each_entry_safe(mpt3sas_phy, next_phy, + &mpt3sas_port->phy_list, port_siblings) { + if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) +- dev_printk(KERN_INFO, &mpt3sas_port->port->dev, +- "remove: sas_addr(0x%016llx), phy(%d)\n", +- (unsigned long long) +- mpt3sas_port->remote_identify.sas_address, +- mpt3sas_phy->phy_id); ++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", ++ (unsigned long long) mpt3sas_port->remote_identify.sas_address, ++ mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; + if (!ioc->remove_host) + sas_port_delete_phy(mpt3sas_port->port, +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index e824be9d9bbb94..9075836ccc3e24 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + /* Temporary dma mapping, used only in the scope of this function */ + mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox), + &mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, mbox_addr)) ++ if (!mbox) + return false; + + /* These are the base addresses for the command memory mailbox array */ + cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox); + cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size, + &cs->cmd_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) { ++ if (!cmd_mbox) { + dev_err(&pdev->dev, "Failed to map command mailbox\n"); + goto out_free; + } +@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox); + stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size, + &cs->stat_mbox_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) { ++ if (!stat_mbox) { + dev_err(&pdev->dev, "Failed to map status mailbox\n"); + goto out_free; + } +@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, + cs->fwstat_buf = dma_alloc_coherent(&pdev->dev, + sizeof(struct myrs_fwstat), + &cs->fwstat_addr, GFP_KERNEL); +- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) { ++ if (!cs->fwstat_buf) { + dev_err(&pdev->dev, "Failed to map firmware health buffer\n"); + cs->fwstat_buf = NULL; + goto out_free; +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index a9d6dac4133466..4daab8b6d67527 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + unsigned long flags = 0; + struct pm8001_hba_info *pm8001_ha; + struct pm8001_device *pm8001_dev = dev->lldd_dev; ++ struct domain_device *parent_dev = dev->parent; + + pm8001_ha = pm8001_find_ha_by_dev(dev); + spin_lock_irqsave(&pm8001_ha->lock, flags); +@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev) + spin_lock_irqsave(&pm8001_ha->lock, flags); + } + PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id); +- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; ++ ++ /* ++ * The phy array only contains local phys. Thus, we cannot clear ++ * phy_attached for a device behind an expander. ++ */ ++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type))) ++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0; + pm8001_free_dev(pm8001_dev); + } else { + pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n"); +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index dcde55c8ee5dea..be20e2c457b8ea 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job) + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + p->e.extra_rx_xchg_address, p->e.extra_control_flags, + sp->handle, sp->remap.req.len, bsg_job); + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(EDIF_MSLEEP_INTERVAL); + cnt++; + if (cnt < EDIF_RETRY_COUNT) +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 5fa2727c1bea76..e881d704b45d1b 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res) + int cnt = 5; \ + do { \ + if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ +- _rval = EINVAL; \ ++ _rval = -EINVAL; \ + break; \ + } \ + _rval = qla2x00_start_sp(_sp); \ +- if (_rval == EAGAIN) \ ++ if (_rval == -EAGAIN) \ + msleep(1); \ + else \ + break; \ +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 8f4cc136a9c9c4..080670cb2aa516 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -420,7 +420,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport, + switch (rval) { + case QLA_SUCCESS: + break; +- case EAGAIN: ++ case -EAGAIN: + msleep(PURLS_MSLEEP_INTERVAL); + cnt++; + if (cnt < PURLS_RETRY_COUNT) +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 163a58eb02e0a2..d0ec42ec0d0419 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p) + + trace_rpmh_tx_done(drv, i, req); + +- /* +- * If wake tcs was re-purposed for sending active +- * votes, clear AMC trigger & enable modes and ++ /* Clear AMC trigger & enable modes and + * disable interrupt for this TCS + */ +- if (!drv->tcs[ACTIVE_TCS].num_tcs) +- __tcs_set_trigger(drv, i, false); ++ __tcs_set_trigger(drv, i, false); + skip: + /* Reclaim the TCS */ + write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0); +diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig +index 2c7f3f9a26ebbb..a6bb01082ec697 100644 +--- a/drivers/thermal/qcom/Kconfig ++++ b/drivers/thermal/qcom/Kconfig +@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM + + config QCOM_LMH + tristate "Qualcomm Limits Management Hardware" +- depends on ARCH_QCOM && QCOM_SCM ++ depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + help + This enables initialization of Qualcomm limits management + hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on +diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c +index d2d49264cf83a4..7c299184c59b1c 100644 +--- a/drivers/thermal/qcom/lmh.c ++++ b/drivers/thermal/qcom/lmh.c +@@ -5,6 +5,8 @@ + */ + #include + #include ++#include ++#include + #include + #include + #include +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 8559ba1361c645..901f5c8311fbf9 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -460,6 +460,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); + static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); + static void gsmld_write_trigger(struct gsm_mux *gsm); + static void gsmld_write_task(struct work_struct *work); ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); + + /** + * gsm_fcs_add - update FCS +@@ -2173,7 +2174,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + pr_debug("DLCI %d goes open.\n", dlci->addr); + /* Send current modem state */ + if (dlci->addr) { +- gsm_modem_update(dlci, 0); ++ gsm_modem_send_initial_msc(dlci); + } else { + /* Start keep-alive control */ + gsm->ka_num = 0; +@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) + return gsm_control_wait(dlci->gsm, ctrl); + } + ++/** ++ * gsm_modem_send_initial_msc - Send initial modem status message ++ * ++ * @dlci channel ++ * ++ * Send an initial MSC message after DLCI open to set the initial ++ * modem status lines. This is only done for basic mode. ++ * Does not wait for a response as we cannot block the input queue ++ * processing. ++ */ ++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) ++{ ++ u8 modembits[2]; ++ ++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) ++ return 0; ++ ++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ ++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; ++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); ++} ++ + /** + * gsm_modem_update - send modem status line state + * @dlci: channel +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index e339abff926d32..e10dcdeeda2d32 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1659,6 +1659,8 @@ static int max310x_i2c_probe(struct i2c_client *client) + port_client = devm_i2c_new_dummy_device(&client->dev, + client->adapter, + port_addr); ++ if (IS_ERR(port_client)) ++ return PTR_ERR(port_client); + + regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c); + } +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 17c1f85f2b7ba2..2724656bf63486 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *context) + struct hv_device *hv_dev = chan->device_obj; + struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev); + +- chan->inbound.ring_buffer->interrupt_mask = 1; + virt_mb(); + + uio_event_notify(&pdata->info); +@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channel *new_sc) + return; + } + +- /* Disable interrupts on sub channel */ +- new_sc->inbound.ring_buffer->interrupt_mask = 1; + set_channel_read_mode(new_sc, HV_CALL_ISR); + + ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr); +@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struct inode *inode) + + ret = vmbus_connect_ring(dev->channel, + hv_uio_channel_cb, dev->channel); +- if (ret == 0) +- dev->channel->inbound.ring_buffer->interrupt_mask = 1; +- else ++ if (ret) + atomic_dec(&pdata->refcnt); + + return ret; +diff --git a/drivers/usb/cdns3/cdnsp-pci.c b/drivers/usb/cdns3/cdnsp-pci.c +index 159c2eae26608c..b9c74c1baccb28 100644 +--- a/drivers/usb/cdns3/cdnsp-pci.c ++++ b/drivers/usb/cdns3/cdnsp-pci.c +@@ -90,7 +90,7 @@ static int cdnsp_pci_probe(struct pci_dev *pdev, + cdnsp = kzalloc(sizeof(*cdnsp), GFP_KERNEL); + if (!cdnsp) { + ret = -ENOMEM; +- goto disable_pci; ++ goto put_pci; + } + } + +@@ -173,9 +173,6 @@ static int cdnsp_pci_probe(struct pci_dev *pdev, + if (!pci_is_enabled(func)) + kfree(cdnsp); + +-disable_pci: +- pci_disable_device(pdev); +- + put_pci: + pci_dev_put(func); + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 4c89f7629d5308..9e8af571448bfc 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1747,6 +1747,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, + cdev->use_os_string = true; + cdev->b_vendor_code = gi->b_vendor_code; + memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN); ++ } else { ++ cdev->use_os_string = false; + } + + if (gadget_is_otg(gadget) && !otg_desc[0]) { +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index cc1f579f02de1c..2d792ab271e2ae 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi) + if (hcd) { + kfree(max3421_hcd->tx); + kfree(max3421_hcd->rx); +- if (max3421_hcd->spi_thread) ++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread)) + kthread_stop(max3421_hcd->spi_thread); + usb_put_hcd(hcd); + } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index a21ac9d80275f7..6443e11eaac045 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1224,19 +1224,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id, + * Stopped state, but it will soon change to Running. + * + * Assume this bug on unexpected Stop Endpoint failures. +- * Keep retrying until the EP starts and stops again. ++ * Keep retrying until the EP starts and stops again, on ++ * chips where this is known to help. Wait for 100ms. + */ ++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) ++ break; + fallthrough; + case EP_STATE_RUNNING: + /* Race, HW handled stop ep cmd before ep was running */ + xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n", + GET_EP_CTX_STATE(ep_ctx)); +- /* +- * Don't retry forever if we guessed wrong or a defective HC never starts +- * the EP or says 'Running' but fails the command. We must give back TDs. +- */ +- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) +- break; + + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); + if (!command) { +diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig +index 99b15b77dfd576..fe1b5fec1dfcab 100644 +--- a/drivers/usb/misc/Kconfig ++++ b/drivers/usb/misc/Kconfig +@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY + config USB_QCOM_EUD + tristate "QCOM Embedded USB Debugger(EUD) Driver" + depends on ARCH_QCOM || COMPILE_TEST ++ select QCOM_SCM + select USB_ROLE_SWITCH + help + This module enables support for Qualcomm Technologies, Inc. +diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c +index 7f371ea1248c32..cfb195a0f6ce22 100644 +--- a/drivers/usb/misc/qcom_eud.c ++++ b/drivers/usb/misc/qcom_eud.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define EUD_REG_INT1_EN_MASK 0x0024 + #define EUD_REG_INT_STATUS_1 0x0044 +@@ -34,7 +35,7 @@ struct eud_chip { + struct device *dev; + struct usb_role_switch *role_sw; + void __iomem *base; +- void __iomem *mode_mgr; ++ phys_addr_t mode_mgr; + unsigned int int_status; + int irq; + bool enabled; +@@ -43,18 +44,29 @@ struct eud_chip { + + static int enable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1); ++ if (ret) ++ return ret; ++ + writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN); + writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE, + priv->base + EUD_REG_INT1_EN_MASK); +- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2); + + return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE); + } + +-static void disable_eud(struct eud_chip *priv) ++static int disable_eud(struct eud_chip *priv) + { ++ int ret; ++ ++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0); ++ if (ret) ++ return ret; ++ + writel(0, priv->base + EUD_REG_CSR_EUD_EN); +- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2); ++ return 0; + } + + static ssize_t enable_show(struct device *dev, +@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev, + chip->enabled = enable; + else + disable_eud(chip); ++ + } else { +- disable_eud(chip); ++ ret = disable_eud(chip); + } + +- return count; ++ return ret < 0 ? ret : count; + } + + static DEVICE_ATTR_RW(enable); +@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data) + static int eud_probe(struct platform_device *pdev) + { + struct eud_chip *chip; ++ struct resource *res; + int ret; + + chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); +@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev) + if (IS_ERR(chip->base)) + return PTR_ERR(chip->base); + +- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1); +- if (IS_ERR(chip->mode_mgr)) +- return PTR_ERR(chip->mode_mgr); ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -ENODEV; ++ chip->mode_mgr = res->start; + + chip->irq = platform_get_irq(pdev, 0); + ret = devm_request_threaded_irq(&pdev->dev, chip->irq, handle_eud_irq, +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index c3ce6b1054f1c3..292c32ccae0502 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled) + + static int twl6030_usb_probe(struct platform_device *pdev) + { +- u32 ret; + struct twl6030_usb *twl; +- int status, err; ++ int status, err, ret; + struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + +diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c +index 01db27cbf1d10d..3559781d01a38c 100644 +--- a/drivers/usb/typec/tipd/core.c ++++ b/drivers/usb/typec/tipd/core.c +@@ -488,24 +488,23 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) + if (!event) + goto err_unlock; + ++ tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event); ++ + if (!tps6598x_read_status(tps, &status)) +- goto err_clear_ints; ++ goto err_unlock; + + if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE) + if (!tps6598x_read_power_status(tps)) +- goto err_clear_ints; ++ goto err_unlock; + + if (event & APPLE_CD_REG_INT_DATA_STATUS_UPDATE) + if (!tps6598x_read_data_status(tps)) +- goto err_clear_ints; ++ goto err_unlock; + + /* Handle plug insert or removal */ + if (event & APPLE_CD_REG_INT_PLUG_EVENT) + tps6598x_handle_plug_event(tps, status); + +-err_clear_ints: +- tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event); +- + err_unlock: + mutex_unlock(&tps->lock); + +@@ -552,25 +551,24 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data) + if (!(event1[0] | event1[1] | event2[0] | event2[1])) + goto err_unlock; + ++ tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len); ++ tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len); ++ + if (!tps6598x_read_status(tps, &status)) +- goto err_clear_ints; ++ goto err_unlock; + + if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE) + if (!tps6598x_read_power_status(tps)) +- goto err_clear_ints; ++ goto err_unlock; + + if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE) + if (!tps6598x_read_data_status(tps)) +- goto err_clear_ints; ++ goto err_unlock; + + /* Handle plug insert or removal */ + if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) + tps6598x_handle_plug_event(tps, status); + +-err_clear_ints: +- tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len); +- tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len); +- + err_unlock: + mutex_unlock(&tps->lock); + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 14a5f55f24fc8c..b22e0881bfaf38 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + ctrlreq->wValue, vdev->rhport); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * NOTE: A similar operation has been done via ++ * USB_REQ_GET_DESCRIPTOR handler below, which is ++ * supposed to always precede USB_REQ_SET_ADDRESS. ++ * ++ * It's not entirely clear if operating on a different ++ * usb_device instance here is a real possibility, ++ * otherwise this call and vdev->udev assignment above ++ * should be dropped. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + + spin_lock(&vdev->ud.lock); +@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); + + vdev->udev = usb_get_dev(urb->dev); ++ /* ++ * Set syscore PM flag for the virtually attached ++ * devices to ensure they will not enter suspend on ++ * the client side. ++ * ++ * Note this doesn't have any impact on the physical ++ * devices attached to the host system on the server ++ * side, hence there is no need to undo the operation ++ * on disconnect. ++ */ ++ dev_pm_syscore_device(&vdev->udev->dev, true); + usb_put_dev(old); + goto out; + +diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c +index 27607d7b9030a4..6adc5f1ae2eb99 100644 +--- a/drivers/vfio/pci/pds/dirty.c ++++ b/drivers/vfio/pci/pds/dirty.c +@@ -81,7 +81,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_dirty *dirty, + + host_ack_bmp = vzalloc(bytes); + if (!host_ack_bmp) { +- bitmap_free(host_seq_bmp); ++ vfree(host_seq_bmp); + return -ENOMEM; + } + +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 7b8fd977f71ccf..134cc10af776bd 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)src, + len - total_translated, &translated, +@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_from_iter(dst, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_from_iter(dst, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +@@ -1237,6 +1238,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + struct iov_iter iter; + u64 translated; + int ret; ++ size_t size; + + ret = iotlb_translate(vrh, (u64)(uintptr_t)dst, + len - total_translated, &translated, +@@ -1254,9 +1256,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + translated); + } + +- ret = copy_to_iter(src, translated, &iter); +- if (ret < 0) +- return ret; ++ size = copy_to_iter(src, translated, &iter); ++ if (size != translated) ++ return -EFAULT; + + src += translated; + dst += translated; +diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c +index 867f9f31137971..a4b497ecfa2051 100644 +--- a/drivers/watchdog/mpc8xxx_wdt.c ++++ b/drivers/watchdog/mpc8xxx_wdt.c +@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) + ddata->swtc = tmp >> 16; + set_bit(WDOG_HW_RUNNING, &ddata->wdd.status); + ++ mpc8xxx_wdt_keepalive(ddata); ++ + return 0; + } + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index b55d5e2abeb3cb..7afce7b744c018 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1960,6 +1960,16 @@ static inline bool ext4_verity_in_progress(struct inode *inode) + + #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime + ++/* ++ * Check whether the inode is tracked as orphan (either in orphan file or ++ * orphan list). ++ */ ++static inline bool ext4_inode_orphan_tracked(struct inode *inode) ++{ ++ return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) || ++ !list_empty(&EXT4_I(inode)->i_orphan); ++} ++ + /* + * Codes for operating systems + */ +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index b37e0e4a71bfbe..0d387a5b5a678c 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -354,7 +354,7 @@ static void ext4_inode_extension_cleanup(struct inode *inode, bool need_trunc) + * to cleanup the orphan list in ext4_handle_inode_extension(). Do it + * now. + */ +- if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) { ++ if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) { + handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); + + if (IS_ERR(handle)) { +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 886d4dfa737a27..63b1384823ba56 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4370,7 +4370,7 @@ static int ext4_fill_raw_inode(struct inode *inode, struct ext4_inode *raw_inode + * old inodes get re-used with the upper 16 bits of the + * uid/gid intact. + */ +- if (ei->i_dtime && list_empty(&ei->i_orphan)) { ++ if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) { + raw_inode->i_uid_high = 0; + raw_inode->i_gid_high = 0; + } else { +diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c +index a23b0c01f8096d..c53918768cb256 100644 +--- a/fs/ext4/orphan.c ++++ b/fs/ext4/orphan.c +@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) + + WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) && + !inode_is_locked(inode)); +- /* +- * Inode orphaned in orphan file or in orphan list? +- */ +- if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) || +- !list_empty(&EXT4_I(inode)->i_orphan)) ++ if (ext4_inode_orphan_tracked(inode)) + return 0; + + /* +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 7e3906f1390975..527f53bfe1b1f0 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1464,9 +1464,9 @@ static void ext4_free_in_core_inode(struct inode *inode) + + static void ext4_destroy_inode(struct inode *inode) + { +- if (!list_empty(&(EXT4_I(inode)->i_orphan))) { ++ if (ext4_inode_orphan_tracked(inode)) { + ext4_msg(inode->i_sb, KERN_ERR, +- "Inode %lu (%p): orphan list check failed!", ++ "Inode %lu (%p): inode tracked as orphan!", + inode->i_ino, EXT4_I(inode)); + print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4, + EXT4_I(inode), sizeof(struct ext4_inode_info), +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index d37104aa847a74..fe23ebfc88ea14 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1751,12 +1751,13 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) + if (map->m_flags & F2FS_MAP_MAPPED) { + unsigned int ofs = start_pgofs - map->m_lblk; + +- f2fs_update_read_extent_cache_range(&dn, +- start_pgofs, map->m_pblk + ofs, +- map->m_len - ofs); ++ if (map->m_len > ofs) ++ f2fs_update_read_extent_cache_range(&dn, ++ start_pgofs, map->m_pblk + ofs, ++ map->m_len - ofs); + } + if (map->m_next_extent) +- *map->m_next_extent = pgofs + 1; ++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs; + } + f2fs_put_dnode(&dn); + unlock_out: +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 7329f706da83c3..ab2ddd09d8131c 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2296,8 +2296,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, + { + if (!inode) + return true; +- if (!test_opt(sbi, RESERVE_ROOT)) +- return false; + if (IS_NOQUOTA(inode)) + return true; + if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid())) +@@ -2318,7 +2316,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi, + avail_user_block_count = sbi->user_block_count - + sbi->current_reserved_blocks; + +- if (!__allow_reserved_blocks(sbi, inode, cap)) ++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 031015823acb2b..6267ba6ef10839 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -36,15 +36,23 @@ + #include + #include + +-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size) ++static void f2fs_zero_post_eof_page(struct inode *inode, ++ loff_t new_size, bool lock) + { + loff_t old_size = i_size_read(inode); + + if (old_size >= new_size) + return; + ++ if (mapping_empty(inode->i_mapping)) ++ return; ++ ++ if (lock) ++ filemap_invalidate_lock(inode->i_mapping); + /* zero or drop pages only in range of [old_size, new_size] */ +- truncate_pagecache(inode, old_size); ++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size); ++ if (lock) ++ filemap_invalidate_unlock(inode->i_mapping); + } + + static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) +@@ -115,9 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) + + f2fs_bug_on(sbi, f2fs_has_inline_data(inode)); + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true); + + file_update_time(vmf->vma->vm_file); + filemap_invalidate_lock_shared(inode->i_mapping); +@@ -844,8 +850,16 @@ int f2fs_truncate(struct inode *inode) + /* we should check inline_data size */ + if (!f2fs_may_inline_data(inode)) { + err = f2fs_convert_inline_inode(inode); +- if (err) ++ if (err) { ++ /* ++ * Always truncate page #0 to avoid page cache ++ * leak in evict() path. ++ */ ++ truncate_inode_pages_range(inode->i_mapping, ++ F2FS_BLK_TO_BYTES(0), ++ F2FS_BLK_END_BYTES(0)); + return err; ++ } + } + + err = f2fs_truncate_blocks(inode, i_size_read(inode), true); +@@ -1069,7 +1083,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + filemap_invalidate_lock(inode->i_mapping); + + if (attr->ia_size > old_size) +- f2fs_zero_post_eof_page(inode, attr->ia_size); ++ f2fs_zero_post_eof_page(inode, attr->ia_size, false); + truncate_setsize(inode, attr->ia_size); + + if (attr->ia_size <= old_size) +@@ -1188,9 +1202,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len) + if (ret) + return ret; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1476,7 +1488,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(inode->i_mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + + f2fs_lock_op(sbi); + f2fs_drop_extent_tree(inode); +@@ -1600,9 +1612,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + if (ret) + return ret; + +- filemap_invalidate_lock(mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + pg_start = ((unsigned long long) offset) >> PAGE_SHIFT; + pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT; +@@ -1736,7 +1746,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len) + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(mapping); + +- f2fs_zero_post_eof_page(inode, offset + len); ++ f2fs_zero_post_eof_page(inode, offset + len, false); + truncate_pagecache(inode, offset); + + while (!ret && idx > pg_start) { +@@ -1792,9 +1802,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset, + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, offset + len); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, offset + len, true); + + f2fs_balance_fs(sbi, true); + +@@ -4710,9 +4718,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from) + if (err) + return err; + +- filemap_invalidate_lock(inode->i_mapping); +- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from)); +- filemap_invalidate_unlock(inode->i_mapping); ++ f2fs_zero_post_eof_page(inode, ++ iocb->ki_pos + iov_iter_count(from), true); + return count; + } + +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 687670075d2256..c4bc86c3535ba6 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -811,8 +811,6 @@ __acquires(&gl->gl_lockref.lock) + clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags); + gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD); + return; +- } else { +- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags); + } + } + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 124b9cee6fed7d..94a1caf3266991 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9226,7 +9226,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args + goto out; + if (rcvd->max_rqst_sz > sent->max_rqst_sz) + return -EINVAL; +- if (rcvd->max_resp_sz < sent->max_resp_sz) ++ if (rcvd->max_resp_sz > sent->max_resp_sz) + return -EINVAL; + if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached) + return -EINVAL; +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 191b91ffadbb21..f227db9f76c2b4 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1510,6 +1510,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size); + } + ++ /* ++ * Index blocks exist, but $BITMAP has zero valid bits. ++ * This implies an on-disk corruption and must be rejected. ++ */ ++ if (in->name == I30_NAME && ++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) { ++ err = -EINVAL; ++ goto out1; ++ } ++ + bit = bmp_size << 3; + } + +diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c +index 44e93ad491ba77..0139124578d9e2 100644 +--- a/fs/ntfs3/run.c ++++ b/fs/ntfs3/run.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include "ntfs.h" +@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, + + if (!dlcn) + return -EINVAL; +- lcn = prev_lcn + dlcn; ++ ++ if (check_add_overflow(prev_lcn, dlcn, &lcn)) ++ return -EINVAL; + prev_lcn = lcn; + } else + return -EINVAL; + +- next_vcn = vcn64 + len; ++ if (check_add_overflow(vcn64, len, &next_vcn)) ++ return -EINVAL; ++ + /* Check boundary. */ + if (next_vcn > evcn + 1) + return -EINVAL; +@@ -1151,7 +1156,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn) + return -EINVAL; + + run_buf += size_size + offset_size; +- vcn64 += len; ++ if (check_add_overflow(vcn64, len, &vcn64)) ++ return -EINVAL; + + #ifndef CONFIG_NTFS3_64BIT_CLUSTER + if (vcn64 > 0x100000000ull) +diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c +index 9b76ee66aeb2f4..38c0d6f64fce38 100644 +--- a/fs/ocfs2/stack_user.c ++++ b/fs/ocfs2/stack_user.c +@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn) + printk(KERN_ERR "ocfs2: Could not determine" + " locking version\n"); + user_cluster_disconnect(conn); ++ lc = NULL; + goto out; + } + wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0)); +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index b74f7690473948..ee6a6ba13f89c8 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4152,7 +4152,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, + static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct sg_table *sgt, +- unsigned int *num_sgs, size_t *sensitive_size) ++ unsigned int *num_sgs) + { + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); +@@ -4169,9 +4169,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += array_size(*num_sgs, sizeof(struct scatterlist)); +- *sensitive_size = len; + +- p = kvzalloc(len, GFP_NOFS); ++ p = kzalloc(len, GFP_NOFS); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -4185,16 +4184,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst + + static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, +- struct aead_request **req, struct scatterlist **sgl, +- size_t *sensitive_size) ++ struct aead_request **req, struct scatterlist **sgl) + { + struct sg_table sgtable = {}; + unsigned int skip, num_sgs, i, j; + ssize_t rc; + void *p; + +- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, +- &num_sgs, sensitive_size); ++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); + if (IS_ERR(p)) + return ERR_CAST(p); + +@@ -4283,7 +4280,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + DECLARE_CRYPTO_WAIT(wait); + unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; +- size_t sensitive_size; + + rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); + if (rc) { +@@ -4309,8 +4305,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + return rc; + } + +- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, +- &sensitive_size); ++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (IS_ERR(creq)) + return PTR_ERR(creq); + +@@ -4340,7 +4335,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, + if (!rc && enc) + memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); + +- kvfree_sensitive(creq, sensitive_size); ++ kfree_sensitive(creq); + return rc; + } + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index ae47450dc40f82..93c31feab3564c 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -5596,7 +5596,8 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, + + if (!work->tcon->posix_extensions) { + pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); +- rc = -EOPNOTSUPP; ++ path_put(&path); ++ return -EOPNOTSUPP; + } else { + info = (struct filesystem_posix_info *)(rsp->Buffer); + info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize); +diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c +index 504e2a1cf33b84..31c1ac256e1be4 100644 +--- a/fs/smb/server/transport_rdma.c ++++ b/fs/smb/server/transport_rdma.c +@@ -152,6 +152,10 @@ struct smb_direct_transport { + struct work_struct disconnect_work; + + bool negotiation_requested; ++ ++ bool legacy_iwarp; ++ u8 initiator_depth; ++ u8 responder_resources; + }; + + #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) +@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) + t->cm_id = cm_id; + cm_id->context = t; + ++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH; ++ t->responder_resources = 1; ++ + t->status = SMB_DIRECT_CS_NEW; + init_waitqueue_head(&t->wait_status); + +@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t, + static int smb_direct_accept_client(struct smb_direct_transport *t) + { + struct rdma_conn_param conn_param; +- struct ib_port_immutable port_immutable; +- u32 ird_ord_hdr[2]; ++ __be32 ird_ord_hdr[2]; + int ret; + ++ /* ++ * smb_direct_handle_connect_request() ++ * already negotiated t->initiator_depth ++ * and t->responder_resources ++ */ + memset(&conn_param, 0, sizeof(conn_param)); +- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom, +- SMB_DIRECT_CM_INITIATOR_DEPTH); +- conn_param.responder_resources = 0; +- +- t->cm_id->device->ops.get_port_immutable(t->cm_id->device, +- t->cm_id->port_num, +- &port_immutable); +- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) { +- ird_ord_hdr[0] = conn_param.responder_resources; +- ird_ord_hdr[1] = 1; ++ conn_param.initiator_depth = t->initiator_depth; ++ conn_param.responder_resources = t->responder_resources; ++ ++ if (t->legacy_iwarp) { ++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources); ++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth); + conn_param.private_data = ird_ord_hdr; + conn_param.private_data_len = sizeof(ird_ord_hdr); + } else { +@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs) + return true; + } + +-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) ++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id, ++ struct rdma_cm_event *event) + { + struct smb_direct_transport *t; + struct task_struct *handler; ++ u8 peer_initiator_depth; ++ u8 peer_responder_resources; + int ret; + + if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) { +@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id) + if (!t) + return -ENOMEM; + ++ peer_initiator_depth = event->param.conn.initiator_depth; ++ peer_responder_resources = event->param.conn.responder_resources; ++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) && ++ event->param.conn.private_data_len == 8) { ++ /* ++ * Legacy clients with only iWarp MPA v1 support ++ * need a private blob in order to negotiate ++ * the IRD/ORD values. ++ */ ++ const __be32 *ird_ord_hdr = event->param.conn.private_data; ++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]); ++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]); ++ ++ /* ++ * cifs.ko sends the legacy IRD/ORD negotiation ++ * event if iWarp MPA v2 was used. ++ * ++ * Here we check that the values match and only ++ * mark the client as legacy if they don't match. ++ */ ++ if ((u32)event->param.conn.initiator_depth != ird32 || ++ (u32)event->param.conn.responder_resources != ord32) { ++ /* ++ * There are broken clients (old cifs.ko) ++ * using little endian and also ++ * struct rdma_conn_param only uses u8 ++ * for initiator_depth and responder_resources, ++ * so we truncate the value to U8_MAX. ++ * ++ * smb_direct_accept_client() will then ++ * do the real negotiation in order to ++ * select the minimum between client and ++ * server. ++ */ ++ ird32 = min_t(u32, ird32, U8_MAX); ++ ord32 = min_t(u32, ord32, U8_MAX); ++ ++ t->legacy_iwarp = true; ++ peer_initiator_depth = (u8)ird32; ++ peer_responder_resources = (u8)ord32; ++ } ++ } ++ ++ /* ++ * First set what the we as server are able to support ++ */ ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ new_cm_id->device->attrs.max_qp_rd_atom); ++ ++ /* ++ * negotiate the value by using the minimum ++ * between client and server if the client provided ++ * non 0 values. ++ */ ++ if (peer_initiator_depth != 0) ++ t->initiator_depth = min_t(u8, t->initiator_depth, ++ peer_initiator_depth); ++ if (peer_responder_resources != 0) ++ t->responder_resources = min_t(u8, t->responder_resources, ++ peer_responder_resources); ++ + ret = smb_direct_connect(t); + if (ret) + goto out_err; +@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id, + { + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: { +- int ret = smb_direct_handle_connect_request(cm_id); ++ int ret = smb_direct_handle_connect_request(cm_id, event); + + if (ret) { + pr_err("Can't create transport: %d\n", ret); +diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c +index d5918eba27e371..53104f25de5116 100644 +--- a/fs/squashfs/inode.c ++++ b/fs/squashfs/inode.c +@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block); + squashfs_i(inode)->block_list_start = block; + squashfs_i(inode)->offset = offset; ++ squashfs_i(inode)->parent = 0; + inode->i_data.a_ops = &squashfs_aops; + + TRACE("File inode %x:%x, start_block %llx, block_list_start " +@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block); + squashfs_i(inode)->block_list_start = block; + squashfs_i(inode)->offset = offset; ++ squashfs_i(inode)->parent = 0; + inode->i_data.a_ops = &squashfs_aops; + + TRACE("File inode %x:%x, start_block %llx, block_list_start " +@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + inode->i_mode |= S_IFLNK; + squashfs_i(inode)->start = block; + squashfs_i(inode)->offset = offset; ++ squashfs_i(inode)->parent = 0; + + if (type == SQUASHFS_LSYMLINK_TYPE) { + __le32 xattr; +@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); + rdev = le32_to_cpu(sqsh_ino->rdev); + init_special_inode(inode, inode->i_mode, new_decode_dev(rdev)); ++ squashfs_i(inode)->parent = 0; + + TRACE("Device inode %x:%x, rdev %x\n", + SQUASHFS_INODE_BLK(ino), offset, rdev); +@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); + rdev = le32_to_cpu(sqsh_ino->rdev); + init_special_inode(inode, inode->i_mode, new_decode_dev(rdev)); ++ squashfs_i(inode)->parent = 0; + + TRACE("Device inode %x:%x, rdev %x\n", + SQUASHFS_INODE_BLK(ino), offset, rdev); +@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + inode->i_mode |= S_IFSOCK; + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); + init_special_inode(inode, inode->i_mode, 0); ++ squashfs_i(inode)->parent = 0; + break; + } + case SQUASHFS_LFIFO_TYPE: +@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) + inode->i_op = &squashfs_inode_ops; + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); + init_special_inode(inode, inode->i_mode, 0); ++ squashfs_i(inode)->parent = 0; + break; + } + default: +diff --git a/fs/squashfs/squashfs_fs_i.h b/fs/squashfs/squashfs_fs_i.h +index 2c82d6f2a4561b..8e497ac07b9a83 100644 +--- a/fs/squashfs/squashfs_fs_i.h ++++ b/fs/squashfs/squashfs_fs_i.h +@@ -16,6 +16,7 @@ struct squashfs_inode_info { + u64 xattr; + unsigned int xattr_size; + int xattr_count; ++ int parent; + union { + struct { + u64 fragment_block; +@@ -27,7 +28,6 @@ struct squashfs_inode_info { + u64 dir_idx_start; + int dir_idx_offset; + int dir_idx_cnt; +- int parent; + }; + }; + struct inode vfs_inode; +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 2f73119c7ec98a..848c46c5e9d3c3 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -2265,6 +2265,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos, + if (check_add_overflow(sizeof(struct allocExtDesc), + le32_to_cpu(header->lengthAllocDescs), &alen)) + return -1; ++ ++ if (alen > epos->bh->b_size) ++ return -1; + } + + switch (iinfo->i_alloc_type) { +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index cf3f8b9bf43f08..010ac18c05916e 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -351,6 +351,7 @@ + __start_once = .; \ + *(.data..once) \ + __end_once = .; \ ++ *(.data..do_once) \ + STRUCT_ALIGN(); \ + *(__tracepoints) \ + /* implement dynamic printk debug */ \ +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 83da9c81fa86ad..0af6b2a5273adc 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -269,6 +269,7 @@ struct bpf_map_owner { + bool xdp_has_frags; + u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; + const struct btf_type *attach_func_proto; ++ enum bpf_attach_type expected_attach_type; + }; + + struct bpf_map { +diff --git a/include/linux/once.h b/include/linux/once.h +index 30346fcdc7995d..449a0e34ad5ad9 100644 +--- a/include/linux/once.h ++++ b/include/linux/once.h +@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + unsigned long ___flags; \ +@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key, + #define DO_ONCE_SLEEPABLE(func, ...) \ + ({ \ + bool ___ret = false; \ +- static bool __section(".data..once") ___done = false; \ ++ static bool __section(".data..do_once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_sleepable_start(&___done); \ +diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h +index 1646dadd7f37cf..3b1c8d93b2654c 100644 +--- a/include/trace/events/filelock.h ++++ b/include/trace/events/filelock.h +@@ -27,7 +27,8 @@ + { FL_SLEEP, "FL_SLEEP" }, \ + { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ + { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ +- { FL_OFDLCK, "FL_OFDLCK" }) ++ { FL_OFDLCK, "FL_OFDLCK" }, \ ++ { FL_RECLAIM, "FL_RECLAIM"}) + + #define show_fl_type(val) \ + __print_symbolic(val, \ +diff --git a/init/Kconfig b/init/Kconfig +index 8b630143c720f6..461591503bf43f 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1367,6 +1367,7 @@ config BOOT_CONFIG_EMBED_FILE + + config INITRAMFS_PRESERVE_MTIME + bool "Preserve cpio archive mtimes in initramfs" ++ depends on BLK_DEV_INITRD + default y + help + Each entry in an initramfs cpio archive carries an mtime value. When +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 3618be05fc3527..a343248c35ded6 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -2279,6 +2279,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + map->owner->type = prog_type; + map->owner->jited = fp->jited; + map->owner->xdp_has_frags = aux->xdp_has_frags; ++ map->owner->expected_attach_type = fp->expected_attach_type; + map->owner->attach_func_proto = aux->attach_func_proto; + for_each_cgroup_storage_type(i) { + map->owner->storage_cookie[i] = +@@ -2290,6 +2291,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, + ret = map->owner->type == prog_type && + map->owner->jited == fp->jited && + map->owner->xdp_has_frags == aux->xdp_has_frags; ++ if (ret && ++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY && ++ map->owner->expected_attach_type != fp->expected_attach_type) ++ ret = false; + for_each_cgroup_storage_type(i) { + if (!ret) + break; +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index a6f825b7fbe6cd..5e644b1b12aaaa 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -13727,7 +13727,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + } else { /* all other ALU ops: and, sub, xor, add, ... */ + + if (BPF_SRC(insn->code) == BPF_X) { +- if (insn->imm != 0 || insn->off > 1 || ++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +@@ -13737,7 +13737,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + if (err) + return err; + } else { +- if (insn->src_reg != BPF_REG_0 || insn->off > 1 || ++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || + (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { + verbose(env, "BPF_ALU uses reserved fields\n"); + return -EINVAL; +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 255999ba9190a6..1d26a0e978f269 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1099,7 +1099,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn + static bool should_sleep_killable(struct seccomp_filter *match, + struct seccomp_knotif *n) + { +- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT; ++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT; + } + + static int seccomp_do_user_notification(int this_syscall, +@@ -1146,13 +1146,11 @@ static int seccomp_do_user_notification(int this_syscall, + + if (err != 0) { + /* +- * Check to see if the notifcation got picked up and +- * whether we should switch to wait killable. ++ * Check to see whether we should switch to wait ++ * killable. Only return the interrupted error if not. + */ +- if (!wait_killable && should_sleep_killable(match, &n)) +- continue; +- +- goto interrupted; ++ if (!(!wait_killable && should_sleep_killable(match, &n))) ++ goto interrupted; + } + + addfd = list_first_entry_or_null(&n.addfd, +diff --git a/kernel/smp.c b/kernel/smp.c +index 3eeffeaf5450c6..13b376c7296a54 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -862,16 +862,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask, + * @mask: The set of cpus to run on (only runs on online subset). + * @func: The function to run. This must be fast and non-blocking. + * @info: An arbitrary pointer to pass to the function. +- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait +- * (atomically) until function has completed on other CPUs. If +- * %SCF_RUN_LOCAL is set, the function will also be run locally +- * if the local CPU is set in the @cpumask. +- * +- * If @wait is true, then returns once @func has returned. ++ * @wait: If true, wait (atomically) until function has completed ++ * on other CPUs. + * + * You must not call this function with disabled interrupts or from a + * hardware interrupt handler or from a bottom half handler. Preemption + * must be disabled when calling this function. ++ * ++ * @func is not called on the local CPU even if @mask contains it. Consider ++ * using on_each_cpu_cond_mask() instead if this is not desirable. + */ + void smp_call_function_many(const struct cpumask *mask, + smp_call_func_t func, void *info, bool wait) +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 8903db0b596026..a896b80252ae11 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -2726,18 +2726,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, + struct bpf_run_ctx *old_run_ctx; + int err; + ++ /* ++ * graph tracer framework ensures we won't migrate, so there is no need ++ * to use migrate_disable for bpf_prog_run again. The check here just for ++ * __this_cpu_inc_return. ++ */ ++ cant_sleep(); ++ + if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) { + err = 0; + goto out; + } + +- migrate_disable(); + rcu_read_lock(); + old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); + err = bpf_prog_run(link->link.prog, regs); + bpf_reset_run_ctx(old_run_ctx); + rcu_read_unlock(); +- migrate_enable(); + + out: + __this_cpu_dec(bpf_prog_active); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index d57d8f1c2dfea4..0c6745a6a13a59 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -6693,6 +6693,8 @@ long hugetlb_change_protection(struct vm_area_struct *vma, + psize); + } + spin_unlock(ptl); ++ ++ cond_resched(); + } + /* + * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index dc9209f9f1a6a3..a128e5709fa153 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -1347,7 +1347,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + { + struct hci_cp_le_set_ext_adv_params cp; + struct hci_rp_le_set_ext_adv_params rp; +- bool connectable; ++ bool connectable, require_privacy; + u32 flags; + bdaddr_t random_addr; + u8 own_addr_type; +@@ -1385,10 +1385,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) + return -EPERM; + + /* Set require_privacy to true only when non-connectable +- * advertising is used. In that case it is fine to use a +- * non-resolvable private address. ++ * advertising is used and it is not periodic. ++ * In that case it is fine to use a non-resolvable private address. + */ +- err = hci_get_random_address(hdev, !connectable, ++ require_privacy = !connectable && !(adv && adv->periodic); ++ ++ err = hci_get_random_address(hdev, require_privacy, + adv_use_rpa(hdev, flags), adv, + &own_addr_type, &random_addr); + if (err < 0) +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index b94d202bf3745c..69529a3049e741 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -718,6 +718,13 @@ static void iso_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %d", sk, sk->sk_state); + ++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ if (iso_pi(sk)->conn) { ++ iso_conn_lock(iso_pi(sk)->conn); ++ iso_pi(sk)->conn->sk = NULL; ++ iso_conn_unlock(iso_pi(sk)->conn); ++ } ++ + /* Kill poor orphan */ + bt_sock_unlink(&iso_sk_list, sk); + sock_set_flag(sk, SOCK_DEAD); +@@ -2084,7 +2091,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), + skb->len); + conn->rx_len -= skb->len; +- return; ++ break; + + case ISO_END: + skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 9b01eaaa0eb2d6..54ddbb2635e2ff 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -4405,13 +4405,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, + return -ENOMEM; + + #ifdef CONFIG_BT_FEATURE_DEBUG +- if (!hdev) { +- flags = bt_dbg_get() ? BIT(0) : 0; ++ flags = bt_dbg_get() ? BIT(0) : 0; + +- memcpy(rp->features[idx].uuid, debug_uuid, 16); +- rp->features[idx].flags = cpu_to_le32(flags); +- idx++; +- } ++ memcpy(rp->features[idx].uuid, debug_uuid, 16); ++ rp->features[idx].flags = cpu_to_le32(flags); ++ idx++; + #endif + + if (hdev && hci_dev_le_state_simultaneous(hdev)) { +diff --git a/net/core/filter.c b/net/core/filter.c +index 7afb7658c38835..b6dbcef649654c 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -9156,13 +9156,17 @@ static bool sock_addr_is_valid_access(int off, int size, + return false; + info->reg_type = PTR_TO_SOCKET; + break; +- default: +- if (type == BPF_READ) { +- if (size != size_default) +- return false; +- } else { ++ case bpf_ctx_range(struct bpf_sock_addr, user_family): ++ case bpf_ctx_range(struct bpf_sock_addr, family): ++ case bpf_ctx_range(struct bpf_sock_addr, type): ++ case bpf_ctx_range(struct bpf_sock_addr, protocol): ++ if (type != BPF_READ) + return false; +- } ++ if (size != size_default) ++ return false; ++ break; ++ default: ++ return false; + } + + return true; +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 4cb0c896caf978..5c848136bc2667 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table, + + int ping_get_port(struct sock *sk, unsigned short ident) + { ++ struct net *net = sock_net(sk); + struct inet_sock *isk, *isk2; + struct hlist_head *hlist; + struct sock *sk2 = NULL; +@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + for (i = 0; i < (1L << 16); i++, result++) { + if (!result) + result++; /* avoid zero */ +- hlist = ping_hashslot(&ping_table, sock_net(sk), +- result); ++ hlist = ping_hashslot(&ping_table, net, result); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + if (isk2->inet_num == result) +@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident) + if (i >= (1L << 16)) + goto fail; + } else { +- hlist = ping_hashslot(&ping_table, sock_net(sk), ident); ++ hlist = ping_hashslot(&ping_table, net, ident); + sk_for_each(sk2, hlist) { ++ if (!net_eq(sock_net(sk2), net)) ++ continue; + isk2 = inet_sk(sk2); + + /* BUG? Why is this reuse and not reuseaddr? ping.c +@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident) + pr_debug("was not hashed\n"); + sk_add_node_rcu(sk, hlist); + sock_set_flag(sk, SOCK_RCU_FREE); +- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); ++ sock_prot_inuse_add(net, sk->sk_prot, 1); + } + spin_unlock(&ping_table.lock); + return 0; +@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident) + } + + sk_for_each_rcu(sk, hslot) { ++ if (!net_eq(sock_net(sk), net)) ++ continue; + isk = inet_sk(sk); + + pr_debug("iterate\n"); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 40a2f172be2cbd..7d824578f217a8 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2786,8 +2786,8 @@ bool tcp_check_oom(struct sock *sk, int shift) + + void __tcp_close(struct sock *sk, long timeout) + { ++ bool data_was_unread = false; + struct sk_buff *skb; +- int data_was_unread = 0; + int state; + + WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); +@@ -2806,11 +2806,12 @@ void __tcp_close(struct sock *sk, long timeout) + * reader process may not have drained the data yet! + */ + while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { +- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; ++ u32 end_seq = TCP_SKB_CB(skb)->end_seq; + + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- len--; +- data_was_unread += len; ++ end_seq--; ++ if (after(end_seq, tcp_sk(sk)->copied_seq)) ++ data_was_unread = true; + __kfree_skb(skb); + } + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 210337ef23cf5c..164c6e80498265 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -5219,12 +5219,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ continue; ++ ++ link_id = link_sta->link_id; ++ } ++ + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) +- continue; +- + ieee80211_prepare_and_rx_handle(&rx, skb, false); + + prev_sta = sta; +@@ -5232,10 +5240,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) +- goto out; ++ if (!status->link_valid && prev_sta->sta.mlo) { ++ struct link_sta_info *link_sta; ++ ++ link_sta = link_sta_info_get_bss(rx.sdata, ++ hdr->addr2); ++ if (!link_sta) ++ goto out; + +- if (!status->link_valid && prev_sta->sta.mlo) ++ link_id = link_sta->link_id; ++ } ++ ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index c2d88b1b06b872..20b223e6e93b9c 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -62,7 +62,7 @@ struct hbucket { + : jhash_size((htable_bits) - HTABLE_REGION_BITS)) + #define ahash_sizeof_regions(htable_bits) \ + (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) +-#define ahash_region(n, htable_bits) \ ++#define ahash_region(n) \ + ((n) / jhash_size(HTABLE_REGION_BITS)) + #define ahash_bucket_start(h, htable_bits) \ + ((htable_bits) < HTABLE_REGION_BITS ? 0 \ +@@ -701,7 +701,7 @@ mtype_resize(struct ip_set *set, bool retried) + #endif + key = HKEY(data, h->initval, htable_bits); + m = __ipset_dereference(hbucket(t, key)); +- nr = ahash_region(key, htable_bits); ++ nr = ahash_region(key); + if (!m) { + m = kzalloc(sizeof(*m) + + AHASH_INIT_SIZE * dsize, +@@ -851,7 +851,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + elements = t->hregion[r].elements; + maxelem = t->maxelem; +@@ -1049,7 +1049,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, + rcu_read_lock_bh(); + t = rcu_dereference_bh(h->table); + key = HKEY(value, h->initval, t->htable_bits); +- r = ahash_region(key, t->htable_bits); ++ r = ahash_region(key); + atomic_inc(&t->uref); + rcu_read_unlock_bh(); + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 8182833a358280..d9c3eefe8cbb0c 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -884,7 +884,7 @@ static void ip_vs_conn_expire(struct timer_list *t) + * conntrack cleanup for the net. + */ + smp_rmb(); +- if (ipvs->enable) ++ if (READ_ONCE(ipvs->enable)) + ip_vs_conn_drop_conntrack(cp); + } + +@@ -1432,7 +1432,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) + cond_resched_rcu(); + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + break; + } + rcu_read_unlock(); +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 3230506ae3ffd8..34c4648ba36ece 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat + if (unlikely(!skb_dst(skb))) + return NF_ACCEPT; + +- if (!ipvs->enable) +- return NF_ACCEPT; +- + ip_vs_fill_iph_skb(af, skb, false, &iph); + #ifdef CONFIG_IP_VS_IPV6 + if (af == AF_INET6) { +@@ -1936,7 +1933,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state + return NF_ACCEPT; + } + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + ip_vs_fill_iph_skb(af, skb, false, &iph); +@@ -2104,7 +2101,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb, + int r; + + /* ipvs enabled in this netns ? */ +- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable)) ++ if (unlikely(sysctl_backup_only(ipvs))) + return NF_ACCEPT; + + if (state->pf == NFPROTO_IPV4) { +@@ -2291,7 +2288,7 @@ static int __net_init __ip_vs_init(struct net *net) + return -ENOMEM; + + /* Hold the beast until a service is registered */ +- ipvs->enable = 0; ++ WRITE_ONCE(ipvs->enable, 0); + ipvs->net = net; + /* Counters used for creating unique names */ + ipvs->gen = atomic_read(&ipvs_netns_cnt); +@@ -2363,7 +2360,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list) + ipvs = net_ipvs(net); + ip_vs_unregister_hooks(ipvs, AF_INET); + ip_vs_unregister_hooks(ipvs, AF_INET6); +- ipvs->enable = 0; /* Disable packet reception */ ++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */ + smp_wmb(); + ip_vs_sync_net_cleanup(ipvs); + } +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index ae76542de3e989..c82dcbb4dabce2 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work) + struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; + + /* netns clean up started, abort delayed work */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock; + if (!kd) + continue; +@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + + *svc_p = svc; + +- if (!ipvs->enable) { ++ if (!READ_ONCE(ipvs->enable)) { + /* Now there is a service - full throttle */ +- ipvs->enable = 1; ++ WRITE_ONCE(ipvs->enable, 1); + + /* Start estimation for first time */ + ip_vs_est_reload_start(ipvs); +diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c +index c5970ba416aea8..b48d3a09e21742 100644 +--- a/net/netfilter/ipvs/ip_vs_est.c ++++ b/net/netfilter/ipvs/ip_vs_est.c +@@ -230,7 +230,7 @@ static int ip_vs_estimation_kthread(void *data) + void ip_vs_est_reload_start(struct netns_ipvs *ipvs) + { + /* Ignore reloads before first service is added */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + return; + ip_vs_est_stopped_recalc(ipvs); + /* Bump the kthread configuration genid */ +@@ -304,7 +304,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + int i; + + if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads && +- ipvs->enable && ipvs->est_max_threads) ++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads) + return -EINVAL; + + mutex_lock(&ipvs->est_mutex); +@@ -341,7 +341,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs) + } + + /* Start kthread tasks only when services are present */ +- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) { ++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) { + ret = ip_vs_est_kthread_start(ipvs, kd); + if (ret < 0) + goto out; +@@ -484,7 +484,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats) + struct ip_vs_estimator *est = &stats->est; + int ret; + +- if (!ipvs->est_max_threads && ipvs->enable) ++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable)) + ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); + + est->ktid = -1; +@@ -661,7 +661,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + /* Wait for cpufreq frequency transition */ + wait_event_idle_timeout(wq, kthread_should_stop(), + HZ / 50); +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + } + +@@ -679,7 +679,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max) + rcu_read_unlock(); + local_bh_enable(); + +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto stop; + cond_resched(); + +@@ -755,7 +755,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + mutex_lock(&ipvs->est_mutex); + for (id = 1; id < ipvs->est_kt_count; id++) { + /* netns clean up started, abort */ +- if (!ipvs->enable) ++ if (!READ_ONCE(ipvs->enable)) + goto unlock2; + kd = ipvs->est_kt_arr[id]; + if (!kd) +@@ -785,7 +785,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs) + id = ipvs->est_kt_count; + + next_kt: +- if (!ipvs->enable || kthread_should_stop()) ++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop()) + goto unlock; + id--; + if (id < 0) +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index ef1f45e43b6308..61d3797fb79954 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -53,6 +53,7 @@ enum { + IP_VS_FTP_EPSV, + }; + ++static bool exiting_module; + /* + * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper + * First port is set to the default port. +@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- if (!ipvs) ++ if (!ipvs || !exiting_module) + return; + + unregister_ip_vs_app(ipvs, &ip_vs_ftp); +@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void) + */ + static void __exit ip_vs_ftp_exit(void) + { ++ exiting_module = true; + unregister_pernet_subsys(&ip_vs_ftp_ops); + /* rcu_barrier() is called by netns */ + } +diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c +index 994a0a1efb5890..cb2a672105dc1a 100644 +--- a/net/nfc/nci/ntf.c ++++ b/net/nfc/nci/ntf.c +@@ -27,11 +27,16 @@ + + /* Handle NCI Notification packets */ + +-static void nci_core_reset_ntf_packet(struct nci_dev *ndev, +- const struct sk_buff *skb) ++static int nci_core_reset_ntf_packet(struct nci_dev *ndev, ++ const struct sk_buff *skb) + { + /* Handle NCI 2.x core reset notification */ +- const struct nci_core_reset_ntf *ntf = (void *)skb->data; ++ const struct nci_core_reset_ntf *ntf; ++ ++ if (skb->len < sizeof(struct nci_core_reset_ntf)) ++ return -EINVAL; ++ ++ ntf = (struct nci_core_reset_ntf *)skb->data; + + ndev->nci_ver = ntf->nci_ver; + pr_debug("nci_ver 0x%x, config_status 0x%x\n", +@@ -42,15 +47,22 @@ static void nci_core_reset_ntf_packet(struct nci_dev *ndev, + __le32_to_cpu(ntf->manufact_specific_info); + + nci_req_complete(ndev, NCI_STATUS_OK); ++ ++ return 0; + } + +-static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, +- struct sk_buff *skb) ++static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, ++ struct sk_buff *skb) + { +- struct nci_core_conn_credit_ntf *ntf = (void *) skb->data; ++ struct nci_core_conn_credit_ntf *ntf; + struct nci_conn_info *conn_info; + int i; + ++ if (skb->len < sizeof(struct nci_core_conn_credit_ntf)) ++ return -EINVAL; ++ ++ ntf = (struct nci_core_conn_credit_ntf *)skb->data; ++ + pr_debug("num_entries %d\n", ntf->num_entries); + + if (ntf->num_entries > NCI_MAX_NUM_CONN) +@@ -68,7 +80,7 @@ static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, + conn_info = nci_get_conn_info_by_conn_id(ndev, + ntf->conn_entries[i].conn_id); + if (!conn_info) +- return; ++ return 0; + + atomic_add(ntf->conn_entries[i].credits, + &conn_info->credits_cnt); +@@ -77,12 +89,19 @@ static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev, + /* trigger the next tx */ + if (!skb_queue_empty(&ndev->tx_q)) + queue_work(ndev->tx_wq, &ndev->tx_work); ++ ++ return 0; + } + +-static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev, +- const struct sk_buff *skb) ++static int nci_core_generic_error_ntf_packet(struct nci_dev *ndev, ++ const struct sk_buff *skb) + { +- __u8 status = skb->data[0]; ++ __u8 status; ++ ++ if (skb->len < 1) ++ return -EINVAL; ++ ++ status = skb->data[0]; + + pr_debug("status 0x%x\n", status); + +@@ -91,12 +110,19 @@ static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev, + (the state remains the same) */ + nci_req_complete(ndev, status); + } ++ ++ return 0; + } + +-static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev, +- struct sk_buff *skb) ++static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev, ++ struct sk_buff *skb) + { +- struct nci_core_intf_error_ntf *ntf = (void *) skb->data; ++ struct nci_core_intf_error_ntf *ntf; ++ ++ if (skb->len < sizeof(struct nci_core_intf_error_ntf)) ++ return -EINVAL; ++ ++ ntf = (struct nci_core_intf_error_ntf *)skb->data; + + ntf->conn_id = nci_conn_id(&ntf->conn_id); + +@@ -105,6 +131,8 @@ static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev, + /* complete the data exchange transaction, if exists */ + if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags)) + nci_data_exchange_complete(ndev, NULL, ntf->conn_id, -EIO); ++ ++ return 0; + } + + static const __u8 * +@@ -329,13 +357,18 @@ void nci_clear_target_list(struct nci_dev *ndev) + ndev->n_targets = 0; + } + +-static void nci_rf_discover_ntf_packet(struct nci_dev *ndev, +- const struct sk_buff *skb) ++static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, ++ const struct sk_buff *skb) + { + struct nci_rf_discover_ntf ntf; +- const __u8 *data = skb->data; ++ const __u8 *data; + bool add_target = true; + ++ if (skb->len < sizeof(struct nci_rf_discover_ntf)) ++ return -EINVAL; ++ ++ data = skb->data; ++ + ntf.rf_discovery_id = *data++; + ntf.rf_protocol = *data++; + ntf.rf_tech_and_mode = *data++; +@@ -390,6 +423,8 @@ static void nci_rf_discover_ntf_packet(struct nci_dev *ndev, + nfc_targets_found(ndev->nfc_dev, ndev->targets, + ndev->n_targets); + } ++ ++ return 0; + } + + static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev, +@@ -531,14 +566,19 @@ static int nci_store_general_bytes_nfc_dep(struct nci_dev *ndev, + return NCI_STATUS_OK; + } + +-static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, +- const struct sk_buff *skb) ++static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, ++ const struct sk_buff *skb) + { + struct nci_conn_info *conn_info; + struct nci_rf_intf_activated_ntf ntf; +- const __u8 *data = skb->data; ++ const __u8 *data; + int err = NCI_STATUS_OK; + ++ if (skb->len < sizeof(struct nci_rf_intf_activated_ntf)) ++ return -EINVAL; ++ ++ data = skb->data; ++ + ntf.rf_discovery_id = *data++; + ntf.rf_interface = *data++; + ntf.rf_protocol = *data++; +@@ -645,7 +685,7 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, + if (err == NCI_STATUS_OK) { + conn_info = ndev->rf_conn_info; + if (!conn_info) +- return; ++ return 0; + + conn_info->max_pkt_payload_len = ntf.max_data_pkt_payload_size; + conn_info->initial_num_credits = ntf.initial_num_credits; +@@ -691,19 +731,26 @@ static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, + pr_err("error when signaling tm activation\n"); + } + } ++ ++ return 0; + } + +-static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev, +- const struct sk_buff *skb) ++static int nci_rf_deactivate_ntf_packet(struct nci_dev *ndev, ++ const struct sk_buff *skb) + { + const struct nci_conn_info *conn_info; +- const struct nci_rf_deactivate_ntf *ntf = (void *)skb->data; ++ const struct nci_rf_deactivate_ntf *ntf; ++ ++ if (skb->len < sizeof(struct nci_rf_deactivate_ntf)) ++ return -EINVAL; ++ ++ ntf = (struct nci_rf_deactivate_ntf *)skb->data; + + pr_debug("entry, type 0x%x, reason 0x%x\n", ntf->type, ntf->reason); + + conn_info = ndev->rf_conn_info; + if (!conn_info) +- return; ++ return 0; + + /* drop tx data queue */ + skb_queue_purge(&ndev->tx_q); +@@ -735,14 +782,20 @@ static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev, + } + + nci_req_complete(ndev, NCI_STATUS_OK); ++ ++ return 0; + } + +-static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev, +- const struct sk_buff *skb) ++static int nci_nfcee_discover_ntf_packet(struct nci_dev *ndev, ++ const struct sk_buff *skb) + { + u8 status = NCI_STATUS_OK; +- const struct nci_nfcee_discover_ntf *nfcee_ntf = +- (struct nci_nfcee_discover_ntf *)skb->data; ++ const struct nci_nfcee_discover_ntf *nfcee_ntf; ++ ++ if (skb->len < sizeof(struct nci_nfcee_discover_ntf)) ++ return -EINVAL; ++ ++ nfcee_ntf = (struct nci_nfcee_discover_ntf *)skb->data; + + /* NFCForum NCI 9.2.1 HCI Network Specific Handling + * If the NFCC supports the HCI Network, it SHALL return one, +@@ -753,6 +806,8 @@ static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev, + ndev->cur_params.id = nfcee_ntf->nfcee_id; + + nci_req_complete(ndev, status); ++ ++ return 0; + } + + void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb) +@@ -779,35 +834,43 @@ void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb) + + switch (ntf_opcode) { + case NCI_OP_CORE_RESET_NTF: +- nci_core_reset_ntf_packet(ndev, skb); ++ if (nci_core_reset_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_CORE_CONN_CREDITS_NTF: +- nci_core_conn_credits_ntf_packet(ndev, skb); ++ if (nci_core_conn_credits_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_CORE_GENERIC_ERROR_NTF: +- nci_core_generic_error_ntf_packet(ndev, skb); ++ if (nci_core_generic_error_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_CORE_INTF_ERROR_NTF: +- nci_core_conn_intf_error_ntf_packet(ndev, skb); ++ if (nci_core_conn_intf_error_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_RF_DISCOVER_NTF: +- nci_rf_discover_ntf_packet(ndev, skb); ++ if (nci_rf_discover_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_RF_INTF_ACTIVATED_NTF: +- nci_rf_intf_activated_ntf_packet(ndev, skb); ++ if (nci_rf_intf_activated_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_RF_DEACTIVATE_NTF: +- nci_rf_deactivate_ntf_packet(ndev, skb); ++ if (nci_rf_deactivate_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_NFCEE_DISCOVER_NTF: +- nci_nfcee_discover_ntf_packet(ndev, skb); ++ if (nci_nfcee_discover_ntf_packet(ndev, skb)) ++ goto end; + break; + + case NCI_OP_RF_NFCEE_ACTION_NTF: +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index cf30bd649e2704..d063b63516f818 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, + rqstp->rq_auth_stat = rpc_autherr_badverf; + return SVC_DENIED; + } +- if (flavor != RPC_AUTH_GSS) { ++ if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) { + rqstp->rq_auth_stat = rpc_autherr_badverf; + return SVC_DENIED; + } +diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c +index b5b0d43bb8dcdd..c3f2717aebf254 100644 +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh) + /* low-level dsp access */ + int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + { +- u16 ret; ++ int ret; + + mutex_lock(&chip->msg_lock); + +@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version) + + int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq) + { +- u16 ret = 0; + u32 freq_raw = 0; + u32 freq = 0; + u32 frequency = 0; ++ int ret; + + mutex_lock(&chip->msg_lock); + +diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c +index fe222c4b74c006..c04be088f17a2b 100644 +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -5858,6 +5858,13 @@ static const struct snd_soc_component_driver wcd934x_component_drv = { + .endianness = 1, + }; + ++static void wcd934x_put_device_action(void *data) ++{ ++ struct device *dev = data; ++ ++ put_device(dev); ++} ++ + static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd) + { + struct device *dev = &wcd->sdev->dev; +@@ -5878,11 +5885,13 @@ static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd) + } + + slim_get_logical_addr(wcd->sidev); +- wcd->if_regmap = regmap_init_slimbus(wcd->sidev, ++ wcd->if_regmap = devm_regmap_init_slimbus(wcd->sidev, + &wcd934x_ifc_regmap_config); +- if (IS_ERR(wcd->if_regmap)) ++ if (IS_ERR(wcd->if_regmap)) { ++ put_device(&wcd->sidev->dev); + return dev_err_probe(dev, PTR_ERR(wcd->if_regmap), + "Failed to allocate ifc register map\n"); ++ } + + of_property_read_u32(dev->parent->of_node, "qcom,dmic-sample-rate", + &wcd->dmic_sample_rate); +@@ -5926,6 +5935,10 @@ static int wcd934x_codec_probe(struct platform_device *pdev) + return ret; + } + ++ ret = devm_add_action_or_reset(dev, wcd934x_put_device_action, &wcd->sidev->dev); ++ if (ret) ++ return ret; ++ + /* set default rate 9P6MHz */ + regmap_update_bits(wcd->regmap, WCD934X_CODEC_RPM_CLK_MCLK_CFG, + WCD934X_CODEC_RPM_CLK_MCLK_CFG_MCLK_MASK, +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 7a30d2d36f199b..fbd7e1f0783fd9 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -46,7 +46,8 @@ enum { + BYT_CHT_ES8316_INTMIC_IN2_MAP, + }; + +-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) ++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK) + #define BYT_CHT_ES8316_SSP0 BIT(16) + #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17) + #define BYT_CHT_ES8316_JD_INVERTED BIT(18) +@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP) ++ int map; ++ ++ map = BYT_CHT_ES8316_MAP(quirk); ++ switch (map) { ++ case BYT_CHT_ES8316_INTMIC_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP) ++ break; ++ case BYT_CHT_ES8316_INTMIC_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map); ++ quirk &= ~BYT_CHT_ES8316_MAP_MASK; ++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP; ++ break; ++ } ++ + if (quirk & BYT_CHT_ES8316_SSP0) + dev_info(dev, "quirk SSP0 enabled"); + if (quirk & BYT_CHT_ES8316_MONO_SPEAKER) +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 6a85e8fdcae646..beca466dd468ec 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -68,7 +68,8 @@ enum { + BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5640_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK) + #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n"); + break; + default: +- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map); ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map); ++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK; ++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP; + break; + } + if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1) +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 805afaf47b2904..2abe47303ecdb3 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -58,7 +58,8 @@ enum { + BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), + }; + +-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) ++#define BYT_RT5651_MAP_MASK GENMASK(3, 0) ++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) + #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) + #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) + #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) +@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static void log_quirks(struct device *dev) + { +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) ++ int map; ++ ++ map = BYT_RT5651_MAP(byt_rt5651_quirk); ++ switch (map) { ++ case BYT_RT5651_DMIC_MAP: + dev_info(dev, "quirk DMIC_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) ++ break; ++ case BYT_RT5651_IN1_MAP: + dev_info(dev, "quirk IN1_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) ++ break; ++ case BYT_RT5651_IN2_MAP: + dev_info(dev, "quirk IN2_MAP enabled"); +- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) ++ break; ++ case BYT_RT5651_IN1_IN2_MAP: + dev_info(dev, "quirk IN1_IN2_MAP enabled"); ++ break; ++ default: ++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); ++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; ++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; ++ break; ++ } ++ + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { + dev_info(dev, "quirk realtek,jack-detect-source %ld\n", + BYT_RT5651_JDSRC(byt_rt5651_quirk)); +diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c +index 0e5ae7fa0ef7a7..0db8c4b2f0ff2e 100644 +--- a/sound/soc/sof/ipc3-topology.c ++++ b/sound/soc/sof/ipc3-topology.c +@@ -2394,11 +2394,6 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif + if (ret < 0) + return ret; + +- /* free all the scheduler widgets now */ +- ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify); +- if (ret < 0) +- return ret; +- + /* + * Tear down all pipelines associated with PCMs that did not get suspended + * and unset the prepare flag so that they can be set up again during resume. +@@ -2414,6 +2409,11 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif + } + } + ++ /* free all the scheduler widgets now. This will also power down the secondary cores */ ++ ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify); ++ if (ret < 0) ++ return ret; ++ + list_for_each_entry(sroute, &sdev->route_list, list) + sroute->setup = false; + +diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h +index a9d8b5b51f37f8..f24953f8b949c1 100644 +--- a/tools/include/nolibc/std.h ++++ b/tools/include/nolibc/std.h +@@ -33,6 +33,6 @@ typedef unsigned long nlink_t; + typedef signed long off_t; + typedef signed long blksize_t; + typedef signed long blkcnt_t; +-typedef __kernel_old_time_t time_t; ++typedef __kernel_time_t time_t; + + #endif /* _NOLIBC_STD_H */ +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index aefbfa2df6207c..95f2ffefff3ff7 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -5013,6 +5013,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd) + return false; + } + ++ /* ++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with ++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. ++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from ++ * bpf_get_map_info_by_fd() when checking for compatibility with an ++ * existing DEVMAP. ++ */ ++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH) ++ map_info.map_flags &= ~BPF_F_RDONLY_PROG; ++ + return (map_info.type == map->def.type && + map_info.key_size == map->def.key_size && + map_info.value_size == map->def.value_size && +diff --git a/tools/testing/nvdimm/test/ndtest.c b/tools/testing/nvdimm/test/ndtest.c +index 3eba10c1e3e8f6..e711a2584143f5 100644 +--- a/tools/testing/nvdimm/test/ndtest.c ++++ b/tools/testing/nvdimm/test/ndtest.c +@@ -845,11 +845,22 @@ static int ndtest_probe(struct platform_device *pdev) + + p->dcr_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR, + sizeof(dma_addr_t), GFP_KERNEL); ++ if (!p->dcr_dma) { ++ rc = -ENOMEM; ++ goto err; ++ } + p->label_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR, + sizeof(dma_addr_t), GFP_KERNEL); ++ if (!p->label_dma) { ++ rc = -ENOMEM; ++ goto err; ++ } + p->dimm_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR, + sizeof(dma_addr_t), GFP_KERNEL); +- ++ if (!p->dimm_dma) { ++ rc = -ENOMEM; ++ goto err; ++ } + rc = ndtest_nvdimm_init(p); + if (rc) + goto err; +diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c +index 4435600ca400dd..e597861b26d6bf 100644 +--- a/tools/testing/selftests/arm64/pauth/exec_target.c ++++ b/tools/testing/selftests/arm64/pauth/exec_target.c +@@ -13,7 +13,12 @@ int main(void) + unsigned long hwcaps; + size_t val; + +- fread(&val, sizeof(size_t), 1, stdin); ++ size_t size = fread(&val, sizeof(size_t), 1, stdin); ++ ++ if (size != 1) { ++ fprintf(stderr, "Could not read input from stdin\n"); ++ return EXIT_FAILURE; ++ } + + /* don't try to execute illegal (unimplemented) instructions) caller + * should have checked this and keep worker simple +diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +index 540181c115a85a..ef00d38b0a8d24 100644 +--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c +@@ -23,7 +23,6 @@ struct { + + struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); +- __uint(max_entries, 2); + __type(key, int); + __type(value, __u32); + } perf_event_map SEC(".maps"); +diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c +index 595194453ff8f8..35b4893ccdf8ae 100644 +--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c ++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c +@@ -15,20 +15,18 @@ + #include + #include + #include +-#include + #include +-#include + +-#include "bpf_util.h" + #include "cgroup_helpers.h" + + #include "test_tcpnotify.h" +-#include "trace_helpers.h" + #include "testing_helpers.h" + + #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L) + + pthread_t tid; ++static bool exit_thread; ++ + int rx_callbacks; + + static void dummyfn(void *ctx, int cpu, void *data, __u32 size) +@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb) + { + int err; + +- while (1) { ++ while (!exit_thread) { + err = perf_buffer__poll(pb, 100); + if (err < 0 && err != -EINTR) { + printf("failed perf_buffer__poll: %d\n", err); +@@ -78,15 +76,10 @@ int main(int argc, char **argv) + int error = EXIT_FAILURE; + struct bpf_object *obj; + char test_script[80]; +- cpu_set_t cpuset; + __u32 key = 0; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + +- CPU_ZERO(&cpuset); +- CPU_SET(0, &cpuset); +- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset); +- + cg_fd = cgroup_setup_and_join(cg_path); + if (cg_fd < 0) + goto err; +@@ -151,6 +144,13 @@ int main(int argc, char **argv) + + sleep(10); + ++ exit_thread = true; ++ int ret = pthread_join(tid, NULL); ++ if (ret) { ++ printf("FAILED: pthread_join\n"); ++ goto err; ++ } ++ + if (verify_result(&g)) { + printf("FAILED: Wrong stats Expected %d calls, got %d\n", + g.ncalls, rx_callbacks); +diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c +index 4aaafbfc2f9735..a019de995e5dfd 100644 +--- a/tools/testing/selftests/nolibc/nolibc-test.c ++++ b/tools/testing/selftests/nolibc/nolibc-test.c +@@ -176,8 +176,8 @@ int expect_zr(int expr, int llen) + } + + +-#define EXPECT_NZ(cond, expr, val) \ +- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0) ++#define EXPECT_NZ(cond, expr) \ ++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0) + + static __attribute__((unused)) + int expect_nz(int expr, int llen) +diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c +index a1f506ba557864..4f09c5db0c7f30 100644 +--- a/tools/testing/selftests/watchdog/watchdog-test.c ++++ b/tools/testing/selftests/watchdog/watchdog-test.c +@@ -332,6 +332,12 @@ int main(int argc, char *argv[]) + if (oneshot) + goto end; + ++ /* Check if WDIOF_KEEPALIVEPING is supported */ ++ if (!(info.options & WDIOF_KEEPALIVEPING)) { ++ printf("WDIOC_KEEPALIVE not supported by this device\n"); ++ goto end; ++ } ++ + printf("Watchdog Ticking Away!\n"); + + /* diff --git a/patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch new file mode 100644 index 0000000000..48d54ba46c --- /dev/null +++ b/patch/kernel/archive/odroidxu4-6.6/patch-6.6.112-113.patch @@ -0,0 +1,7576 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 60d48ebbc2cb00..fff3ca50c6c26c 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5638,6 +5638,9 @@ + + rootflags= [KNL] Set root filesystem mount option string + ++ initramfs_options= [KNL] ++ Specify mount options for for the initramfs mount. ++ + rootfstype= [KNL] Set root filesystem type + + rootwait [KNL] Wait (indefinitely) for root device to show up. +diff --git a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +index 5ac994b3c0aa15..b304bc5a08c402 100644 +--- a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml ++++ b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +@@ -57,11 +57,24 @@ required: + - clocks + - clock-names + - '#phy-cells' +- - power-domains + - resets + - reset-names + - rockchip,grf + ++allOf: ++ - if: ++ properties: ++ compatible: ++ contains: ++ enum: ++ - rockchip,px30-csi-dphy ++ - rockchip,rk1808-csi-dphy ++ - rockchip,rk3326-csi-dphy ++ - rockchip,rk3368-csi-dphy ++ then: ++ required: ++ - power-domains ++ + additionalProperties: false + + examples: +diff --git a/Makefile b/Makefile +index 64d76baa0e0c9b..ab277ff8764317 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 6 +-SUBLEVEL = 112 ++SUBLEVEL = 113 + EXTRAVERSION = + NAME = Pinguïn Aangedreven + +diff --git a/arch/arm/mach-omap2/pm33xx-core.c b/arch/arm/mach-omap2/pm33xx-core.c +index c907478be196ed..4abb86dc98fdac 100644 +--- a/arch/arm/mach-omap2/pm33xx-core.c ++++ b/arch/arm/mach-omap2/pm33xx-core.c +@@ -388,12 +388,15 @@ static int __init amx3_idle_init(struct device_node *cpu_node, int cpu) + if (!state_node) + break; + +- if (!of_device_is_available(state_node)) ++ if (!of_device_is_available(state_node)) { ++ of_node_put(state_node); + continue; ++ } + + if (i == CPUIDLE_STATE_MAX) { + pr_warn("%s: cpuidle states reached max possible\n", + __func__); ++ of_node_put(state_node); + break; + } + +@@ -403,6 +406,7 @@ static int __init amx3_idle_init(struct device_node *cpu_node, int cpu) + states[state_count].wfi_flags |= WFI_FLAG_WAKE_M3 | + WFI_FLAG_FLUSH_CACHE; + ++ of_node_put(state_node); + state_count++; + } + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 6f5f96853ba1c2..701e139a9cbd06 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1529,6 +1529,8 @@ mdss: display-subsystem@1a00000 { + + interrupts = ; + ++ resets = <&gcc GCC_MDSS_BCR>; ++ + interrupt-controller; + #interrupt-cells = <1>; + +diff --git a/arch/arm64/boot/dts/qcom/msm8939.dtsi b/arch/arm64/boot/dts/qcom/msm8939.dtsi +index c844e01f9aa15b..86432ed25b23a1 100644 +--- a/arch/arm64/boot/dts/qcom/msm8939.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8939.dtsi +@@ -1210,6 +1210,8 @@ mdss: display-subsystem@1a00000 { + + power-domains = <&gcc MDSS_GDSC>; + ++ resets = <&gcc GCC_MDSS_BCR>; ++ + #address-cells = <1>; + #size-cells = <1>; + #interrupt-cells = <1>; +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 64ea9d73d970a9..fa91e2036dd56f 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -5208,11 +5208,11 @@ slimbam: dma-controller@17184000 { + compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0"; + qcom,controlled-remotely; + reg = <0 0x17184000 0 0x2a000>; +- num-channels = <31>; ++ num-channels = <23>; + interrupts = ; + #dma-cells = <1>; + qcom,ee = <1>; +- qcom,num-ees = <2>; ++ qcom,num-ees = <4>; + iommus = <&apps_smmu 0x1806 0x0>; + }; + +diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +index 1497f7c8adfaf4..dfdc6e659cc464 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +@@ -185,7 +185,7 @@ secure_proxy_sa3: mailbox@43600000 { + + main_pmx0: pinctrl@f4000 { + compatible = "pinctrl-single"; +- reg = <0x00 0xf4000 0x00 0x2ac>; ++ reg = <0x00 0xf4000 0x00 0x25c>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 2ce9ef9d924aac..4561c4a670afbd 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -2174,17 +2174,21 @@ static void bti_enable(const struct arm64_cpu_capabilities *__unused) + #ifdef CONFIG_ARM64_MTE + static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) + { ++ static bool cleared_zero_page = false; ++ + sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_ATA | SCTLR_EL1_ATA0); + + mte_cpu_setup(); + + /* + * Clear the tags in the zero page. This needs to be done via the +- * linear map which has the Tagged attribute. ++ * linear map which has the Tagged attribute. Since this page is ++ * always mapped as pte_special(), set_pte_at() will not attempt to ++ * clear the tags or set PG_mte_tagged. + */ +- if (try_page_mte_tagging(ZERO_PAGE(0))) { ++ if (!cleared_zero_page) { ++ cleared_zero_page = true; + mte_clear_page_tags(lm_alias(empty_zero_page)); +- set_page_mte_tagged(ZERO_PAGE(0)); + } + + kasan_init_hw_tags_cpu(); +diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c +index 4edecaac8f919a..84ea9c50c076f0 100644 +--- a/arch/arm64/kernel/mte.c ++++ b/arch/arm64/kernel/mte.c +@@ -428,7 +428,8 @@ static int __access_remote_tags(struct mm_struct *mm, unsigned long addr, + put_page(page); + break; + } +- WARN_ON_ONCE(!page_mte_tagged(page)); ++ ++ WARN_ON_ONCE(!page_mte_tagged(page) && !is_zero_page(page)); + + /* limit access to the end of the page */ + offset = offset_in_page(addr); +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index 70b91a8c6bb3f3..c0942cce3b6878 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -131,9 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + + void *alloc_insn_page(void) + { +- return __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START, VMALLOC_END, ++ void *addr; ++ ++ addr = __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START, VMALLOC_END, + GFP_KERNEL, PAGE_KERNEL_ROX, VM_FLUSH_RESET_PERMS, + NUMA_NO_NODE, __builtin_return_address(0)); ++ if (!addr) ++ return NULL; ++ set_memory_rox((unsigned long)addr, 1); ++ return addr; + } + + /* arm kprobe: install breakpoint in text */ +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 655dc2b1616f2c..31be0d00976e22 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -363,10 +363,9 @@ void __init platform_init(void) + arch_reserve_vmcore(); + arch_parse_crashkernel(); + +-#ifdef CONFIG_ACPI_TABLE_UPGRADE +- acpi_table_upgrade(); +-#endif + #ifdef CONFIG_ACPI ++ acpi_table_upgrade(); ++ acpi_gbl_use_global_lock = false; + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); + #endif +diff --git a/arch/parisc/include/uapi/asm/ioctls.h b/arch/parisc/include/uapi/asm/ioctls.h +index 82d1148c6379a5..74b4027a4e8083 100644 +--- a/arch/parisc/include/uapi/asm/ioctls.h ++++ b/arch/parisc/include/uapi/asm/ioctls.h +@@ -10,10 +10,10 @@ + #define TCSETS _IOW('T', 17, struct termios) /* TCSETATTR */ + #define TCSETSW _IOW('T', 18, struct termios) /* TCSETATTRD */ + #define TCSETSF _IOW('T', 19, struct termios) /* TCSETATTRF */ +-#define TCGETA _IOR('T', 1, struct termio) +-#define TCSETA _IOW('T', 2, struct termio) +-#define TCSETAW _IOW('T', 3, struct termio) +-#define TCSETAF _IOW('T', 4, struct termio) ++#define TCGETA 0x40125401 ++#define TCSETA 0x80125402 ++#define TCSETAW 0x80125403 ++#define TCSETAF 0x80125404 + #define TCSBRK _IO('T', 5) + #define TCXONC _IO('T', 6) + #define TCFLSH _IO('T', 7) +diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c +index 69d65ffab31263..03165c82dfdbd9 100644 +--- a/arch/parisc/lib/memcpy.c ++++ b/arch/parisc/lib/memcpy.c +@@ -41,7 +41,6 @@ unsigned long raw_copy_from_user(void *dst, const void __user *src, + mtsp(get_kernel_space(), SR_TEMP2); + + /* Check region is user accessible */ +- if (start) + while (start < end) { + if (!prober_user(SR_TEMP1, start)) { + newlen = (start - (unsigned long) src); +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index 28fac477007316..5337ad8a2e340f 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -1895,7 +1895,7 @@ static int pnv_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, + return 0; + + out: +- irq_domain_free_irqs_parent(domain, virq, i - 1); ++ irq_domain_free_irqs_parent(domain, virq, i); + msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq, nr_irqs); + return ret; + } +diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c +index fdcf10cd4d1270..b53f817fc421f8 100644 +--- a/arch/powerpc/platforms/pseries/msi.c ++++ b/arch/powerpc/platforms/pseries/msi.c +@@ -587,7 +587,7 @@ static int pseries_irq_domain_alloc(struct irq_domain *domain, unsigned int virq + + out: + /* TODO: handle RTAS cleanup in ->msi_finish() ? */ +- irq_domain_free_irqs_parent(domain, virq, i - 1); ++ irq_domain_free_irqs_parent(domain, virq, i); + return ret; + } + +diff --git a/arch/s390/net/bpf_jit.h b/arch/s390/net/bpf_jit.h +deleted file mode 100644 +index 7822ea92e54afd..00000000000000 +--- a/arch/s390/net/bpf_jit.h ++++ /dev/null +@@ -1,55 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +-/* +- * BPF Jit compiler defines +- * +- * Copyright IBM Corp. 2012,2015 +- * +- * Author(s): Martin Schwidefsky +- * Michael Holzheu +- */ +- +-#ifndef __ARCH_S390_NET_BPF_JIT_H +-#define __ARCH_S390_NET_BPF_JIT_H +- +-#ifndef __ASSEMBLY__ +- +-#include +-#include +- +-#endif /* __ASSEMBLY__ */ +- +-/* +- * Stackframe layout (packed stack): +- * +- * ^ high +- * +---------------+ | +- * | old backchain | | +- * +---------------+ | +- * | r15 - r6 | | +- * +---------------+ | +- * | 4 byte align | | +- * | tail_call_cnt | | +- * BFP -> +===============+ | +- * | | | +- * | BPF stack | | +- * | | | +- * R15+160 -> +---------------+ | +- * | new backchain | | +- * R15+152 -> +---------------+ | +- * | + 152 byte SA | | +- * R15 -> +---------------+ + low +- * +- * We get 160 bytes stack space from calling function, but only use +- * 12 * 8 byte for old backchain, r15..r6, and tail_call_cnt. +- * +- * The stack size used by the BPF program ("BPF stack" above) is passed +- * via "aux->stack_depth". +- */ +-#define STK_SPACE_ADD (160) +-#define STK_160_UNUSED (160 - 12 * 8) +-#define STK_OFF (STK_SPACE_ADD - STK_160_UNUSED) +- +-#define STK_OFF_R6 (160 - 11 * 8) /* Offset of r6 on stack */ +-#define STK_OFF_TCCNT (160 - 12 * 8) /* Offset of tail_call_cnt on stack */ +- +-#endif /* __ARCH_S390_NET_BPF_JIT_H */ +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 2d8facfd4e4252..5a64d34a37482b 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -31,11 +31,10 @@ + #include + #include + #include +-#include "bpf_jit.h" + + struct bpf_jit { + u32 seen; /* Flags to remember seen eBPF instructions */ +- u32 seen_reg[16]; /* Array to remember which registers are used */ ++ u16 seen_regs; /* Mask to remember which registers are used */ + u32 *addrs; /* Array with relative instruction addresses */ + u8 *prg_buf; /* Start of program */ + int size; /* Size of program and literal pool */ +@@ -53,6 +52,7 @@ struct bpf_jit { + int excnt; /* Number of exception table entries */ + int prologue_plt_ret; /* Return address for prologue hotpatch PLT */ + int prologue_plt; /* Start of prologue hotpatch PLT */ ++ u32 frame_off; /* Offset of struct bpf_prog from %r15 */ + }; + + #define SEEN_MEM BIT(0) /* use mem[] for temporary storage */ +@@ -118,8 +118,8 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) + { + u32 r1 = reg2hex[b1]; + +- if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1]) +- jit->seen_reg[r1] = 1; ++ if (r1 >= 6 && r1 <= 15) ++ jit->seen_regs |= (1 << r1); + } + + #define REG_SET_SEEN(b1) \ +@@ -127,8 +127,6 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) + reg_set_seen(jit, b1); \ + }) + +-#define REG_SEEN(b1) jit->seen_reg[reg2hex[(b1)]] +- + /* + * EMIT macros for code generation + */ +@@ -400,12 +398,26 @@ static void jit_fill_hole(void *area, unsigned int size) + memset(area, 0, size); + } + ++/* ++ * Caller-allocated part of the frame. ++ * Thanks to packed stack, its otherwise unused initial part can be used for ++ * the BPF stack and for the next frame. ++ */ ++struct prog_frame { ++ u64 unused[8]; ++ /* BPF stack starts here and grows towards 0 */ ++ u32 tail_call_cnt; ++ u32 pad; ++ u64 r6[10]; /* r6 - r15 */ ++ u64 backchain; ++} __packed; ++ + /* + * Save registers from "rs" (register start) to "re" (register end) on stack + */ + static void save_regs(struct bpf_jit *jit, u32 rs, u32 re) + { +- u32 off = STK_OFF_R6 + (rs - 6) * 8; ++ u32 off = offsetof(struct prog_frame, r6) + (rs - 6) * 8; + + if (rs == re) + /* stg %rs,off(%r15) */ +@@ -418,12 +430,9 @@ static void save_regs(struct bpf_jit *jit, u32 rs, u32 re) + /* + * Restore registers from "rs" (register start) to "re" (register end) on stack + */ +-static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re, u32 stack_depth) ++static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re) + { +- u32 off = STK_OFF_R6 + (rs - 6) * 8; +- +- if (jit->seen & SEEN_STACK) +- off += STK_OFF + stack_depth; ++ u32 off = jit->frame_off + offsetof(struct prog_frame, r6) + (rs - 6) * 8; + + if (rs == re) + /* lg %rs,off(%r15) */ +@@ -436,12 +445,12 @@ static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re, u32 stack_depth) + /* + * Return first seen register (from start) + */ +-static int get_start(struct bpf_jit *jit, int start) ++static int get_start(u16 seen_regs, int start) + { + int i; + + for (i = start; i <= 15; i++) { +- if (jit->seen_reg[i]) ++ if (seen_regs & (1 << i)) + return i; + } + return 0; +@@ -450,15 +459,15 @@ static int get_start(struct bpf_jit *jit, int start) + /* + * Return last seen register (from start) (gap >= 2) + */ +-static int get_end(struct bpf_jit *jit, int start) ++static int get_end(u16 seen_regs, int start) + { + int i; + + for (i = start; i < 15; i++) { +- if (!jit->seen_reg[i] && !jit->seen_reg[i + 1]) ++ if (!(seen_regs & (3 << i))) + return i - 1; + } +- return jit->seen_reg[15] ? 15 : 14; ++ return (seen_regs & (1 << 15)) ? 15 : 14; + } + + #define REGS_SAVE 1 +@@ -467,8 +476,9 @@ static int get_end(struct bpf_jit *jit, int start) + * Save and restore clobbered registers (6-15) on stack. + * We save/restore registers in chunks with gap >= 2 registers. + */ +-static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth) ++static void save_restore_regs(struct bpf_jit *jit, int op, u16 extra_regs) + { ++ u16 seen_regs = jit->seen_regs | extra_regs; + const int last = 15, save_restore_size = 6; + int re = 6, rs; + +@@ -482,14 +492,14 @@ static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth) + } + + do { +- rs = get_start(jit, re); ++ rs = get_start(seen_regs, re); + if (!rs) + break; +- re = get_end(jit, rs + 1); ++ re = get_end(seen_regs, rs + 1); + if (op == REGS_SAVE) + save_regs(jit, rs, re); + else +- restore_regs(jit, rs, re, stack_depth); ++ restore_regs(jit, rs, re); + re++; + } while (re <= last); + } +@@ -554,11 +564,12 @@ static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target) + * Emit function prologue + * + * Save registers and create stack frame if necessary. +- * See stack frame layout description in "bpf_jit.h"! ++ * Stack frame layout is described by struct prog_frame. + */ +-static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, +- u32 stack_depth) ++static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp) + { ++ BUILD_BUG_ON(sizeof(struct prog_frame) != STACK_FRAME_OVERHEAD); ++ + /* No-op for hotpatching */ + /* brcl 0,prologue_plt */ + EMIT6_PCREL_RILC(0xc0040000, 0, jit->prologue_plt); +@@ -566,8 +577,9 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, + + if (fp->aux->func_idx == 0) { + /* Initialize the tail call counter in the main program. */ +- /* xc STK_OFF_TCCNT(4,%r15),STK_OFF_TCCNT(%r15) */ +- _EMIT6(0xd703f000 | STK_OFF_TCCNT, 0xf000 | STK_OFF_TCCNT); ++ /* xc tail_call_cnt(4,%r15),tail_call_cnt(%r15) */ ++ _EMIT6(0xd703f000 | offsetof(struct prog_frame, tail_call_cnt), ++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); + } else { + /* + * Skip the tail call counter initialization in subprograms. +@@ -579,7 +591,7 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, + /* Tail calls have to skip above initialization */ + jit->tail_call_start = jit->prg; + /* Save registers */ +- save_restore_regs(jit, REGS_SAVE, stack_depth); ++ save_restore_regs(jit, REGS_SAVE, 0); + /* Setup literal pool */ + if (is_first_pass(jit) || (jit->seen & SEEN_LITERAL)) { + if (!is_first_pass(jit) && +@@ -597,13 +609,15 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp, + if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) { + /* lgr %w1,%r15 (backchain) */ + EMIT4(0xb9040000, REG_W1, REG_15); +- /* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */ +- EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED); +- /* aghi %r15,-STK_OFF */ +- EMIT4_IMM(0xa70b0000, REG_15, -(STK_OFF + stack_depth)); +- /* stg %w1,152(%r15) (backchain) */ ++ /* la %bfp,unused_end(%r15) (BPF frame pointer) */ ++ EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, ++ offsetofend(struct prog_frame, unused)); ++ /* aghi %r15,-frame_off */ ++ EMIT4_IMM(0xa70b0000, REG_15, -jit->frame_off); ++ /* stg %w1,backchain(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0, +- REG_15, 152); ++ REG_15, ++ offsetof(struct prog_frame, backchain)); + } + } + +@@ -647,13 +661,13 @@ static void call_r1(struct bpf_jit *jit) + /* + * Function epilogue + */ +-static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth) ++static void bpf_jit_epilogue(struct bpf_jit *jit) + { + jit->exit_ip = jit->prg; + /* Load exit code: lgr %r2,%b0 */ + EMIT4(0xb9040000, REG_2, BPF_REG_0); + /* Restore registers */ +- save_restore_regs(jit, REGS_RESTORE, stack_depth); ++ save_restore_regs(jit, REGS_RESTORE, 0); + if (nospec_uses_trampoline()) { + jit->r14_thunk_ip = jit->prg; + /* Generate __s390_indirect_jump_r14 thunk */ +@@ -779,7 +793,7 @@ static int sign_extend(struct bpf_jit *jit, int r, u8 size, u8 flags) + * stack space for the large switch statement. + */ + static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, +- int i, bool extra_pass, u32 stack_depth) ++ int i, bool extra_pass) + { + struct bpf_insn *insn = &fp->insnsi[i]; + u32 dst_reg = insn->dst_reg; +@@ -1425,17 +1439,11 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + jit->seen |= SEEN_FUNC; + /* + * Copy the tail call counter to where the callee expects it. +- * +- * Note 1: The callee can increment the tail call counter, but +- * we do not load it back, since the x86 JIT does not do this +- * either. +- * +- * Note 2: We assume that the verifier does not let us call the +- * main program, which clears the tail call counter on entry. + */ +- /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */ +- _EMIT6(0xd203f000 | STK_OFF_TCCNT, +- 0xf000 | (STK_OFF_TCCNT + STK_OFF + stack_depth)); ++ /* mvc tail_call_cnt(4,%r15),frame_off+tail_call_cnt(%r15) */ ++ _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt), ++ 0xf000 | (jit->frame_off + ++ offsetof(struct prog_frame, tail_call_cnt))); + + /* Sign-extend the kfunc arguments. */ + if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { +@@ -1457,6 +1465,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + call_r1(jit); + /* lgr %b0,%r2: load return value into %b0 */ + EMIT4(0xb9040000, BPF_REG_0, REG_2); ++ ++ /* ++ * Copy the potentially updated tail call counter back. ++ */ ++ ++ if (insn->src_reg == BPF_PSEUDO_CALL) ++ /* ++ * mvc frame_off+tail_call_cnt(%r15), ++ * tail_call_cnt(4,%r15) ++ */ ++ _EMIT6(0xd203f000 | (jit->frame_off + ++ offsetof(struct prog_frame, ++ tail_call_cnt)), ++ 0xf000 | offsetof(struct prog_frame, ++ tail_call_cnt)); ++ + break; + } + case BPF_JMP | BPF_TAIL_CALL: { +@@ -1486,10 +1510,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + * goto out; + */ + +- if (jit->seen & SEEN_STACK) +- off = STK_OFF_TCCNT + STK_OFF + stack_depth; +- else +- off = STK_OFF_TCCNT; ++ off = jit->frame_off + ++ offsetof(struct prog_frame, tail_call_cnt); + /* lhi %w0,1 */ + EMIT4_IMM(0xa7080000, REG_W0, 1); + /* laal %w1,%w0,off(%r15) */ +@@ -1519,7 +1541,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + /* + * Restore registers before calling function + */ +- save_restore_regs(jit, REGS_RESTORE, stack_depth); ++ save_restore_regs(jit, REGS_RESTORE, 0); + + /* + * goto *(prog->bpf_func + tail_call_start); +@@ -1822,7 +1844,7 @@ static int bpf_set_addr(struct bpf_jit *jit, int i) + * Compile eBPF program into s390x code + */ + static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp, +- bool extra_pass, u32 stack_depth) ++ bool extra_pass) + { + int i, insn_count, lit32_size, lit64_size; + +@@ -1830,19 +1852,25 @@ static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp, + jit->lit64 = jit->lit64_start; + jit->prg = 0; + jit->excnt = 0; ++ if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) ++ jit->frame_off = sizeof(struct prog_frame) - ++ offsetofend(struct prog_frame, unused) + ++ round_up(fp->aux->stack_depth, 8); ++ else ++ jit->frame_off = 0; + +- bpf_jit_prologue(jit, fp, stack_depth); ++ bpf_jit_prologue(jit, fp); + if (bpf_set_addr(jit, 0) < 0) + return -1; + for (i = 0; i < fp->len; i += insn_count) { +- insn_count = bpf_jit_insn(jit, fp, i, extra_pass, stack_depth); ++ insn_count = bpf_jit_insn(jit, fp, i, extra_pass); + if (insn_count < 0) + return -1; + /* Next instruction address */ + if (bpf_set_addr(jit, i + insn_count) < 0) + return -1; + } +- bpf_jit_epilogue(jit, stack_depth); ++ bpf_jit_epilogue(jit); + + lit32_size = jit->lit32 - jit->lit32_start; + lit64_size = jit->lit64 - jit->lit64_start; +@@ -1902,7 +1930,6 @@ static struct bpf_binary_header *bpf_jit_alloc(struct bpf_jit *jit, + */ + struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + { +- u32 stack_depth = round_up(fp->aux->stack_depth, 8); + struct bpf_prog *tmp, *orig_fp = fp; + struct bpf_binary_header *header; + struct s390_jit_data *jit_data; +@@ -1955,7 +1982,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + * - 3: Calculate program size and addrs array + */ + for (pass = 1; pass <= 3; pass++) { +- if (bpf_jit_prog(&jit, fp, extra_pass, stack_depth)) { ++ if (bpf_jit_prog(&jit, fp, extra_pass)) { + fp = orig_fp; + goto free_addrs; + } +@@ -1969,7 +1996,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + goto free_addrs; + } + skip_init_ctx: +- if (bpf_jit_prog(&jit, fp, extra_pass, stack_depth)) { ++ if (bpf_jit_prog(&jit, fp, extra_pass)) { + bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; +@@ -2285,9 +2312,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + /* stg %r1,backchain_off(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_1, REG_0, REG_15, + tjit->backchain_off); +- /* mvc tccnt_off(4,%r15),stack_size+STK_OFF_TCCNT(%r15) */ ++ /* mvc tccnt_off(4,%r15),stack_size+tail_call_cnt(%r15) */ + _EMIT6(0xd203f000 | tjit->tccnt_off, +- 0xf000 | (tjit->stack_size + STK_OFF_TCCNT)); ++ 0xf000 | (tjit->stack_size + ++ offsetof(struct prog_frame, tail_call_cnt))); + /* stmg %r2,%rN,fwd_reg_args_off(%r15) */ + if (nr_reg_args) + EMIT6_DISP_LH(0xeb000000, 0x0024, REG_2, +@@ -2424,8 +2452,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + (nr_stack_args * sizeof(u64) - 1) << 16 | + tjit->stack_args_off, + 0xf000 | tjit->orig_stack_args_off); +- /* mvc STK_OFF_TCCNT(4,%r15),tccnt_off(%r15) */ +- _EMIT6(0xd203f000 | STK_OFF_TCCNT, 0xf000 | tjit->tccnt_off); ++ /* mvc tail_call_cnt(4,%r15),tccnt_off(%r15) */ ++ _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt), ++ 0xf000 | tjit->tccnt_off); + /* lgr %r1,%r8 */ + EMIT4(0xb9040000, REG_1, REG_8); + /* %r1() */ +@@ -2433,6 +2462,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + /* stg %r2,retval_off(%r15) */ + EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15, + tjit->retval_off); ++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */ ++ _EMIT6(0xd203f000 | tjit->tccnt_off, ++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt)); + + im->ip_after_call = jit->prg_buf + jit->prg; + +@@ -2482,8 +2514,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + if (flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET)) + EMIT6_DISP_LH(0xe3000000, 0x0004, REG_2, REG_0, REG_15, + tjit->retval_off); +- /* mvc stack_size+STK_OFF_TCCNT(4,%r15),tccnt_off(%r15) */ +- _EMIT6(0xd203f000 | (tjit->stack_size + STK_OFF_TCCNT), ++ /* mvc stack_size+tail_call_cnt(4,%r15),tccnt_off(%r15) */ ++ _EMIT6(0xd203f000 | (tjit->stack_size + ++ offsetof(struct prog_frame, tail_call_cnt)), + 0xf000 | tjit->tccnt_off); + /* aghi %r15,stack_size */ + EMIT4_IMM(0xa70b0000, REG_15, tjit->stack_size); +diff --git a/arch/sparc/kernel/of_device_32.c b/arch/sparc/kernel/of_device_32.c +index 06012e68bdcaec..284a4cafa4324c 100644 +--- a/arch/sparc/kernel/of_device_32.c ++++ b/arch/sparc/kernel/of_device_32.c +@@ -387,6 +387,7 @@ static struct platform_device * __init scan_one_device(struct device_node *dp, + + if (of_device_register(op)) { + printk("%pOF: Could not register of device.\n", dp); ++ put_device(&op->dev); + kfree(op); + op = NULL; + } +diff --git a/arch/sparc/kernel/of_device_64.c b/arch/sparc/kernel/of_device_64.c +index d3842821a5a050..d2cd4f42e0cf07 100644 +--- a/arch/sparc/kernel/of_device_64.c ++++ b/arch/sparc/kernel/of_device_64.c +@@ -680,6 +680,7 @@ static struct platform_device * __init scan_one_device(struct device_node *dp, + + if (of_device_register(op)) { + printk("%pOF: Could not register of device.\n", dp); ++ put_device(&op->dev); + kfree(op); + op = NULL; + } +diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c +index 8dad5d0995dcce..5bf77c07f6b620 100644 +--- a/arch/sparc/mm/hugetlbpage.c ++++ b/arch/sparc/mm/hugetlbpage.c +@@ -133,6 +133,26 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, + + static pte_t sun4u_hugepage_shift_to_tte(pte_t entry, unsigned int shift) + { ++ unsigned long hugepage_size = _PAGE_SZ4MB_4U; ++ ++ pte_val(entry) = pte_val(entry) & ~_PAGE_SZALL_4U; ++ ++ switch (shift) { ++ case HPAGE_256MB_SHIFT: ++ hugepage_size = _PAGE_SZ256MB_4U; ++ pte_val(entry) |= _PAGE_PMD_HUGE; ++ break; ++ case HPAGE_SHIFT: ++ pte_val(entry) |= _PAGE_PMD_HUGE; ++ break; ++ case HPAGE_64K_SHIFT: ++ hugepage_size = _PAGE_SZ64K_4U; ++ break; ++ default: ++ WARN_ONCE(1, "unsupported hugepage shift=%u\n", shift); ++ } ++ ++ pte_val(entry) = pte_val(entry) | hugepage_size; + return entry; + } + +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index 723e48b57bd0f8..425980eacaa841 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -661,6 +661,7 @@ + #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS 0xc0000300 + #define MSR_AMD64_PERF_CNTR_GLOBAL_CTL 0xc0000301 + #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR 0xc0000302 ++#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET 0xc0000303 + + /* AMD Last Branch Record MSRs */ + #define MSR_AMD64_LBR_SELECT 0xc000010e +diff --git a/arch/x86/kernel/umip.c b/arch/x86/kernel/umip.c +index 5a4b21389b1d98..d432f3824f0c29 100644 +--- a/arch/x86/kernel/umip.c ++++ b/arch/x86/kernel/umip.c +@@ -156,15 +156,26 @@ static int identify_insn(struct insn *insn) + if (!insn->modrm.nbytes) + return -EINVAL; + +- /* All the instructions of interest start with 0x0f. */ +- if (insn->opcode.bytes[0] != 0xf) ++ /* The instructions of interest have 2-byte opcodes: 0F 00 or 0F 01. */ ++ if (insn->opcode.nbytes < 2 || insn->opcode.bytes[0] != 0xf) + return -EINVAL; + + if (insn->opcode.bytes[1] == 0x1) { + switch (X86_MODRM_REG(insn->modrm.value)) { + case 0: ++ /* The reg form of 0F 01 /0 encodes VMX instructions. */ ++ if (X86_MODRM_MOD(insn->modrm.value) == 3) ++ return -EINVAL; ++ + return UMIP_INST_SGDT; + case 1: ++ /* ++ * The reg form of 0F 01 /1 encodes MONITOR/MWAIT, ++ * STAC/CLAC, and ENCLS. ++ */ ++ if (X86_MODRM_MOD(insn->modrm.value) == 3) ++ return -EINVAL; ++ + return UMIP_INST_SIDT; + case 4: + return UMIP_INST_SMSW; +diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c +index da2d82e3a8735e..f2cd8cfb0ef557 100644 +--- a/arch/x86/kvm/pmu.c ++++ b/arch/x86/kvm/pmu.c +@@ -588,6 +588,7 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + msr_info->data = pmu->global_ctrl; + break; + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: + case MSR_CORE_PERF_GLOBAL_OVF_CTRL: + msr_info->data = 0; + break; +@@ -649,6 +650,10 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + if (!msr_info->host_initiated) + pmu->global_status &= ~data; + break; ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: ++ if (!msr_info->host_initiated) ++ pmu->global_status |= data & ~pmu->global_status_mask; ++ break; + default: + kvm_pmu_mark_pmc_in_use(vcpu, msr_info->index); + return static_call(kvm_x86_pmu_set_msr)(vcpu, msr_info); +diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c +index 3fd47de14b38a3..0bad24f763d222 100644 +--- a/arch/x86/kvm/svm/pmu.c ++++ b/arch/x86/kvm/svm/pmu.c +@@ -117,6 +117,7 @@ static bool amd_is_valid_msr(struct kvm_vcpu *vcpu, u32 msr) + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS: + case MSR_AMD64_PERF_CNTR_GLOBAL_CTL: + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: + return pmu->version > 1; + default: + if (msr > MSR_F15H_PERF_CTR5 && +diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c +index 29566e457ec4b5..0833f2c1a9d68b 100644 +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -4156,11 +4156,20 @@ static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu) + + static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu) + { ++ struct vcpu_svm *svm = to_svm(vcpu); ++ ++ /* ++ * Next RIP must be provided as IRQs are disabled, and accessing guest ++ * memory to decode the instruction might fault, i.e. might sleep. ++ */ ++ if (!nrips || !svm->vmcb->control.next_rip) ++ return EXIT_FASTPATH_NONE; ++ + if (is_guest_mode(vcpu)) + return EXIT_FASTPATH_NONE; + +- if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR && +- to_svm(vcpu)->vmcb->control.exit_info_1) ++ if (svm->vmcb->control.exit_code == SVM_EXIT_MSR && ++ svm->vmcb->control.exit_info_1) + return handle_fastpath_set_msr_irqoff(vcpu); + + return EXIT_FASTPATH_NONE; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 71d60d4e991fd3..a589a5781e9066 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1495,6 +1495,7 @@ static const u32 msrs_to_save_pmu[] = { + MSR_AMD64_PERF_CNTR_GLOBAL_CTL, + MSR_AMD64_PERF_CNTR_GLOBAL_STATUS, + MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR, ++ MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET, + }; + + static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_base) + +@@ -7194,6 +7195,7 @@ static void kvm_probe_msr_to_save(u32 msr_index) + case MSR_AMD64_PERF_CNTR_GLOBAL_CTL: + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS: + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: + if (!kvm_cpu_cap_has(X86_FEATURE_PERFMON_V2)) + return; + break; +diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c +index 178cf96ca10acb..f878bbb8b0ac2f 100644 +--- a/arch/xtensa/platforms/iss/simdisk.c ++++ b/arch/xtensa/platforms/iss/simdisk.c +@@ -230,10 +230,14 @@ static ssize_t proc_read_simdisk(struct file *file, char __user *buf, + static ssize_t proc_write_simdisk(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { +- char *tmp = memdup_user_nul(buf, count); ++ char *tmp; + struct simdisk *dev = pde_data(file_inode(file)); + int err; + ++ if (count == 0 || count > PAGE_SIZE) ++ return -EINVAL; ++ ++ tmp = memdup_user_nul(buf, count); + if (IS_ERR(tmp)) + return PTR_ERR(tmp); + +diff --git a/block/blk-crypto-fallback.c b/block/blk-crypto-fallback.c +index e6468eab2681e9..7f1a9dba404979 100644 +--- a/block/blk-crypto-fallback.c ++++ b/block/blk-crypto-fallback.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include "blk-cgroup.h" + #include "blk-crypto-internal.h" +@@ -229,7 +230,9 @@ static bool blk_crypto_fallback_split_bio_if_needed(struct bio **bio_ptr) + bio->bi_status = BLK_STS_RESOURCE; + return false; + } ++ + bio_chain(split_bio, bio); ++ trace_block_split(split_bio, bio->bi_iter.bi_sector); + submit_bio_noacct(bio); + *bio_ptr = split_bio; + } +diff --git a/crypto/essiv.c b/crypto/essiv.c +index f7d4ef4837e541..4dbec116ddc3e0 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + struct aead_request *subreq = &rctx->aead_req; ++ int ivsize = crypto_aead_ivsize(tfm); ++ int ssize = req->assoclen - ivsize; + struct scatterlist *src = req->src; + int err; + ++ if (ssize < 0) ++ return -EINVAL; ++ + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); + + /* +@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + */ + rctx->assoc = NULL; + if (req->src == req->dst || !enc) { +- scatterwalk_map_and_copy(req->iv, req->dst, +- req->assoclen - crypto_aead_ivsize(tfm), +- crypto_aead_ivsize(tfm), 1); ++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); + } else { + u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; +- int ivsize = crypto_aead_ivsize(tfm); +- int ssize = req->assoclen - ivsize; + struct scatterlist *sg; + int nents; + +- if (ssize < 0) +- return -EINVAL; +- + nents = sg_nents_for_len(req->src, ssize); + if (nents < 0) + return -EINVAL; +diff --git a/drivers/acpi/acpi_dbg.c b/drivers/acpi/acpi_dbg.c +index d50261d05f3a1a..515b20d0b698a4 100644 +--- a/drivers/acpi/acpi_dbg.c ++++ b/drivers/acpi/acpi_dbg.c +@@ -569,11 +569,11 @@ static int acpi_aml_release(struct inode *inode, struct file *file) + return 0; + } + +-static int acpi_aml_read_user(char __user *buf, int len) ++static ssize_t acpi_aml_read_user(char __user *buf, size_t len) + { +- int ret; + struct circ_buf *crc = &acpi_aml_io.out_crc; +- int n; ++ ssize_t ret; ++ size_t n; + char *p; + + ret = acpi_aml_lock_read(crc, ACPI_AML_OUT_USER); +@@ -582,7 +582,7 @@ static int acpi_aml_read_user(char __user *buf, int len) + /* sync head before removing logs */ + smp_rmb(); + p = &crc->buf[crc->tail]; +- n = min(len, circ_count_to_end(crc)); ++ n = min_t(size_t, len, circ_count_to_end(crc)); + if (copy_to_user(buf, p, n)) { + ret = -EFAULT; + goto out; +@@ -599,8 +599,8 @@ static int acpi_aml_read_user(char __user *buf, int len) + static ssize_t acpi_aml_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) + { +- int ret = 0; +- int size = 0; ++ ssize_t ret = 0; ++ ssize_t size = 0; + + if (!count) + return 0; +@@ -639,11 +639,11 @@ static ssize_t acpi_aml_read(struct file *file, char __user *buf, + return size > 0 ? size : ret; + } + +-static int acpi_aml_write_user(const char __user *buf, int len) ++static ssize_t acpi_aml_write_user(const char __user *buf, size_t len) + { +- int ret; + struct circ_buf *crc = &acpi_aml_io.in_crc; +- int n; ++ ssize_t ret; ++ size_t n; + char *p; + + ret = acpi_aml_lock_write(crc, ACPI_AML_IN_USER); +@@ -652,7 +652,7 @@ static int acpi_aml_write_user(const char __user *buf, int len) + /* sync tail before inserting cmds */ + smp_mb(); + p = &crc->buf[crc->head]; +- n = min(len, circ_space_to_end(crc)); ++ n = min_t(size_t, len, circ_space_to_end(crc)); + if (copy_from_user(p, buf, n)) { + ret = -EFAULT; + goto out; +@@ -663,14 +663,14 @@ static int acpi_aml_write_user(const char __user *buf, int len) + ret = n; + out: + acpi_aml_unlock_fifo(ACPI_AML_IN_USER, ret >= 0); +- return n; ++ return ret; + } + + static ssize_t acpi_aml_write(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { +- int ret = 0; +- int size = 0; ++ ssize_t ret = 0; ++ ssize_t size = 0; + + if (!count) + return 0; +diff --git a/drivers/acpi/acpi_tad.c b/drivers/acpi/acpi_tad.c +index 33c3b16af556b5..ecba82ac7cd5f9 100644 +--- a/drivers/acpi/acpi_tad.c ++++ b/drivers/acpi/acpi_tad.c +@@ -564,6 +564,9 @@ static int acpi_tad_remove(struct platform_device *pdev) + + pm_runtime_get_sync(dev); + ++ if (dd->capabilities & ACPI_TAD_RT) ++ sysfs_remove_group(&dev->kobj, &acpi_tad_time_attr_group); ++ + if (dd->capabilities & ACPI_TAD_DC_WAKE) + sysfs_remove_group(&dev->kobj, &acpi_tad_dc_attr_group); + +diff --git a/drivers/acpi/acpica/evglock.c b/drivers/acpi/acpica/evglock.c +index 989dc01af03fbb..bc205b3309043b 100644 +--- a/drivers/acpi/acpica/evglock.c ++++ b/drivers/acpi/acpica/evglock.c +@@ -42,6 +42,10 @@ acpi_status acpi_ev_init_global_lock_handler(void) + return_ACPI_STATUS(AE_OK); + } + ++ if (!acpi_gbl_use_global_lock) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Attempt installation of the global lock handler */ + + status = acpi_install_fixed_event_handler(ACPI_EVENT_GLOBAL, +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index e3cbaf3c3bbc15..a70b6db3bf0596 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -94,7 +94,7 @@ enum { + + struct acpi_battery { + struct mutex lock; +- struct mutex sysfs_lock; ++ struct mutex update_lock; + struct power_supply *bat; + struct power_supply_desc bat_desc; + struct acpi_device *device; +@@ -888,15 +888,12 @@ static int sysfs_add_battery(struct acpi_battery *battery) + + static void sysfs_remove_battery(struct acpi_battery *battery) + { +- mutex_lock(&battery->sysfs_lock); +- if (!battery->bat) { +- mutex_unlock(&battery->sysfs_lock); ++ if (!battery->bat) + return; +- } ++ + battery_hook_remove_battery(battery); + power_supply_unregister(battery->bat); + battery->bat = NULL; +- mutex_unlock(&battery->sysfs_lock); + } + + static void find_battery(const struct dmi_header *dm, void *private) +@@ -1056,6 +1053,9 @@ static void acpi_battery_notify(acpi_handle handle, u32 event, void *data) + + if (!battery) + return; ++ ++ guard(mutex)(&battery->update_lock); ++ + old = battery->bat; + /* + * On Acer Aspire V5-573G notifications are sometimes triggered too +@@ -1078,21 +1078,22 @@ static void acpi_battery_notify(acpi_handle handle, u32 event, void *data) + } + + static int battery_notify(struct notifier_block *nb, +- unsigned long mode, void *_unused) ++ unsigned long mode, void *_unused) + { + struct acpi_battery *battery = container_of(nb, struct acpi_battery, + pm_nb); +- int result; + +- switch (mode) { +- case PM_POST_HIBERNATION: +- case PM_POST_SUSPEND: ++ if (mode == PM_POST_SUSPEND || mode == PM_POST_HIBERNATION) { ++ guard(mutex)(&battery->update_lock); ++ + if (!acpi_battery_present(battery)) + return 0; + + if (battery->bat) { + acpi_battery_refresh(battery); + } else { ++ int result; ++ + result = acpi_battery_get_info(battery); + if (result) + return result; +@@ -1104,7 +1105,6 @@ static int battery_notify(struct notifier_block *nb, + + acpi_battery_init_alarm(battery); + acpi_battery_get_state(battery); +- break; + } + + return 0; +@@ -1182,6 +1182,8 @@ static int acpi_battery_update_retry(struct acpi_battery *battery) + { + int retry, ret; + ++ guard(mutex)(&battery->update_lock); ++ + for (retry = 5; retry; retry--) { + ret = acpi_battery_update(battery, false); + if (!ret) +@@ -1192,6 +1194,13 @@ static int acpi_battery_update_retry(struct acpi_battery *battery) + return ret; + } + ++static void sysfs_battery_cleanup(struct acpi_battery *battery) ++{ ++ guard(mutex)(&battery->update_lock); ++ ++ sysfs_remove_battery(battery); ++} ++ + static int acpi_battery_add(struct acpi_device *device) + { + int result = 0; +@@ -1203,15 +1212,21 @@ static int acpi_battery_add(struct acpi_device *device) + if (device->dep_unmet) + return -EPROBE_DEFER; + +- battery = kzalloc(sizeof(struct acpi_battery), GFP_KERNEL); ++ battery = devm_kzalloc(&device->dev, sizeof(*battery), GFP_KERNEL); + if (!battery) + return -ENOMEM; + battery->device = device; + strcpy(acpi_device_name(device), ACPI_BATTERY_DEVICE_NAME); + strcpy(acpi_device_class(device), ACPI_BATTERY_CLASS); + device->driver_data = battery; +- mutex_init(&battery->lock); +- mutex_init(&battery->sysfs_lock); ++ result = devm_mutex_init(&device->dev, &battery->lock); ++ if (result) ++ return result; ++ ++ result = devm_mutex_init(&device->dev, &battery->update_lock); ++ if (result) ++ return result; ++ + if (acpi_has_method(battery->device->handle, "_BIX")) + set_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags); + +@@ -1238,10 +1253,7 @@ static int acpi_battery_add(struct acpi_device *device) + device_init_wakeup(&device->dev, 0); + unregister_pm_notifier(&battery->pm_nb); + fail: +- sysfs_remove_battery(battery); +- mutex_destroy(&battery->lock); +- mutex_destroy(&battery->sysfs_lock); +- kfree(battery); ++ sysfs_battery_cleanup(battery); + + return result; + } +@@ -1260,11 +1272,10 @@ static void acpi_battery_remove(struct acpi_device *device) + + device_init_wakeup(&device->dev, 0); + unregister_pm_notifier(&battery->pm_nb); +- sysfs_remove_battery(battery); + +- mutex_destroy(&battery->lock); +- mutex_destroy(&battery->sysfs_lock); +- kfree(battery); ++ guard(mutex)(&battery->update_lock); ++ ++ sysfs_remove_battery(battery); + } + + #ifdef CONFIG_PM_SLEEP +@@ -1281,6 +1292,9 @@ static int acpi_battery_resume(struct device *dev) + return -EINVAL; + + battery->update_time = 0; ++ ++ guard(mutex)(&battery->update_lock); ++ + acpi_battery_update(battery, true); + return 0; + } +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index dca5682308cb32..5898c3c8c2a7f2 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -74,6 +74,7 @@ static bool acpi_nondev_subnode_extract(union acpi_object *desc, + struct fwnode_handle *parent) + { + struct acpi_data_node *dn; ++ acpi_handle scope = NULL; + bool result; + + dn = kzalloc(sizeof(*dn), GFP_KERNEL); +@@ -86,29 +87,35 @@ static bool acpi_nondev_subnode_extract(union acpi_object *desc, + INIT_LIST_HEAD(&dn->data.properties); + INIT_LIST_HEAD(&dn->data.subnodes); + +- result = acpi_extract_properties(handle, desc, &dn->data); +- +- if (handle) { +- acpi_handle scope; +- acpi_status status; ++ /* ++ * The scope for the completion of relative pathname segments and ++ * subnode object lookup is the one of the namespace node (device) ++ * containing the object that has returned the package. That is, it's ++ * the scope of that object's parent device. ++ */ ++ if (handle) ++ acpi_get_parent(handle, &scope); + +- /* +- * The scope for the subnode object lookup is the one of the +- * namespace node (device) containing the object that has +- * returned the package. That is, it's the scope of that +- * object's parent. +- */ +- status = acpi_get_parent(handle, &scope); +- if (ACPI_SUCCESS(status) +- && acpi_enumerate_nondev_subnodes(scope, desc, &dn->data, +- &dn->fwnode)) +- result = true; +- } else if (acpi_enumerate_nondev_subnodes(NULL, desc, &dn->data, +- &dn->fwnode)) { ++ /* ++ * Extract properties from the _DSD-equivalent package pointed to by ++ * desc and use scope (if not NULL) for the completion of relative ++ * pathname segments. ++ * ++ * The extracted properties will be held in the new data node dn. ++ */ ++ result = acpi_extract_properties(scope, desc, &dn->data); ++ /* ++ * Look for subnodes in the _DSD-equivalent package pointed to by desc ++ * and create child nodes of dn if there are any. ++ */ ++ if (acpi_enumerate_nondev_subnodes(scope, desc, &dn->data, &dn->fwnode)) + result = true; +- } + + if (result) { ++ /* ++ * This will be NULL if the desc package is embedded in an outer ++ * _DSD-equivalent package and its scope cannot be determined. ++ */ + dn->handle = handle; + dn->data.pointer = desc; + list_add_tail(&dn->sibling, list); +@@ -120,35 +127,21 @@ static bool acpi_nondev_subnode_extract(union acpi_object *desc, + return false; + } + +-static bool acpi_nondev_subnode_data_ok(acpi_handle handle, +- const union acpi_object *link, +- struct list_head *list, +- struct fwnode_handle *parent) +-{ +- struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER }; +- acpi_status status; +- +- status = acpi_evaluate_object_typed(handle, NULL, NULL, &buf, +- ACPI_TYPE_PACKAGE); +- if (ACPI_FAILURE(status)) +- return false; +- +- if (acpi_nondev_subnode_extract(buf.pointer, handle, link, list, +- parent)) +- return true; +- +- ACPI_FREE(buf.pointer); +- return false; +-} +- + static bool acpi_nondev_subnode_ok(acpi_handle scope, + const union acpi_object *link, + struct list_head *list, + struct fwnode_handle *parent) + { ++ struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER }; + acpi_handle handle; + acpi_status status; + ++ /* ++ * If the scope is unknown, the _DSD-equivalent package being parsed ++ * was embedded in an outer _DSD-equivalent package as a result of ++ * direct evaluation of an object pointed to by a reference. In that ++ * case, using a pathname as the target object pointer is invalid. ++ */ + if (!scope) + return false; + +@@ -157,7 +150,17 @@ static bool acpi_nondev_subnode_ok(acpi_handle scope, + if (ACPI_FAILURE(status)) + return false; + +- return acpi_nondev_subnode_data_ok(handle, link, list, parent); ++ status = acpi_evaluate_object_typed(handle, NULL, NULL, &buf, ++ ACPI_TYPE_PACKAGE); ++ if (ACPI_FAILURE(status)) ++ return false; ++ ++ if (acpi_nondev_subnode_extract(buf.pointer, handle, link, list, ++ parent)) ++ return true; ++ ++ ACPI_FREE(buf.pointer); ++ return false; + } + + static bool acpi_add_nondev_subnodes(acpi_handle scope, +@@ -168,9 +171,12 @@ static bool acpi_add_nondev_subnodes(acpi_handle scope, + bool ret = false; + int i; + ++ /* ++ * Every element in the links package is expected to represent a link ++ * to a non-device node in a tree containing device-specific data. ++ */ + for (i = 0; i < links->package.count; i++) { + union acpi_object *link, *desc; +- acpi_handle handle; + bool result; + + link = &links->package.elements[i]; +@@ -178,26 +184,53 @@ static bool acpi_add_nondev_subnodes(acpi_handle scope, + if (link->package.count != 2) + continue; + +- /* The first one must be a string. */ ++ /* The first one (the key) must be a string. */ + if (link->package.elements[0].type != ACPI_TYPE_STRING) + continue; + +- /* The second one may be a string, a reference or a package. */ ++ /* The second one (the target) may be a string or a package. */ + switch (link->package.elements[1].type) { + case ACPI_TYPE_STRING: ++ /* ++ * The string is expected to be a full pathname or a ++ * pathname segment relative to the given scope. That ++ * pathname is expected to point to an object returning ++ * a package that contains _DSD-equivalent information. ++ */ + result = acpi_nondev_subnode_ok(scope, link, list, + parent); + break; +- case ACPI_TYPE_LOCAL_REFERENCE: +- handle = link->package.elements[1].reference.handle; +- result = acpi_nondev_subnode_data_ok(handle, link, list, +- parent); +- break; + case ACPI_TYPE_PACKAGE: ++ /* ++ * This happens when a reference is used in AML to ++ * point to the target. Since the target is expected ++ * to be a named object, a reference to it will cause it ++ * to be avaluated in place and its return package will ++ * be embedded in the links package at the location of ++ * the reference. ++ * ++ * The target package is expected to contain _DSD- ++ * equivalent information, but the scope in which it ++ * is located in the original AML is unknown. Thus ++ * it cannot contain pathname segments represented as ++ * strings because there is no way to build full ++ * pathnames out of them. ++ */ ++ acpi_handle_debug(scope, "subnode %s: Unknown scope\n", ++ link->package.elements[0].string.pointer); + desc = &link->package.elements[1]; + result = acpi_nondev_subnode_extract(desc, NULL, link, + list, parent); + break; ++ case ACPI_TYPE_LOCAL_REFERENCE: ++ /* ++ * It is not expected to see any local references in ++ * the links package because referencing a named object ++ * should cause it to be evaluated in place. ++ */ ++ acpi_handle_info(scope, "subnode %s: Unexpected reference\n", ++ link->package.elements[0].string.pointer); ++ fallthrough; + default: + result = false; + break; +@@ -357,6 +390,9 @@ static void acpi_untie_nondev_subnodes(struct acpi_device_data *data) + struct acpi_data_node *dn; + + list_for_each_entry(dn, &data->subnodes, sibling) { ++ if (!dn->handle) ++ continue; ++ + acpi_detach_data(dn->handle, acpi_nondev_subnode_tag); + + acpi_untie_nondev_subnodes(&dn->data); +@@ -371,6 +407,9 @@ static bool acpi_tie_nondev_subnodes(struct acpi_device_data *data) + acpi_status status; + bool ret; + ++ if (!dn->handle) ++ continue; ++ + status = acpi_attach_data(dn->handle, acpi_nondev_subnode_tag, dn); + if (ACPI_FAILURE(status) && status != AE_ALREADY_EXISTS) { + acpi_handle_err(dn->handle, "Can't tag data node\n"); +diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c +index c48f4d9f2c690b..558cfb3a06c5ea 100644 +--- a/drivers/bus/mhi/ep/main.c ++++ b/drivers/bus/mhi/ep/main.c +@@ -387,17 +387,13 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, + { + struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id]; + struct device *dev = &mhi_cntrl->mhi_dev->dev; +- size_t tr_len, read_offset, write_offset; ++ size_t tr_len, read_offset; + struct mhi_ep_buf_info buf_info = {}; + u32 len = MHI_EP_DEFAULT_MTU; + struct mhi_ring_element *el; +- bool tr_done = false; + void *buf_addr; +- u32 buf_left; + int ret; + +- buf_left = len; +- + do { + /* Don't process the transfer ring if the channel is not in RUNNING state */ + if (mhi_chan->state != MHI_CH_STATE_RUNNING) { +@@ -410,24 +406,23 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, + /* Check if there is data pending to be read from previous read operation */ + if (mhi_chan->tre_bytes_left) { + dev_dbg(dev, "TRE bytes remaining: %u\n", mhi_chan->tre_bytes_left); +- tr_len = min(buf_left, mhi_chan->tre_bytes_left); ++ tr_len = min(len, mhi_chan->tre_bytes_left); + } else { + mhi_chan->tre_loc = MHI_TRE_DATA_GET_PTR(el); + mhi_chan->tre_size = MHI_TRE_DATA_GET_LEN(el); + mhi_chan->tre_bytes_left = mhi_chan->tre_size; + +- tr_len = min(buf_left, mhi_chan->tre_size); ++ tr_len = min(len, mhi_chan->tre_size); + } + + read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left; +- write_offset = len - buf_left; + + buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL); + if (!buf_addr) + return -ENOMEM; + + buf_info.host_addr = mhi_chan->tre_loc + read_offset; +- buf_info.dev_addr = buf_addr + write_offset; ++ buf_info.dev_addr = buf_addr; + buf_info.size = tr_len; + buf_info.cb = mhi_ep_read_completion; + buf_info.cb_buf = buf_addr; +@@ -443,16 +438,12 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl, + goto err_free_buf_addr; + } + +- buf_left -= tr_len; + mhi_chan->tre_bytes_left -= tr_len; + +- if (!mhi_chan->tre_bytes_left) { +- if (MHI_TRE_DATA_GET_IEOT(el)) +- tr_done = true; +- ++ if (!mhi_chan->tre_bytes_left) + mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size; +- } +- } while (buf_left && !tr_done); ++ /* Read until the some buffer is left or the ring becomes not empty */ ++ } while (!mhi_ep_queue_is_empty(mhi_chan->mhi_dev, DMA_TO_DEVICE)); + + return 0; + +@@ -486,15 +477,11 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring) + mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); + } else { + /* UL channel */ +- do { +- ret = mhi_ep_read_channel(mhi_cntrl, ring); +- if (ret < 0) { +- dev_err(&mhi_chan->mhi_dev->dev, "Failed to read channel\n"); +- return ret; +- } +- +- /* Read until the ring becomes empty */ +- } while (!mhi_ep_queue_is_empty(mhi_chan->mhi_dev, DMA_TO_DEVICE)); ++ ret = mhi_ep_read_channel(mhi_cntrl, ring); ++ if (ret < 0) { ++ dev_err(&mhi_chan->mhi_dev->dev, "Failed to read channel\n"); ++ return ret; ++ } + } + + return 0; +diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c +index cfd17c02fe20ef..4af748ff509855 100644 +--- a/drivers/bus/mhi/host/init.c ++++ b/drivers/bus/mhi/host/init.c +@@ -164,7 +164,6 @@ void mhi_deinit_free_irq(struct mhi_controller *mhi_cntrl) + int mhi_init_irq_setup(struct mhi_controller *mhi_cntrl) + { + struct mhi_event *mhi_event = mhi_cntrl->mhi_event; +- struct device *dev = &mhi_cntrl->mhi_dev->dev; + unsigned long irq_flags = IRQF_SHARED | IRQF_NO_SUSPEND; + int i, ret; + +@@ -191,7 +190,7 @@ int mhi_init_irq_setup(struct mhi_controller *mhi_cntrl) + continue; + + if (mhi_event->irq >= mhi_cntrl->nr_irqs) { +- dev_err(dev, "irq %d not available for event ring\n", ++ dev_err(mhi_cntrl->cntrl_dev, "irq %d not available for event ring\n", + mhi_event->irq); + ret = -EINVAL; + goto error_request; +@@ -202,7 +201,7 @@ int mhi_init_irq_setup(struct mhi_controller *mhi_cntrl) + irq_flags, + "mhi", mhi_event); + if (ret) { +- dev_err(dev, "Error requesting irq:%d for ev:%d\n", ++ dev_err(mhi_cntrl->cntrl_dev, "Error requesting irq:%d for ev:%d\n", + mhi_cntrl->irq[mhi_event->irq], i); + goto error_request; + } +diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c +index ecfcb50302f6ce..efda90dcf5b3d0 100644 +--- a/drivers/char/ipmi/ipmi_kcs_sm.c ++++ b/drivers/char/ipmi/ipmi_kcs_sm.c +@@ -122,10 +122,10 @@ struct si_sm_data { + unsigned long error0_timeout; + }; + +-static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs, +- struct si_sm_io *io, enum kcs_states state) ++static unsigned int init_kcs_data(struct si_sm_data *kcs, ++ struct si_sm_io *io) + { +- kcs->state = state; ++ kcs->state = KCS_IDLE; + kcs->io = io; + kcs->write_pos = 0; + kcs->write_count = 0; +@@ -140,12 +140,6 @@ static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs, + return 2; + } + +-static unsigned int init_kcs_data(struct si_sm_data *kcs, +- struct si_sm_io *io) +-{ +- return init_kcs_data_with_state(kcs, io, KCS_IDLE); +-} +- + static inline unsigned char read_status(struct si_sm_data *kcs) + { + return kcs->io->inputb(kcs->io, 1); +@@ -276,7 +270,7 @@ static int start_kcs_transaction(struct si_sm_data *kcs, unsigned char *data, + if (size > MAX_KCS_WRITE_SIZE) + return IPMI_REQ_LEN_EXCEEDED_ERR; + +- if (kcs->state != KCS_IDLE) { ++ if ((kcs->state != KCS_IDLE) && (kcs->state != KCS_HOSED)) { + dev_warn(kcs->io->dev, "KCS in invalid state %d\n", kcs->state); + return IPMI_NOT_IN_MY_STATE_ERR; + } +@@ -501,7 +495,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time) + } + + if (kcs->state == KCS_HOSED) { +- init_kcs_data_with_state(kcs, kcs->io, KCS_ERROR0); ++ init_kcs_data(kcs, kcs->io); + return SI_SM_HOSED; + } + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 96f175bd6d9fb7..b7d8bf202ed2d0 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -39,7 +39,9 @@ + + #define IPMI_DRIVER_VERSION "39.2" + +-static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void); ++static struct ipmi_recv_msg *ipmi_alloc_recv_msg(struct ipmi_user *user); ++static void ipmi_set_recv_msg_user(struct ipmi_recv_msg *msg, ++ struct ipmi_user *user); + static int ipmi_init_msghandler(void); + static void smi_recv_tasklet(struct tasklet_struct *t); + static void handle_new_recv_msgs(struct ipmi_smi *intf); +@@ -939,13 +941,11 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + * risk. At this moment, simply skip it in that case. + */ + ipmi_free_recv_msg(msg); +- atomic_dec(&msg->user->nr_msgs); + } else { + int index; + struct ipmi_user *user = acquire_ipmi_user(msg->user, &index); + + if (user) { +- atomic_dec(&user->nr_msgs); + user->handler->ipmi_recv_hndl(msg, user->handler_data); + release_ipmi_user(user, index); + } else { +@@ -1634,8 +1634,7 @@ int ipmi_set_gets_events(struct ipmi_user *user, bool val) + spin_unlock_irqrestore(&intf->events_lock, flags); + + list_for_each_entry_safe(msg, msg2, &msgs, link) { +- msg->user = user; +- kref_get(&user->refcount); ++ ipmi_set_recv_msg_user(msg, user); + deliver_local_response(intf, msg); + } + +@@ -2309,22 +2308,18 @@ static int i_ipmi_request(struct ipmi_user *user, + struct ipmi_recv_msg *recv_msg; + int rv = 0; + +- if (user) { +- if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) { +- /* Decrement will happen at the end of the routine. */ +- rv = -EBUSY; +- goto out; +- } +- } +- +- if (supplied_recv) ++ if (supplied_recv) { + recv_msg = supplied_recv; +- else { +- recv_msg = ipmi_alloc_recv_msg(); +- if (recv_msg == NULL) { +- rv = -ENOMEM; +- goto out; ++ recv_msg->user = user; ++ if (user) { ++ atomic_inc(&user->nr_msgs); ++ /* The put happens when the message is freed. */ ++ kref_get(&user->refcount); + } ++ } else { ++ recv_msg = ipmi_alloc_recv_msg(user); ++ if (IS_ERR(recv_msg)) ++ return PTR_ERR(recv_msg); + } + recv_msg->user_msg_data = user_msg_data; + +@@ -2335,8 +2330,7 @@ static int i_ipmi_request(struct ipmi_user *user, + if (smi_msg == NULL) { + if (!supplied_recv) + ipmi_free_recv_msg(recv_msg); +- rv = -ENOMEM; +- goto out; ++ return -ENOMEM; + } + } + +@@ -2346,10 +2340,6 @@ static int i_ipmi_request(struct ipmi_user *user, + goto out_err; + } + +- recv_msg->user = user; +- if (user) +- /* The put happens when the message is freed. */ +- kref_get(&user->refcount); + recv_msg->msgid = msgid; + /* + * Store the message to send in the receive message so timeout +@@ -2378,8 +2368,10 @@ static int i_ipmi_request(struct ipmi_user *user, + + if (rv) { + out_err: +- ipmi_free_smi_msg(smi_msg); +- ipmi_free_recv_msg(recv_msg); ++ if (!supplied_smi) ++ ipmi_free_smi_msg(smi_msg); ++ if (!supplied_recv) ++ ipmi_free_recv_msg(recv_msg); + } else { + dev_dbg(intf->si_dev, "Send: %*ph\n", + smi_msg->data_size, smi_msg->data); +@@ -2388,9 +2380,6 @@ static int i_ipmi_request(struct ipmi_user *user, + } + rcu_read_unlock(); + +-out: +- if (rv && user) +- atomic_dec(&user->nr_msgs); + return rv; + } + +@@ -3883,7 +3872,7 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, + unsigned char chan; + struct ipmi_user *user = NULL; + struct ipmi_ipmb_addr *ipmb_addr; +- struct ipmi_recv_msg *recv_msg; ++ struct ipmi_recv_msg *recv_msg = NULL; + + if (msg->rsp_size < 10) { + /* Message not big enough, just ignore it. */ +@@ -3904,9 +3893,8 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, + rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); + if (rcvr) { + user = rcvr->user; +- kref_get(&user->refcount); +- } else +- user = NULL; ++ recv_msg = ipmi_alloc_recv_msg(user); ++ } + rcu_read_unlock(); + + if (user == NULL) { +@@ -3941,47 +3929,41 @@ static int handle_ipmb_get_msg_cmd(struct ipmi_smi *intf, + rv = -1; + } + rcu_read_unlock(); +- } else { +- recv_msg = ipmi_alloc_recv_msg(); +- if (!recv_msg) { +- /* +- * We couldn't allocate memory for the +- * message, so requeue it for handling +- * later. +- */ +- rv = 1; +- kref_put(&user->refcount, free_user); +- } else { +- /* Extract the source address from the data. */ +- ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; +- ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; +- ipmb_addr->slave_addr = msg->rsp[6]; +- ipmb_addr->lun = msg->rsp[7] & 3; +- ipmb_addr->channel = msg->rsp[3] & 0xf; ++ } else if (!IS_ERR(recv_msg)) { ++ /* Extract the source address from the data. */ ++ ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; ++ ipmb_addr->addr_type = IPMI_IPMB_ADDR_TYPE; ++ ipmb_addr->slave_addr = msg->rsp[6]; ++ ipmb_addr->lun = msg->rsp[7] & 3; ++ ipmb_addr->channel = msg->rsp[3] & 0xf; + +- /* +- * Extract the rest of the message information +- * from the IPMB header. +- */ +- recv_msg->user = user; +- recv_msg->recv_type = IPMI_CMD_RECV_TYPE; +- recv_msg->msgid = msg->rsp[7] >> 2; +- recv_msg->msg.netfn = msg->rsp[4] >> 2; +- recv_msg->msg.cmd = msg->rsp[8]; +- recv_msg->msg.data = recv_msg->msg_data; ++ /* ++ * Extract the rest of the message information ++ * from the IPMB header. ++ */ ++ recv_msg->recv_type = IPMI_CMD_RECV_TYPE; ++ recv_msg->msgid = msg->rsp[7] >> 2; ++ recv_msg->msg.netfn = msg->rsp[4] >> 2; ++ recv_msg->msg.cmd = msg->rsp[8]; ++ recv_msg->msg.data = recv_msg->msg_data; + +- /* +- * We chop off 10, not 9 bytes because the checksum +- * at the end also needs to be removed. +- */ +- recv_msg->msg.data_len = msg->rsp_size - 10; +- memcpy(recv_msg->msg_data, &msg->rsp[9], +- msg->rsp_size - 10); +- if (deliver_response(intf, recv_msg)) +- ipmi_inc_stat(intf, unhandled_commands); +- else +- ipmi_inc_stat(intf, handled_commands); +- } ++ /* ++ * We chop off 10, not 9 bytes because the checksum ++ * at the end also needs to be removed. ++ */ ++ recv_msg->msg.data_len = msg->rsp_size - 10; ++ memcpy(recv_msg->msg_data, &msg->rsp[9], ++ msg->rsp_size - 10); ++ if (deliver_response(intf, recv_msg)) ++ ipmi_inc_stat(intf, unhandled_commands); ++ else ++ ipmi_inc_stat(intf, handled_commands); ++ } else { ++ /* ++ * We couldn't allocate memory for the message, so ++ * requeue it for handling later. ++ */ ++ rv = 1; + } + + return rv; +@@ -3994,7 +3976,7 @@ static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, + int rv = 0; + struct ipmi_user *user = NULL; + struct ipmi_ipmb_direct_addr *daddr; +- struct ipmi_recv_msg *recv_msg; ++ struct ipmi_recv_msg *recv_msg = NULL; + unsigned char netfn = msg->rsp[0] >> 2; + unsigned char cmd = msg->rsp[3]; + +@@ -4003,9 +3985,8 @@ static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, + rcvr = find_cmd_rcvr(intf, netfn, cmd, 0); + if (rcvr) { + user = rcvr->user; +- kref_get(&user->refcount); +- } else +- user = NULL; ++ recv_msg = ipmi_alloc_recv_msg(user); ++ } + rcu_read_unlock(); + + if (user == NULL) { +@@ -4032,44 +4013,38 @@ static int handle_ipmb_direct_rcv_cmd(struct ipmi_smi *intf, + rv = -1; + } + rcu_read_unlock(); +- } else { +- recv_msg = ipmi_alloc_recv_msg(); +- if (!recv_msg) { +- /* +- * We couldn't allocate memory for the +- * message, so requeue it for handling +- * later. +- */ +- rv = 1; +- kref_put(&user->refcount, free_user); +- } else { +- /* Extract the source address from the data. */ +- daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; +- daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; +- daddr->channel = 0; +- daddr->slave_addr = msg->rsp[1]; +- daddr->rs_lun = msg->rsp[0] & 3; +- daddr->rq_lun = msg->rsp[2] & 3; ++ } else if (!IS_ERR(recv_msg)) { ++ /* Extract the source address from the data. */ ++ daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; ++ daddr->addr_type = IPMI_IPMB_DIRECT_ADDR_TYPE; ++ daddr->channel = 0; ++ daddr->slave_addr = msg->rsp[1]; ++ daddr->rs_lun = msg->rsp[0] & 3; ++ daddr->rq_lun = msg->rsp[2] & 3; + +- /* +- * Extract the rest of the message information +- * from the IPMB header. +- */ +- recv_msg->user = user; +- recv_msg->recv_type = IPMI_CMD_RECV_TYPE; +- recv_msg->msgid = (msg->rsp[2] >> 2); +- recv_msg->msg.netfn = msg->rsp[0] >> 2; +- recv_msg->msg.cmd = msg->rsp[3]; +- recv_msg->msg.data = recv_msg->msg_data; +- +- recv_msg->msg.data_len = msg->rsp_size - 4; +- memcpy(recv_msg->msg_data, msg->rsp + 4, +- msg->rsp_size - 4); +- if (deliver_response(intf, recv_msg)) +- ipmi_inc_stat(intf, unhandled_commands); +- else +- ipmi_inc_stat(intf, handled_commands); +- } ++ /* ++ * Extract the rest of the message information ++ * from the IPMB header. ++ */ ++ recv_msg->recv_type = IPMI_CMD_RECV_TYPE; ++ recv_msg->msgid = (msg->rsp[2] >> 2); ++ recv_msg->msg.netfn = msg->rsp[0] >> 2; ++ recv_msg->msg.cmd = msg->rsp[3]; ++ recv_msg->msg.data = recv_msg->msg_data; ++ ++ recv_msg->msg.data_len = msg->rsp_size - 4; ++ memcpy(recv_msg->msg_data, msg->rsp + 4, ++ msg->rsp_size - 4); ++ if (deliver_response(intf, recv_msg)) ++ ipmi_inc_stat(intf, unhandled_commands); ++ else ++ ipmi_inc_stat(intf, handled_commands); ++ } else { ++ /* ++ * We couldn't allocate memory for the message, so ++ * requeue it for handling later. ++ */ ++ rv = 1; + } + + return rv; +@@ -4183,7 +4158,7 @@ static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, + unsigned char chan; + struct ipmi_user *user = NULL; + struct ipmi_lan_addr *lan_addr; +- struct ipmi_recv_msg *recv_msg; ++ struct ipmi_recv_msg *recv_msg = NULL; + + if (msg->rsp_size < 12) { + /* Message not big enough, just ignore it. */ +@@ -4204,9 +4179,8 @@ static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, + rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); + if (rcvr) { + user = rcvr->user; +- kref_get(&user->refcount); +- } else +- user = NULL; ++ recv_msg = ipmi_alloc_recv_msg(user); ++ } + rcu_read_unlock(); + + if (user == NULL) { +@@ -4218,49 +4192,44 @@ static int handle_lan_get_msg_cmd(struct ipmi_smi *intf, + * them to be freed. + */ + rv = 0; +- } else { +- recv_msg = ipmi_alloc_recv_msg(); +- if (!recv_msg) { +- /* +- * We couldn't allocate memory for the +- * message, so requeue it for handling later. +- */ +- rv = 1; +- kref_put(&user->refcount, free_user); +- } else { +- /* Extract the source address from the data. */ +- lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; +- lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; +- lan_addr->session_handle = msg->rsp[4]; +- lan_addr->remote_SWID = msg->rsp[8]; +- lan_addr->local_SWID = msg->rsp[5]; +- lan_addr->lun = msg->rsp[9] & 3; +- lan_addr->channel = msg->rsp[3] & 0xf; +- lan_addr->privilege = msg->rsp[3] >> 4; ++ } else if (!IS_ERR(recv_msg)) { ++ /* Extract the source address from the data. */ ++ lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; ++ lan_addr->addr_type = IPMI_LAN_ADDR_TYPE; ++ lan_addr->session_handle = msg->rsp[4]; ++ lan_addr->remote_SWID = msg->rsp[8]; ++ lan_addr->local_SWID = msg->rsp[5]; ++ lan_addr->lun = msg->rsp[9] & 3; ++ lan_addr->channel = msg->rsp[3] & 0xf; ++ lan_addr->privilege = msg->rsp[3] >> 4; + +- /* +- * Extract the rest of the message information +- * from the IPMB header. +- */ +- recv_msg->user = user; +- recv_msg->recv_type = IPMI_CMD_RECV_TYPE; +- recv_msg->msgid = msg->rsp[9] >> 2; +- recv_msg->msg.netfn = msg->rsp[6] >> 2; +- recv_msg->msg.cmd = msg->rsp[10]; +- recv_msg->msg.data = recv_msg->msg_data; ++ /* ++ * Extract the rest of the message information ++ * from the IPMB header. ++ */ ++ recv_msg->recv_type = IPMI_CMD_RECV_TYPE; ++ recv_msg->msgid = msg->rsp[9] >> 2; ++ recv_msg->msg.netfn = msg->rsp[6] >> 2; ++ recv_msg->msg.cmd = msg->rsp[10]; ++ recv_msg->msg.data = recv_msg->msg_data; + +- /* +- * We chop off 12, not 11 bytes because the checksum +- * at the end also needs to be removed. +- */ +- recv_msg->msg.data_len = msg->rsp_size - 12; +- memcpy(recv_msg->msg_data, &msg->rsp[11], +- msg->rsp_size - 12); +- if (deliver_response(intf, recv_msg)) +- ipmi_inc_stat(intf, unhandled_commands); +- else +- ipmi_inc_stat(intf, handled_commands); +- } ++ /* ++ * We chop off 12, not 11 bytes because the checksum ++ * at the end also needs to be removed. ++ */ ++ recv_msg->msg.data_len = msg->rsp_size - 12; ++ memcpy(recv_msg->msg_data, &msg->rsp[11], ++ msg->rsp_size - 12); ++ if (deliver_response(intf, recv_msg)) ++ ipmi_inc_stat(intf, unhandled_commands); ++ else ++ ipmi_inc_stat(intf, handled_commands); ++ } else { ++ /* ++ * We couldn't allocate memory for the message, so ++ * requeue it for handling later. ++ */ ++ rv = 1; + } + + return rv; +@@ -4282,7 +4251,7 @@ static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, + unsigned char chan; + struct ipmi_user *user = NULL; + struct ipmi_system_interface_addr *smi_addr; +- struct ipmi_recv_msg *recv_msg; ++ struct ipmi_recv_msg *recv_msg = NULL; + + /* + * We expect the OEM SW to perform error checking +@@ -4311,9 +4280,8 @@ static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, + rcvr = find_cmd_rcvr(intf, netfn, cmd, chan); + if (rcvr) { + user = rcvr->user; +- kref_get(&user->refcount); +- } else +- user = NULL; ++ recv_msg = ipmi_alloc_recv_msg(user); ++ } + rcu_read_unlock(); + + if (user == NULL) { +@@ -4326,48 +4294,42 @@ static int handle_oem_get_msg_cmd(struct ipmi_smi *intf, + */ + + rv = 0; +- } else { +- recv_msg = ipmi_alloc_recv_msg(); +- if (!recv_msg) { +- /* +- * We couldn't allocate memory for the +- * message, so requeue it for handling +- * later. +- */ +- rv = 1; +- kref_put(&user->refcount, free_user); +- } else { +- /* +- * OEM Messages are expected to be delivered via +- * the system interface to SMS software. We might +- * need to visit this again depending on OEM +- * requirements +- */ +- smi_addr = ((struct ipmi_system_interface_addr *) +- &recv_msg->addr); +- smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; +- smi_addr->channel = IPMI_BMC_CHANNEL; +- smi_addr->lun = msg->rsp[0] & 3; +- +- recv_msg->user = user; +- recv_msg->user_msg_data = NULL; +- recv_msg->recv_type = IPMI_OEM_RECV_TYPE; +- recv_msg->msg.netfn = msg->rsp[0] >> 2; +- recv_msg->msg.cmd = msg->rsp[1]; +- recv_msg->msg.data = recv_msg->msg_data; ++ } else if (!IS_ERR(recv_msg)) { ++ /* ++ * OEM Messages are expected to be delivered via ++ * the system interface to SMS software. We might ++ * need to visit this again depending on OEM ++ * requirements ++ */ ++ smi_addr = ((struct ipmi_system_interface_addr *) ++ &recv_msg->addr); ++ smi_addr->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE; ++ smi_addr->channel = IPMI_BMC_CHANNEL; ++ smi_addr->lun = msg->rsp[0] & 3; ++ ++ recv_msg->user_msg_data = NULL; ++ recv_msg->recv_type = IPMI_OEM_RECV_TYPE; ++ recv_msg->msg.netfn = msg->rsp[0] >> 2; ++ recv_msg->msg.cmd = msg->rsp[1]; ++ recv_msg->msg.data = recv_msg->msg_data; + +- /* +- * The message starts at byte 4 which follows the +- * Channel Byte in the "GET MESSAGE" command +- */ +- recv_msg->msg.data_len = msg->rsp_size - 4; +- memcpy(recv_msg->msg_data, &msg->rsp[4], +- msg->rsp_size - 4); +- if (deliver_response(intf, recv_msg)) +- ipmi_inc_stat(intf, unhandled_commands); +- else +- ipmi_inc_stat(intf, handled_commands); +- } ++ /* ++ * The message starts at byte 4 which follows the ++ * Channel Byte in the "GET MESSAGE" command ++ */ ++ recv_msg->msg.data_len = msg->rsp_size - 4; ++ memcpy(recv_msg->msg_data, &msg->rsp[4], ++ msg->rsp_size - 4); ++ if (deliver_response(intf, recv_msg)) ++ ipmi_inc_stat(intf, unhandled_commands); ++ else ++ ipmi_inc_stat(intf, handled_commands); ++ } else { ++ /* ++ * We couldn't allocate memory for the message, so ++ * requeue it for handling later. ++ */ ++ rv = 1; + } + + return rv; +@@ -4426,8 +4388,8 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, + if (!user->gets_events) + continue; + +- recv_msg = ipmi_alloc_recv_msg(); +- if (!recv_msg) { ++ recv_msg = ipmi_alloc_recv_msg(user); ++ if (IS_ERR(recv_msg)) { + rcu_read_unlock(); + list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, + link) { +@@ -4446,8 +4408,6 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, + deliver_count++; + + copy_event_into_recv_msg(recv_msg, msg); +- recv_msg->user = user; +- kref_get(&user->refcount); + list_add_tail(&recv_msg->link, &msgs); + } + srcu_read_unlock(&intf->users_srcu, index); +@@ -4463,8 +4423,8 @@ static int handle_read_event_rsp(struct ipmi_smi *intf, + * No one to receive the message, put it in queue if there's + * not already too many things in the queue. + */ +- recv_msg = ipmi_alloc_recv_msg(); +- if (!recv_msg) { ++ recv_msg = ipmi_alloc_recv_msg(NULL); ++ if (IS_ERR(recv_msg)) { + /* + * We couldn't allocate memory for the + * message, so requeue it for handling +@@ -5156,27 +5116,51 @@ static void free_recv_msg(struct ipmi_recv_msg *msg) + kfree(msg); + } + +-static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) ++static struct ipmi_recv_msg *ipmi_alloc_recv_msg(struct ipmi_user *user) + { + struct ipmi_recv_msg *rv; + ++ if (user) { ++ if (atomic_add_return(1, &user->nr_msgs) > max_msgs_per_user) { ++ atomic_dec(&user->nr_msgs); ++ return ERR_PTR(-EBUSY); ++ } ++ } ++ + rv = kmalloc(sizeof(struct ipmi_recv_msg), GFP_ATOMIC); +- if (rv) { +- rv->user = NULL; +- rv->done = free_recv_msg; +- atomic_inc(&recv_msg_inuse_count); ++ if (!rv) { ++ if (user) ++ atomic_dec(&user->nr_msgs); ++ return ERR_PTR(-ENOMEM); + } ++ ++ rv->user = user; ++ rv->done = free_recv_msg; ++ if (user) ++ kref_get(&user->refcount); ++ atomic_inc(&recv_msg_inuse_count); + return rv; + } + + void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) + { +- if (msg->user && !oops_in_progress) ++ if (msg->user && !oops_in_progress) { ++ atomic_dec(&msg->user->nr_msgs); + kref_put(&msg->user->refcount, free_user); ++ } + msg->done(msg); + } + EXPORT_SYMBOL(ipmi_free_recv_msg); + ++static void ipmi_set_recv_msg_user(struct ipmi_recv_msg *msg, ++ struct ipmi_user *user) ++{ ++ WARN_ON_ONCE(msg->user); /* User should not be set. */ ++ msg->user = user; ++ atomic_inc(&user->nr_msgs); ++ kref_get(&user->refcount); ++} ++ + static atomic_t panic_done_count = ATOMIC_INIT(0); + + static void dummy_smi_done_handler(struct ipmi_smi_msg *msg) +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index c71e61ccb95a2b..5e6ee5b82b8ff4 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); ++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), ++ original_int_vec); + rc = -1; + } + +diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c +index c173a44c800aa8..629f050a855aae 100644 +--- a/drivers/clk/at91/clk-peripheral.c ++++ b/drivers/clk/at91/clk-peripheral.c +@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw, + long best_diff = LONG_MIN; + u32 shift; + +- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) +- return parent_rate; ++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) { ++ req->rate = parent_rate; ++ ++ return 0; ++ } + + /* Fist step: check the available dividers. */ + for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) { +diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +index dfba6eb61ccfee..4ecdf9ae024439 100644 +--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c ++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c +@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = { + GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28), + GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29), + /* INFRA_AO1 */ +- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0), ++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0), + GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2), + GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4), +diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c +index c93bc7f926e5d4..359f92df826b5e 100644 +--- a/drivers/clk/mediatek/clk-mux.c ++++ b/drivers/clk/mediatek/clk-mux.c +@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index) + static int mtk_clk_mux_determine_rate(struct clk_hw *hw, + struct clk_rate_request *req) + { +- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw); +- +- return clk_mux_determine_rate_flags(hw, req, mux->data->flags); ++ return clk_mux_determine_rate_flags(hw, req, 0); + } + + const struct clk_ops mtk_mux_clr_set_upd_ops = { +diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c +index 69ebf65081b81f..bbd7d64038fab5 100644 +--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c +@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw, + return 0; + } + +-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate, +- unsigned long *prate) ++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) + { + unsigned long m; + +- if (*prate < rate) { ++ if (req->best_parent_rate < req->rate) { + pr_warn("%s: pll dividers not supported\n", __func__); + return -EINVAL; + } + +- m = DIV_ROUND_UP_ULL(*prate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { +- pr_warn("%s: unable to support rate %lu\n", __func__, rate); ++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2); ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { ++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate); + return -EINVAL; + } + +- return 2 * *prate * m; ++ req->rate = 2 * req->best_parent_rate * m; ++ ++ return 0; + } + + static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, +@@ -403,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + } + + m = DIV_ROUND_UP_ULL(parent_rate, rate * 2); +- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) { ++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) { + pr_warn("%s: unable to support rate %lu\n", __func__, rate); + return -EINVAL; + } +@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, + + static const struct clk_ops lpc18xx_pll0_ops = { + .recalc_rate = lpc18xx_pll0_recalc_rate, +- .round_rate = lpc18xx_pll0_round_rate, ++ .determine_rate = lpc18xx_pll0_determine_rate, + .set_rate = lpc18xx_pll0_set_rate, + }; + +diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c +index 7bfba0afd77831..4ec408c3a26aa4 100644 +--- a/drivers/clk/tegra/clk-bpmp.c ++++ b/drivers/clk/tegra/clk-bpmp.c +@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp, + + bpmp->num_clocks = count; + +- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL); ++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL); + if (!bpmp->clocks) + return -ENOMEM; + +diff --git a/drivers/clocksource/clps711x-timer.c b/drivers/clocksource/clps711x-timer.c +index e95fdc49c2269c..bbceb0289d457a 100644 +--- a/drivers/clocksource/clps711x-timer.c ++++ b/drivers/clocksource/clps711x-timer.c +@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(struct device_node *np) + unsigned int irq = irq_of_parse_and_map(np, 0); + struct clk *clock = of_clk_get(np, 0); + void __iomem *base = of_iomap(np, 0); ++ int ret = 0; + + if (!base) + return -ENOMEM; +- if (!irq) +- return -EINVAL; +- if (IS_ERR(clock)) +- return PTR_ERR(clock); ++ if (!irq) { ++ ret = -EINVAL; ++ goto unmap_io; ++ } ++ if (IS_ERR(clock)) { ++ ret = PTR_ERR(clock); ++ goto unmap_io; ++ } + + switch (of_alias_get_id(np, "timer")) { + case CLPS711X_CLKSRC_CLOCKSOURCE: + clps711x_clksrc_init(clock, base); + break; + case CLPS711X_CLKSRC_CLOCKEVENT: +- return _clps711x_clkevt_init(clock, base, irq); ++ ret = _clps711x_clkevt_init(clock, base, irq); ++ break; + default: +- return -EINVAL; ++ ret = -EINVAL; ++ break; + } + +- return 0; ++unmap_io: ++ iounmap(base); ++ return ret; + } + TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init); +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index ed782c0b48af25..60b4e3b608c006 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1341,10 +1341,10 @@ static void update_qos_request(enum freq_qos_req_type type) + continue; + + req = policy->driver_data; +- cpufreq_cpu_put(policy); +- +- if (!req) ++ if (!req) { ++ cpufreq_cpu_put(policy); + continue; ++ } + + if (hwp_active) + intel_pstate_get_hwp_cap(cpu); +@@ -1360,6 +1360,8 @@ static void update_qos_request(enum freq_qos_req_type type) + + if (freq_qos_update_request(req, freq) < 0) + pr_warn("Failed to update freq constraint: CPU%d\n", i); ++ ++ cpufreq_cpu_put(policy); + } + } + +diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c +index 7b8fcfa55038bc..39186008afbfdf 100644 +--- a/drivers/cpufreq/tegra186-cpufreq.c ++++ b/drivers/cpufreq/tegra186-cpufreq.c +@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, + { + struct tegra186_cpufreq_data *data = cpufreq_get_driver_data(); + struct cpufreq_frequency_table *tbl = policy->freq_table + index; +- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; ++ unsigned int edvd_offset; + u32 edvd_val = tbl->driver_data; ++ u32 cpu; + +- writel(edvd_val, data->regs + edvd_offset); ++ for_each_cpu(cpu, policy->cpus) { ++ edvd_offset = data->cpus[cpu].edvd_offset; ++ writel(edvd_val, data->regs + edvd_offset); ++ } + + return 0; + } +diff --git a/drivers/crypto/aspeed/aspeed-hace-crypto.c b/drivers/crypto/aspeed/aspeed-hace-crypto.c +index f0eddb7854e5d8..15e843b4854d0a 100644 +--- a/drivers/crypto/aspeed/aspeed-hace-crypto.c ++++ b/drivers/crypto/aspeed/aspeed-hace-crypto.c +@@ -346,7 +346,7 @@ static int aspeed_sk_start_sg(struct aspeed_hace_dev *hace_dev) + + } else { + dma_unmap_sg(hace_dev->dev, req->dst, rctx->dst_nents, +- DMA_TO_DEVICE); ++ DMA_FROM_DEVICE); + dma_unmap_sg(hace_dev->dev, req->src, rctx->src_nents, + DMA_TO_DEVICE); + } +diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c +index 099b32a10dd753..d234495f1115b8 100644 +--- a/drivers/crypto/atmel-tdes.c ++++ b/drivers/crypto/atmel-tdes.c +@@ -548,7 +548,7 @@ static int atmel_tdes_crypt_start(struct atmel_tdes_dev *dd) + + if (err && (dd->flags & TDES_FLAGS_FAST)) { + dma_unmap_sg(dd->dev, dd->in_sg, 1, DMA_TO_DEVICE); +- dma_unmap_sg(dd->dev, dd->out_sg, 1, DMA_TO_DEVICE); ++ dma_unmap_sg(dd->dev, dd->out_sg, 1, DMA_FROM_DEVICE); + } + + return err; +diff --git a/drivers/crypto/rockchip/rk3288_crypto_ahash.c b/drivers/crypto/rockchip/rk3288_crypto_ahash.c +index 29c9537216fa6d..8f3406289df430 100644 +--- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c ++++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c +@@ -252,7 +252,7 @@ static void rk_hash_unprepare(struct crypto_engine *engine, void *breq) + struct rk_ahash_rctx *rctx = ahash_request_ctx(areq); + struct rk_crypto_info *rkc = rctx->dev; + +- dma_unmap_sg(rkc->dev, areq->src, rctx->nrsg, DMA_TO_DEVICE); ++ dma_unmap_sg(rkc->dev, areq->src, sg_nents(areq->src), DMA_TO_DEVICE); + } + + static int rk_hash_run(struct crypto_engine *engine, void *breq) +diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c +index 9a2656d73600b5..b39f395c077eeb 100644 +--- a/drivers/firmware/meson/meson_sm.c ++++ b/drivers/firmware/meson/meson_sm.c +@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write); + struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node) + { + struct platform_device *pdev = of_find_device_by_node(sm_node); ++ struct meson_sm_firmware *fw; + + if (!pdev) + return NULL; + +- return platform_get_drvdata(pdev); ++ fw = platform_get_drvdata(pdev); ++ ++ put_device(&pdev->dev); ++ ++ return fw; + } + EXPORT_SYMBOL_GPL(meson_sm_get); + +diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c +index cfa7b0a50c8e33..03b16b8f639ad0 100644 +--- a/drivers/gpio/gpio-wcd934x.c ++++ b/drivers/gpio/gpio-wcd934x.c +@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev) + chip->base = -1; + chip->ngpio = WCD934X_NPINS; + chip->label = dev_name(dev); +- chip->can_sleep = false; ++ chip->can_sleep = true; + + return devm_gpiochip_add_data(dev, chip, data); + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +index 670d5ab9d9984f..f97c1826770825 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c +@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration( + REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0); + + if (data->taps.h_taps + data->taps.v_taps <= 2) { +- /* Set bypass */ +- +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ /* Disable scaler functionality */ ++ REG_WRITE(SCL_SCALER_ENABLE, 0); + ++ /* Clear registers that can cause glitches even when the scaler is off */ ++ REG_WRITE(SCL_TAP_CONTROL, 0); ++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0); ++ REG_WRITE(SCL_F_SHARP_CONTROL, 0); + return false; + } + +@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration( + SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1, + SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1); + +- /* DCE6 has no SCL_MODE register, skip scale mode programming */ ++ REG_WRITE(SCL_SCALER_ENABLE, 1); + + /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */ + +@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler( + REG_SET(DC_LB_MEM_SIZE, 0, + DC_LB_MEM_SIZE, xfm_dce->lb_memory_size); + ++ REG_WRITE(SCL_UPDATE, 0x00010000); ++ + /* Clear SCL_F_SHARP_CONTROL value to 0 */ + REG_WRITE(SCL_F_SHARP_CONTROL, 0); + +@@ -527,8 +532,7 @@ static void dce60_transform_set_scaler( + if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) { + /* 4. Program vertical filters */ + if (xfm_dce->filter_v == NULL) +- REG_SET(SCL_VERT_FILTER_CONTROL, 0, +- SCL_V_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.v_taps, +@@ -542,8 +546,7 @@ static void dce60_transform_set_scaler( + + /* 5. Program horizontal filters */ + if (xfm_dce->filter_h == NULL) +- REG_SET(SCL_HORZ_FILTER_CONTROL, 0, +- SCL_H_2TAP_HARDCODE_COEF_EN, 0); ++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0); + program_multi_taps_filter( + xfm_dce, + data->taps.h_taps, +@@ -566,6 +569,8 @@ static void dce60_transform_set_scaler( + /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */ + + /* DCE6 DATA_FORMAT register does not support ALPHA_EN */ ++ ++ REG_WRITE(SCL_UPDATE, 0); + } + #endif + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +index cbce194ec7b82b..eb716e8337e236 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h +@@ -155,6 +155,9 @@ + SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \ + SRI(VIEWPORT_START, SCL, id), \ + SRI(VIEWPORT_SIZE, SCL, id), \ ++ SRI(SCL_SCALER_ENABLE, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \ ++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \ + SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \ + SRI(SCL_VERT_FILTER_INIT, SCL, id), \ +@@ -590,6 +593,7 @@ struct dce_transform_registers { + uint32_t SCL_VERT_FILTER_SCALE_RATIO; + uint32_t SCL_HORZ_FILTER_INIT; + #if defined(CONFIG_DRM_AMD_DC_SI) ++ uint32_t SCL_SCALER_ENABLE; + uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA; + uint32_t SCL_HORZ_FILTER_INIT_CHROMA; + #endif +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +index 9de01ae574c035..067eddd9c62d80 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h +@@ -4115,6 +4115,7 @@ + #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42 + #define mmSCL0_SCL_CONTROL 0x1B44 + #define mmSCL0_SCL_DEBUG 0x1B6A + #define mmSCL0_SCL_DEBUG2 0x1B69 +@@ -4144,6 +4145,7 @@ + #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55 + #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40 + #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41 ++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42 + #define mmSCL1_SCL_CONTROL 0x1E44 + #define mmSCL1_SCL_DEBUG 0x1E6A + #define mmSCL1_SCL_DEBUG2 0x1E69 +@@ -4173,6 +4175,7 @@ + #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155 + #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140 + #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141 ++#define mmSCL2_SCL_SCALER_ENABLE 0x4142 + #define mmSCL2_SCL_CONTROL 0x4144 + #define mmSCL2_SCL_DEBUG 0x416A + #define mmSCL2_SCL_DEBUG2 0x4169 +@@ -4202,6 +4205,7 @@ + #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455 + #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440 + #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441 ++#define mmSCL3_SCL_SCALER_ENABLE 0x4442 + #define mmSCL3_SCL_CONTROL 0x4444 + #define mmSCL3_SCL_DEBUG 0x446A + #define mmSCL3_SCL_DEBUG2 0x4469 +@@ -4231,6 +4235,7 @@ + #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755 + #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740 + #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741 ++#define mmSCL4_SCL_SCALER_ENABLE 0x4742 + #define mmSCL4_SCL_CONTROL 0x4744 + #define mmSCL4_SCL_DEBUG 0x476A + #define mmSCL4_SCL_DEBUG2 0x4769 +@@ -4260,6 +4265,7 @@ + #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55 + #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40 + #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41 ++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42 + #define mmSCL5_SCL_CONTROL 0x4A44 + #define mmSCL5_SCL_DEBUG 0x4A6A + #define mmSCL5_SCL_DEBUG2 0x4A69 +@@ -4287,6 +4293,7 @@ + #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55 + #define mmSCL_COEF_RAM_SELECT 0x1B40 + #define mmSCL_COEF_RAM_TAP_DATA 0x1B41 ++#define mmSCL_SCALER_ENABLE 0x1B42 + #define mmSCL_CONTROL 0x1B44 + #define mmSCL_DEBUG 0x1B6A + #define mmSCL_DEBUG2 0x1B69 +diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +index bd8085ec54ed57..da5596fbfdcb31 100644 +--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h ++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h +@@ -8648,6 +8648,8 @@ + #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000 + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L + #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000 ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L ++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000 + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L + #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000 + #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L +diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c +index 036ee034397283..11f164a15d7c21 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -836,7 +836,7 @@ nouveau_bo_move_prep(struct nouveau_drm *drm, struct ttm_buffer_object *bo, + nvif_vmm_put(vmm, &old_mem->vma[1]); + nvif_vmm_put(vmm, &old_mem->vma[0]); + } +- return 0; ++ return ret; + } + + static int +diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c +index 92f4261305bd9d..f2ae5d17ea601e 100644 +--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c +@@ -576,7 +576,10 @@ static int rcar_mipi_dsi_startup(struct rcar_mipi_dsi *dsi, + udelay(10); + rcar_mipi_dsi_clr(dsi, CLOCKSET1, CLOCKSET1_UPDATEPLL); + +- ppisetr = PPISETR_DLEN_3 | PPISETR_CLEN; ++ rcar_mipi_dsi_clr(dsi, TXSETR, TXSETR_LANECNT_MASK); ++ rcar_mipi_dsi_set(dsi, TXSETR, dsi->lanes - 1); ++ ++ ppisetr = ((BIT(dsi->lanes) - 1) & PPISETR_DLEN_MASK) | PPISETR_CLEN; + rcar_mipi_dsi_write(dsi, PPISETR, ppisetr); + + rcar_mipi_dsi_set(dsi, PHYSETUP, PHYSETUP_SHUTDOWNZ); +diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h +index a6b276f1d6ee15..a54c7eb4113b93 100644 +--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h ++++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h +@@ -12,6 +12,9 @@ + #define LINKSR_LPBUSY (1 << 1) + #define LINKSR_HSBUSY (1 << 0) + ++#define TXSETR 0x100 ++#define TXSETR_LANECNT_MASK (0x3 << 0) ++ + /* + * Video Mode Register + */ +@@ -80,10 +83,7 @@ + * PHY-Protocol Interface (PPI) Registers + */ + #define PPISETR 0x700 +-#define PPISETR_DLEN_0 (0x1 << 0) +-#define PPISETR_DLEN_1 (0x3 << 0) +-#define PPISETR_DLEN_2 (0x7 << 0) +-#define PPISETR_DLEN_3 (0xf << 0) ++#define PPISETR_DLEN_MASK (0xf << 0) + #define PPISETR_CLEN (1 << 8) + + #define PPICLCR 0x710 +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index b129ce873af3f2..b235e7cc41f3f8 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + SVGA3dCmdHeader *header) + { + struct vmw_bo *vmw_bo = NULL; ++ struct vmw_resource *res; + struct vmw_surface *srf = NULL; + VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); + int ret; +@@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, + + dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? + VMW_RES_DIRTY_SET : 0; +- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, +- dirty, user_surface_converter, +- &cmd->body.host.sid, NULL); ++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, ++ user_surface_converter, &cmd->body.host.sid, ++ NULL); + if (unlikely(ret != 0)) { + if (unlikely(ret != -ERESTARTSYS)) + VMW_DEBUG_USER("could not find surface for DMA.\n"); + return ret; + } + +- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); ++ res = sw_context->res_cache[vmw_res_surface].res; ++ if (!res) { ++ VMW_DEBUG_USER("Invalid DMA surface.\n"); ++ return -EINVAL; ++ } + +- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); ++ srf = vmw_res_to_srf(res); ++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, ++ header); + + return 0; + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +index aaacbdcbd742fb..946f166d6fc765 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +@@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, + hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); + } + node->res = vmw_resource_reference_unless_doomed(res); +- if (!node->res) ++ if (!node->res) { ++ hash_del_rcu(&node->hash.head); + return -ESRCH; ++ } + + node->first_usage = 1; + if (!res->dev_priv->has_mob) { +@@ -654,7 +656,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) + hash_del_rcu(&val->hash.head); + + list_for_each_entry(val, &ctx->resource_ctx_list, head) +- hash_del_rcu(&entry->hash.head); ++ hash_del_rcu(&val->hash.head); + + ctx->sw_context = NULL; + } +diff --git a/drivers/iio/adc/xilinx-ams.c b/drivers/iio/adc/xilinx-ams.c +index f52abf759260f2..5de86a953d4182 100644 +--- a/drivers/iio/adc/xilinx-ams.c ++++ b/drivers/iio/adc/xilinx-ams.c +@@ -118,7 +118,7 @@ + #define AMS_ALARM_THRESHOLD_OFF_10 0x10 + #define AMS_ALARM_THRESHOLD_OFF_20 0x20 + +-#define AMS_ALARM_THR_DIRECT_MASK BIT(1) ++#define AMS_ALARM_THR_DIRECT_MASK BIT(0) + #define AMS_ALARM_THR_MIN 0x0000 + #define AMS_ALARM_THR_MAX (BIT(16) - 1) + +@@ -385,6 +385,29 @@ static void ams_update_pl_alarm(struct ams *ams, unsigned long alarm_mask) + ams_pl_update_reg(ams, AMS_REG_CONFIG3, AMS_REGCFG3_ALARM_MASK, cfg); + } + ++static void ams_unmask(struct ams *ams) ++{ ++ unsigned int status, unmask; ++ ++ status = readl(ams->base + AMS_ISR_0); ++ ++ /* Clear those bits which are not active anymore */ ++ unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; ++ ++ /* Clear status of disabled alarm */ ++ unmask |= ams->intr_mask; ++ ++ ams->current_masked_alarm &= status; ++ ++ /* Also clear those which are masked out anyway */ ++ ams->current_masked_alarm &= ~ams->intr_mask; ++ ++ /* Clear the interrupts before we unmask them */ ++ writel(unmask, ams->base + AMS_ISR_0); ++ ++ ams_update_intrmask(ams, ~AMS_ALARM_MASK, ~AMS_ALARM_MASK); ++} ++ + static void ams_update_alarm(struct ams *ams, unsigned long alarm_mask) + { + unsigned long flags; +@@ -397,6 +420,7 @@ static void ams_update_alarm(struct ams *ams, unsigned long alarm_mask) + + spin_lock_irqsave(&ams->intr_lock, flags); + ams_update_intrmask(ams, AMS_ISR0_ALARM_MASK, ~alarm_mask); ++ ams_unmask(ams); + spin_unlock_irqrestore(&ams->intr_lock, flags); + } + +@@ -1025,28 +1049,9 @@ static void ams_handle_events(struct iio_dev *indio_dev, unsigned long events) + static void ams_unmask_worker(struct work_struct *work) + { + struct ams *ams = container_of(work, struct ams, ams_unmask_work.work); +- unsigned int status, unmask; + + spin_lock_irq(&ams->intr_lock); +- +- status = readl(ams->base + AMS_ISR_0); +- +- /* Clear those bits which are not active anymore */ +- unmask = (ams->current_masked_alarm ^ status) & ams->current_masked_alarm; +- +- /* Clear status of disabled alarm */ +- unmask |= ams->intr_mask; +- +- ams->current_masked_alarm &= status; +- +- /* Also clear those which are masked out anyway */ +- ams->current_masked_alarm &= ~ams->intr_mask; +- +- /* Clear the interrupts before we unmask them */ +- writel(unmask, ams->base + AMS_ISR_0); +- +- ams_update_intrmask(ams, ~AMS_ALARM_MASK, ~AMS_ALARM_MASK); +- ++ ams_unmask(ams); + spin_unlock_irq(&ams->intr_lock); + + /* If still pending some alarm re-trigger the timer */ +diff --git a/drivers/iio/dac/ad5360.c b/drivers/iio/dac/ad5360.c +index e0b7f658d61196..cf9cf90cd6e276 100644 +--- a/drivers/iio/dac/ad5360.c ++++ b/drivers/iio/dac/ad5360.c +@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio_dev *indio_dev, unsigned int set, + unsigned int clr) + { + struct ad5360_state *st = iio_priv(indio_dev); +- unsigned int ret; ++ int ret; + + mutex_lock(&st->lock); + +diff --git a/drivers/iio/dac/ad5421.c b/drivers/iio/dac/ad5421.c +index 7644acfd879e04..9228e3cee1b850 100644 +--- a/drivers/iio/dac/ad5421.c ++++ b/drivers/iio/dac/ad5421.c +@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio_dev *indio_dev, unsigned int set, + unsigned int clr) + { + struct ad5421_state *st = iio_priv(indio_dev); +- unsigned int ret; ++ int ret; + + mutex_lock(&st->lock); + +diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c +index 4abf80f75ef5d9..03e75261e891fe 100644 +--- a/drivers/iio/frequency/adf4350.c ++++ b/drivers/iio/frequency/adf4350.c +@@ -143,6 +143,19 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq) + if (freq > ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq) + return -EINVAL; + ++ st->r4_rf_div_sel = 0; ++ ++ /* ++ * !\TODO: The below computation is making sure we get a power of 2 ++ * shift (st->r4_rf_div_sel) so that freq becomes higher or equal to ++ * ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() ++ * and friends. ++ */ ++ while (freq < ADF4350_MIN_VCO_FREQ) { ++ freq <<= 1; ++ st->r4_rf_div_sel++; ++ } ++ + if (freq > ADF4350_MAX_FREQ_45_PRESC) { + prescaler = ADF4350_REG1_PRESCALER; + mdiv = 75; +@@ -151,13 +164,6 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq) + mdiv = 23; + } + +- st->r4_rf_div_sel = 0; +- +- while (freq < ADF4350_MIN_VCO_FREQ) { +- freq <<= 1; +- st->r4_rf_div_sel++; +- } +- + /* + * Allow a predefined reference division factor + * if not set, compute our own +diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +index 91c181bb92869d..a1f055014cc652 100644 +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -747,10 +747,6 @@ static int inv_icm42600_resume(struct device *dev) + if (ret) + goto out_unlock; + +- pm_runtime_disable(dev); +- pm_runtime_set_active(dev); +- pm_runtime_enable(dev); +- + /* restore sensors state */ + ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, + st->suspended.accel, +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 88bccdbb0bed08..ac7b8fb36db8fb 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4415,7 +4415,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev) + } + + if (info->ats_supported && ecap_prs(iommu->ecap) && +- pci_pri_supported(pdev)) ++ ecap_pds(iommu->ecap) && pci_pri_supported(pdev)) + info->pri_supported = 1; + } + } +diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c +index 57289966915492..2d20cf9d84cead 100644 +--- a/drivers/irqchip/irq-sifive-plic.c ++++ b/drivers/irqchip/irq-sifive-plic.c +@@ -248,11 +248,11 @@ static int plic_irq_suspend(void) + + priv = per_cpu_ptr(&plic_handlers, smp_processor_id())->priv; + +- for (i = 0; i < priv->nr_irqs; i++) +- if (readl(priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID)) +- __set_bit(i, priv->prio_save); +- else +- __clear_bit(i, priv->prio_save); ++ /* irq ID 0 is reserved */ ++ for (i = 1; i < priv->nr_irqs; i++) { ++ __assign_bit(i, priv->prio_save, ++ readl(priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID)); ++ } + + for_each_cpu(cpu, cpu_present_mask) { + struct plic_handler *handler = per_cpu_ptr(&plic_handlers, cpu); +@@ -279,7 +279,8 @@ static void plic_irq_resume(void) + + priv = per_cpu_ptr(&plic_handlers, smp_processor_id())->priv; + +- for (i = 0; i < priv->nr_irqs; i++) { ++ /* irq ID 0 is reserved */ ++ for (i = 1; i < priv->nr_irqs; i++) { + index = BIT_WORD(i); + writel((priv->prio_save[index] & BIT_MASK(i)) ? 1 : 0, + priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID); +diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c +index e4fcac97dbfaa0..90f248ef2a1fcc 100644 +--- a/drivers/mailbox/zynqmp-ipi-mailbox.c ++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c +@@ -616,11 +616,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata) + i = pdata->num_mboxes; + for (; i >= 0; i--) { + ipi_mbox = &pdata->ipi_mboxes[i]; +- if (ipi_mbox->dev.parent) { +- mbox_controller_unregister(&ipi_mbox->mbox); +- if (device_is_registered(&ipi_mbox->dev)) +- device_unregister(&ipi_mbox->dev); +- } ++ if (device_is_registered(&ipi_mbox->dev)) ++ device_unregister(&ipi_mbox->dev); + } + } + +diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c +index 1f7edc0f5b1abe..a184fd9fc6f3b3 100644 +--- a/drivers/media/i2c/mt9v111.c ++++ b/drivers/media/i2c/mt9v111.c +@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(struct mt9v111_dev *mt9v111, + static int mt9v111_hw_config(struct mt9v111_dev *mt9v111) + { + struct i2c_client *c = mt9v111->client; +- unsigned int ret; + u16 outfmtctrl2; ++ int ret; + + /* Force device reset. */ + ret = __mt9v111_hw_reset(mt9v111); +diff --git a/drivers/media/mc/mc-devnode.c b/drivers/media/mc/mc-devnode.c +index 94abd042045dab..6fd8885f5928e4 100644 +--- a/drivers/media/mc/mc-devnode.c ++++ b/drivers/media/mc/mc-devnode.c +@@ -50,11 +50,6 @@ static void media_devnode_release(struct device *cd) + { + struct media_devnode *devnode = to_media_devnode(cd); + +- mutex_lock(&media_devnode_lock); +- /* Mark device node number as free */ +- clear_bit(devnode->minor, media_devnode_nums); +- mutex_unlock(&media_devnode_lock); +- + /* Release media_devnode and perform other cleanups as needed. */ + if (devnode->release) + devnode->release(devnode); +@@ -283,6 +278,7 @@ void media_devnode_unregister(struct media_devnode *devnode) + /* Delete the cdev on this minor as well */ + cdev_device_del(&devnode->cdev, &devnode->dev); + devnode->media_dev = NULL; ++ clear_bit(devnode->minor, media_devnode_nums); + mutex_unlock(&media_devnode_lock); + + put_device(&devnode->dev); +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index 951b79ca125cdd..f885e718524c22 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -678,7 +678,7 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + * (already discovered through iterating over links) and pads + * not internally connected. + */ +- if (origin == local || !local->num_links || ++ if (origin == local || local->num_links || + !media_entity_has_pad_interdep(origin->entity, origin->index, + local->index)) + continue; +diff --git a/drivers/media/pci/cx18/cx18-queue.c b/drivers/media/pci/cx18/cx18-queue.c +index 013694bfcb1c1b..7cbb2d5869320b 100644 +--- a/drivers/media/pci/cx18/cx18-queue.c ++++ b/drivers/media/pci/cx18/cx18-queue.c +@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_stream *s) + break; + } + ++ buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, ++ buf->buf, s->buf_size, ++ s->dma); ++ if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) { ++ kfree(buf->buf); ++ kfree(mdl); ++ kfree(buf); ++ break; ++ } ++ + INIT_LIST_HEAD(&mdl->list); + INIT_LIST_HEAD(&mdl->buf_list); + mdl->id = s->mdl_base_idx; /* a somewhat safe value */ + cx18_enqueue(s, mdl, &s->q_idle); + + INIT_LIST_HEAD(&buf->list); +- buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, +- buf->buf, s->buf_size, +- s->dma); + cx18_buf_sync_for_cpu(s, buf); + list_add_tail(&buf->list, &s->buf_pool); + } +diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c +index b7aaa8b4a7841d..e39bf64c5c715b 100644 +--- a/drivers/media/pci/ivtv/ivtv-irq.c ++++ b/drivers/media/pci/ivtv/ivtv-irq.c +@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct ivtv_stream *s, u32 offset, int lock) + + /* Insert buffer block for YUV if needed */ + if (s->type == IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { +- if (yi->blanking_dmaptr) { ++ if (yi->blanking_ptr) { + s->sg_pending[idx].src = yi->blanking_dmaptr; + s->sg_pending[idx].dst = offset; + s->sg_pending[idx].size = 720 * 16; +diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c +index 2d9274537725af..71f0401066471a 100644 +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, struct ivtv_user_dma *dma, + ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); + + /* If we've offset the y plane, ensure top area is blanked */ +- if (f->offset_y && yi->blanking_dmaptr) { ++ if (f->offset_y && yi->blanking_ptr) { + dma->SGarray[dma->SG_length].size = cpu_to_le32(720*16); + dma->SGarray[dma->SG_length].src = cpu_to_le32(yi->blanking_dmaptr); + dma->SGarray[dma->SG_length].dst = cpu_to_le32(IVTV_DECODER_OFFSET + yuv_offset[frame]); +@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *itv) + yi->blanking_dmaptr = dma_map_single(&itv->pdev->dev, + yi->blanking_ptr, + 720 * 16, DMA_TO_DEVICE); ++ if (dma_mapping_error(&itv->pdev->dev, yi->blanking_dmaptr)) { ++ kfree(yi->blanking_ptr); ++ yi->blanking_ptr = NULL; ++ yi->blanking_dmaptr = 0; ++ IVTV_DEBUG_WARN("Failed to dma_map yuv blanking buffer\n"); ++ } + } else { + yi->blanking_dmaptr = 0; + IVTV_DEBUG_WARN("Failed to allocate yuv blanking buffer\n"); +diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c +index fe7da2b3048299..01461b2fed51d8 100644 +--- a/drivers/media/platform/qcom/venus/firmware.c ++++ b/drivers/media/platform/qcom/venus/firmware.c +@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venus_core *core) + u32 fw_size = core->fw.mapped_mem_size; + void __iomem *wrapper_base; + +- if (IS_IRIS2_1(core)) ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) + wrapper_base = core->wrapper_tz_base; + else + wrapper_base = core->wrapper_base; +@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venus_core *core) + writel(fw_size, wrapper_base + WRAPPER_NONPIX_START_ADDR); + writel(fw_size, wrapper_base + WRAPPER_NONPIX_END_ADDR); + +- if (IS_IRIS2_1(core)) { ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) { + /* Bring XTSS out of reset */ + writel(0, wrapper_base + WRAPPER_TZ_XTSS_SW_RESET); + } else { +@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_core *core, bool resume) + if (resume) { + venus_reset_cpu(core); + } else { +- if (IS_IRIS2_1(core)) ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) + writel(WRAPPER_XTSS_SW_RESET_BIT, + core->wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET); + else +@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct venus_core *core) + void __iomem *wrapper_base = core->wrapper_base; + void __iomem *wrapper_tz_base = core->wrapper_tz_base; + +- if (IS_IRIS2_1(core)) { ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) { + /* Assert the reset to XTSS */ + reg = readl(wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET); + reg |= WRAPPER_XTSS_SW_RESET_BIT; +diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c +index f8901d6fbe9bf1..ff3088691d5e18 100644 +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -735,11 +735,11 @@ int lirc_register(struct rc_dev *dev) + + cdev_init(&dev->lirc_cdev, &lirc_fops); + ++ get_device(&dev->dev); ++ + err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev); + if (err) +- goto out_ida; +- +- get_device(&dev->dev); ++ goto out_put_device; + + switch (dev->driver_type) { + case RC_DRIVER_SCANCODE: +@@ -763,7 +763,8 @@ int lirc_register(struct rc_dev *dev) + + return 0; + +-out_ida: ++out_put_device: ++ put_device(&dev->lirc_dev); + ida_free(&lirc_ida, minor); + return err; + } +diff --git a/drivers/memory/samsung/exynos-srom.c b/drivers/memory/samsung/exynos-srom.c +index e73dd330af477d..d913fb901973f0 100644 +--- a/drivers/memory/samsung/exynos-srom.c ++++ b/drivers/memory/samsung/exynos-srom.c +@@ -121,20 +121,18 @@ static int exynos_srom_probe(struct platform_device *pdev) + return -ENOMEM; + + srom->dev = dev; +- srom->reg_base = of_iomap(np, 0); +- if (!srom->reg_base) { ++ srom->reg_base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(srom->reg_base)) { + dev_err(&pdev->dev, "iomap of exynos srom controller failed\n"); +- return -ENOMEM; ++ return PTR_ERR(srom->reg_base); + } + + platform_set_drvdata(pdev, srom); + + srom->reg_offset = exynos_srom_alloc_reg_dump(exynos_srom_offsets, + ARRAY_SIZE(exynos_srom_offsets)); +- if (!srom->reg_offset) { +- iounmap(srom->reg_base); ++ if (!srom->reg_offset) + return -ENOMEM; +- } + + for_each_child_of_node(np, child) { + if (exynos_srom_configure_bank(srom, child)) { +diff --git a/drivers/mfd/intel_soc_pmic_chtdc_ti.c b/drivers/mfd/intel_soc_pmic_chtdc_ti.c +index 992855bfda3e47..6daf33e07ea0a8 100644 +--- a/drivers/mfd/intel_soc_pmic_chtdc_ti.c ++++ b/drivers/mfd/intel_soc_pmic_chtdc_ti.c +@@ -81,8 +81,9 @@ static struct mfd_cell chtdc_ti_dev[] = { + static const struct regmap_config chtdc_ti_regmap_config = { + .reg_bits = 8, + .val_bits = 8, +- .max_register = 128, +- .cache_type = REGCACHE_NONE, ++ .max_register = 0xff, ++ /* The hardware does not support reading multiple registers at once */ ++ .use_single_read = true, + }; + + static const struct regmap_irq chtdc_ti_irqs[] = { +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 5e03a6ba55711a..a85442d74e0928 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -322,11 +322,11 @@ static void fastrpc_free_map(struct kref *ref) + + perm.vmid = QCOM_SCM_VMID_HLOS; + perm.perm = QCOM_SCM_PERM_RWX; +- err = qcom_scm_assign_mem(map->phys, map->size, ++ err = qcom_scm_assign_mem(map->phys, map->len, + &src_perms, &perm, 1); + if (err) { +- dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d", +- map->phys, map->size, err); ++ dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n", ++ map->phys, map->len, err); + return; + } + } +@@ -752,7 +752,8 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, + struct fastrpc_session_ctx *sess = fl->sctx; + struct fastrpc_map *map = NULL; + struct sg_table *table; +- int err = 0; ++ struct scatterlist *sgl = NULL; ++ int err = 0, sgl_index = 0; + + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) +@@ -789,7 +790,15 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, + map->phys = sg_dma_address(map->table->sgl); + map->phys += ((u64)fl->sctx->sid << 32); + } +- map->size = len; ++ for_each_sg(map->table->sgl, sgl, map->table->nents, ++ sgl_index) ++ map->size += sg_dma_len(sgl); ++ if (len > map->size) { ++ dev_dbg(sess->dev, "Bad size passed len 0x%llx map size 0x%llx\n", ++ len, map->size); ++ err = -EINVAL; ++ goto map_err; ++ } + map->va = sg_virt(map->table->sgl); + map->len = len; + +@@ -806,10 +815,10 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, + dst_perms[1].vmid = fl->cctx->vmperms[0].vmid; + dst_perms[1].perm = QCOM_SCM_PERM_RWX; + map->attr = attr; +- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2); ++ err = qcom_scm_assign_mem(map->phys, (u64)map->len, &src_perms, dst_perms, 2); + if (err) { +- dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d", +- map->phys, map->size, err); ++ dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n", ++ map->phys, map->len, err); + goto map_err; + } + } +@@ -1240,7 +1249,7 @@ static bool is_session_rejected(struct fastrpc_user *fl, bool unsigned_pd_reques + * that does not support unsigned PD offload + */ + if (!fl->cctx->unsigned_support || !unsigned_pd_request) { +- dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD"); ++ dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD\n"); + return true; + } + } +@@ -1304,7 +1313,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, + &src_perms, + fl->cctx->vmperms, fl->cctx->vmcount); + if (err) { +- dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d", ++ dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n", + fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); + goto err_map; + } +@@ -1358,7 +1367,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, + (u64)fl->cctx->remote_heap->size, + &src_perms, &dst_perms, 1); + if (err) +- dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d", ++ dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n", + fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err); + } + err_map: +@@ -2063,7 +2072,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) + args[0].length = sizeof(req_msg); + + pages.addr = map->phys; +- pages.size = map->size; ++ pages.size = map->len; + + args[1].ptr = (u64) (uintptr_t) &pages; + args[1].length = sizeof(pages); +@@ -2078,7 +2087,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) + err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]); + if (err) { + dev_err(dev, "mem mmap error, fd %d, vaddr %llx, size %lld\n", +- req.fd, req.vaddrin, map->size); ++ req.fd, req.vaddrin, map->len); + goto err_invoke; + } + +@@ -2091,7 +2100,7 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) + if (copy_to_user((void __user *)argp, &req, sizeof(req))) { + /* unmap the memory and release the buffer */ + req_unmap.vaddr = (uintptr_t) rsp_msg.vaddr; +- req_unmap.length = map->size; ++ req_unmap.length = map->len; + fastrpc_req_mem_unmap_impl(fl, &req_unmap); + return -EFAULT; + } +diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c +index cb87e827377934..2c58df6855f2a5 100644 +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -945,7 +945,11 @@ static void mmc_sdio_remove(struct mmc_host *host) + */ + static int mmc_sdio_alive(struct mmc_host *host) + { +- return mmc_select_card(host->card); ++ if (!mmc_host_is_spi(host)) ++ return mmc_select_card(host->card); ++ else ++ return mmc_io_rw_direct(host->card, 0, 0, SDIO_CCCR_CCCR, 0, ++ NULL); + } + + /* +diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c +index fe5912d31beea4..b0a70badf3eb77 100644 +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -876,10 +876,14 @@ static int fsmc_nand_probe_config_dt(struct platform_device *pdev, + if (!of_property_read_u32(np, "bank-width", &val)) { + if (val == 2) { + nand->options |= NAND_BUSWIDTH_16; +- } else if (val != 1) { ++ } else if (val == 1) { ++ nand->options |= NAND_BUSWIDTH_AUTO; ++ } else { + dev_err(&pdev->dev, "invalid bank-width %u\n", val); + return -EINVAL; + } ++ } else { ++ nand->options |= NAND_BUSWIDTH_AUTO; + } + + if (of_property_read_bool(np, "nand-skip-bbtscan")) +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index eee675a25b2c3c..ef9adecb639aec 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -483,10 +483,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + "missing 'reg' property in node %pOF\n", + tbi); + err = -EBUSY; ++ of_node_put(tbi); + goto error; + } + set_tbipa(*prop, pdev, + data->get_tbipa, priv->map, &res); ++ of_node_put(tbi); + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 33bbcced81059a..275561272721e4 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv, + mlx4_unregister_mac(mdev->dev, priv->port, mac); + + hlist_del_rcu(&entry->hlist); +- kfree_rcu(entry, rcu); + en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n", + entry->mac, priv->port); ++ kfree_rcu(entry, rcu); + ++removed; + } + } +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 0e8ff839cae234..3a340cb2b205f4 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -1763,14 +1763,10 @@ static int ath11k_core_reconfigure_on_crash(struct ath11k_base *ab) + mutex_unlock(&ab->core_lock); + + ath11k_dp_free(ab); +- ath11k_hal_srng_deinit(ab); ++ ath11k_hal_srng_clear(ab); + + ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS(ab))) - 1; + +- ret = ath11k_hal_srng_init(ab); +- if (ret) +- return ret; +- + clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags); + + ret = ath11k_core_qmi_firmware_ready(ab); +diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c +index 1215408d1a6abb..79cf65bc2e1724 100644 +--- a/drivers/net/wireless/ath/ath11k/hal.c ++++ b/drivers/net/wireless/ath/ath11k/hal.c +@@ -1356,6 +1356,22 @@ void ath11k_hal_srng_deinit(struct ath11k_base *ab) + } + EXPORT_SYMBOL(ath11k_hal_srng_deinit); + ++void ath11k_hal_srng_clear(struct ath11k_base *ab) ++{ ++ /* No need to memset rdp and wrp memory since each individual ++ * segment would get cleared in ath11k_hal_srng_src_hw_init() ++ * and ath11k_hal_srng_dst_hw_init(). ++ */ ++ memset(ab->hal.srng_list, 0, ++ sizeof(ab->hal.srng_list)); ++ memset(ab->hal.shadow_reg_addr, 0, ++ sizeof(ab->hal.shadow_reg_addr)); ++ ab->hal.avail_blk_resource = 0; ++ ab->hal.current_blk_index = 0; ++ ab->hal.num_shadow_reg_configured = 0; ++} ++EXPORT_SYMBOL(ath11k_hal_srng_clear); ++ + void ath11k_hal_dump_srng_stats(struct ath11k_base *ab) + { + struct hal_srng *srng; +diff --git a/drivers/net/wireless/ath/ath11k/hal.h b/drivers/net/wireless/ath/ath11k/hal.h +index 80447f488954a8..aa21eb1fdce159 100644 +--- a/drivers/net/wireless/ath/ath11k/hal.h ++++ b/drivers/net/wireless/ath/ath11k/hal.h +@@ -962,6 +962,7 @@ int ath11k_hal_srng_setup(struct ath11k_base *ab, enum hal_ring_type type, + struct hal_srng_params *params); + int ath11k_hal_srng_init(struct ath11k_base *ath11k); + void ath11k_hal_srng_deinit(struct ath11k_base *ath11k); ++void ath11k_hal_srng_clear(struct ath11k_base *ab); + void ath11k_hal_dump_srng_stats(struct ath11k_base *ab); + void ath11k_hal_srng_get_shadow_config(struct ath11k_base *ab, + u32 **cfg, u32 *len); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c +index 13e892d788b277..92281811103ef9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c +@@ -21,6 +21,9 @@ static const struct usb_device_id mt7921u_device_table[] = { + /* Netgear, Inc. [A8000,AXE3000] */ + { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9060, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, ++ /* Netgear, Inc. A7500 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9065, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, + /* TP-Link TXE50UH */ + { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0107, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM }, +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 136dba6221d86a..053385c84bf848 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2986,10 +2986,12 @@ static unsigned long check_vendor_combination_bug(struct pci_dev *pdev) + * Exclude Samsung 990 Evo from NVME_QUIRK_SIMPLE_SUSPEND + * because of high power consumption (> 2 Watt) in s2idle + * sleep. Only some boards with Intel CPU are affected. ++ * (Note for testing: Samsung 990 Evo Plus has same PCI ID) + */ + if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") || + dmi_match(DMI_BOARD_NAME, "GMxPXxx") || + dmi_match(DMI_BOARD_NAME, "GXxMRXx") || ++ dmi_match(DMI_BOARD_NAME, "NS5X_NS7XAU") || + dmi_match(DMI_BOARD_NAME, "PH4PG31") || + dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") || + dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71")) +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 5bfec440b4fd70..aae4e8ef9e3654 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -3957,6 +3957,7 @@ static int of_unittest_pci_node_verify(struct pci_dev *pdev, bool add) + unittest(!np, "Child device tree node is not removed\n"); + child_dev = device_find_any_child(&pdev->dev); + unittest(!child_dev, "Child device is not removed\n"); ++ put_device(child_dev); + } + + failed: +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index bf9a961c9f2766..9055ce34c636bd 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -1213,8 +1213,8 @@ static int ks_pcie_probe(struct platform_device *pdev) + if (irq < 0) + return irq; + +- ret = request_irq(irq, ks_pcie_err_irq_handler, IRQF_SHARED, +- "ks-pcie-error-irq", ks_pcie); ++ ret = devm_request_irq(dev, irq, ks_pcie_err_irq_handler, IRQF_SHARED, ++ "ks-pcie-error-irq", ks_pcie); + if (ret < 0) { + dev_err(dev, "failed to request error IRQ %d\n", + irq); +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 115a21cf869ae6..c7d3e248a59a20 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -1218,6 +1218,7 @@ static int tegra_pcie_bpmp_set_ctrl_state(struct tegra_pcie_dw *pcie, + struct mrq_uphy_response resp; + struct tegra_bpmp_message msg; + struct mrq_uphy_request req; ++ int err; + + /* + * Controller-5 doesn't need to have its state set by BPMP-FW in +@@ -1240,7 +1241,13 @@ static int tegra_pcie_bpmp_set_ctrl_state(struct tegra_pcie_dw *pcie, + msg.rx.data = &resp; + msg.rx.size = sizeof(resp); + +- return tegra_bpmp_transfer(pcie->bpmp, &msg); ++ err = tegra_bpmp_transfer(pcie->bpmp, &msg); ++ if (err) ++ return err; ++ if (msg.rx.ret) ++ return -EINVAL; ++ ++ return 0; + } + + static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie, +@@ -1249,6 +1256,7 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie, + struct mrq_uphy_response resp; + struct tegra_bpmp_message msg; + struct mrq_uphy_request req; ++ int err; + + memset(&req, 0, sizeof(req)); + memset(&resp, 0, sizeof(resp)); +@@ -1268,7 +1276,13 @@ static int tegra_pcie_bpmp_set_pll_state(struct tegra_pcie_dw *pcie, + msg.rx.data = &resp; + msg.rx.size = sizeof(resp); + +- return tegra_bpmp_transfer(pcie->bpmp, &msg); ++ err = tegra_bpmp_transfer(pcie->bpmp, &msg); ++ if (err) ++ return err; ++ if (msg.rx.ret) ++ return -EINVAL; ++ ++ return 0; + } + + static void tegra_pcie_downstream_dev_to_D0(struct tegra_pcie_dw *pcie) +@@ -1963,10 +1977,10 @@ static int tegra_pcie_ep_raise_legacy_irq(struct tegra_pcie_dw *pcie, u16 irq) + + static int tegra_pcie_ep_raise_msi_irq(struct tegra_pcie_dw *pcie, u16 irq) + { +- if (unlikely(irq > 31)) ++ if (unlikely(irq > 32)) + return -EINVAL; + +- appl_writel(pcie, BIT(irq), APPL_MSI_CTRL_1); ++ appl_writel(pcie, BIT(irq - 1), APPL_MSI_CTRL_1); + + return 0; + } +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 80d975dcb2ee27..da37569460b1ad 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -14,6 +14,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -269,7 +270,7 @@ struct tegra_msi { + DECLARE_BITMAP(used, INT_PCI_MSI_NR); + struct irq_domain *domain; + struct mutex map_lock; +- spinlock_t mask_lock; ++ raw_spinlock_t mask_lock; + void *virt; + dma_addr_t phys; + int irq; +@@ -1604,14 +1605,13 @@ static void tegra_msi_irq_mask(struct irq_data *d) + struct tegra_msi *msi = irq_data_get_irq_chip_data(d); + struct tegra_pcie *pcie = msi_to_pcie(msi); + unsigned int index = d->hwirq / 32; +- unsigned long flags; + u32 value; + +- spin_lock_irqsave(&msi->mask_lock, flags); +- value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); +- value &= ~BIT(d->hwirq % 32); +- afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); +- spin_unlock_irqrestore(&msi->mask_lock, flags); ++ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { ++ value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); ++ value &= ~BIT(d->hwirq % 32); ++ afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); ++ } + } + + static void tegra_msi_irq_unmask(struct irq_data *d) +@@ -1619,14 +1619,13 @@ static void tegra_msi_irq_unmask(struct irq_data *d) + struct tegra_msi *msi = irq_data_get_irq_chip_data(d); + struct tegra_pcie *pcie = msi_to_pcie(msi); + unsigned int index = d->hwirq / 32; +- unsigned long flags; + u32 value; + +- spin_lock_irqsave(&msi->mask_lock, flags); +- value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); +- value |= BIT(d->hwirq % 32); +- afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); +- spin_unlock_irqrestore(&msi->mask_lock, flags); ++ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { ++ value = afi_readl(pcie, AFI_MSI_EN_VEC(index)); ++ value |= BIT(d->hwirq % 32); ++ afi_writel(pcie, value, AFI_MSI_EN_VEC(index)); ++ } + } + + static int tegra_msi_set_affinity(struct irq_data *d, const struct cpumask *mask, bool force) +@@ -1742,7 +1741,7 @@ static int tegra_pcie_msi_setup(struct tegra_pcie *pcie) + int err; + + mutex_init(&msi->map_lock); +- spin_lock_init(&msi->mask_lock); ++ raw_spin_lock_init(&msi->mask_lock); + + if (IS_ENABLED(CONFIG_PCI_MSI)) { + err = tegra_allocate_domains(msi); +diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c +index 704ab5d723a959..77f6366e7db107 100644 +--- a/drivers/pci/controller/pcie-rcar-host.c ++++ b/drivers/pci/controller/pcie-rcar-host.c +@@ -12,6 +12,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -36,7 +37,7 @@ struct rcar_msi { + DECLARE_BITMAP(used, INT_PCI_MSI_NR); + struct irq_domain *domain; + struct mutex map_lock; +- spinlock_t mask_lock; ++ raw_spinlock_t mask_lock; + int irq1; + int irq2; + }; +@@ -50,20 +51,13 @@ struct rcar_pcie_host { + int (*phy_init_fn)(struct rcar_pcie_host *host); + }; + +-static DEFINE_SPINLOCK(pmsr_lock); +- + static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base) + { +- unsigned long flags; + u32 pmsr, val; + int ret = 0; + +- spin_lock_irqsave(&pmsr_lock, flags); +- +- if (!pcie_base || pm_runtime_suspended(pcie_dev)) { +- ret = -EINVAL; +- goto unlock_exit; +- } ++ if (!pcie_base || pm_runtime_suspended(pcie_dev)) ++ return -EINVAL; + + pmsr = readl(pcie_base + PMSR); + +@@ -85,8 +79,6 @@ static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base) + writel(L1FAEG | PMEL1RX, pcie_base + PMSR); + } + +-unlock_exit: +- spin_unlock_irqrestore(&pmsr_lock, flags); + return ret; + } + +@@ -633,28 +625,26 @@ static void rcar_msi_irq_mask(struct irq_data *d) + { + struct rcar_msi *msi = irq_data_get_irq_chip_data(d); + struct rcar_pcie *pcie = &msi_to_host(msi)->pcie; +- unsigned long flags; + u32 value; + +- spin_lock_irqsave(&msi->mask_lock, flags); +- value = rcar_pci_read_reg(pcie, PCIEMSIIER); +- value &= ~BIT(d->hwirq); +- rcar_pci_write_reg(pcie, value, PCIEMSIIER); +- spin_unlock_irqrestore(&msi->mask_lock, flags); ++ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { ++ value = rcar_pci_read_reg(pcie, PCIEMSIIER); ++ value &= ~BIT(d->hwirq); ++ rcar_pci_write_reg(pcie, value, PCIEMSIIER); ++ } + } + + static void rcar_msi_irq_unmask(struct irq_data *d) + { + struct rcar_msi *msi = irq_data_get_irq_chip_data(d); + struct rcar_pcie *pcie = &msi_to_host(msi)->pcie; +- unsigned long flags; + u32 value; + +- spin_lock_irqsave(&msi->mask_lock, flags); +- value = rcar_pci_read_reg(pcie, PCIEMSIIER); +- value |= BIT(d->hwirq); +- rcar_pci_write_reg(pcie, value, PCIEMSIIER); +- spin_unlock_irqrestore(&msi->mask_lock, flags); ++ scoped_guard(raw_spinlock_irqsave, &msi->mask_lock) { ++ value = rcar_pci_read_reg(pcie, PCIEMSIIER); ++ value |= BIT(d->hwirq); ++ rcar_pci_write_reg(pcie, value, PCIEMSIIER); ++ } + } + + static int rcar_msi_set_affinity(struct irq_data *d, const struct cpumask *mask, bool force) +@@ -770,7 +760,7 @@ static int rcar_pcie_enable_msi(struct rcar_pcie_host *host) + int err; + + mutex_init(&msi->map_lock); +- spin_lock_init(&msi->mask_lock); ++ raw_spin_lock_init(&msi->mask_lock); + + err = of_address_to_resource(dev->of_node, 0, &res); + if (err) +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index ac1dae113f2d9f..4cf20ca25ea74e 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -282,17 +282,20 @@ static void pci_epf_test_clean_dma_chan(struct pci_epf_test *epf_test) + if (!epf_test->dma_supported) + return; + +- dma_release_channel(epf_test->dma_chan_tx); +- if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) { ++ if (epf_test->dma_chan_tx) { ++ dma_release_channel(epf_test->dma_chan_tx); ++ if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) { ++ epf_test->dma_chan_tx = NULL; ++ epf_test->dma_chan_rx = NULL; ++ return; ++ } + epf_test->dma_chan_tx = NULL; +- epf_test->dma_chan_rx = NULL; +- return; + } + +- dma_release_channel(epf_test->dma_chan_rx); +- epf_test->dma_chan_rx = NULL; +- +- return; ++ if (epf_test->dma_chan_rx) { ++ dma_release_channel(epf_test->dma_chan_rx); ++ epf_test->dma_chan_rx = NULL; ++ } + } + + static void pci_epf_test_print_rate(struct pci_epf_test *epf_test, +diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c +index 25dbe85c421758..f97c4f0e1c7a3d 100644 +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -581,15 +581,18 @@ static int sriov_add_vfs(struct pci_dev *dev, u16 num_vfs) + if (dev->no_vf_scan) + return 0; + ++ pci_lock_rescan_remove(); + for (i = 0; i < num_vfs; i++) { + rc = pci_iov_add_virtfn(dev, i); + if (rc) + goto failed; + } ++ pci_unlock_rescan_remove(); + return 0; + failed: + while (i--) + pci_iov_remove_virtfn(dev, i); ++ pci_unlock_rescan_remove(); + + return rc; + } +@@ -709,8 +712,10 @@ static void sriov_del_vfs(struct pci_dev *dev) + struct pci_sriov *iov = dev->sriov; + int i; + ++ pci_lock_rescan_remove(); + for (i = 0; i < iov->num_VFs; i++) + pci_iov_remove_virtfn(dev, i); ++ pci_unlock_rescan_remove(); + } + + static void sriov_disable(struct pci_dev *dev) +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 9c59bf03d6579f..1705d2d0ed1268 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1612,6 +1612,7 @@ void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type) + switch (err_type) { + case PCI_ERS_RESULT_NONE: + case PCI_ERS_RESULT_CAN_RECOVER: ++ case PCI_ERS_RESULT_NEED_RESET: + envp[idx++] = "ERROR_EVENT=BEGIN_RECOVERY"; + envp[idx++] = "DEVICE_ONLINE=0"; + break; +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index 92e8ac85f58e86..449d42744d336f 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -196,8 +196,14 @@ static ssize_t max_link_width_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct pci_dev *pdev = to_pci_dev(dev); ++ ssize_t ret; + +- return sysfs_emit(buf, "%u\n", pcie_get_width_cap(pdev)); ++ /* We read PCI_EXP_LNKCAP, so we need the device to be accessible. */ ++ pci_config_pm_runtime_get(pdev); ++ ret = sysfs_emit(buf, "%u\n", pcie_get_width_cap(pdev)); ++ pci_config_pm_runtime_put(pdev); ++ ++ return ret; + } + static DEVICE_ATTR_RO(max_link_width); + +@@ -209,7 +215,10 @@ static ssize_t current_link_speed_show(struct device *dev, + int err; + enum pci_bus_speed speed; + ++ pci_config_pm_runtime_get(pci_dev); + err = pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &linkstat); ++ pci_config_pm_runtime_put(pci_dev); ++ + if (err) + return -EINVAL; + +@@ -226,7 +235,10 @@ static ssize_t current_link_width_show(struct device *dev, + u16 linkstat; + int err; + ++ pci_config_pm_runtime_get(pci_dev); + err = pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &linkstat); ++ pci_config_pm_runtime_put(pci_dev); ++ + if (err) + return -EINVAL; + +@@ -242,7 +254,10 @@ static ssize_t secondary_bus_number_show(struct device *dev, + u8 sec_bus; + int err; + ++ pci_config_pm_runtime_get(pci_dev); + err = pci_read_config_byte(pci_dev, PCI_SECONDARY_BUS, &sec_bus); ++ pci_config_pm_runtime_put(pci_dev); ++ + if (err) + return -EINVAL; + +@@ -258,7 +273,10 @@ static ssize_t subordinate_bus_number_show(struct device *dev, + u8 sub_bus; + int err; + ++ pci_config_pm_runtime_get(pci_dev); + err = pci_read_config_byte(pci_dev, PCI_SUBORDINATE_BUS, &sub_bus); ++ pci_config_pm_runtime_put(pci_dev); ++ + if (err) + return -EINVAL; + +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index eeb9ea9044b43d..8e700020ee0bc3 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -38,7 +38,7 @@ + #define AER_ERROR_SOURCES_MAX 128 + + #define AER_MAX_TYPEOF_COR_ERRS 16 /* as per PCI_ERR_COR_STATUS */ +-#define AER_MAX_TYPEOF_UNCOR_ERRS 27 /* as per PCI_ERR_UNCOR_STATUS*/ ++#define AER_MAX_TYPEOF_UNCOR_ERRS 32 /* as per PCI_ERR_UNCOR_STATUS*/ + + struct aer_err_source { + unsigned int status; +@@ -510,11 +510,11 @@ static const char *aer_uncorrectable_error_string[] = { + "AtomicOpBlocked", /* Bit Position 24 */ + "TLPBlockedErr", /* Bit Position 25 */ + "PoisonTLPBlocked", /* Bit Position 26 */ +- NULL, /* Bit Position 27 */ +- NULL, /* Bit Position 28 */ +- NULL, /* Bit Position 29 */ +- NULL, /* Bit Position 30 */ +- NULL, /* Bit Position 31 */ ++ "DMWrReqBlocked", /* Bit Position 27 */ ++ "IDECheck", /* Bit Position 28 */ ++ "MisIDETLP", /* Bit Position 29 */ ++ "PCRC_CHECK", /* Bit Position 30 */ ++ "TLPXlatBlocked", /* Bit Position 31 */ + }; + + static const char *aer_agent_string[] = { +diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c +index 705893b5f7b09b..197191178cddc2 100644 +--- a/drivers/pci/pcie/err.c ++++ b/drivers/pci/pcie/err.c +@@ -108,6 +108,12 @@ static int report_normal_detected(struct pci_dev *dev, void *data) + return report_error_detected(dev, pci_channel_io_normal, data); + } + ++static int report_perm_failure_detected(struct pci_dev *dev, void *data) ++{ ++ pci_uevent_ers(dev, PCI_ERS_RESULT_DISCONNECT); ++ return 0; ++} ++ + static int report_mmio_enabled(struct pci_dev *dev, void *data) + { + struct pci_driver *pdrv; +@@ -275,7 +281,7 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, + failed: + pci_walk_bridge(bridge, pci_pm_runtime_put, NULL); + +- pci_uevent_ers(bridge, PCI_ERS_RESULT_DISCONNECT); ++ pci_walk_bridge(bridge, report_perm_failure_detected, NULL); + + /* TODO: Should kernel panic here? */ + pci_info(bridge, "device recovery failed\n"); +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h +index 9af93e3d8d9ff3..1efbae6c99876e 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.h ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.h +@@ -352,10 +352,6 @@ extern const struct samsung_pinctrl_of_match_data exynos850_of_data; + extern const struct samsung_pinctrl_of_match_data exynosautov9_of_data; + extern const struct samsung_pinctrl_of_match_data fsd_of_data; + extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data; +-extern const struct samsung_pinctrl_of_match_data s3c2412_of_data; +-extern const struct samsung_pinctrl_of_match_data s3c2416_of_data; +-extern const struct samsung_pinctrl_of_match_data s3c2440_of_data; +-extern const struct samsung_pinctrl_of_match_data s3c2450_of_data; + extern const struct samsung_pinctrl_of_match_data s5pv210_of_data; + + #endif /* __PINCTRL_SAMSUNG_H */ +diff --git a/drivers/power/supply/max77976_charger.c b/drivers/power/supply/max77976_charger.c +index 99659dc8f5a6df..56ab502e1a80b5 100644 +--- a/drivers/power/supply/max77976_charger.c ++++ b/drivers/power/supply/max77976_charger.c +@@ -292,10 +292,10 @@ static int max77976_get_property(struct power_supply *psy, + case POWER_SUPPLY_PROP_ONLINE: + err = max77976_get_online(chg, &val->intval); + break; +- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX: ++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX: + val->intval = MAX77976_CHG_CC_MAX; + break; +- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT: ++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: + err = max77976_get_integer(chg, CHG_CC, + MAX77976_CHG_CC_MIN, + MAX77976_CHG_CC_MAX, +@@ -330,7 +330,7 @@ static int max77976_set_property(struct power_supply *psy, + int err = 0; + + switch (psp) { +- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT: ++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: + err = max77976_set_integer(chg, CHG_CC, + MAX77976_CHG_CC_MIN, + MAX77976_CHG_CC_MAX, +@@ -355,7 +355,7 @@ static int max77976_property_is_writeable(struct power_supply *psy, + enum power_supply_property psp) + { + switch (psp) { +- case POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT: ++ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: + case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT: + return true; + default: +@@ -368,8 +368,8 @@ static enum power_supply_property max77976_psy_props[] = { + POWER_SUPPLY_PROP_CHARGE_TYPE, + POWER_SUPPLY_PROP_HEALTH, + POWER_SUPPLY_PROP_ONLINE, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, ++ POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT, ++ POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX, + POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, + POWER_SUPPLY_PROP_MODEL_NAME, + POWER_SUPPLY_PROP_MANUFACTURER, +diff --git a/drivers/pwm/pwm-berlin.c b/drivers/pwm/pwm-berlin.c +index 0971c666afd134..14729a6ae09a98 100644 +--- a/drivers/pwm/pwm-berlin.c ++++ b/drivers/pwm/pwm-berlin.c +@@ -273,7 +273,7 @@ static int berlin_pwm_suspend(struct device *dev) + if (!channel) + continue; + +- channel->enable = berlin_pwm_readl(bpc, i, BERLIN_PWM_ENABLE); ++ channel->enable = berlin_pwm_readl(bpc, i, BERLIN_PWM_EN); + channel->ctrl = berlin_pwm_readl(bpc, i, BERLIN_PWM_CONTROL); + channel->duty = berlin_pwm_readl(bpc, i, BERLIN_PWM_DUTY); + channel->tcnt = berlin_pwm_readl(bpc, i, BERLIN_PWM_TCNT); +@@ -304,7 +304,7 @@ static int berlin_pwm_resume(struct device *dev) + berlin_pwm_writel(bpc, i, channel->ctrl, BERLIN_PWM_CONTROL); + berlin_pwm_writel(bpc, i, channel->duty, BERLIN_PWM_DUTY); + berlin_pwm_writel(bpc, i, channel->tcnt, BERLIN_PWM_TCNT); +- berlin_pwm_writel(bpc, i, channel->enable, BERLIN_PWM_ENABLE); ++ berlin_pwm_writel(bpc, i, channel->enable, BERLIN_PWM_EN); + } + + return 0; +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 4a7c41a6c21e7d..93baffe110c00a 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -443,6 +443,29 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + else + err = rtc->ops->set_alarm(rtc->dev.parent, alarm); + ++ /* ++ * Check for potential race described above. If the waiting for next ++ * second, and the second just ticked since the check above, either ++ * ++ * 1) It ticked after the alarm was set, and an alarm irq should be ++ * generated. ++ * ++ * 2) It ticked before the alarm was set, and alarm irq most likely will ++ * not be generated. ++ * ++ * While we cannot easily check for which of these two scenarios we ++ * are in, we can return -ETIME to signal that the timer has already ++ * expired, which is true in both cases. ++ */ ++ if ((scheduled - now) <= 1) { ++ err = __rtc_read_time(rtc, &tm); ++ if (err) ++ return err; ++ now = rtc_tm_to_time64(&tm); ++ if (scheduled <= now) ++ return -ETIME; ++ } ++ + trace_rtc_set_alarm(rtc_tm_to_time64(&alarm->time), err); + return err; + } +@@ -594,6 +617,10 @@ int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled) + rtc->uie_rtctimer.node.expires = ktime_add(now, onesec); + rtc->uie_rtctimer.period = ktime_set(1, 0); + err = rtc_timer_enqueue(rtc, &rtc->uie_rtctimer); ++ if (!err && rtc->ops && rtc->ops->alarm_irq_enable) ++ err = rtc->ops->alarm_irq_enable(rtc->dev.parent, 1); ++ if (err) ++ goto out; + } else { + rtc_timer_remove(rtc, &rtc->uie_rtctimer); + } +diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c +index 9f8b5d4a8f6b65..6b77c122fdc109 100644 +--- a/drivers/rtc/rtc-optee.c ++++ b/drivers/rtc/rtc-optee.c +@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev) + { + struct optee_rtc *priv = dev_get_drvdata(dev); + ++ tee_shm_free(priv->shm); + tee_client_close_session(priv->ctx, priv->session_id); + tee_client_close_context(priv->ctx); + +diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c +index 807f953ae0aedc..b7a7ea036f7adc 100644 +--- a/drivers/rtc/rtc-x1205.c ++++ b/drivers/rtc/rtc-x1205.c +@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = { + MODULE_DEVICE_TABLE(i2c, x1205_id); + + static const struct of_device_id x1205_dt_ids[] = { +- { .compatible = "xircom,x1205", }, ++ { .compatible = "xicor,x1205", }, + {}, + }; + MODULE_DEVICE_TABLE(of, x1205_dt_ids); +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 49c57a9c110b5f..42a89ab33e1c78 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -6528,18 +6528,21 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, + while (left) { + sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; + buff_size[sg_used] = sz; +- buff[sg_used] = kmalloc(sz, GFP_KERNEL); +- if (buff[sg_used] == NULL) { +- status = -ENOMEM; +- goto cleanup1; +- } ++ + if (ioc->Request.Type.Direction & XFER_WRITE) { +- if (copy_from_user(buff[sg_used], data_ptr, sz)) { +- status = -EFAULT; ++ buff[sg_used] = memdup_user(data_ptr, sz); ++ if (IS_ERR(buff[sg_used])) { ++ status = PTR_ERR(buff[sg_used]); + goto cleanup1; + } +- } else +- memset(buff[sg_used], 0, sz); ++ } else { ++ buff[sg_used] = kzalloc(sz, GFP_KERNEL); ++ if (!buff[sg_used]) { ++ status = -ENOMEM; ++ goto cleanup1; ++ } ++ } ++ + left -= sz; + data_ptr += sz; + sg_used++; +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 43ebb331e21673..47c4434dc7e796 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi) + if (mvi->shost) + scsi_host_put(mvi->shost); + list_for_each_entry(mwq, &mvi->wq_list, entry) +- cancel_delayed_work(&mwq->work_q); ++ cancel_delayed_work_sync(&mwq->work_q); + kfree(mvi->rsvd_tags); + kfree(mvi); + } +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index bf9b816637d02e..7b809644436eb7 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -687,6 +687,7 @@ static int cqspi_read_setup(struct cqspi_flash_pdata *f_pdata, + reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; + reg |= (op->addr.nbytes - 1); + writel(reg, reg_base + CQSPI_REG_SIZE); ++ readl(reg_base + CQSPI_REG_SIZE); /* Flush posted write. */ + return 0; + } + +@@ -726,6 +727,7 @@ static int cqspi_indirect_read_execute(struct cqspi_flash_pdata *f_pdata, + reinit_completion(&cqspi->transfer_complete); + writel(CQSPI_REG_INDIRECTRD_START_MASK, + reg_base + CQSPI_REG_INDIRECTRD); ++ readl(reg_base + CQSPI_REG_INDIRECTRD); /* Flush posted write. */ + + while (remaining > 0) { + if (!wait_for_completion_timeout(&cqspi->transfer_complete, +@@ -1004,6 +1006,7 @@ static int cqspi_write_setup(struct cqspi_flash_pdata *f_pdata, + reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; + reg |= (op->addr.nbytes - 1); + writel(reg, reg_base + CQSPI_REG_SIZE); ++ readl(reg_base + CQSPI_REG_SIZE); /* Flush posted write. */ + return 0; + } + +@@ -1029,6 +1032,8 @@ static int cqspi_indirect_write_execute(struct cqspi_flash_pdata *f_pdata, + reinit_completion(&cqspi->transfer_complete); + writel(CQSPI_REG_INDIRECTWR_START_MASK, + reg_base + CQSPI_REG_INDIRECTWR); ++ readl(reg_base + CQSPI_REG_INDIRECTWR); /* Flush posted write. */ ++ + /* + * As per 66AK2G02 TRM SPRUHY8F section 11.15.5.3 Indirect Access + * Controller programming sequence, couple of cycles of +diff --git a/drivers/video/fbdev/core/fb_cmdline.c b/drivers/video/fbdev/core/fb_cmdline.c +index 4d1634c492ec4d..594b60424d1c64 100644 +--- a/drivers/video/fbdev/core/fb_cmdline.c ++++ b/drivers/video/fbdev/core/fb_cmdline.c +@@ -40,7 +40,7 @@ int fb_get_options(const char *name, char **option) + bool enabled; + + if (name) +- is_of = strncmp(name, "offb", 4); ++ is_of = !strncmp(name, "offb", 4); + + enabled = __video_get_options(name, &options, is_of); + +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 9e3b5d21d09877..3a8f2e659e008d 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1326,14 +1326,17 @@ int bind_interdomain_evtchn_to_irq_lateeoi(struct xenbus_device *dev, + } + EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi); + +-static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn) ++static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn, ++ bool percpu) + { + struct evtchn_status status; + evtchn_port_t port; +- int rc = -ENOENT; ++ bool exists = false; + + memset(&status, 0, sizeof(status)); + for (port = 0; port < xen_evtchn_max_channels(); port++) { ++ int rc; ++ + status.dom = DOMID_SELF; + status.port = port; + rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status); +@@ -1341,12 +1344,16 @@ static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn) + continue; + if (status.status != EVTCHNSTAT_virq) + continue; +- if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) { ++ if (status.u.virq != virq) ++ continue; ++ if (status.vcpu == xen_vcpu_nr(cpu)) { + *evtchn = port; +- break; ++ return 0; ++ } else if (!percpu) { ++ exists = true; + } + } +- return rc; ++ return exists ? -EEXIST : -ENOENT; + } + + /** +@@ -1393,8 +1400,11 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + evtchn = bind_virq.port; + else { + if (ret == -EEXIST) +- ret = find_virq(virq, cpu, &evtchn); +- BUG_ON(ret < 0); ++ ret = find_virq(virq, cpu, &evtchn, percpu); ++ if (ret) { ++ __unbind_from_irq(info, info->irq); ++ goto out; ++ } + } + + ret = xen_irq_info_virq_setup(info, cpu, evtchn, virq); +@@ -1799,9 +1809,20 @@ static int xen_rebind_evtchn_to_cpu(struct irq_info *info, unsigned int tcpu) + * virq or IPI channel, which don't actually need to be rebound. Ignore + * it, but don't do the xenlinux-level rebind in that case. + */ +- if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) ++ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) { ++ int old_cpu = info->cpu; ++ + bind_evtchn_to_cpu(info, tcpu, false); + ++ if (info->type == IRQT_VIRQ) { ++ int virq = info->u.virq; ++ int irq = per_cpu(virq_to_irq, old_cpu)[virq]; ++ ++ per_cpu(virq_to_irq, old_cpu)[virq] = -1; ++ per_cpu(virq_to_irq, tcpu)[virq] = irq; ++ } ++ } ++ + do_unmask(info, EVT_MASK_REASON_TEMPORARY); + + return 0; +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index c16df629907e13..55537b673990de 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -116,7 +116,7 @@ static void do_suspend(void) + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { + pr_err("%s: dpm_suspend_start %d\n", __func__, err); +- goto out_thaw; ++ goto out_resume_end; + } + + printk(KERN_DEBUG "suspending xenstore...\n"); +@@ -156,6 +156,7 @@ static void do_suspend(void) + else + xs_suspend_cancel(); + ++out_resume_end: + dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE); + + out_thaw: +diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c +index 203e5964c9b0fc..5e46f8cd7ea073 100644 +--- a/fs/btrfs/export.c ++++ b/fs/btrfs/export.c +@@ -24,7 +24,11 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, + int type; + + if (parent && (len < BTRFS_FID_SIZE_CONNECTABLE)) { +- *max_len = BTRFS_FID_SIZE_CONNECTABLE; ++ if (btrfs_root_id(BTRFS_I(inode)->root) != ++ btrfs_root_id(BTRFS_I(parent)->root)) ++ *max_len = BTRFS_FID_SIZE_CONNECTABLE_ROOT; ++ else ++ *max_len = BTRFS_FID_SIZE_CONNECTABLE; + return FILEID_INVALID; + } else if (len < BTRFS_FID_SIZE_NON_CONNECTABLE) { + *max_len = BTRFS_FID_SIZE_NON_CONNECTABLE; +@@ -46,6 +50,8 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, + parent_root_id = BTRFS_I(parent)->root->root_key.objectid; + + if (parent_root_id != fid->root_objectid) { ++ if (*max_len < BTRFS_FID_SIZE_CONNECTABLE_ROOT) ++ return FILEID_INVALID; + fid->parent_root_objectid = parent_root_id; + len = BTRFS_FID_SIZE_CONNECTABLE_ROOT; + type = FILEID_BTRFS_WITH_PARENT_ROOT; +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index ccf94c5fbfdfd6..88ba277bc3a79e 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -364,6 +364,13 @@ noinline_for_stack bool find_lock_delalloc_range(struct inode *inode, + /* step one, find a bunch of delalloc bytes starting at start */ + delalloc_start = *start; + delalloc_end = 0; ++ ++ /* ++ * If @max_bytes is smaller than a block, btrfs_find_delalloc_range() can ++ * return early without handling any dirty ranges. ++ */ ++ ASSERT(max_bytes >= fs_info->sectorsize); ++ + found = btrfs_find_delalloc_range(tree, &delalloc_start, &delalloc_end, + max_bytes, &cached_state); + if (!found || delalloc_end <= *start || delalloc_start > orig_end) { +@@ -394,13 +401,14 @@ noinline_for_stack bool find_lock_delalloc_range(struct inode *inode, + delalloc_start, delalloc_end); + ASSERT(!ret || ret == -EAGAIN); + if (ret == -EAGAIN) { +- /* some of the pages are gone, lets avoid looping by +- * shortening the size of the delalloc range we're searching ++ /* ++ * Some of the pages are gone, lets avoid looping by ++ * shortening the size of the delalloc range we're searching. + */ + free_extent_state(cached_state); + cached_state = NULL; + if (!loops) { +- max_bytes = PAGE_SIZE; ++ max_bytes = fs_info->sectorsize; + loops = 1; + goto again; + } else { +diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c +index 2fbf97077ce910..3f06362985b5a6 100644 +--- a/fs/cramfs/inode.c ++++ b/fs/cramfs/inode.c +@@ -117,9 +117,18 @@ static struct inode *get_cramfs_inode(struct super_block *sb, + inode_nohighmem(inode); + inode->i_data.a_ops = &cramfs_aops; + break; +- default: ++ case S_IFCHR: ++ case S_IFBLK: ++ case S_IFIFO: ++ case S_IFSOCK: + init_special_inode(inode, cramfs_inode->mode, + old_decode_dev(cramfs_inode->size)); ++ break; ++ default: ++ printk(KERN_DEBUG "CRAMFS: Invalid file type 0%04o for inode %lu.\n", ++ inode->i_mode, inode->i_ino); ++ iget_failed(inode); ++ return ERR_PTR(-EIO); + } + + inode->i_mode = cramfs_inode->mode; +diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c +index 1b68586f73f3fe..c970f41c50483e 100644 +--- a/fs/ext4/fsmap.c ++++ b/fs/ext4/fsmap.c +@@ -74,7 +74,8 @@ static int ext4_getfsmap_dev_compare(const void *p1, const void *p2) + static bool ext4_getfsmap_rec_before_low_key(struct ext4_getfsmap_info *info, + struct ext4_fsmap *rec) + { +- return rec->fmr_physical < info->gfi_low.fmr_physical; ++ return rec->fmr_physical + rec->fmr_length <= ++ info->gfi_low.fmr_physical; + } + + /* +@@ -200,15 +201,18 @@ static int ext4_getfsmap_meta_helper(struct super_block *sb, + ext4_group_first_block_no(sb, agno)); + fs_end = fs_start + EXT4_C2B(sbi, len); + +- /* Return relevant extents from the meta_list */ ++ /* ++ * Return relevant extents from the meta_list. We emit all extents that ++ * partially/fully overlap with the query range ++ */ + list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) { +- if (p->fmr_physical < info->gfi_next_fsblk) { ++ if (p->fmr_physical + p->fmr_length <= info->gfi_next_fsblk) { + list_del(&p->fmr_list); + kfree(p); + continue; + } +- if (p->fmr_physical <= fs_start || +- p->fmr_physical + p->fmr_length <= fs_end) { ++ if (p->fmr_physical <= fs_end && ++ p->fmr_physical + p->fmr_length > fs_start) { + /* Emit the retained free extent record if present */ + if (info->gfi_lastfree.fmr_owner) { + error = ext4_getfsmap_helper(sb, info, +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 63b1384823ba56..91a9fa6f1ad4f0 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3871,7 +3871,11 @@ int ext4_can_truncate(struct inode *inode) + * We have to make sure i_disksize gets properly updated before we truncate + * page cache due to hole punching or zero range. Otherwise i_disksize update + * can get lost as it may have been postponed to submission of writeback but +- * that will never happen after we truncate page cache. ++ * that will never happen if we remove the folio containing i_size from the ++ * page cache. Also if we punch hole within i_size but above i_disksize, ++ * following ext4_page_mkwrite() may mistakenly allocate written blocks over ++ * the hole and thus introduce allocated blocks beyond i_disksize which is ++ * not allowed (e2fsck would complain in case of crash). + */ + int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, + loff_t len) +@@ -3882,9 +3886,11 @@ int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset, + loff_t size = i_size_read(inode); + + WARN_ON(!inode_is_locked(inode)); +- if (offset > size || offset + len < size) ++ if (offset > size) + return 0; + ++ if (offset + len < size) ++ size = offset + len; + if (EXT4_I(inode)->i_disksize >= size) + return 0; + +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index 5e6b07b3496006..c566161127cd7a 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -225,7 +225,7 @@ static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to) + do { + if (bh_offset(bh) + blocksize <= from) + continue; +- if (bh_offset(bh) > to) ++ if (bh_offset(bh) >= to) + break; + wait_on_buffer(bh); + if (buffer_uptodate(bh)) +diff --git a/fs/ext4/orphan.c b/fs/ext4/orphan.c +index c53918768cb256..05997b4d012038 100644 +--- a/fs/ext4/orphan.c ++++ b/fs/ext4/orphan.c +@@ -513,7 +513,7 @@ void ext4_release_orphan_info(struct super_block *sb) + return; + for (i = 0; i < oi->of_blocks; i++) + brelse(oi->of_binfo[i].ob_bh); +- kfree(oi->of_binfo); ++ kvfree(oi->of_binfo); + } + + static struct ext4_orphan_block_tail *ext4_orphan_block_tail( +@@ -584,9 +584,20 @@ int ext4_init_orphan_info(struct super_block *sb) + ext4_msg(sb, KERN_ERR, "get orphan inode failed"); + return PTR_ERR(inode); + } ++ /* ++ * This is just an artificial limit to prevent corrupted fs from ++ * consuming absurd amounts of memory when pinning blocks of orphan ++ * file in memory. ++ */ ++ if (inode->i_size > 8 << 20) { ++ ext4_msg(sb, KERN_ERR, "orphan file too big: %llu", ++ (unsigned long long)inode->i_size); ++ ret = -EFSCORRUPTED; ++ goto out_put; ++ } + oi->of_blocks = inode->i_size >> sb->s_blocksize_bits; + oi->of_csum_seed = EXT4_I(inode)->i_csum_seed; +- oi->of_binfo = kmalloc_array(oi->of_blocks, ++ oi->of_binfo = kvmalloc_array(oi->of_blocks, + sizeof(struct ext4_orphan_block), + GFP_KERNEL); + if (!oi->of_binfo) { +@@ -627,7 +638,7 @@ int ext4_init_orphan_info(struct super_block *sb) + out_free: + for (i--; i >= 0; i--) + brelse(oi->of_binfo[i].ob_bh); +- kfree(oi->of_binfo); ++ kvfree(oi->of_binfo); + out_put: + iput(inode); + return ret; +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index ca22aa9e04b4b1..66933e55efb3bd 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -251,6 +251,10 @@ check_xattrs(struct inode *inode, struct buffer_head *bh, + err_str = "invalid ea_ino"; + goto errout; + } ++ if (ea_ino && !size) { ++ err_str = "invalid size in ea xattr"; ++ goto errout; ++ } + if (size > EXT4_XATTR_SIZE_MAX) { + err_str = "e_value size too large"; + goto errout; +@@ -1036,7 +1040,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, + int ref_change) + { + struct ext4_iloc iloc; +- s64 ref_count; ++ u64 ref_count; + int ret; + + inode_lock_nested(ea_inode, I_MUTEX_XATTR); +@@ -1046,13 +1050,17 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, + goto out; + + ref_count = ext4_xattr_inode_get_ref(ea_inode); ++ if ((ref_count == 0 && ref_change < 0) || (ref_count == U64_MAX && ref_change > 0)) { ++ ext4_error_inode(ea_inode, __func__, __LINE__, 0, ++ "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d", ++ ea_inode->i_ino, ref_count, ref_change); ++ ret = -EFSCORRUPTED; ++ goto out; ++ } + ref_count += ref_change; + ext4_xattr_inode_set_ref(ea_inode, ref_count); + + if (ref_change > 0) { +- WARN_ONCE(ref_count <= 0, "EA inode %lu ref_count=%lld", +- ea_inode->i_ino, ref_count); +- + if (ref_count == 1) { + WARN_ONCE(ea_inode->i_nlink, "EA inode %lu i_nlink=%u", + ea_inode->i_ino, ea_inode->i_nlink); +@@ -1061,9 +1069,6 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, + ext4_orphan_del(handle, ea_inode); + } + } else { +- WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld", +- ea_inode->i_ino, ref_count); +- + if (ref_count == 0) { + WARN_ONCE(ea_inode->i_nlink != 1, + "EA inode %lu i_nlink=%u", +diff --git a/fs/file.c b/fs/file.c +index 0ce6a6930276d3..9b76b9644ac275 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -1138,7 +1138,10 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags) + err = expand_files(files, fd); + if (unlikely(err < 0)) + goto out_unlock; +- return do_dup2(files, file, fd, flags); ++ err = do_dup2(files, file, fd, flags); ++ if (err < 0) ++ return err; ++ return 0; + + out_unlock: + spin_unlock(&files->file_lock); +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index ed110568d6127f..274fae88b498e4 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -422,22 +422,23 @@ static bool inode_do_switch_wbs(struct inode *inode, + * Transfer to @new_wb's IO list if necessary. If the @inode is dirty, + * the specific list @inode was on is ignored and the @inode is put on + * ->b_dirty which is always correct including from ->b_dirty_time. +- * The transfer preserves @inode->dirtied_when ordering. If the @inode +- * was clean, it means it was on the b_attached list, so move it onto +- * the b_attached list of @new_wb. ++ * If the @inode was clean, it means it was on the b_attached list, so ++ * move it onto the b_attached list of @new_wb. + */ + if (!list_empty(&inode->i_io_list)) { + inode->i_wb = new_wb; + + if (inode->i_state & I_DIRTY_ALL) { +- struct inode *pos; +- +- list_for_each_entry(pos, &new_wb->b_dirty, i_io_list) +- if (time_after_eq(inode->dirtied_when, +- pos->dirtied_when)) +- break; ++ /* ++ * We need to keep b_dirty list sorted by ++ * dirtied_time_when. However properly sorting the ++ * inode in the list gets too expensive when switching ++ * many inodes. So just attach inode at the end of the ++ * dirty list and clobber the dirtied_time_when. ++ */ ++ inode->dirtied_time_when = jiffies; + inode_io_list_move_locked(inode, new_wb, +- pos->i_io_list.prev); ++ &new_wb->b_dirty); + } else { + inode_cgwb_move_to_attached(inode, new_wb); + } +@@ -479,6 +480,7 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + */ + down_read(&bdi->wb_switch_rwsem); + ++ inodep = isw->inodes; + /* + * By the time control reaches here, RCU grace period has passed + * since I_WB_SWITCH assertion and all wb stat update transactions +@@ -489,6 +491,7 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + * gives us exclusion against all wb related operations on @inode + * including IO list manipulations and stat updates. + */ ++relock: + if (old_wb < new_wb) { + spin_lock(&old_wb->list_lock); + spin_lock_nested(&new_wb->list_lock, SINGLE_DEPTH_NESTING); +@@ -497,10 +500,17 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + spin_lock_nested(&old_wb->list_lock, SINGLE_DEPTH_NESTING); + } + +- for (inodep = isw->inodes; *inodep; inodep++) { ++ while (*inodep) { + WARN_ON_ONCE((*inodep)->i_wb != old_wb); + if (inode_do_switch_wbs(*inodep, old_wb, new_wb)) + nr_switched++; ++ inodep++; ++ if (*inodep && need_resched()) { ++ spin_unlock(&new_wb->list_lock); ++ spin_unlock(&old_wb->list_lock); ++ cond_resched(); ++ goto relock; ++ } + } + + spin_unlock(&new_wb->list_lock); +diff --git a/fs/fsopen.c b/fs/fsopen.c +index ce03f6521c8870..3576b1084ec2fb 100644 +--- a/fs/fsopen.c ++++ b/fs/fsopen.c +@@ -18,50 +18,56 @@ + #include "internal.h" + #include "mount.h" + ++static inline const char *fetch_message_locked(struct fc_log *log, size_t len, ++ bool *need_free) ++{ ++ const char *p; ++ int index; ++ ++ if (unlikely(log->head == log->tail)) ++ return ERR_PTR(-ENODATA); ++ ++ index = log->tail & (ARRAY_SIZE(log->buffer) - 1); ++ p = log->buffer[index]; ++ if (unlikely(strlen(p) > len)) ++ return ERR_PTR(-EMSGSIZE); ++ ++ log->buffer[index] = NULL; ++ *need_free = log->need_free & (1 << index); ++ log->need_free &= ~(1 << index); ++ log->tail++; ++ ++ return p; ++} ++ + /* + * Allow the user to read back any error, warning or informational messages. ++ * Only one message is returned for each read(2) call. + */ + static ssize_t fscontext_read(struct file *file, + char __user *_buf, size_t len, loff_t *pos) + { + struct fs_context *fc = file->private_data; +- struct fc_log *log = fc->log.log; +- unsigned int logsize = ARRAY_SIZE(log->buffer); +- ssize_t ret; +- char *p; ++ ssize_t err; ++ const char *p __free(kfree) = NULL, *message; + bool need_free; +- int index, n; ++ int n; + +- ret = mutex_lock_interruptible(&fc->uapi_mutex); +- if (ret < 0) +- return ret; +- +- if (log->head == log->tail) { +- mutex_unlock(&fc->uapi_mutex); +- return -ENODATA; +- } +- +- index = log->tail & (logsize - 1); +- p = log->buffer[index]; +- need_free = log->need_free & (1 << index); +- log->buffer[index] = NULL; +- log->need_free &= ~(1 << index); +- log->tail++; ++ err = mutex_lock_interruptible(&fc->uapi_mutex); ++ if (err < 0) ++ return err; ++ message = fetch_message_locked(fc->log.log, len, &need_free); + mutex_unlock(&fc->uapi_mutex); ++ if (IS_ERR(message)) ++ return PTR_ERR(message); + +- ret = -EMSGSIZE; +- n = strlen(p); +- if (n > len) +- goto err_free; +- ret = -EFAULT; +- if (copy_to_user(_buf, p, n) != 0) +- goto err_free; +- ret = n; +- +-err_free: + if (need_free) +- kfree(p); +- return ret; ++ p = message; ++ ++ n = strlen(message); ++ if (copy_to_user(_buf, message, n)) ++ return -EFAULT; ++ return n; + } + + static int fscontext_release(struct inode *inode, struct file *file) +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index df575473c1cc0b..ee8a6fe360e728 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -470,8 +470,14 @@ void minix_set_inode(struct inode *inode, dev_t rdev) + inode->i_op = &minix_symlink_inode_operations; + inode_nohighmem(inode); + inode->i_mapping->a_ops = &minix_aops; +- } else ++ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || ++ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { + init_special_inode(inode, inode->i_mode, rdev); ++ } else { ++ printk(KERN_DEBUG "MINIX-fs: Invalid file type 0%04o for inode %lu.\n", ++ inode->i_mode, inode->i_ino); ++ make_bad_inode(inode); ++ } + } + + /* +diff --git a/fs/namei.c b/fs/namei.c +index 155e4d09a5fb2c..02b0c273129824 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1364,6 +1364,10 @@ static int follow_automount(struct path *path, int *count, unsigned lookup_flags + dentry->d_inode) + return -EISDIR; + ++ /* No need to trigger automounts if mountpoint crossing is disabled. */ ++ if (lookup_flags & LOOKUP_NO_XDEV) ++ return -EXDEV; ++ + if (count && (*count)++ >= MAXSYMLINKS) + return -ELOOP; + +@@ -1387,6 +1391,10 @@ static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped, + /* Allow the filesystem to manage the transit without i_mutex + * being held. */ + if (flags & DCACHE_MANAGE_TRANSIT) { ++ if (lookup_flags & LOOKUP_NO_XDEV) { ++ ret = -EXDEV; ++ break; ++ } + ret = path->dentry->d_op->d_manage(path, false); + flags = smp_load_acquire(&path->dentry->d_flags); + if (ret < 0) +diff --git a/fs/namespace.c b/fs/namespace.c +index f79226472251ba..646d9e7d41ee8a 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -64,6 +64,15 @@ static int __init set_mphash_entries(char *str) + } + __setup("mphash_entries=", set_mphash_entries); + ++static char * __initdata initramfs_options; ++static int __init initramfs_options_setup(char *str) ++{ ++ initramfs_options = str; ++ return 1; ++} ++ ++__setup("initramfs_options=", initramfs_options_setup); ++ + static u64 event; + static DEFINE_IDA(mnt_id_ida); + static DEFINE_IDA(mnt_group_ida); +@@ -4728,7 +4737,7 @@ static void __init init_mount_tree(void) + struct mnt_namespace *ns; + struct path root; + +- mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", NULL); ++ mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", initramfs_options); + if (IS_ERR(mnt)) + panic("Can't create rootfs"); + +diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c +index 46a7f9b813e527..b02886f38925f8 100644 +--- a/fs/nfsd/lockd.c ++++ b/fs/nfsd/lockd.c +@@ -48,6 +48,21 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp, + switch (nfserr) { + case nfs_ok: + return 0; ++ case nfserr_jukebox: ++ /* this error can indicate a presence of a conflicting ++ * delegation to an NLM lock request. Options are: ++ * (1) For now, drop this request and make the client ++ * retry. When delegation is returned, client's lock retry ++ * will complete. ++ * (2) NLM4_DENIED as per "spec" signals to the client ++ * that the lock is unavailable now but client can retry. ++ * Linux client implementation does not. It treats ++ * NLM4_DENIED same as NLM4_FAILED and errors the request. ++ * (3) For the future, treat this as blocked lock and try ++ * to callback when the delegation is returned but might ++ * not have a proper lock request to block on. ++ */ ++ fallthrough; + case nfserr_dropit: + return nlm_drop_reply; + case nfserr_stale: +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index cd78b7ecbd4325..e9c1271b7ecc39 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1368,7 +1368,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, + return 0; + } + if (work) { +- strscpy(work->nsui_ipaddr, ipaddr, sizeof(work->nsui_ipaddr) - 1); ++ strscpy(work->nsui_ipaddr, ipaddr, sizeof(work->nsui_ipaddr)); + refcount_set(&work->nsui_refcnt, 2); + work->nsui_busy = true; + list_add_tail(&work->nsui_list, &nn->nfsd_ssc_mount_list); +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index cf4fe21a50399b..29b585f443f3eb 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -1399,6 +1399,7 @@ int wnd_extend(struct wnd_bitmap *wnd, size_t new_bits) + mark_buffer_dirty(bh); + unlock_buffer(bh); + /* err = sync_dirty_buffer(bh); */ ++ put_bh(bh); + + b0 = 0; + bits -= op; +diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c +index e62d9cc592e0c8..c80b291a14a576 100644 +--- a/fs/smb/client/smb1ops.c ++++ b/fs/smb/client/smb1ops.c +@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid, + } + + #ifdef CONFIG_CIFS_XATTR ++ /* ++ * For non-symlink WSL reparse points it is required to fetch ++ * EA $LXMOD which contains in its S_DT part the mandatory file type. ++ */ ++ if (!rc && data->reparse_point) { ++ struct smb2_file_full_ea_info *ea; ++ u32 next = 0; ++ ++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ ++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE, ++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], ++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb); ++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) { ++ ea->next_entry_offset = cpu_to_le32(0); ++ ea->flags = 0; ++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; ++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE); ++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1); ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); ++ rc = 0; ++ } else if (rc >= 0) { ++ /* It is an error if EA $LXMOD has wrong size. */ ++ rc = -EINVAL; ++ } else { ++ /* ++ * In all other cases ignore error if fetching ++ * of EA $LXMOD failed. It is needed only for ++ * non-symlink WSL reparse points and wsl_to_fattr() ++ * handle the case when EA is missing. ++ */ ++ rc = 0; ++ } ++ } ++ + /* + * For WSL CHR and BLK reparse points it is required to fetch + * EA $LXDEV which contains major and minor device numbers. + */ + if (!rc && data->reparse_point) { + struct smb2_file_full_ea_info *ea; ++ u32 next = 0; + + ea = (struct smb2_file_full_ea_info *)data->wsl.eas; ++ do { ++ ea = (void *)((u8 *)ea + next); ++ next = le32_to_cpu(ea->next_entry_offset); ++ } while (next); ++ if (le16_to_cpu(ea->ea_value_length)) { ++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) + ++ ea->ea_name_length + 1 + ++ le16_to_cpu(ea->ea_value_length), 4)); ++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset)); ++ } ++ + rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV, + &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1], + SMB2_WSL_XATTR_DEV_SIZE, cifs_sb); +@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid, + ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN; + ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE); + memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1); +- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + +- SMB2_WSL_XATTR_DEV_SIZE; ++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 + ++ SMB2_WSL_XATTR_MODE_SIZE, 4); + rc = 0; + } else if (rc >= 0) { + /* It is an error if EA $LXDEV has wrong size. */ +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 79641d1ee86757..232a3c28905568 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -1216,31 +1216,33 @@ int + smb2_set_file_info(struct inode *inode, const char *full_path, + FILE_BASIC_INFO *buf, const unsigned int xid) + { +- struct cifs_open_parms oparms; ++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); ++ struct cifsFileInfo *cfile = NULL; ++ struct cifs_open_parms oparms; + struct tcon_link *tlink; + struct cifs_tcon *tcon; +- struct cifsFileInfo *cfile; +- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), }; +- int rc; +- +- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && +- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) && +- (buf->Attributes == 0)) +- return 0; /* would be a no op, no sense sending this */ ++ int rc = 0; + + tlink = cifs_sb_tlink(cifs_sb); + if (IS_ERR(tlink)) + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && ++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) { ++ if (buf->Attributes == 0) ++ goto out; /* would be a no op, no sense sending this */ ++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); ++ } ++ + oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES, + FILE_OPEN, 0, ACL_NO_MODE); + rc = smb2_compound_op(xid, tcon, cifs_sb, + full_path, &oparms, &in_iov, + &(int){SMB2_OP_SET_INFO}, 1, + cfile, NULL, NULL, NULL); ++out: + cifs_put_tlink(tlink); + return rc; + } +diff --git a/fs/smb/server/ksmbd_netlink.h b/fs/smb/server/ksmbd_netlink.h +index f4e55199938d58..c6c1844d444822 100644 +--- a/fs/smb/server/ksmbd_netlink.h ++++ b/fs/smb/server/ksmbd_netlink.h +@@ -108,10 +108,11 @@ struct ksmbd_startup_request { + __u32 smb2_max_credits; /* MAX credits */ + __u32 smbd_max_io_size; /* smbd read write size */ + __u32 max_connections; /* Number of maximum simultaneous connections */ +- __u32 reserved[126]; /* Reserved room */ ++ __u32 max_ip_connections; /* Number of maximum connection per ip address */ ++ __u32 reserved[125]; /* Reserved room */ + __u32 ifc_list_sz; /* interfaces list size */ + __s8 ____payload[]; +-}; ++} __packed; + + #define KSMBD_STARTUP_CONFIG_INTERFACES(s) ((s)->____payload) + +diff --git a/fs/smb/server/server.h b/fs/smb/server/server.h +index 4d06f2eb0d6adb..d0744498ceed66 100644 +--- a/fs/smb/server/server.h ++++ b/fs/smb/server/server.h +@@ -43,6 +43,7 @@ struct ksmbd_server_config { + unsigned int auth_mechs; + unsigned int max_connections; + unsigned int max_inflight_req; ++ unsigned int max_ip_connections; + + char *conf[SERVER_CONF_WORK_GROUP + 1]; + }; +diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c +index 281101fd1f76f1..80581a7bc1bcc7 100644 +--- a/fs/smb/server/transport_ipc.c ++++ b/fs/smb/server/transport_ipc.c +@@ -321,6 +321,9 @@ static int ipc_server_config_on_startup(struct ksmbd_startup_request *req) + if (req->max_connections) + server_conf.max_connections = req->max_connections; + ++ if (req->max_ip_connections) ++ server_conf.max_ip_connections = req->max_ip_connections; ++ + ret = ksmbd_set_netbios_name(req->netbios_name); + ret |= ksmbd_set_server_string(req->server_string); + ret |= ksmbd_set_work_group(req->work_group); +diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c +index 53c536f2ce9f9c..c43a465114289b 100644 +--- a/fs/smb/server/transport_tcp.c ++++ b/fs/smb/server/transport_tcp.c +@@ -240,6 +240,7 @@ static int ksmbd_kthread_fn(void *p) + struct interface *iface = (struct interface *)p; + struct ksmbd_conn *conn; + int ret; ++ unsigned int max_ip_conns; + + while (!kthread_should_stop()) { + mutex_lock(&iface->sock_release_lock); +@@ -257,34 +258,39 @@ static int ksmbd_kthread_fn(void *p) + continue; + } + ++ if (!server_conf.max_ip_connections) ++ goto skip_max_ip_conns_limit; ++ + /* + * Limits repeated connections from clients with the same IP. + */ ++ max_ip_conns = 0; + down_read(&conn_list_lock); +- list_for_each_entry(conn, &conn_list, conns_list) ++ list_for_each_entry(conn, &conn_list, conns_list) { + #if IS_ENABLED(CONFIG_IPV6) + if (client_sk->sk->sk_family == AF_INET6) { + if (memcmp(&client_sk->sk->sk_v6_daddr, +- &conn->inet6_addr, 16) == 0) { +- ret = -EAGAIN; +- break; +- } ++ &conn->inet6_addr, 16) == 0) ++ max_ip_conns++; + } else if (inet_sk(client_sk->sk)->inet_daddr == +- conn->inet_addr) { +- ret = -EAGAIN; +- break; +- } ++ conn->inet_addr) ++ max_ip_conns++; + #else + if (inet_sk(client_sk->sk)->inet_daddr == +- conn->inet_addr) { ++ conn->inet_addr) ++ max_ip_conns++; ++#endif ++ if (server_conf.max_ip_connections <= max_ip_conns) { + ret = -EAGAIN; + break; + } +-#endif ++ } + up_read(&conn_list_lock); + if (ret == -EAGAIN) + continue; + ++skip_max_ip_conns_limit: ++ + if (server_conf.max_connections && + atomic_inc_return(&active_num_conn) >= server_conf.max_connections) { + pr_info_ratelimited("Limit the maximum number of connections(%u)\n", +diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c +index 53104f25de5116..f5dcb8353f862f 100644 +--- a/fs/squashfs/inode.c ++++ b/fs/squashfs/inode.c +@@ -140,8 +140,17 @@ int squashfs_read_inode(struct inode *inode, long long ino) + if (err < 0) + goto failed_read; + ++ inode->i_size = le32_to_cpu(sqsh_ino->file_size); + frag = le32_to_cpu(sqsh_ino->fragment); + if (frag != SQUASHFS_INVALID_FRAG) { ++ /* ++ * the file cannot have a fragment (tailend) and have a ++ * file size a multiple of the block size ++ */ ++ if ((inode->i_size & (msblk->block_size - 1)) == 0) { ++ err = -EINVAL; ++ goto failed_read; ++ } + frag_offset = le32_to_cpu(sqsh_ino->offset); + frag_size = squashfs_frag_lookup(sb, frag, &frag_blk); + if (frag_size < 0) { +@@ -155,7 +164,6 @@ int squashfs_read_inode(struct inode *inode, long long ino) + } + + set_nlink(inode, 1); +- inode->i_size = le32_to_cpu(sqsh_ino->file_size); + inode->i_fop = &generic_ro_fops; + inode->i_mode |= S_IFREG; + inode->i_blocks = ((inode->i_size - 1) >> 9) + 1; +@@ -184,8 +192,21 @@ int squashfs_read_inode(struct inode *inode, long long ino) + if (err < 0) + goto failed_read; + ++ inode->i_size = le64_to_cpu(sqsh_ino->file_size); ++ if (inode->i_size < 0) { ++ err = -EINVAL; ++ goto failed_read; ++ } + frag = le32_to_cpu(sqsh_ino->fragment); + if (frag != SQUASHFS_INVALID_FRAG) { ++ /* ++ * the file cannot have a fragment (tailend) and have a ++ * file size a multiple of the block size ++ */ ++ if ((inode->i_size & (msblk->block_size - 1)) == 0) { ++ err = -EINVAL; ++ goto failed_read; ++ } + frag_offset = le32_to_cpu(sqsh_ino->offset); + frag_size = squashfs_frag_lookup(sb, frag, &frag_blk); + if (frag_size < 0) { +@@ -200,7 +221,6 @@ int squashfs_read_inode(struct inode *inode, long long ino) + + xattr_id = le32_to_cpu(sqsh_ino->xattr); + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); +- inode->i_size = le64_to_cpu(sqsh_ino->file_size); + inode->i_op = &squashfs_inode_ops; + inode->i_fop = &generic_ro_fops; + inode->i_mode |= S_IFREG; +diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h +index 7e9e7e76904369..2b5891515f3d82 100644 +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -213,6 +213,12 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_osi_data, 0); + */ + ACPI_INIT_GLOBAL(u8, acpi_gbl_reduced_hardware, FALSE); + ++/* ++ * ACPI Global Lock is mainly used for systems with SMM, so no-SMM systems ++ * (such as loong_arch) may not have and not use Global Lock. ++ */ ++ACPI_INIT_GLOBAL(u8, acpi_gbl_use_global_lock, TRUE); ++ + /* + * Maximum timeout for While() loop iterations before forced method abort. + * This mechanism is intended to prevent infinite loops during interpreter +diff --git a/include/asm-generic/io.h b/include/asm-generic/io.h +index bac63e874c7bf9..52db695436bb0b 100644 +--- a/include/asm-generic/io.h ++++ b/include/asm-generic/io.h +@@ -74,6 +74,7 @@ + #if IS_ENABLED(CONFIG_TRACE_MMIO_ACCESS) && !(defined(__DISABLE_TRACE_MMIO__)) + #include + ++#define rwmmio_tracepoint_enabled(tracepoint) tracepoint_enabled(tracepoint) + DECLARE_TRACEPOINT(rwmmio_write); + DECLARE_TRACEPOINT(rwmmio_post_write); + DECLARE_TRACEPOINT(rwmmio_read); +@@ -90,6 +91,7 @@ void log_post_read_mmio(u64 val, u8 width, const volatile void __iomem *addr, + + #else + ++#define rwmmio_tracepoint_enabled(tracepoint) false + static inline void log_write_mmio(u64 val, u8 width, volatile void __iomem *addr, + unsigned long caller_addr, unsigned long caller_addr0) {} + static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr, +@@ -188,11 +190,13 @@ static inline u8 readb(const volatile void __iomem *addr) + { + u8 val; + +- log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __raw_readb(addr); + __io_ar(val); +- log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -203,11 +207,13 @@ static inline u16 readw(const volatile void __iomem *addr) + { + u16 val; + +- log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __le16_to_cpu((__le16 __force)__raw_readw(addr)); + __io_ar(val); +- log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -218,11 +224,13 @@ static inline u32 readl(const volatile void __iomem *addr) + { + u32 val; + +- log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __le32_to_cpu((__le32 __force)__raw_readl(addr)); + __io_ar(val); +- log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -234,11 +242,13 @@ static inline u64 readq(const volatile void __iomem *addr) + { + u64 val; + +- log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); + __io_ar(val); +- log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -248,11 +258,13 @@ static inline u64 readq(const volatile void __iomem *addr) + #define writeb writeb + static inline void writeb(u8 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writeb(value, addr); + __io_aw(); +- log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -260,11 +272,13 @@ static inline void writeb(u8 value, volatile void __iomem *addr) + #define writew writew + static inline void writew(u16 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writew((u16 __force)cpu_to_le16(value), addr); + __io_aw(); +- log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -272,11 +286,13 @@ static inline void writew(u16 value, volatile void __iomem *addr) + #define writel writel + static inline void writel(u32 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writel((u32 __force)__cpu_to_le32(value), addr); + __io_aw(); +- log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -285,11 +301,13 @@ static inline void writel(u32 value, volatile void __iomem *addr) + #define writeq writeq + static inline void writeq(u64 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writeq((u64 __force)__cpu_to_le64(value), addr); + __io_aw(); +- log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + } + #endif + #endif /* CONFIG_64BIT */ +@@ -305,9 +323,11 @@ static inline u8 readb_relaxed(const volatile void __iomem *addr) + { + u8 val; + +- log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); + val = __raw_readb(addr); +- log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -318,9 +338,11 @@ static inline u16 readw_relaxed(const volatile void __iomem *addr) + { + u16 val; + +- log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); + val = __le16_to_cpu((__le16 __force)__raw_readw(addr)); +- log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -331,9 +353,11 @@ static inline u32 readl_relaxed(const volatile void __iomem *addr) + { + u32 val; + +- log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); + val = __le32_to_cpu((__le32 __force)__raw_readl(addr)); +- log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -344,9 +368,11 @@ static inline u64 readq_relaxed(const volatile void __iomem *addr) + { + u64 val; + +- log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); + val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); +- log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -355,9 +381,11 @@ static inline u64 readq_relaxed(const volatile void __iomem *addr) + #define writeb_relaxed writeb_relaxed + static inline void writeb_relaxed(u8 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + __raw_writeb(value, addr); +- log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -365,9 +393,11 @@ static inline void writeb_relaxed(u8 value, volatile void __iomem *addr) + #define writew_relaxed writew_relaxed + static inline void writew_relaxed(u16 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + __raw_writew((u16 __force)cpu_to_le16(value), addr); +- log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -375,9 +405,11 @@ static inline void writew_relaxed(u16 value, volatile void __iomem *addr) + #define writel_relaxed writel_relaxed + static inline void writel_relaxed(u32 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + __raw_writel((u32 __force)__cpu_to_le32(value), addr); +- log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -385,9 +417,11 @@ static inline void writel_relaxed(u32 value, volatile void __iomem *addr) + #define writeq_relaxed writeq_relaxed + static inline void writeq_relaxed(u64 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + __raw_writeq((u64 __force)__cpu_to_le64(value), addr); +- log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + } + #endif + +diff --git a/include/linux/iio/frequency/adf4350.h b/include/linux/iio/frequency/adf4350.h +index de45cf2ee1e4f8..ce2086f97e3fcf 100644 +--- a/include/linux/iio/frequency/adf4350.h ++++ b/include/linux/iio/frequency/adf4350.h +@@ -51,7 +51,7 @@ + + /* REG3 Bit Definitions */ + #define ADF4350_REG3_12BIT_CLKDIV(x) ((x) << 3) +-#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 16) ++#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 15) + #define ADF4350_REG3_12BIT_CSR_EN (1 << 18) + #define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21) + #define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22) +diff --git a/include/linux/ksm.h b/include/linux/ksm.h +index b9cdeba03668ae..f74c5222484017 100644 +--- a/include/linux/ksm.h ++++ b/include/linux/ksm.h +@@ -59,6 +59,12 @@ static inline int ksm_fork(struct mm_struct *mm, struct mm_struct *oldmm) + int ret; + + if (test_bit(MMF_VM_MERGEABLE, &oldmm->flags)) { ++ long nr_ksm_zero_pages = atomic_long_read(&mm->ksm_zero_pages); ++ ++ mm->ksm_merging_pages = 0; ++ mm->ksm_rmap_items = 0; ++ atomic_long_add(nr_ksm_zero_pages, &ksm_zero_pages); ++ + ret = __ksm_enter(mm); + if (ret) + return ret; +diff --git a/include/linux/sched.h b/include/linux/sched.h +index cb38eee732fd02..9559501236af08 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -2343,6 +2343,12 @@ enum rseq_event_mask { + RSEQ_EVENT_MIGRATE = (1U << RSEQ_EVENT_MIGRATE_BIT), + }; + ++#ifdef CONFIG_MEMBARRIER ++# define RSEQ_EVENT_GUARD irq ++#else ++# define RSEQ_EVENT_GUARD preempt ++#endif ++ + static inline void rseq_set_notify_resume(struct task_struct *t) + { + if (t->rseq) +@@ -2361,9 +2367,8 @@ static inline void rseq_handle_notify_resume(struct ksignal *ksig, + static inline void rseq_signal_deliver(struct ksignal *ksig, + struct pt_regs *regs) + { +- preempt_disable(); +- __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask); +- preempt_enable(); ++ scoped_guard(RSEQ_EVENT_GUARD) ++ __set_bit(RSEQ_EVENT_SIGNAL_BIT, ¤t->rseq_event_mask); + rseq_handle_notify_resume(ksig, regs); + } + +diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h +index 0740dfc6c04881..61a497ec5a2a96 100644 +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -1881,19 +1881,23 @@ extern const struct v4l2_subdev_ops v4l2_subdev_call_wrappers; + * + * Note: only legacy non-MC drivers may need this macro. + */ +-#define v4l2_subdev_call_state_try(sd, o, f, args...) \ +- ({ \ +- int __result; \ +- static struct lock_class_key __key; \ +- const char *name = KBUILD_BASENAME \ +- ":" __stringify(__LINE__) ":state->lock"; \ +- struct v4l2_subdev_state *state = \ +- __v4l2_subdev_state_alloc(sd, name, &__key); \ +- v4l2_subdev_lock_state(state); \ +- __result = v4l2_subdev_call(sd, o, f, state, ##args); \ +- v4l2_subdev_unlock_state(state); \ +- __v4l2_subdev_state_free(state); \ +- __result; \ ++#define v4l2_subdev_call_state_try(sd, o, f, args...) \ ++ ({ \ ++ int __result; \ ++ static struct lock_class_key __key; \ ++ const char *name = KBUILD_BASENAME \ ++ ":" __stringify(__LINE__) ":state->lock"; \ ++ struct v4l2_subdev_state *state = \ ++ __v4l2_subdev_state_alloc(sd, name, &__key); \ ++ if (IS_ERR(state)) { \ ++ __result = PTR_ERR(state); \ ++ } else { \ ++ v4l2_subdev_lock_state(state); \ ++ __result = v4l2_subdev_call(sd, o, f, state, ##args); \ ++ v4l2_subdev_unlock_state(state); \ ++ __v4l2_subdev_state_free(state); \ ++ } \ ++ __result; \ + }) + + /** +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index c0f4b91e4f5ece..32606d54306057 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -955,8 +955,7 @@ struct nft_expr_ops { + const struct nft_expr *expr, + bool reset); + int (*validate)(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data); ++ const struct nft_expr *expr); + bool (*reduce)(struct nft_regs_track *track, + const struct nft_expr *expr); + bool (*gc)(struct net *net, +diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h +index 167640b843ef8a..38cae7113de462 100644 +--- a/include/net/netfilter/nft_fib.h ++++ b/include/net/netfilter/nft_fib.h +@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in) + int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset); + int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + const struct nlattr * const tb[]); +-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data); +- ++int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr); + + void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs, + const struct nft_pktinfo *pkt); +diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h +index ba1238f12a487a..d602263590fed5 100644 +--- a/include/net/netfilter/nft_meta.h ++++ b/include/net/netfilter/nft_meta.h +@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct nft_ctx *ctx, + const struct nft_expr *expr); + + int nft_meta_set_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data); ++ const struct nft_expr *expr); + + bool nft_meta_get_reduce(struct nft_regs_track *track, + const struct nft_expr *expr); +diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h +index 6d9ba62efd7504..19060212988a1e 100644 +--- a/include/net/netfilter/nft_reject.h ++++ b/include/net/netfilter/nft_reject.h +@@ -15,8 +15,7 @@ struct nft_reject { + extern const struct nla_policy nft_reject_policy[]; + + int nft_reject_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data); ++ const struct nft_expr *expr); + + int nft_reject_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, +diff --git a/init/main.c b/init/main.c +index c787e94cc8982b..20d2dd4d9b40f0 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -530,6 +530,12 @@ static int __init unknown_bootoption(char *param, char *val, + const char *unused, void *arg) + { + size_t len = strlen(param); ++ /* ++ * Well-known bootloader identifiers: ++ * 1. LILO/Grub pass "BOOT_IMAGE=..."; ++ * 2. kexec/kdump (kexec-tools) pass "kexec". ++ */ ++ const char *bootloader[] = { "BOOT_IMAGE=", "kexec", NULL }; + + /* Handle params aliased to sysctls */ + if (sysctl_is_alias(param)) +@@ -537,6 +543,12 @@ static int __init unknown_bootoption(char *param, char *val, + + repair_env_string(param, val); + ++ /* Handle bootloader identifier */ ++ for (int i = 0; bootloader[i]; i++) { ++ if (strstarts(param, bootloader[i])) ++ return 0; ++ } ++ + /* Handle obsolete-style parameters */ + if (obsolete_checksetup(param)) + return 0; +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index 99d0625b6c828f..9a9630adcba4f6 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + +-static void bpf_free_inode(struct inode *inode) ++static void bpf_destroy_inode(struct inode *inode) + { + enum bpf_type type; + +@@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { + .statfs = simple_statfs, + .drop_inode = generic_delete_inode, + .show_options = bpf_show_options, +- .free_inode = bpf_free_inode, ++ .destroy_inode = bpf_destroy_inode, + }; + + enum { +diff --git a/kernel/fork.c b/kernel/fork.c +index 0e20d7e9460848..2141ebb2ef92ad 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1799,7 +1799,7 @@ static int copy_files(unsigned long clone_flags, struct task_struct *tsk, + return 0; + } + +-static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) ++static int copy_sighand(u64 clone_flags, struct task_struct *tsk) + { + struct sighand_struct *sig; + +diff --git a/kernel/pid.c b/kernel/pid.c +index 6500ef956f2f88..e57adc00cb779b 100644 +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -477,7 +477,7 @@ pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns) + struct upid *upid; + pid_t nr = 0; + +- if (pid && ns->level <= pid->level) { ++ if (pid && ns && ns->level <= pid->level) { + upid = &pid->numbers[ns->level]; + if (upid->ns == ns) + nr = upid->nr; +diff --git a/kernel/rseq.c b/kernel/rseq.c +index 23894ba8250cf9..810005f927d7cc 100644 +--- a/kernel/rseq.c ++++ b/kernel/rseq.c +@@ -255,12 +255,12 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) + + /* + * Load and clear event mask atomically with respect to +- * scheduler preemption. ++ * scheduler preemption and membarrier IPIs. + */ +- preempt_disable(); +- event_mask = t->rseq_event_mask; +- t->rseq_event_mask = 0; +- preempt_enable(); ++ scoped_guard(RSEQ_EVENT_GUARD) { ++ event_mask = t->rseq_event_mask; ++ t->rseq_event_mask = 0; ++ } + + return !!event_mask; + } +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index a15cf7969953a5..5bb9735e19d2f5 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2214,6 +2214,25 @@ static int find_later_rq(struct task_struct *task) + return -1; + } + ++static struct task_struct *pick_next_pushable_dl_task(struct rq *rq) ++{ ++ struct task_struct *p; ++ ++ if (!has_pushable_dl_tasks(rq)) ++ return NULL; ++ ++ p = __node_2_pdl(rb_first_cached(&rq->dl.pushable_dl_tasks_root)); ++ ++ WARN_ON_ONCE(rq->cpu != task_cpu(p)); ++ WARN_ON_ONCE(task_current(rq, p)); ++ WARN_ON_ONCE(p->nr_cpus_allowed <= 1); ++ ++ WARN_ON_ONCE(!task_on_rq_queued(p)); ++ WARN_ON_ONCE(!dl_task(p)); ++ ++ return p; ++} ++ + /* Locks the rq it finds */ + static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) + { +@@ -2241,12 +2260,37 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) + + /* Retry if something changed. */ + if (double_lock_balance(rq, later_rq)) { +- if (unlikely(task_rq(task) != rq || ++ /* ++ * double_lock_balance had to release rq->lock, in the ++ * meantime, task may no longer be fit to be migrated. ++ * Check the following to ensure that the task is ++ * still suitable for migration: ++ * 1. It is possible the task was scheduled, ++ * migrate_disabled was set and then got preempted, ++ * so we must check the task migration disable ++ * flag. ++ * 2. The CPU picked is in the task's affinity. ++ * 3. For throttled task (dl_task_offline_migration), ++ * check the following: ++ * - the task is not on the rq anymore (it was ++ * migrated) ++ * - the task is not on CPU anymore ++ * - the task is still a dl task ++ * - the task is not queued on the rq anymore ++ * 4. For the non-throttled task (push_dl_task), the ++ * check to ensure that this task is still at the ++ * head of the pushable tasks list is enough. ++ */ ++ if (unlikely(is_migration_disabled(task) || + !cpumask_test_cpu(later_rq->cpu, &task->cpus_mask) || +- task_on_cpu(rq, task) || +- !dl_task(task) || +- is_migration_disabled(task) || +- !task_on_rq_queued(task))) { ++ (task->dl.dl_throttled && ++ (task_rq(task) != rq || ++ task_on_cpu(rq, task) || ++ !dl_task(task) || ++ !task_on_rq_queued(task))) || ++ (!task->dl.dl_throttled && ++ task != pick_next_pushable_dl_task(rq)))) { ++ + double_unlock_balance(rq, later_rq); + later_rq = NULL; + break; +@@ -2269,25 +2313,6 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq) + return later_rq; + } + +-static struct task_struct *pick_next_pushable_dl_task(struct rq *rq) +-{ +- struct task_struct *p; +- +- if (!has_pushable_dl_tasks(rq)) +- return NULL; +- +- p = __node_2_pdl(rb_first_cached(&rq->dl.pushable_dl_tasks_root)); +- +- WARN_ON_ONCE(rq->cpu != task_cpu(p)); +- WARN_ON_ONCE(task_current(rq, p)); +- WARN_ON_ONCE(p->nr_cpus_allowed <= 1); +- +- WARN_ON_ONCE(!task_on_rq_queued(p)); +- WARN_ON_ONCE(!dl_task(p)); +- +- return p; +-} +- + /* + * See if the non running -deadline tasks on this rq + * can be sent to some other CPU where they can preempt +diff --git a/kernel/sys.c b/kernel/sys.c +index 355de0b65c2358..47cb10a16b009d 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1689,6 +1689,7 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, unsigned int, resource, + struct rlimit old, new; + struct task_struct *tsk; + unsigned int checkflags = 0; ++ bool need_tasklist; + int ret; + + if (old_rlim) +@@ -1715,8 +1716,25 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, unsigned int, resource, + get_task_struct(tsk); + rcu_read_unlock(); + +- ret = do_prlimit(tsk, resource, new_rlim ? &new : NULL, +- old_rlim ? &old : NULL); ++ need_tasklist = !same_thread_group(tsk, current); ++ if (need_tasklist) { ++ /* ++ * Ensure we can't race with group exit or de_thread(), ++ * so tsk->group_leader can't be freed or changed until ++ * read_unlock(tasklist_lock) below. ++ */ ++ read_lock(&tasklist_lock); ++ if (!pid_alive(tsk)) ++ ret = -ESRCH; ++ } ++ ++ if (!ret) { ++ ret = do_prlimit(tsk, resource, new_rlim ? &new : NULL, ++ old_rlim ? &old : NULL); ++ } ++ ++ if (need_tasklist) ++ read_unlock(&tasklist_lock); + + if (!ret && old_rlim) { + rlim_to_rlim64(&old, &old64); +diff --git a/kernel/trace/trace_fprobe.c b/kernel/trace/trace_fprobe.c +index 93620a78358769..a233262f858c86 100644 +--- a/kernel/trace/trace_fprobe.c ++++ b/kernel/trace/trace_fprobe.c +@@ -342,12 +342,14 @@ static int fentry_dispatcher(struct fprobe *fp, unsigned long entry_ip, + void *entry_data) + { + struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); ++ unsigned int flags = trace_probe_load_flag(&tf->tp); + int ret = 0; + +- if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE)) ++ if (flags & TP_FLAG_TRACE) + fentry_trace_func(tf, entry_ip, regs); ++ + #ifdef CONFIG_PERF_EVENTS +- if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE)) ++ if (flags & TP_FLAG_PROFILE) + ret = fentry_perf_func(tf, entry_ip, regs); + #endif + return ret; +@@ -359,11 +361,12 @@ static void fexit_dispatcher(struct fprobe *fp, unsigned long entry_ip, + void *entry_data) + { + struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp); ++ unsigned int flags = trace_probe_load_flag(&tf->tp); + +- if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE)) ++ if (flags & TP_FLAG_TRACE) + fexit_trace_func(tf, entry_ip, ret_ip, regs, entry_data); + #ifdef CONFIG_PERF_EVENTS +- if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE)) ++ if (flags & TP_FLAG_PROFILE) + fexit_perf_func(tf, entry_ip, ret_ip, regs, entry_data); + #endif + } +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 46491f3c1569cd..20dbe40ab15e8e 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -1713,14 +1713,15 @@ static int kprobe_register(struct trace_event_call *event, + static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs) + { + struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp); ++ unsigned int flags = trace_probe_load_flag(&tk->tp); + int ret = 0; + + raw_cpu_inc(*tk->nhit); + +- if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) ++ if (flags & TP_FLAG_TRACE) + kprobe_trace_func(tk, regs); + #ifdef CONFIG_PERF_EVENTS +- if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) ++ if (flags & TP_FLAG_PROFILE) + ret = kprobe_perf_func(tk, regs); + #endif + return ret; +@@ -1732,6 +1733,7 @@ kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) + { + struct kretprobe *rp = get_kretprobe(ri); + struct trace_kprobe *tk; ++ unsigned int flags; + + /* + * There is a small chance that get_kretprobe(ri) returns NULL when +@@ -1744,10 +1746,11 @@ kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs) + tk = container_of(rp, struct trace_kprobe, rp); + raw_cpu_inc(*tk->nhit); + +- if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE)) ++ flags = trace_probe_load_flag(&tk->tp); ++ if (flags & TP_FLAG_TRACE) + kretprobe_trace_func(tk, ri, regs); + #ifdef CONFIG_PERF_EVENTS +- if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE)) ++ if (flags & TP_FLAG_PROFILE) + kretprobe_perf_func(tk, ri, regs); + #endif + return 0; /* We don't tweak kernel, so just return 0 */ +diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h +index 48afed3c3f88ec..c71fa9c2f3815b 100644 +--- a/kernel/trace/trace_probe.h ++++ b/kernel/trace/trace_probe.h +@@ -268,16 +268,21 @@ struct event_file_link { + struct list_head list; + }; + ++static inline unsigned int trace_probe_load_flag(struct trace_probe *tp) ++{ ++ return smp_load_acquire(&tp->event->flags); ++} ++ + static inline bool trace_probe_test_flag(struct trace_probe *tp, + unsigned int flag) + { +- return !!(tp->event->flags & flag); ++ return !!(trace_probe_load_flag(tp) & flag); + } + + static inline void trace_probe_set_flag(struct trace_probe *tp, + unsigned int flag) + { +- tp->event->flags |= flag; ++ smp_store_release(&tp->event->flags, tp->event->flags | flag); + } + + static inline void trace_probe_clear_flag(struct trace_probe *tp, +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index ecf04e81ddf705..03d79a9ebd8c82 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -1514,6 +1514,7 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) + struct trace_uprobe *tu; + struct uprobe_dispatch_data udd; + struct uprobe_cpu_buffer *ucb = NULL; ++ unsigned int flags; + int ret = 0; + + tu = container_of(con, struct trace_uprobe, consumer); +@@ -1527,11 +1528,12 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) + if (WARN_ON_ONCE(!uprobe_cpu_buffer)) + return 0; + +- if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE)) ++ flags = trace_probe_load_flag(&tu->tp); ++ if (flags & TP_FLAG_TRACE) + ret |= uprobe_trace_func(tu, regs, &ucb); + + #ifdef CONFIG_PERF_EVENTS +- if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE)) ++ if (flags & TP_FLAG_PROFILE) + ret |= uprobe_perf_func(tu, regs, &ucb); + #endif + uprobe_buffer_put(ucb); +@@ -1544,6 +1546,7 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, + struct trace_uprobe *tu; + struct uprobe_dispatch_data udd; + struct uprobe_cpu_buffer *ucb = NULL; ++ unsigned int flags; + + tu = container_of(con, struct trace_uprobe, consumer); + +@@ -1555,11 +1558,12 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, + if (WARN_ON_ONCE(!uprobe_cpu_buffer)) + return 0; + +- if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE)) ++ flags = trace_probe_load_flag(&tu->tp); ++ if (flags & TP_FLAG_TRACE) + uretprobe_trace_func(tu, func, regs, &ucb); + + #ifdef CONFIG_PERF_EVENTS +- if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE)) ++ if (flags & TP_FLAG_PROFILE) + uretprobe_perf_func(tu, func, regs, &ucb); + #endif + uprobe_buffer_put(ucb); +diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile +index 8d1446c2be7193..88246000c9d8eb 100644 +--- a/lib/crypto/Makefile ++++ b/lib/crypto/Makefile +@@ -30,6 +30,10 @@ obj-$(CONFIG_CRYPTO_LIB_CURVE25519_GENERIC) += libcurve25519-generic.o + libcurve25519-generic-y := curve25519-fiat32.o + libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o + libcurve25519-generic-y += curve25519-generic.o ++# clang versions prior to 18 may blow out the stack with KASAN ++ifeq ($(call clang-min-version, 180000),) ++KASAN_SANITIZE_curve25519-hacl64.o := n ++endif + + obj-$(CONFIG_CRYPTO_LIB_CURVE25519) += libcurve25519.o + libcurve25519-y += curve25519.o +diff --git a/lib/genalloc.c b/lib/genalloc.c +index 4fa5635bf81bd6..841f2978383334 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -899,8 +899,11 @@ struct gen_pool *of_gen_pool_get(struct device_node *np, + if (!name) + name = of_node_full_name(np_pool); + } +- if (pdev) ++ if (pdev) { + pool = gen_pool_get(&pdev->dev, name); ++ put_device(&pdev->dev); ++ } ++ + of_node_put(np_pool); + + return pool; +diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c +index 5764b9885e7d21..4d7dc9f65f682e 100644 +--- a/mm/damon/vaddr.c ++++ b/mm/damon/vaddr.c +@@ -324,10 +324,8 @@ static int damon_mkold_pmd_entry(pmd_t *pmd, unsigned long addr, + } + + pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); +- if (!pte) { +- walk->action = ACTION_AGAIN; ++ if (!pte) + return 0; +- } + if (!pte_present(ptep_get(pte))) + goto out; + damon_ptep_mkold(pte, walk->vma, addr); +@@ -479,10 +477,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr, + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + + pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); +- if (!pte) { +- walk->action = ACTION_AGAIN; ++ if (!pte) + return 0; +- } + ptent = ptep_get(pte); + if (!pte_present(ptent)) + goto out; +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 0c6745a6a13a59..532a840a426646 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3298,6 +3298,9 @@ static void __init hugetlb_hstate_alloc_pages(struct hstate *h) + return; + } + ++ if (!h->max_huge_pages) ++ return; ++ + /* do node specific alloc */ + for_each_online_node(i) { + if (h->max_huge_pages_node[i] > 0) { +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 44011ebecddf01..93cb65c6553ec3 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3738,7 +3738,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask, unsigned int order) + if (!(gfp_mask & __GFP_NOMEMALLOC)) { + alloc_flags |= ALLOC_NON_BLOCK; + +- if (order > 0) ++ if (order > 0 && (alloc_flags & ALLOC_MIN_RESERVE)) + alloc_flags |= ALLOC_HIGHATOMIC; + } + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index a1c22eab71ffec..cc54b8267bcc7b 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br, + if (!br_opt_get(br, BROPT_VLAN_ENABLED)) + return; + +- vg = br_vlan_group(br); ++ vg = br_vlan_group_rcu(br); + + if (idx >= 0 && + ctx->vlan[idx].proto == br->vlan_proto) { +diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c +index bd4d1b4d745f64..affb740c8685eb 100644 +--- a/net/bridge/netfilter/nft_meta_bridge.c ++++ b/net/bridge/netfilter/nft_meta_bridge.c +@@ -168,8 +168,7 @@ static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track, + } + + static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct nft_meta *priv = nft_expr_priv(expr); + unsigned int hooks; +@@ -179,7 +178,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx, + hooks = 1 << NF_BR_PRE_ROUTING; + break; + default: +- return nft_meta_set_validate(ctx, expr, data); ++ return nft_meta_set_validate(ctx, expr); + } + + return nft_chain_validate_hooks(ctx->chain, hooks); +diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c +index 71b54fed7263df..1cb5c16e97b7fa 100644 +--- a/net/bridge/netfilter/nft_reject_bridge.c ++++ b/net/bridge/netfilter/nft_reject_bridge.c +@@ -170,8 +170,7 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, + } + + static int nft_reject_bridge_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) | + (1 << NF_BR_LOCAL_IN)); +diff --git a/net/core/filter.c b/net/core/filter.c +index b6dbcef649654c..c2e888ea54abbf 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2273,6 +2273,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + goto out_drop; + ++ skb_dst_drop(skb); + skb_dst_set(skb, dst); + } else if (nh->nh_family != AF_INET6) { + goto out_drop; +@@ -2382,6 +2383,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, + goto out_drop; + } + ++ skb_dst_drop(skb); + skb_dst_set(skb, &rt->dst); + } + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 7d824578f217a8..5dde0aed314405 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1724,6 +1724,7 @@ EXPORT_SYMBOL(tcp_peek_len); + /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */ + int tcp_set_rcvlowat(struct sock *sk, int val) + { ++ struct tcp_sock *tp = tcp_sk(sk); + int space, cap; + + if (sk->sk_userlocks & SOCK_RCVBUF_LOCK) +@@ -1742,7 +1743,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val) + space = tcp_space_from_win(sk, val); + if (space > sk->sk_rcvbuf) { + WRITE_ONCE(sk->sk_rcvbuf, space); +- WRITE_ONCE(tcp_sk(sk)->window_clamp, val); ++ ++ if (tp->window_clamp && tp->window_clamp < val) ++ WRITE_ONCE(tp->window_clamp, val); + } + return 0; + } +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index c6d00817ad3fd9..8834cd41b38408 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -7200,7 +7200,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, + &foc, TCP_SYNACK_FASTOPEN, skb); + /* Add the child socket directly into the accept queue */ + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { +- reqsk_fastopen_remove(fastopen_sk, req, false); + bh_unlock_sock(fastopen_sk); + sock_put(fastopen_sk); + goto drop_and_free; +diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c +index 29c167e5fc0255..ab7bdb6531816d 100644 +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -227,9 +227,12 @@ void mptcp_pm_add_addr_received(const struct sock *ssk, + } else { + __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP); + } +- /* id0 should not have a different address */ ++ /* - id0 should not have a different address ++ * - special case for C-flag: linked to fill_local_addresses_vec() ++ */ + } else if ((addr->id == 0 && !mptcp_pm_nl_is_init_remote_addr(msk, addr)) || +- (addr->id > 0 && !READ_ONCE(pm->accept_addr))) { ++ (addr->id > 0 && !READ_ONCE(pm->accept_addr) && ++ !mptcp_pm_add_addr_c_flag_case(msk))) { + mptcp_pm_announce_addr(msk, addr, true); + mptcp_pm_add_addr_send_ack(msk); + } else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) { +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index de24989b05a600..9d2c38421f7a2b 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -675,10 +675,12 @@ static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk, + struct mptcp_addr_info mpc_addr; + struct pm_nl_pernet *pernet; + unsigned int subflows_max; ++ bool c_flag_case; + int i = 0; + + pernet = pm_nl_get_pernet_from_msk(msk); + subflows_max = mptcp_pm_get_subflows_max(msk); ++ c_flag_case = remote->id && mptcp_pm_add_addr_c_flag_case(msk); + + mptcp_local_address((struct sock_common *)msk, &mpc_addr); + +@@ -691,11 +693,26 @@ static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk, + continue; + + if (msk->pm.subflows < subflows_max) { ++ bool is_id0; ++ + msk->pm.subflows++; + addrs[i] = entry->addr; + ++ is_id0 = mptcp_addresses_equal(&entry->addr, ++ &mpc_addr, ++ entry->addr.port); ++ ++ if (c_flag_case && ++ (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)) { ++ __clear_bit(addrs[i].id, ++ msk->pm.id_avail_bitmap); ++ ++ if (!is_id0) ++ msk->pm.local_addr_used++; ++ } ++ + /* Special case for ID0: set the correct ID */ +- if (mptcp_addresses_equal(&entry->addr, &mpc_addr, entry->addr.port)) ++ if (is_id0) + addrs[i].id = 0; + + i++; +@@ -703,6 +720,39 @@ static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk, + } + rcu_read_unlock(); + ++ /* Special case: peer sets the C flag, accept one ADD_ADDR if default ++ * limits are used -- accepting no ADD_ADDR -- and use subflow endpoints ++ */ ++ if (!i && c_flag_case) { ++ unsigned int local_addr_max = mptcp_pm_get_local_addr_max(msk); ++ ++ while (msk->pm.local_addr_used < local_addr_max && ++ msk->pm.subflows < subflows_max) { ++ struct mptcp_pm_addr_entry local; ++ ++ if (!select_local_address(pernet, msk, &local)) ++ break; ++ ++ __clear_bit(local.addr.id, msk->pm.id_avail_bitmap); ++ ++ if (!mptcp_pm_addr_families_match(sk, &local.addr, ++ remote)) ++ continue; ++ ++ if (mptcp_addresses_equal(&local.addr, &mpc_addr, ++ local.addr.port)) ++ continue; ++ ++ addrs[i] = local.addr; ++ ++ msk->pm.local_addr_used++; ++ msk->pm.subflows++; ++ i++; ++ } ++ ++ return i; ++ } ++ + /* If the array is empty, fill in the single + * 'IPADDRANY' local address + */ +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index c5f41cdb36c4b1..1f213706dfaa52 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -1080,6 +1080,14 @@ static inline void mptcp_pm_close_subflow(struct mptcp_sock *msk) + spin_unlock_bh(&msk->pm.lock); + } + ++static inline bool mptcp_pm_add_addr_c_flag_case(struct mptcp_sock *msk) ++{ ++ return READ_ONCE(msk->pm.remote_deny_join_id0) && ++ msk->pm.local_addr_used == 0 && ++ mptcp_pm_get_add_addr_accept_max(msk) == 0 && ++ msk->pm.subflows < mptcp_pm_get_subflows_max(msk); ++} ++ + void mptcp_sockopt_sync(struct mptcp_sock *msk, struct sock *ssk); + void mptcp_sockopt_sync_locked(struct mptcp_sock *msk, struct sock *ssk); + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 4ffb5ef79ca13f..5ca1d775e976d4 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3793,7 +3793,6 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r + int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) + { + struct nft_expr *expr, *last; +- const struct nft_data *data; + struct nft_rule *rule; + int err; + +@@ -3814,7 +3813,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) + /* This may call nft_chain_validate() recursively, + * callers that do so must increment ctx->level. + */ +- err = expr->ops->validate(ctx, expr, &data); ++ err = expr->ops->validate(ctx, expr); + if (err < 0) + return err; + } +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index d3d11dede54507..52cdfee17f73f1 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -350,8 +350,7 @@ static int nft_target_dump(struct sk_buff *skb, + } + + static int nft_target_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct xt_target *target = expr->ops->data; + unsigned int hook_mask = 0; +@@ -611,8 +610,7 @@ static int nft_match_large_dump(struct sk_buff *skb, + } + + static int nft_match_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct xt_match *match = expr->ops->data; + unsigned int hook_mask = 0; +diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c +index bf825f6cb974ea..507b7eba9bcdcb 100644 +--- a/net/netfilter/nft_fib.c ++++ b/net/netfilter/nft_fib.c +@@ -26,8 +26,7 @@ const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = { + }; + EXPORT_SYMBOL(nft_fib_policy); + +-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data) ++int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + const struct nft_fib *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 5a3d6854204202..1894032a7971c6 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -385,8 +385,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + } + + static int nft_flow_offload_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + unsigned int hook_mask = (1 << NF_INET_FORWARD); + +diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c +index a5268e6dd32f1b..fa9e4ae00b16a9 100644 +--- a/net/netfilter/nft_fwd_netdev.c ++++ b/net/netfilter/nft_fwd_netdev.c +@@ -204,8 +204,7 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, + } + + static int nft_fwd_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) | + (1 << NF_NETDEV_EGRESS)); +diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c +index ac2422c215e545..02ee5fb69871f8 100644 +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -244,8 +244,7 @@ static int nft_immediate_dump(struct sk_buff *skb, + } + + static int nft_immediate_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **d) ++ const struct nft_expr *expr) + { + const struct nft_immediate_expr *priv = nft_expr_priv(expr); + struct nft_ctx *pctx = (struct nft_ctx *)ctx; +diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c +index 1b9edf2b339373..dd5441f92fdb06 100644 +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -206,8 +206,7 @@ static int nft_lookup_dump(struct sk_buff *skb, + } + + static int nft_lookup_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **d) ++ const struct nft_expr *expr) + { + const struct nft_lookup *priv = nft_expr_priv(expr); + struct nft_set_iter iter; +diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c +index 8a14aaca93bbdf..eee05394c53390 100644 +--- a/net/netfilter/nft_masq.c ++++ b/net/netfilter/nft_masq.c +@@ -27,8 +27,7 @@ static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = { + }; + + static int nft_masq_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + int err; + +diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c +index 9139ce38ea7b9a..dec76d28a0ac64 100644 +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx) + } + + static int nft_meta_get_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + const struct nft_meta *priv = nft_expr_priv(expr); + +@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx, + } + + int nft_meta_set_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct nft_meta *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c +index 808f5802c2704a..3d3e639a7a8370 100644 +--- a/net/netfilter/nft_nat.c ++++ b/net/netfilter/nft_nat.c +@@ -137,8 +137,7 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = { + }; + + static int nft_nat_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + struct nft_nat *priv = nft_expr_priv(expr); + int err; +diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c +index 509011b1ef597c..08a27433e2f5fc 100644 +--- a/net/netfilter/nft_objref.c ++++ b/net/netfilter/nft_objref.c +@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr, + obj->ops->eval(obj, regs, pkt); + } + ++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type) ++{ ++ unsigned int hooks; ++ ++ switch (type) { ++ case NFT_OBJECT_SYNPROXY: ++ if (ctx->family != NFPROTO_IPV4 && ++ ctx->family != NFPROTO_IPV6 && ++ ctx->family != NFPROTO_INET) ++ return -EOPNOTSUPP; ++ ++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD); ++ ++ return nft_chain_validate_hooks(ctx->chain, hooks); ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ ++static int nft_objref_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ struct nft_object *obj = nft_objref_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type); ++} ++ + static int nft_objref_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = { + .activate = nft_objref_activate, + .deactivate = nft_objref_deactivate, + .dump = nft_objref_dump, ++ .validate = nft_objref_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +@@ -198,6 +228,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx, + nf_tables_destroy_set(ctx, priv->set); + } + ++static int nft_objref_map_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ const struct nft_objref_map *priv = nft_expr_priv(expr); ++ ++ return nft_objref_validate_obj_type(ctx, priv->set->objtype); ++} ++ + static const struct nft_expr_ops nft_objref_map_ops = { + .type = &nft_objref_type, + .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)), +@@ -207,6 +245,7 @@ static const struct nft_expr_ops nft_objref_map_ops = { + .deactivate = nft_objref_map_deactivate, + .destroy = nft_objref_map_destroy, + .dump = nft_objref_map_dump, ++ .validate = nft_objref_map_validate, + .reduce = NFT_REDUCE_READONLY, + }; + +diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c +index 7f61506e5b44bd..123b4f47ccef4c 100644 +--- a/net/netfilter/nft_osf.c ++++ b/net/netfilter/nft_osf.c +@@ -113,8 +113,7 @@ static int nft_osf_dump(struct sk_buff *skb, + } + + static int nft_osf_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + unsigned int hooks; + +diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c +index b2b8127c8d4381..b8ebb187814f29 100644 +--- a/net/netfilter/nft_queue.c ++++ b/net/netfilter/nft_queue.c +@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const struct nft_expr *expr, + } + + static int nft_queue_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_LOCAL_IN) | +diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c +index a58bd8d291ff2d..9051863509f319 100644 +--- a/net/netfilter/nft_redir.c ++++ b/net/netfilter/nft_redir.c +@@ -27,8 +27,7 @@ static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = { + }; + + static int nft_redir_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + int err; + +diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c +index ed2e668474d677..196a92c7ea09b7 100644 +--- a/net/netfilter/nft_reject.c ++++ b/net/netfilter/nft_reject.c +@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { + EXPORT_SYMBOL_GPL(nft_reject_policy); + + int nft_reject_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, + (1 << NF_INET_LOCAL_IN) | +diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c +index 973fa31a9dd6cd..49020e67304ad7 100644 +--- a/net/netfilter/nft_reject_inet.c ++++ b/net/netfilter/nft_reject_inet.c +@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const struct nft_expr *expr, + } + + static int nft_reject_inet_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, + (1 << NF_INET_LOCAL_IN) | +diff --git a/net/netfilter/nft_reject_netdev.c b/net/netfilter/nft_reject_netdev.c +index 7865cd8b11bb6a..2558ce1505d989 100644 +--- a/net/netfilter/nft_reject_netdev.c ++++ b/net/netfilter/nft_reject_netdev.c +@@ -145,8 +145,7 @@ static void nft_reject_netdev_eval(const struct nft_expr *expr, + } + + static int nft_reject_netdev_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS)); + } +diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c +index 2434c624aafde1..9525f1e02a7d83 100644 +--- a/net/netfilter/nft_rt.c ++++ b/net/netfilter/nft_rt.c +@@ -160,8 +160,7 @@ static int nft_rt_get_dump(struct sk_buff *skb, + return -1; + } + +-static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data) ++static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + const struct nft_rt *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c +index 187b667bad6c34..35d0409b009501 100644 +--- a/net/netfilter/nft_socket.c ++++ b/net/netfilter/nft_socket.c +@@ -275,8 +275,7 @@ static bool nft_socket_reduce(struct nft_regs_track *track, + } + + static int nft_socket_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6 && +diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c +index 1d737f89dfc18c..5d3e5182598596 100644 +--- a/net/netfilter/nft_synproxy.c ++++ b/net/netfilter/nft_synproxy.c +@@ -248,8 +248,7 @@ static void nft_synproxy_eval(const struct nft_expr *expr, + } + + static int nft_synproxy_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6 && +diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c +index 71412adb73d414..ed344af2a439be 100644 +--- a/net/netfilter/nft_tproxy.c ++++ b/net/netfilter/nft_tproxy.c +@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buff *skb, + } + + static int nft_tproxy_validate(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nft_data **data) ++ const struct nft_expr *expr) + { + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6 && +diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c +index 1c866757db5524..8a07b46cc8fb73 100644 +--- a/net/netfilter/nft_xfrm.c ++++ b/net/netfilter/nft_xfrm.c +@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_buff *skb, + return 0; + } + +-static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nft_data **data) ++static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr) + { + const struct nft_xfrm *priv = nft_expr_priv(expr); + unsigned int hooks; +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index 08527d882e56ef..eb2ed7db3fe16b 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -31,6 +31,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include ++#include + #include + #include + #include +@@ -1796,7 +1797,7 @@ struct sctp_association *sctp_unpack_cookie( + } + } + +- if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { ++ if (crypto_memneq(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { + *error = -SCTP_IERROR_BAD_SIG; + goto fail; + } +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 808863e047e0c0..cd18b22b2bbaee 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -30,6 +30,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +@@ -884,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + return SCTP_DISPOSITION_CONSUME; + + nomem_authev: +- sctp_ulpevent_free(ai_ev); ++ if (ai_ev) ++ sctp_ulpevent_free(ai_ev); + nomem_aiev: + sctp_ulpevent_free(ev); + nomem_ev: +@@ -4415,7 +4417,7 @@ static enum sctp_ierror sctp_sf_authenticate( + sh_key, GFP_ATOMIC); + + /* Discard the packet if the digests do not match */ +- if (memcmp(save_digest, digest, sig_len)) { ++ if (crypto_memneq(save_digest, digest, sig_len)) { + kfree(save_digest); + return SCTP_IERROR_BAD_SIG; + } +diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c +index aa108bea6739b3..ddcbfaede6849a 100644 +--- a/security/keys/trusted-keys/trusted_tpm1.c ++++ b/security/keys/trusted-keys/trusted_tpm1.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -241,7 +242,7 @@ int TSS_checkhmac1(unsigned char *buffer, + if (ret < 0) + goto out; + +- if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE)) ++ if (crypto_memneq(testhmac, authdata, SHA1_DIGEST_SIZE)) + ret = -EINVAL; + out: + kfree_sensitive(sdesc); +@@ -334,7 +335,7 @@ static int TSS_checkhmac2(unsigned char *buffer, + TPM_NONCE_SIZE, ononce, 1, continueflag1, 0, 0); + if (ret < 0) + goto out; +- if (memcmp(testhmac1, authdata1, SHA1_DIGEST_SIZE)) { ++ if (crypto_memneq(testhmac1, authdata1, SHA1_DIGEST_SIZE)) { + ret = -EINVAL; + goto out; + } +@@ -343,7 +344,7 @@ static int TSS_checkhmac2(unsigned char *buffer, + TPM_NONCE_SIZE, ononce, 1, continueflag2, 0, 0); + if (ret < 0) + goto out; +- if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE)) ++ if (crypto_memneq(testhmac2, authdata2, SHA1_DIGEST_SIZE)) + ret = -EINVAL; + out: + kfree_sensitive(sdesc); +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index 0fb759c6eeaf94..07bd84204baa7f 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -59,8 +59,8 @@ + + #define SOF_IPC4_INVALID_NODE_ID 0xffffffff + +-/* FW requires minimum 2ms DMA buffer size */ +-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2 ++/* FW requires minimum 4ms DMA buffer size */ ++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4 + + /* + * The base of multi-gateways. Multi-gateways addressing starts from +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 4f869fff28fe43..17e03236e3461c 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -306,10 +306,10 @@ $(OUTPUT)test-libbabeltrace.bin: + $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace) + + $(OUTPUT)test-compile-32.bin: +- $(CC) -m32 -o $@ test-compile.c ++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-compile-x32.bin: +- $(CC) -mx32 -o $@ test-compile.c ++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c + + $(OUTPUT)test-zlib.bin: + $(BUILD) -lz +diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h +index ae64090184d328..b50960cce23f24 100644 +--- a/tools/lib/perf/include/perf/event.h ++++ b/tools/lib/perf/include/perf/event.h +@@ -285,6 +285,7 @@ struct perf_record_header_event_type { + struct perf_record_header_tracing_data { + struct perf_event_header header; + __u32 size; ++ __u32 pad; + }; + + #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15) +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 9692ebdd7f11e9..1512fedd90cf9a 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -638,8 +638,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + * (behavior changed with commit b0a873e). + */ + if (errno == EINVAL || errno == ENOSYS || +- errno == ENOENT || errno == EOPNOTSUPP || +- errno == ENXIO) { ++ errno == ENOENT || errno == ENXIO) { + if (verbose > 0) + ui__warning("%s event is not supported by the kernel.\n", + evsel__name(counter)); +@@ -657,7 +656,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + if (verbose > 0) + ui__warning("%s\n", msg); + return COUNTER_RETRY; +- } else if (target__has_per_thread(&target) && ++ } else if (target__has_per_thread(&target) && errno != EOPNOTSUPP && + evsel_list->core.threads && + evsel_list->core.threads->err_thread != -1) { + /* +@@ -678,6 +677,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter) + return COUNTER_SKIP; + } + ++ if (errno == EOPNOTSUPP) { ++ if (verbose > 0) { ++ ui__warning("%s event is not supported by the kernel.\n", ++ evsel__name(counter)); ++ } ++ counter->supported = false; ++ counter->errored = true; ++ ++ if ((evsel__leader(counter) != counter) || ++ !(counter->core.leader->nr_members > 1)) ++ return COUNTER_SKIP; ++ } ++ + evsel__open_strerror(counter, &target, errno, msg, sizeof(msg)); + ui__error("%s\n", msg); + +diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c +index 1c4feec1adff11..6e7f053006b4ff 100644 +--- a/tools/perf/tests/perf-record.c ++++ b/tools/perf/tests/perf-record.c +@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("sched__get_first_possible_cpu: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) { + pr_debug("sched_setaffinity: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("perf_evlist__open: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest + if (err < 0) { + pr_debug("evlist__mmap: %s\n", + str_error_r(errno, sbuf, sizeof(sbuf))); ++ evlist__cancel_workload(evlist); + goto out_delete_evlist; + } + +diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh +index 3f1e67795490a0..62f13dfeae8e4d 100755 +--- a/tools/perf/tests/shell/stat.sh ++++ b/tools/perf/tests/shell/stat.sh +@@ -146,6 +146,34 @@ test_cputype() { + echo "cputype test [Success]" + } + ++test_hybrid() { ++ # Test the default stat command on hybrid devices opens one cycles event for ++ # each CPU type. ++ echo "hybrid test" ++ ++ # Count the number of core PMUs, assume minimum of 1 ++ pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l) ++ if [ "$pmus" -lt 1 ] ++ then ++ pmus=1 ++ fi ++ ++ # Run default Perf stat ++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c) ++ ++ # The expectation is that default output will have a cycles events on each ++ # hybrid PMU. In situations with no cycles PMU events, like virtualized, this ++ # can fall back to task-clock and so the end count may be 0. Fail if neither ++ # condition holds. ++ if [ "$pmus" -ne "$cycles_events" ] && [ "0" -ne "$cycles_events" ] ++ then ++ echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]" ++ err=1 ++ return ++ fi ++ echo "hybrid test [Success]" ++} ++ + test_default_stat + test_stat_record_report + test_stat_record_script +@@ -153,4 +181,5 @@ test_stat_repeat_weak_groups + test_topdown_groups + test_topdown_weak_groups + test_cputype ++test_hybrid + exit $err +diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +index 1443c28545a946..358c611eeddbb3 100644 +--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h ++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +@@ -56,15 +56,15 @@ enum arm_spe_op_type { + ARM_SPE_OP_BR_INDIRECT = 1 << 17, + }; + +-enum arm_spe_neoverse_data_source { +- ARM_SPE_NV_L1D = 0x0, +- ARM_SPE_NV_L2 = 0x8, +- ARM_SPE_NV_PEER_CORE = 0x9, +- ARM_SPE_NV_LOCAL_CLUSTER = 0xa, +- ARM_SPE_NV_SYS_CACHE = 0xb, +- ARM_SPE_NV_PEER_CLUSTER = 0xc, +- ARM_SPE_NV_REMOTE = 0xd, +- ARM_SPE_NV_DRAM = 0xe, ++enum arm_spe_common_data_source { ++ ARM_SPE_COMMON_DS_L1D = 0x0, ++ ARM_SPE_COMMON_DS_L2 = 0x8, ++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9, ++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa, ++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb, ++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc, ++ ARM_SPE_COMMON_DS_REMOTE = 0xd, ++ ARM_SPE_COMMON_DS_DRAM = 0xe, + }; + + struct arm_spe_record { +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index 9848310cee5f35..0302e6407b5a20 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq, + return arm_spe_deliver_synth_event(spe, speq, event, &sample); + } + +-static const struct midr_range neoverse_spe[] = { ++static const struct midr_range common_ds_encoding_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + {}, + }; + +-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record, +- union perf_mem_data_src *data_src) ++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record, ++ union perf_mem_data_src *data_src) + { + /* + * Even though four levels of cache hierarchy are possible, no known +@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + } + + switch (record->source) { +- case ARM_SPE_NV_L1D: ++ case ARM_SPE_COMMON_DS_L1D: + data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_L2: ++ case ARM_SPE_COMMON_DS_L2: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; + break; +- case ARM_SPE_NV_PEER_CORE: ++ case ARM_SPE_COMMON_DS_PEER_CORE: + data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know if this is L1, L2 but we do know it was a cache-2-cache + * transfer, so set SNOOPX_PEER + */ +- case ARM_SPE_NV_LOCAL_CLUSTER: +- case ARM_SPE_NV_PEER_CLUSTER: ++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER: ++ case ARM_SPE_COMMON_DS_PEER_CLUSTER: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; +@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + /* + * System cache is assumed to be L3 + */ +- case ARM_SPE_NV_SYS_CACHE: ++ case ARM_SPE_COMMON_DS_SYS_CACHE: + data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3; + data_src->mem_snoop = PERF_MEM_SNOOP_HIT; +@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec + * We don't know what level it hit in, except it came from the other + * socket + */ +- case ARM_SPE_NV_REMOTE: +- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1; +- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE; ++ case ARM_SPE_COMMON_DS_REMOTE: ++ data_src->mem_lvl = PERF_MEM_LVL_NA; ++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA; + data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER; + break; +- case ARM_SPE_NV_DRAM: ++ case ARM_SPE_COMMON_DS_DRAM: + data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT; + data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM; + data_src->mem_snoop = PERF_MEM_SNOOP_NONE; +@@ -514,13 +514,13 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco + } + + if (record->type & ARM_SPE_REMOTE_ACCESS) +- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1; ++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE; + } + + static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr) + { + union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA }; +- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe); ++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus); + + /* Only synthesize data source for LDST operations */ + if (!is_ldst_op(record->op)) +@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m + else + return 0; + +- if (is_neoverse) +- arm_spe__synth_data_source_neoverse(record, &data_src); ++ if (is_common) ++ arm_spe__synth_data_source_common(record, &data_src); + else + arm_spe__synth_data_source_generic(record, &data_src); + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 2a6295f1ac1bc0..6d1327f8c6043a 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -2874,7 +2874,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + + /* If event has exclude user then don't exclude kernel. */ + if (evsel->core.attr.exclude_user) +- return false; ++ goto no_fallback; + + /* Is there already the separator in the name. */ + if (strchr(name, '/') || +@@ -2882,7 +2882,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + sep = ""; + + if (asprintf(&new_name, "%s%su", name, sep) < 0) +- return false; ++ goto no_fallback; + + free(evsel->name); + evsel->name = new_name; +@@ -2893,8 +2893,31 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize) + evsel->core.attr.exclude_hv = 1; + + return true; +- } ++ } else if (err == EOPNOTSUPP && !evsel->core.attr.exclude_guest && ++ !evsel->exclude_GH) { ++ const char *name = evsel__name(evsel); ++ char *new_name; ++ const char *sep = ":"; ++ ++ /* Is there already the separator in the name. */ ++ if (strchr(name, '/') || ++ (strchr(name, ':') && !evsel->is_libpfm_event)) ++ sep = ""; ++ ++ if (asprintf(&new_name, "%s%sH", name, sep) < 0) ++ goto no_fallback; + ++ free(evsel->name); ++ evsel->name = new_name; ++ /* Apple M1 requires exclude_guest */ ++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples"); ++ evsel->core.attr.exclude_guest = 1; ++ ++ return true; ++ } ++no_fallback: ++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d", ++ evsel__name(evsel), err); + return false; + } + +@@ -3131,6 +3154,8 @@ bool evsel__is_hybrid(const struct evsel *evsel) + + struct evsel *evsel__leader(const struct evsel *evsel) + { ++ if (evsel->core.leader == NULL) ++ return NULL; + return container_of(evsel->core.leader, struct evsel, core); + } + +diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c +index af9a97612f9df3..f61574d1581e3c 100644 +--- a/tools/perf/util/lzma.c ++++ b/tools/perf/util/lzma.c +@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 277b2cbd518611..e4d57e7df7ae10 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1662,7 +1662,7 @@ static s64 perf_session__process_user_event(struct perf_session *session, + struct perf_tool *tool = session->tool; + struct perf_sample sample = { .time = 0, }; + int fd = perf_data__fd(session->data); +- int err; ++ s64 err; + + if (event->header.type != PERF_RECORD_COMPRESSED || + tool->compressed == perf_session__process_compressed_event_stub) +diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py +index e837132d5031bd..eecb462c021cd9 100644 +--- a/tools/perf/util/setup.py ++++ b/tools/perf/util/setup.py +@@ -1,6 +1,7 @@ + from os import getenv, path + from subprocess import Popen, PIPE + from re import sub ++import shlex + + cc = getenv("CC") + +@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline + src_feature_tests = getenv('srctree') + '/tools/build/feature' + + def clang_has_option(option): +- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines() ++ cmd = shlex.split(f"{cc} {cc_options} {option}") ++ cmd.append(path.join(src_feature_tests, "test-hello.c")) ++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines() + return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ] + + if cc_is_clang: +diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c +index 78d2297c1b6746..1f7c065230599d 100644 +--- a/tools/perf/util/zlib.c ++++ b/tools/perf/util/zlib.c +@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input) + ssize_t rc; + + if (fd < 0) +- return -1; ++ return false; + + rc = read(fd, buf, sizeof(buf)); + close(fd); +diff --git a/tools/testing/selftests/mm/madv_populate.c b/tools/testing/selftests/mm/madv_populate.c +index 17bcb07f19f349..7278623acf8c54 100644 +--- a/tools/testing/selftests/mm/madv_populate.c ++++ b/tools/testing/selftests/mm/madv_populate.c +@@ -264,23 +264,6 @@ static void test_softdirty(void) + munmap(addr, SIZE); + } + +-static int system_has_softdirty(void) +-{ +- /* +- * There is no way to check if the kernel supports soft-dirty, other +- * than by writing to a page and seeing if the bit was set. But the +- * tests are intended to check that the bit gets set when it should, so +- * doing that check would turn a potentially legitimate fail into a +- * skip. Fortunately, we know for sure that arm64 does not support +- * soft-dirty. So for now, let's just use the arch as a corse guide. +- */ +-#if defined(__aarch64__) +- return 0; +-#else +- return 1; +-#endif +-} +- + int main(int argc, char **argv) + { + int nr_tests = 16; +@@ -288,7 +271,7 @@ int main(int argc, char **argv) + + pagesize = getpagesize(); + +- if (system_has_softdirty()) ++ if (softdirty_supported()) + nr_tests += 5; + + ksft_print_header(); +@@ -300,7 +283,7 @@ int main(int argc, char **argv) + test_holes(); + test_populate_read(); + test_populate_write(); +- if (system_has_softdirty()) ++ if (softdirty_supported()) + test_softdirty(); + + err = ksft_get_fail_cnt(); +diff --git a/tools/testing/selftests/mm/soft-dirty.c b/tools/testing/selftests/mm/soft-dirty.c +index 7dbfa53d93a05f..7095b95d19ae2d 100644 +--- a/tools/testing/selftests/mm/soft-dirty.c ++++ b/tools/testing/selftests/mm/soft-dirty.c +@@ -193,8 +193,11 @@ int main(int argc, char **argv) + int pagesize; + + ksft_print_header(); +- ksft_set_plan(15); + ++ if (!softdirty_supported()) ++ ksft_exit_skip("soft-dirty is not support\n"); ++ ++ ksft_set_plan(15); + pagemap_fd = open(PAGEMAP_FILE_PATH, O_RDONLY); + if (pagemap_fd < 0) + ksft_exit_fail_msg("Failed to open %s\n", PAGEMAP_FILE_PATH); +diff --git a/tools/testing/selftests/mm/vm_util.c b/tools/testing/selftests/mm/vm_util.c +index 558c9cd8901c5a..b2af70d75711aa 100644 +--- a/tools/testing/selftests/mm/vm_util.c ++++ b/tools/testing/selftests/mm/vm_util.c +@@ -97,6 +97,42 @@ uint64_t read_pmd_pagesize(void) + return strtoul(buf, NULL, 10); + } + ++char *__get_smap_entry(void *addr, const char *pattern, char *buf, size_t len) ++{ ++ int ret; ++ FILE *fp; ++ char *entry = NULL; ++ char addr_pattern[MAX_LINE_LENGTH]; ++ ++ ret = snprintf(addr_pattern, MAX_LINE_LENGTH, "%08lx-", ++ (unsigned long)addr); ++ if (ret >= MAX_LINE_LENGTH) ++ ksft_exit_fail_msg("%s: Pattern is too long\n", __func__); ++ ++ fp = fopen(SMAP_FILE_PATH, "r"); ++ if (!fp) ++ ksft_exit_fail_msg("%s: Failed to open file %s\n", __func__, ++ SMAP_FILE_PATH); ++ ++ if (!check_for_pattern(fp, addr_pattern, buf, len)) ++ goto err_out; ++ ++ /* Fetch the pattern in the same block */ ++ if (!check_for_pattern(fp, pattern, buf, len)) ++ goto err_out; ++ ++ /* Trim trailing newline */ ++ entry = strchr(buf, '\n'); ++ if (entry) ++ *entry = '\0'; ++ ++ entry = buf + strlen(pattern); ++ ++err_out: ++ fclose(fp); ++ return entry; ++} ++ + bool __check_huge(void *addr, char *pattern, int nr_hpages, + uint64_t hpage_size) + { +@@ -269,3 +305,44 @@ int uffd_unregister(int uffd, void *addr, uint64_t len) + + return ret; + } ++ ++static bool check_vmflag(void *addr, const char *flag) ++{ ++ char buffer[MAX_LINE_LENGTH]; ++ const char *flags; ++ size_t flaglen; ++ ++ flags = __get_smap_entry(addr, "VmFlags:", buffer, sizeof(buffer)); ++ if (!flags) ++ ksft_exit_fail_msg("%s: No VmFlags for %p\n", __func__, addr); ++ ++ while (true) { ++ flags += strspn(flags, " "); ++ ++ flaglen = strcspn(flags, " "); ++ if (!flaglen) ++ return false; ++ ++ if (flaglen == strlen(flag) && !memcmp(flags, flag, flaglen)) ++ return true; ++ ++ flags += flaglen; ++ } ++} ++ ++bool softdirty_supported(void) ++{ ++ char *addr; ++ bool supported = false; ++ const size_t pagesize = getpagesize(); ++ ++ /* New mappings are expected to be marked with VM_SOFTDIRTY (sd). */ ++ addr = mmap(0, pagesize, PROT_READ | PROT_WRITE, ++ MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); ++ if (!addr) ++ ksft_exit_fail_msg("mmap failed\n"); ++ ++ supported = check_vmflag(addr, "sd"); ++ munmap(addr, pagesize); ++ return supported; ++} +diff --git a/tools/testing/selftests/mm/vm_util.h b/tools/testing/selftests/mm/vm_util.h +index 0c603bec5e209c..9816d6e9bce6c9 100644 +--- a/tools/testing/selftests/mm/vm_util.h ++++ b/tools/testing/selftests/mm/vm_util.h +@@ -51,6 +51,7 @@ int uffd_register(int uffd, void *addr, uint64_t len, + int uffd_unregister(int uffd, void *addr, uint64_t len); + int uffd_register_with_ioctls(int uffd, void *addr, uint64_t len, + bool miss, bool wp, bool minor, uint64_t *ioctls); ++bool softdirty_supported(void); + + /* + * On ppc64 this will only work with radix 2M hugepage size +diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh +index 442b7220468afc..9a907d8260c9c7 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3234,6 +3234,17 @@ deny_join_id0_tests() + run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 1 1 1 + fi ++ ++ # default limits, server deny join id 0 + signal ++ if reset_with_allow_join_id0 "default limits, server deny join id 0" 0 1; then ++ pm_nl_set_limits $ns1 0 2 ++ pm_nl_set_limits $ns2 0 2 ++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal ++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow ++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow ++ run_tests $ns1 $ns2 10.0.1.1 ++ chk_join_nr 2 2 2 ++ fi + } + + fullmesh_tests() +diff --git a/tools/testing/selftests/rseq/rseq.c b/tools/testing/selftests/rseq/rseq.c +index f6156790c3b4df..05dc77fd527b3b 100644 +--- a/tools/testing/selftests/rseq/rseq.c ++++ b/tools/testing/selftests/rseq/rseq.c +@@ -40,9 +40,9 @@ + * Define weak versions to play nice with binaries that are statically linked + * against a libc that doesn't support registering its own rseq. + */ +-__weak ptrdiff_t __rseq_offset; +-__weak unsigned int __rseq_size; +-__weak unsigned int __rseq_flags; ++extern __weak ptrdiff_t __rseq_offset; ++extern __weak unsigned int __rseq_size; ++extern __weak unsigned int __rseq_flags; + + static const ptrdiff_t *libc_rseq_offset_p = &__rseq_offset; + static const unsigned int *libc_rseq_size_p = &__rseq_size; +@@ -198,7 +198,7 @@ void rseq_init(void) + * libc not having registered a restartable sequence. Try to find the + * symbols if that's the case. + */ +- if (!*libc_rseq_size_p) { ++ if (!libc_rseq_size_p || !*libc_rseq_size_p) { + libc_rseq_offset_p = dlsym(RTLD_NEXT, "__rseq_offset"); + libc_rseq_size_p = dlsym(RTLD_NEXT, "__rseq_size"); + libc_rseq_flags_p = dlsym(RTLD_NEXT, "__rseq_flags");